cyrus-core 0.2.44 → 0.2.45

package/dist/agent-runner-types.d.ts

@@ -344,7 +344,7 @@ export interface IAgentRunner {
 export interface AgentRunnerConfig {
     /** Working directory for the agent session */
     workingDirectory?: string;
-    /** List of allowed tool patterns (e.g., ["Read(**)", "Edit(**)"]) */
+    /** List of allowed tool names (e.g., ["Read", "Edit", "Bash"]) */
     allowedTools?: string[];
     /** List of disallowed tool patterns */
     disallowedTools?: string[];

package/dist/agent-runner-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-runner-types.d.ts","sourceRoot":"","sources":["../src/agent-runner-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,oBAAoB,IAAI,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAChH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AASpD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,WAAW,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC/B,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IACtD;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC;IAC9D,oBAAoB,CACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,OAAO,GACd,MAAM,CAAC;IACV,gBAAgB,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,GAAG,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACd,MAAM,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAEzC;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzC;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,WAAW,CAAC,IAAI,OAAO,CAAC;IAExB;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,IAAI,CAAC;IAEb;;;;;;;;;;;;;OAaG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,IAAI,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,IAAI,iBAAiB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IACjC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,cAAc,CAAC,EAAE;QAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC1D,iFAAiF;IACjF,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0BAA0B;IAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,sCAAsC;IACtC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+BAA+B;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE9C;;;;;;GAMG;AACH,YAAY,EACX,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,gBAAgB,EAChB,cAAc,GACd,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"agent-runner-types.d.ts","sourceRoot":"","sources":["../src/agent-runner-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,UAAU,EACV,cAAc,EACd,eAAe,EACf,MAAM,gCAAgC,CAAC;AAGxC,OAAO,KAAK,EAAE,oBAAoB,IAAI,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AAChH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AASpD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACrC,uCAAuC;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC/B,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,OAAO,EAAE,qBAAqB,EAAE,CAAC;IACjC,+CAA+C;IAC/C,WAAW,EAAE,OAAO,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5D;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACrC,2FAA2F;IAC3F,QAAQ,EAAE,OAAO,CAAC;IAClB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,sBAAsB,CAAC;IACjC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAC/B,KAAK,EAAE,oBAAoB,EAC3B,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,WAAW,KACf,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAEpC;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IACjC;;;OAGG;IACH,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC;IACtD;;OAEG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC;IAC9D,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC;IAC9D,oBAAoB,CACnB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,GAAG,EACd,OAAO,EAAE,OAAO,GACd,MAAM,CAAC;IACV,gBAAgB,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,GAAG,EACd,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,OAAO,GACd,MAAM,CAAC;CACV;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,MAAM,WAAW,YAAY;IAC5B;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,sBAAsB,EAAE,OAAO,CAAC;IAEzC;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEjD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,cAAc,CAAC,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEnE;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAEzC;;;;;;;;;;;;;OAaG;IACH,cAAc,CAAC,IAAI,IAAI,CAAC;IAExB;;;;;;;;OAQG;IACH,WAAW,CAAC,IAAI,OAAO,CAAC;IAExB;;;;;;;;;;;;;OAaG;IACH,IAAI,IAAI,IAAI,CAAC;IAEb;;;;;;;;;;;;;OAaG;IACH,SAAS,IAAI,OAAO,CAAC;IAErB;;;;;;;;;;;;;;;;OAgBG;IACH,WAAW,IAAI,YAAY,EAAE,CAAC;IAE9B;;;;;;;;;;;;;;;OAeG;IACH,YAAY,IAAI,iBAAiB,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,iBAAiB;IACjC,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,0CAA0C;IAC1C,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,mDAAmD;IACnD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,yCAAyC;IACzC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC5C,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,cAAc,CAAC,EAAE;QAChB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IACF,iDAAiD;IACjD,KAAK,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC1D,iFAAiF;IACjF,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,0BAA0B;IAC1B,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,sCAAsC;IACtC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChE;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,gBAAgB;IAChC,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+BAA+B;IAC/B,SAAS,EAAE,IAAI,CAAC;IAChB,8CAA8C;IAC9C,SAAS,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE9C;;;;;;GAMG;AACH,YAAY,EACX,mBAAmB,EACnB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,gBAAgB,EAChB,cAAc,GACd,MAAM,gCAAgC,CAAC"}

package/dist/config-schemas.d.ts

@@ -41,6 +41,73 @@ export declare const UserAccessControlConfigSchema: z.ZodObject<{
     }>>;
     blockMessage: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * Network policy for egress sandboxing.
+ * Controls which domains/subnets Bash-spawned subprocesses (git, gh, npm,
+ * curl, etc.) can reach and enables per-domain header injection
+ * (credentials brokering).
+ *
+ * Three modes (following Vercel Sandbox Firewall conventions):
+ * - **allow-all**: No networkPolicy set — unrestricted access (default)
+ * - **deny-all**: networkPolicy set with no `allow` rules — blocks all traffic
+ * - **user-defined**: networkPolicy with `allow` rules — deny-all by default,
+ *   only explicitly listed domains are reachable
+ *
+ * Scope: Claude Code's sandbox network proxy only intercepts traffic from
+ * Bash tool subprocesses. It does NOT apply to Claude's own inference API
+ * calls, MCP server traffic, or built-in file tools (Read/Edit/Write).
+ *
+ * @see https://docs.anthropic.com/en/docs/claude-code/security#sandbox
+ * @see https://vercel.com/docs/vercel-sandbox/concepts/firewall#network-policies
+ */
+export declare const NetworkPolicySchema: z.ZodObject<{
+    preset: z.ZodOptional<z.ZodEnum<{
+        trusted: "trusted";
+    }>>;
+    allow: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+        transform: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            headers: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>>;
+    subnets: z.ZodOptional<z.ZodObject<{
+        allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * Sandbox configuration for network egress control.
+ * Configures the egress proxy that intercepts outbound traffic from
+ * Bash-spawned subprocesses in agent sessions.
+ *
+ * When enabled, the proxy starts on EdgeWorker boot and sandbox
+ * network ports are passed to the Claude Agent SDK per-session.
+ * Only Bash tool commands (git, gh, npm, curl, etc.) route through
+ * the proxy — Claude's inference API, MCP servers, and built-in
+ * file tools are unaffected.
+ *
+ * @see https://docs.anthropic.com/en/docs/claude-code/security#sandbox
+ */
+export declare const SandboxConfigSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    httpProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    socksProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+    networkPolicy: z.ZodOptional<z.ZodObject<{
+        preset: z.ZodOptional<z.ZodEnum<{
+            trusted: "trusted";
+        }>>;
+        allow: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+            transform: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                headers: z.ZodRecord<z.ZodString, z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>>;
+        subnets: z.ZodOptional<z.ZodObject<{
+            allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    systemWideCert: z.ZodOptional<z.ZodBoolean>;
+    logRequests: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
 /**
  * Configuration for a Linear workspace's credentials.
  * Keyed by workspace ID in EdgeConfig.linearWorkspaces.
@@ -268,6 +335,27 @@ export declare const EdgeConfigSchema: z.ZodObject<{
             disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        httpProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        socksProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        networkPolicy: z.ZodOptional<z.ZodObject<{
+            preset: z.ZodOptional<z.ZodEnum<{
+                trusted: "trusted";
+            }>>;
+            allow: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+                transform: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>>>;
+            subnets: z.ZodOptional<z.ZodObject<{
+                allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        systemWideCert: z.ZodOptional<z.ZodBoolean>;
+        logRequests: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * Payload version of RepositoryConfigSchema for incoming API requests.
@@ -413,6 +501,27 @@ export declare const EdgeConfigPayloadSchema: z.ZodObject<{
             disallowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strip>>;
     }, z.core.$strip>>;
+    sandbox: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        httpProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        socksProxyPort: z.ZodDefault<z.ZodOptional<z.ZodNumber>>;
+        networkPolicy: z.ZodOptional<z.ZodObject<{
+            preset: z.ZodOptional<z.ZodEnum<{
+                trusted: "trusted";
+            }>>;
+            allow: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodObject<{
+                transform: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>>>;
+            subnets: z.ZodOptional<z.ZodObject<{
+                allow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                deny: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        systemWideCert: z.ZodOptional<z.ZodBoolean>;
+        logRequests: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
     repositories: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
         name: z.ZodString;
@@ -502,6 +611,8 @@ export type UserAccessControlConfig = z.infer<typeof UserAccessControlConfigSche
 export type LinearWorkspaceConfig = z.infer<typeof LinearWorkspaceConfigSchema>;
 export type RepositoryConfig = z.infer<typeof RepositoryConfigSchema>;
 export type EdgeConfig = z.infer<typeof EdgeConfigSchema>;
+export type SandboxConfig = z.infer<typeof SandboxConfigSchema>;
+export type NetworkPolicy = z.infer<typeof NetworkPolicySchema>;
 export type RepositoryConfigPayload = z.infer<typeof RepositoryConfigPayloadSchema>;
 export type EdgeConfigPayload = z.infer<typeof EdgeConfigPayloadSchema>;
 /**

package/dist/config-schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-schemas.d.ts","sourceRoot":"","sources":["../src/config-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;EAAkD,CAAC;AAChF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;mBAI/B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA4BxC,CAAC;AA0EH;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAOtC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4E3B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAExC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiEzB;AAGD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,6BAA6B,CACpC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,6BAA6B,CACpC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAOvE"}
+{"version":3,"file":"config-schemas.d.ts","sourceRoot":"","sources":["../src/config-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;EAAkD,CAAC;AAChF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB;;;;mBAI/B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;iBA4BxC,CAAC;AAsFH;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;iBAmC9B,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;iBAmC9B,CAAC;AAaH;;;GAGG;AACH,eAAO,MAAM,2BAA2B;;;;;iBAOtC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA0CjC,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAmF3B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAExC,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAElC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC1B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiEzB;AAGD,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,6BAA6B,CACpC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAChF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACtE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAC1D,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAC5C,OAAO,6BAA6B,CACpC,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,gBAAgB,GAAG,MAAM,CAOvE"}

package/dist/config-schemas.js

@@ -100,6 +100,122 @@ const PromptTypeDefaultsSchema = z.object({
     allowedTools: ToolRestrictionSchema.optional(),
     disallowedTools: z.array(z.string()).optional(),
 });
+/**
+ * Header transform rule for egress proxy.
+ * Injects or overrides HTTP headers on outgoing requests to a specific domain.
+ * Follows the Vercel Sandbox Firewall transform interface.
+ *
+ * @see https://vercel.com/docs/vercel-sandbox/concepts/firewall
+ */
+const HeaderTransformSchema = z.object({
+    /** Headers to inject/override on outgoing requests */
+    headers: z.record(z.string(), z.string()),
+});
+/**
+ * Per-domain allow rule with optional header transforms.
+ * When transforms are specified, TLS is terminated for that domain
+ * so headers can be inspected and modified (credentials brokering).
+ */
+const DomainRuleSchema = z.array(z.object({
+    transform: z.array(HeaderTransformSchema).optional(),
+}));
+/**
+ * Network policy for egress sandboxing.
+ * Controls which domains/subnets Bash-spawned subprocesses (git, gh, npm,
+ * curl, etc.) can reach and enables per-domain header injection
+ * (credentials brokering).
+ *
+ * Three modes (following Vercel Sandbox Firewall conventions):
+ * - **allow-all**: No networkPolicy set — unrestricted access (default)
+ * - **deny-all**: networkPolicy set with no `allow` rules — blocks all traffic
+ * - **user-defined**: networkPolicy with `allow` rules — deny-all by default,
+ *   only explicitly listed domains are reachable
+ *
+ * Scope: Claude Code's sandbox network proxy only intercepts traffic from
+ * Bash tool subprocesses. It does NOT apply to Claude's own inference API
+ * calls, MCP server traffic, or built-in file tools (Read/Edit/Write).
+ *
+ * @see https://docs.anthropic.com/en/docs/claude-code/security#sandbox
+ * @see https://vercel.com/docs/vercel-sandbox/concepts/firewall#network-policies
+ */
+export const NetworkPolicySchema = z.object({
+    /**
+     * Network policy preset. When set, pre-populates the allow list with
+     * a curated set of domains. Additional `allow` rules are merged on top.
+     *
+     * - `"trusted"`: ~200 domains matching Claude Code on the web's default
+     *   allowlist — package registries, version control, cloud platforms,
+     *   container registries, dev tools, and monitoring services.
+     *
+     * @see https://docs.anthropic.com/en/docs/claude-code/claude-code-on-the-web#default-allowed-domains
+     */
+    preset: z.enum(["trusted"]).optional(),
+    /**
+     * Domain allow rules with optional transforms.
+     * When present, all unlisted domains are denied (deny-all default).
+     * Keys are domain patterns:
+     * - Exact match: "api.example.com"
+     * - Wildcard subdomain: "*.example.com" (matches any subdomain, NOT parent)
+     * - Wildcard segment: "www.*.com" (matches one segment)
+     *
+     * When a preset is also set, these rules are merged on top of the
+     * preset's domains (custom rules take precedence).
+     */
+    allow: z.record(z.string(), DomainRuleSchema).optional(),
+    /** Subnet-based rules */
+    subnets: z
+        .object({
+        /** IP ranges to allow (bypasses domain matching) */
+        allow: z.array(z.string()).optional(),
+        /** IP ranges to deny (takes precedence over all allow rules) */
+        deny: z.array(z.string()).optional(),
+    })
+        .optional(),
+});
+/**
+ * Sandbox configuration for network egress control.
+ * Configures the egress proxy that intercepts outbound traffic from
+ * Bash-spawned subprocesses in agent sessions.
+ *
+ * When enabled, the proxy starts on EdgeWorker boot and sandbox
+ * network ports are passed to the Claude Agent SDK per-session.
+ * Only Bash tool commands (git, gh, npm, curl, etc.) route through
+ * the proxy — Claude's inference API, MCP servers, and built-in
+ * file tools are unaffected.
+ *
+ * @see https://docs.anthropic.com/en/docs/claude-code/security#sandbox
+ */
+export const SandboxConfigSchema = z.object({
+    /**
+     * Enable or disable the egress proxy.
+     * When true, the proxy starts on EdgeWorker boot and sandbox network ports
+     * are passed to Claude Agent SDK sessions to route traffic through it.
+     * @default false
+     */
+    enabled: z.boolean().optional(),
+    /** HTTP proxy port for SDK sandbox.network.httpProxyPort */
+    httpProxyPort: z.number().optional().default(9080),
+    /** SOCKS proxy port for SDK sandbox.network.socksProxyPort */
+    socksProxyPort: z.number().optional().default(9081),
+    /**
+     * Network policy controlling allowed domains, transforms, and subnets.
+     * If omitted, all traffic is allowed (passthrough mode with logging).
+     */
+    networkPolicy: NetworkPolicySchema.optional(),
+    /**
+     * Whether the CA certificate has been trusted system-wide (e.g., via
+     * `sudo security add-trusted-cert` on macOS). When true, per-session
+     * CA cert env vars (NODE_EXTRA_CA_CERTS, GIT_SSL_CAINFO, etc.) are
+     * skipped — the OS cert store handles trust for all tools.
+     * @default false
+     */
+    systemWideCert: z.boolean().optional(),
+    /**
+     * Log all proxied requests (method, URL, domain, status).
+     * @default true
+     */
+    logRequests: z.boolean().optional(),
+});
 /**
  * Global defaults for prompt types
  */
@@ -227,6 +343,12 @@ export const EdgeConfigSchema = z.object({
     userAccessControl: UserAccessControlConfigSchema.optional(),
     /** Global defaults for prompt types (tool restrictions per prompt type) */
     promptDefaults: PromptDefaultsSchema.optional(),
+    /**
+     * Sandbox configuration for network egress control.
+     * When enabled, starts an egress proxy and configures Claude Code to route
+     * all agent network traffic through it for inspection and filtering.
+     */
+    sandbox: SandboxConfigSchema.optional(),
 });
 /**
  * Payload version of RepositoryConfigSchema for incoming API requests.

package/dist/config-schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-schemas.js","sourceRoot":"","sources":["../src/config-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB;IACjC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,mBAAmB;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,gBAAgB;CACjD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACrB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,8CAA8C;IAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,CAAC,CAAC,MAAM,CAAC;QACR,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;QAC9C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,MAAM,CAAC;QACR,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC5C,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3D,QAAQ,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACjD,uBAAuB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,sFAAsF;IACtF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,oBAAoB;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mFAAmF;IACnF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE5B,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,0CAA0C;IAC1C,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3C,0CAA0C;IAC1C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,yCAAyC;IACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAE7C;;;OAGG;IACH,gBAAgB,EAAE,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;SAC/C,QAAQ,EAAE;IAEZ,0DAA0D;IAC1D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,2CAA2C;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qCAAqC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,4FAA4F;IAC5F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,2EAA2E;IAC3E,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,mFAAmF;IACnF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,kGAAkG;IAClG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEnD,2DAA2D;IAC3D,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C;;;OAGG;IACH,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAE3D,2EAA2E;IAC3E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAChC,GAA4B;IAE5B,sDAAsD;IACtD,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAyC,CAAC;IAC5D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,2CAA2C;IAC3C,MAAM,gBAAgB,GAQlB,EAAE,CAAC;IAEP,+EAA+E;IAC/E,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAyC,CAAC;IAEjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAuC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAiC,CAAC;QACrD,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,WAAW,CAAC,GAAG;oBAC/B,WAAW,EAAE,KAAK;oBAClB,GAAG,CAAC,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ;wBAC9C,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;wBACjD,CAAC,CAAC,EAAE,CAAC;oBACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ;wBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,EACL,WAAW,EAAE,YAAY,EACzB,kBAAkB,EAAE,mBAAmB,EACvC,mBAAmB,EAAE,oBAAoB,EACzC,GAAG,IAAI,EACP,GAAG,IAAI,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAEpD,OAAO;QACN,GAAG,IAAI;QACP,YAAY,EAAE,aAAa;QAC3B,gBAAgB;KAChB,CAAC;AACH,CAAC;AAeD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,eAAe,IAAI,CAAC,IAAI,uCAAuC,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;AAC/B,CAAC"}
+{"version":3,"file":"config-schemas.js","sourceRoot":"","sources":["../src/config-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGhF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC,MAAM,EAAE,EAAE,qBAAqB;IACjC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,mBAAmB;IACjD,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,gBAAgB;CACjD,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEvD;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC;IACrC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;IACrB,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjB,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;CACxB,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC;IACvC,8CAA8C;IAC9C,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,kEAAkE;IAClE,CAAC,CAAC,MAAM,CAAC;QACR,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;QAC9C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KAC/C,CAAC;CACF,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,MAAM,CAAC;QACR,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;CACF,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC5C,OAAO,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3C,MAAM,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC1C,YAAY,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAChD,uBAAuB,EAAE,uBAAuB,CAAC,QAAQ,EAAE;IAC3D,QAAQ,EAAE,yBAAyB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC9C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC/C,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,sDAAsD;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;CACzC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAC/B,CAAC,CAAC,MAAM,CAAC;IACR,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CACF,CAAC;AAEF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C;;;;;;;;;OASG;IACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IAEtC;;;;;;;;;;OAUG;IACH,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAExD,yBAAyB;IACzB,OAAO,EAAE,CAAC;SACR,MAAM,CAAC;QACP,oDAAoD;QACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QACrC,gEAAgE;QAChE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,QAAQ,EAAE;CACZ,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C;;;;;OAKG;IACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE/B,4DAA4D;IAC5D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAElD,8DAA8D;IAC9D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAEnD;;;OAGG;IACH,aAAa,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IAE7C;;;;;;OAMG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAEtC;;;OAGG;IACH,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,QAAQ,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC5C,MAAM,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IAC3C,YAAY,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACjD,uBAAuB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;CAC5D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,sFAAsF;IACtF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC1C,CAAC,CAAC;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,4BAA4B;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAEhB,oBAAoB;IACpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEhC,+FAA+F;IAC/F,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAE3C,2EAA2E;IAC3E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,kFAAkF;IAClF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,mFAAmF;IACnF,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,0BAA0B;IAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;IAE5B,oBAAoB;IACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAChC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5C,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC/C,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEpC,0CAA0C;IAC1C,YAAY,EAAE,kBAAkB,CAAC,QAAQ,EAAE;IAE3C,0CAA0C;IAC1C,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,yCAAyC;IACzC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAE7C;;;OAGG;IACH,gBAAgB,EAAE,CAAC;SACjB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;SAC/C,QAAQ,EAAE;IAEZ,0DAA0D;IAC1D,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,2CAA2C;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAErC,qCAAqC;IACrC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEvC,4FAA4F;IAC5F,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,2EAA2E;IAC3E,0BAA0B,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEjD,mFAAmF;IACnF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEzC,kGAAkG;IAClG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAExC;;;;OAIG;IACH,aAAa,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAE1C;;;OAGG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAEnC;;;OAGG;IACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE3C,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAE1C,qDAAqD;IACrD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEnD,2DAA2D;IAC3D,sBAAsB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAEtD;;;;OAIG;IACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAE1C;;;OAGG;IACH,iBAAiB,EAAE,6BAA6B,CAAC,QAAQ,EAAE;IAE3D,2EAA2E;IAC3E,cAAc,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAE/C;;;;OAIG;IACH,OAAO,EAAE,mBAAmB,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,sBAAsB,CAAC,MAAM,CAAC;IAC1E,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC;CACpD,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAChC,GAA4B;IAE5B,sDAAsD;IACtD,IAAI,GAAG,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAyC,CAAC;IAC5D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC;IAE7E,IAAI,CAAC,eAAe,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC;IACZ,CAAC;IAED,2CAA2C;IAC3C,MAAM,gBAAgB,GAQlB,EAAE,CAAC;IAEP,+EAA+E;IAC/E,MAAM,UAAU,GAAG,GAAG,CAAC,mBAAyC,CAAC;IAEjE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,iBAAuC,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAiC,CAAC;QACrD,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;YAC1B,4EAA4E;YAC5E,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,gBAAgB,CAAC,WAAW,CAAC,GAAG;oBAC/B,WAAW,EAAE,KAAK;oBAClB,GAAG,CAAC,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ;wBAC9C,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;wBACjD,CAAC,CAAC,EAAE,CAAC;oBACN,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC1D,GAAG,CAAC,OAAO,IAAI,CAAC,mBAAmB,KAAK,QAAQ;wBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,EAAE;wBACnD,CAAC,CAAC,EAAE,CAAC;iBACN,CAAC;YACH,CAAC;QACF,CAAC;IACF,CAAC;IAED,iEAAiE;IACjE,MAAM,aAAa,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxC,MAAM,EACL,WAAW,EAAE,YAAY,EACzB,kBAAkB,EAAE,mBAAmB,EACvC,mBAAmB,EAAE,oBAAoB,EACzC,GAAG,IAAI,EACP,GAAG,IAAI,CAAC;QACT,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IAEH,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAEpD,OAAO;QACN,GAAG,IAAI;QACP,YAAY,EAAE,aAAa;QAC3B,gBAAgB;KAChB,CAAC;AACH,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC9D,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACd,eAAe,IAAI,CAAC,IAAI,uCAAuC,CAC/D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;AAC/B,CAAC"}

package/dist/config-types.d.ts

@@ -2,7 +2,8 @@ import type { SDKMessage } from "@anthropic-ai/claude-agent-sdk";
 import type { Workspace } from "./CyrusAgentSession.js";
 import type { EdgeConfig, RepositoryConfig } from "./config-schemas.js";
 import type { Issue } from "./issue-tracker/types.js";
-export { type EdgeConfig, type EdgeConfigPayload, EdgeConfigPayloadSchema, EdgeConfigSchema, type LinearWorkspaceConfig, LinearWorkspaceConfigSchema, migrateEdgeConfig, type RepositoryConfig, type RepositoryConfigPayload, RepositoryConfigPayloadSchema, RepositoryConfigSchema, type RunnerType, RunnerTypeSchema, requireLinearWorkspaceId, type UserAccessControlConfig, UserAccessControlConfigSchema, type UserIdentifier, UserIdentifierSchema, } from "./config-schemas.js";
+export { type EdgeConfig, type EdgeConfigPayload, EdgeConfigPayloadSchema, EdgeConfigSchema, type LinearWorkspaceConfig, LinearWorkspaceConfigSchema, migrateEdgeConfig, type NetworkPolicy, NetworkPolicySchema, type RepositoryConfig, type RepositoryConfigPayload, RepositoryConfigPayloadSchema, RepositoryConfigSchema, type RunnerType, RunnerTypeSchema, requireLinearWorkspaceId, type SandboxConfig, SandboxConfigSchema, type UserAccessControlConfig, UserAccessControlConfigSchema, type UserIdentifier, UserIdentifierSchema, } from "./config-schemas.js";
+export { TRUSTED_DOMAINS } from "./trusted-domains.js";
 /**
  * Resolve path with tilde (~) expansion
  * Expands ~ to the user's home directory and resolves to absolute path

package/dist/config-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-types.d.ts","sourceRoot":"","sources":["../src/config-types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,EACN,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,cAAc,EACnB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAIlB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IAIpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAI5B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACV,0GAA0G;QAC1G,eAAe,CAAC,EAAE,CACjB,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,gBAAgB,EAAE,EAChC,OAAO,CAAC,EAAE;YAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KACnD,OAAO,CAAC,SAAS,CAAC,CAAC;QAExB,0FAA0F;QAC1F,eAAe,CAAC,EAAE,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,0DAA0D;QAC1D,cAAc,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,wDAAwD;QACxD,YAAY,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,uBAAuB;QACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;QAEpD,6CAA6C;QAC7C,eAAe,CAAC,EAAE,oBAAoB,CAAC;KACvC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,uBAAuB,CAAC"}
+{"version":3,"file":"config-types.d.ts","sourceRoot":"","sources":["../src/config-types.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AAGtD,OAAO,EACN,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,2BAA2B,EAC3B,iBAAiB,EACjB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,UAAU,EACf,gBAAgB,EAChB,wBAAwB,EACxB,KAAK,aAAa,EAClB,mBAAmB,EACnB,KAAK,uBAAuB,EAC5B,6BAA6B,EAC7B,KAAK,cAAc,EACnB,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAClC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,KACjB,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,WAAW,uBAAuB;IACvC,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAIlB,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB,yCAAyC;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IAIpB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,CAAC;IAI5B,oEAAoE;IACpE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,8CAA8C;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IAIrB;;;OAGG;IACH,QAAQ,CAAC,EAAE;QACV,0GAA0G;QAC1G,eAAe,CAAC,EAAE,CACjB,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,gBAAgB,EAAE,EAChC,OAAO,CAAC,EAAE;YAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KACnD,OAAO,CAAC,SAAS,CAAC,CAAC;QAExB,0FAA0F;QAC1F,eAAe,CAAC,EAAE,CACjB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,UAAU,EACnB,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,0DAA0D;QAC1D,cAAc,CAAC,EAAE,CAChB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,EACZ,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,wDAAwD;QACxD,YAAY,CAAC,EAAE,CACd,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,YAAY,EAAE,MAAM,KAChB,IAAI,CAAC;QAEV,uBAAuB;QACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;QAEpD,6CAA6C;QAC7C,eAAe,CAAC,EAAE,oBAAoB,CAAC;KACvC,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,uBAAuB,CAAC"}

package/dist/config-types.js

@@ -1,7 +1,8 @@
 import { homedir } from "node:os";
 import { resolve } from "node:path";
 // Re-export schemas and types from config-schemas
-export { EdgeConfigPayloadSchema, EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-schemas.js";
+export { EdgeConfigPayloadSchema, EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, NetworkPolicySchema, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, SandboxConfigSchema, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-schemas.js";
+export { TRUSTED_DOMAINS } from "./trusted-domains.js";
 /**
  * Resolve path with tilde (~) expansion
  * Expands ~ to the user's home directory and resolves to absolute path

package/dist/config-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-types.js","sourceRoot":"","sources":["../src/config-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,kDAAkD;AAClD,OAAO,EAGN,uBAAuB,EACvB,gBAAgB,EAEhB,2BAA2B,EAC3B,iBAAiB,EAGjB,6BAA6B,EAC7B,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EAExB,6BAA6B,EAE7B,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}
+{"version":3,"file":"config-types.js","sourceRoot":"","sources":["../src/config-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,kDAAkD;AAClD,OAAO,EAGN,uBAAuB,EACvB,gBAAgB,EAEhB,2BAA2B,EAC3B,iBAAiB,EAEjB,mBAAmB,EAGnB,6BAA6B,EAC7B,sBAAsB,EAEtB,gBAAgB,EAChB,wBAAwB,EAExB,mBAAmB,EAEnB,6BAA6B,EAE7B,oBAAoB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC"}

package/dist/constants.d.ts

@@ -9,6 +9,18 @@ export declare const DEFAULT_PROXY_URL = "https://cyrus-proxy.ceedar.workers.dev
  * Default directory name for git worktrees
  */
 export declare const DEFAULT_WORKTREES_DIR = "worktrees";
+/**
+ * Default directory name for cloned repositories
+ */
+export declare const DEFAULT_REPOS_DIR = "repos";
+/**
+ * Resolves the repos directory, preferring CYRUS_REPOS_DIR env var over the default.
+ */
+export declare function getDefaultReposDir(cyrusHome: string): string;
+/**
+ * Resolves the worktrees directory, preferring CYRUS_WORKTREES_DIR env var over the default.
+ */
+export declare function getDefaultWorktreesDir(cyrusHome: string): string;
 /**
  * Default base branch for new repositories
  */

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,2CAA2C,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,uBAAuB,gBAAgB,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB,2CAA2C,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,qBAAqB,cAAc,CAAC;AAEjD;;GAEG;AACH,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKhE;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,SAAS,CAAC;AAE1C;;GAEG;AACH,eAAO,MAAM,uBAAuB,gBAAgB,CAAC"}

package/dist/constants.js

@@ -1,3 +1,4 @@
+import { join } from "node:path";
 /**
  * Shared constants used across Cyrus packages
  */
@@ -9,6 +10,23 @@ export const DEFAULT_PROXY_URL = "https://cyrus-proxy.ceedar.workers.dev";
  * Default directory name for git worktrees
  */
 export const DEFAULT_WORKTREES_DIR = "worktrees";
+/**
+ * Default directory name for cloned repositories
+ */
+export const DEFAULT_REPOS_DIR = "repos";
+/**
+ * Resolves the repos directory, preferring CYRUS_REPOS_DIR env var over the default.
+ */
+export function getDefaultReposDir(cyrusHome) {
+    return (process.env.CYRUS_REPOS_DIR?.trim() || join(cyrusHome, DEFAULT_REPOS_DIR));
+}
+/**
+ * Resolves the worktrees directory, preferring CYRUS_WORKTREES_DIR env var over the default.
+ */
+export function getDefaultWorktreesDir(cyrusHome) {
+    return (process.env.CYRUS_WORKTREES_DIR?.trim() ||
+        join(cyrusHome, DEFAULT_WORKTREES_DIR));
+}
 /**
  * Default base branch for new repositories
  */

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;GAEG;AAEH;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAE1E;;GAEG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,WAAW,CAAC;AAEjD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IACnD,OAAO,CACN,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CACzE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAAiB;IACvD,OAAO,CACN,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE;QACvC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC,CACtC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC"}

package/dist/index.d.ts

@@ -2,9 +2,9 @@ export type { ILogger, LogContext } from "./logging/index.js";
 export { createLogger, LogLevel } from "./logging/index.js";
 export type { AgentMessage, AgentRunnerConfig, AgentSessionInfo, AgentUserMessage, AskUserQuestion, AskUserQuestionAnswers, AskUserQuestionInput, AskUserQuestionOption, AskUserQuestionResult, HookCallbackMatcher, HookEvent, IAgentRunner, IMessageFormatter, McpServerConfig, OnAskUserQuestion, SDKAssistantMessage, SDKAssistantMessageError, SDKMessage, SDKResultMessage, SDKUserMessage, } from "./agent-runner-types.js";
 export type { BaseBranchResolution, CyrusAgentSession, CyrusAgentSessionEntry, IssueContext, IssueMinimal, RepositoryContext, Workspace, } from "./CyrusAgentSession.js";
-export type { EdgeConfig, EdgeConfigPayload, EdgeWorkerConfig, LinearWorkspaceConfig, OAuthCallbackHandler, RepositoryConfig, RepositoryConfigPayload, RunnerType, UserAccessControlConfig, UserIdentifier, } from "./config-types.js";
-export { EdgeConfigPayloadSchema, EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, resolvePath, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-types.js";
-export { DEFAULT_BASE_BRANCH, DEFAULT_CONFIG_FILENAME, DEFAULT_PROXY_URL, DEFAULT_WORKTREES_DIR, } from "./constants.js";
+export type { EdgeConfig, EdgeConfigPayload, EdgeWorkerConfig, LinearWorkspaceConfig, NetworkPolicy, OAuthCallbackHandler, RepositoryConfig, RepositoryConfigPayload, RunnerType, SandboxConfig, UserAccessControlConfig, UserIdentifier, } from "./config-types.js";
+export { EdgeConfigPayloadSchema, EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, NetworkPolicySchema, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, resolvePath, SandboxConfigSchema, TRUSTED_DOMAINS, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-types.js";
+export { DEFAULT_BASE_BRANCH, DEFAULT_CONFIG_FILENAME, DEFAULT_PROXY_URL, DEFAULT_REPOS_DIR, DEFAULT_WORKTREES_DIR, getDefaultReposDir, getDefaultWorktreesDir, } from "./constants.js";
 export type { AgentActivity, AgentActivityContent, AgentActivityCreateInput, AgentActivityPayload, AgentActivitySDK, AgentEvent, AgentEventTransportConfig, AgentEventTransportEvents, AgentSession, AgentSessionCreatedWebhook, AgentSessionCreateOnCommentInput, AgentSessionCreateOnIssueInput, AgentSessionCreateResponse, AgentSessionPromptedWebhook, AgentSessionSDK, Comment, CommentCreateInput, CommentWithAttachments, Connection, FetchChildrenOptions, FileUploadRequest, FileUploadResponse, GuidanceRule, IAgentEventTransport, IIssueTrackerService, Issue, IssueDeletedWebhook, IssueRelation, IssueStateChangeWebhook, IssueUnassignedWebhook, IssueUpdateInput, IssueUpdateWebhook, IssueWithChildren, Label, PaginationOptions, Team, User, Webhook, WebhookAgentSession, WebhookComment, WebhookIssue, WorkflowState, } from "./issue-tracker/index.js";
 export { AgentActivityContentType, AgentActivitySignal, AgentSessionStatus, AgentSessionType, CLIEventTransport, CLIIssueTrackerService, CLIRPCServer, isAgentSessionCreatedEvent, isAgentSessionCreatedWebhook, isAgentSessionPromptedEvent, isAgentSessionPromptedWebhook, isCommentMentionEvent, isIssueAssignedEvent, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedEvent, isIssueUnassignedWebhook, isNewCommentEvent, } from "./issue-tracker/index.js";
 export type { ContentChanges, ContentUpdateMessage, GitHubPlatformRef, GitHubSessionStartPlatformData, GitHubUserPromptPlatformData, GitLabPlatformRef, GitLabSessionStartPlatformData, GitLabUserPromptPlatformData, GuidanceItem, IMessageTranslator, InternalMessage, InternalMessageBase, IssueStateChangeMessage, LinearContentUpdatePlatformData, LinearIssueStateChangePlatformData, LinearPlatformRef, LinearSessionStartPlatformData, LinearStopSignalPlatformData, LinearUnassignPlatformData, LinearUserPromptPlatformData, MessageAction, MessageAuthor, MessageSource, SessionStartMessage, SlackPlatformRef, SlackSessionStartPlatformData, SlackUserPromptPlatformData, StopSignalMessage, TranslationContext, TranslationResult, UnassignMessage, UserPromptMessage, } from "./messages/index.js";
@@ -12,5 +12,7 @@ export { hasGitHubSessionStartPlatformData, hasGitHubUserPromptPlatformData, has
 export type { SerializableEdgeWorkerState, SerializedCyrusAgentSession, SerializedCyrusAgentSessionEntry, V3SerializableEdgeWorkerState, } from "./PersistenceManager.js";
 export { PERSISTENCE_VERSION, PersistenceManager, } from "./PersistenceManager.js";
 export { StreamingPrompt } from "./StreamingPrompt.js";
+export type { WebhookIpValidatorOptions, WebhookProvider, } from "./security/index.js";
+export { GITHUB_WEBHOOK_CIDRS_FALLBACK, GITLAB_WEBHOOK_CIDRS, ipMatchesAllowlist, LINEAR_WEBHOOK_IPS, WebhookIpValidator, } from "./security/index.js";
 export type { IAgentProgressEvent, ISimpleAgentQueryOptions, ISimpleAgentResult, ISimpleAgentRunner, ISimpleAgentRunnerConfig, } from "./simple-agent-runner-types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAO5D,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,gBAAgB,EAChB,cAAc,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,GACT,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,uBAAuB,EACvB,cAAc,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,uBAAuB,EAEvB,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,6BAA6B,EAC7B,oBAAoB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,GACrB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACX,aAAa,EACb,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,yBAAyB,EACzB,yBAAyB,EACzB,YAAY,EACZ,0BAA0B,EAC1B,gCAAgC,EAChC,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,eAAe,EACf,OAAO,EACP,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,EACL,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,iBAAiB,EACjB,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,aAAa,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,sCAAsC,EACtC,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACX,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,EAC/B,kCAAkC,EAClC,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAGvD,YAAY,EACX,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,GACxB,MAAM,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAO5D,YAAY,EACX,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,SAAS,EACT,YAAY,EACZ,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,UAAU,EACV,gBAAgB,EAChB,cAAc,GACd,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACX,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,SAAS,GACT,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACX,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,aAAa,EACb,uBAAuB,EACvB,cAAc,GACd,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACN,uBAAuB,EAEvB,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,GACpB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACX,aAAa,EACb,oBAAoB,EACpB,wBAAwB,EACxB,oBAAoB,EACpB,gBAAgB,EAChB,UAAU,EACV,yBAAyB,EACzB,yBAAyB,EACzB,YAAY,EACZ,0BAA0B,EAC1B,gCAAgC,EAChC,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,eAAe,EACf,OAAO,EACP,kBAAkB,EAClB,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,YAAY,EACZ,oBAAoB,EACpB,oBAAoB,EACpB,KAAK,EACL,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,KAAK,EACL,iBAAiB,EACjB,IAAI,EACJ,IAAI,EACJ,OAAO,EACP,mBAAmB,EACnB,cAAc,EACd,YAAY,EACZ,aAAa,GACb,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACN,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,sCAAsC,EACtC,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EACX,cAAc,EACd,oBAAoB,EACpB,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,uBAAuB,EACvB,+BAA+B,EAC/B,kCAAkC,EAClC,iBAAiB,EACjB,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,EAC1B,4BAA4B,EAC5B,aAAa,EACb,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACN,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,YAAY,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,gCAAgC,EAChC,6BAA6B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EACX,yBAAyB,EACzB,eAAe,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,YAAY,EACX,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,GACxB,MAAM,gCAAgC,CAAC"}

package/dist/index.js

@@ -2,13 +2,15 @@
 export { createLogger, LogLevel } from "./logging/index.js";
 export { EdgeConfigPayloadSchema, 
 // Zod schemas for runtime validation
-EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, resolvePath, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-types.js";
+EdgeConfigSchema, LinearWorkspaceConfigSchema, migrateEdgeConfig, NetworkPolicySchema, RepositoryConfigPayloadSchema, RepositoryConfigSchema, RunnerTypeSchema, requireLinearWorkspaceId, resolvePath, SandboxConfigSchema, TRUSTED_DOMAINS, UserAccessControlConfigSchema, UserIdentifierSchema, } from "./config-types.js";
 // Constants
-export { DEFAULT_BASE_BRANCH, DEFAULT_CONFIG_FILENAME, DEFAULT_PROXY_URL, DEFAULT_WORKTREES_DIR, } from "./constants.js";
+export { DEFAULT_BASE_BRANCH, DEFAULT_CONFIG_FILENAME, DEFAULT_PROXY_URL, DEFAULT_REPOS_DIR, DEFAULT_WORKTREES_DIR, getDefaultReposDir, getDefaultWorktreesDir, } from "./constants.js";
 export { AgentActivityContentType, AgentActivitySignal, AgentSessionStatus, AgentSessionType, CLIEventTransport, CLIIssueTrackerService, CLIRPCServer, isAgentSessionCreatedEvent, isAgentSessionCreatedWebhook, isAgentSessionPromptedEvent, isAgentSessionPromptedWebhook, isCommentMentionEvent, isIssueAssignedEvent, isIssueAssignedWebhook, isIssueCommentMentionWebhook, isIssueDeletedWebhook, isIssueNewCommentWebhook, isIssueStateChangeWebhook, isIssueTitleOrDescriptionUpdateWebhook, isIssueUnassignedEvent, isIssueUnassignedWebhook, isNewCommentEvent, } from "./issue-tracker/index.js";
 export { hasGitHubSessionStartPlatformData, hasGitHubUserPromptPlatformData, hasGitLabSessionStartPlatformData, hasGitLabUserPromptPlatformData, hasLinearSessionStartPlatformData, hasLinearUserPromptPlatformData, hasSlackSessionStartPlatformData, hasSlackUserPromptPlatformData, isContentUpdateMessage, isGitHubMessage, isGitLabMessage, isIssueStateChangeMessage, isLinearMessage, isSessionStartMessage, isSlackMessage, isStopSignalMessage, isUnassignMessage, isUserPromptMessage, } from "./messages/index.js";
 export { PERSISTENCE_VERSION, PersistenceManager, } from "./PersistenceManager.js";
 export { StreamingPrompt } from "./StreamingPrompt.js";
+// Webhook IP validation
+export { GITHUB_WEBHOOK_CIDRS_FALLBACK, GITLAB_WEBHOOK_CIDRS, ipMatchesAllowlist, LINEAR_WEBHOOK_IPS, WebhookIpValidator, } from "./security/index.js";
 // Platform-agnostic webhook type aliases - exported from issue-tracker
 // These are now defined in issue-tracker/types.ts as aliases to Linear SDK webhook types
 // EdgeWorker and other high-level code should use these generic names via issue-tracker exports

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AAGV,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAoD5D,OAAO,EACN,uBAAuB;AACvB,qCAAqC;AACrC,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,6BAA6B,EAC7B,oBAAoB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY;AACZ,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,qBAAqB,GACrB,MAAM,gBAAgB,CAAC;AA8CxB,OAAO,EACN,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,sCAAsC,EACtC,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAoClC,OAAO,EACN,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAUvD,uEAAuE;AACvE,yFAAyF;AACzF,gGAAgG"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,UAAU;AAGV,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAsD5D,OAAO,EACN,uBAAuB;AACvB,qCAAqC;AACrC,gBAAgB,EAChB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,6BAA6B,EAC7B,sBAAsB,EACtB,gBAAgB,EAChB,wBAAwB,EACxB,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,6BAA6B,EAC7B,oBAAoB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,YAAY;AACZ,OAAO,EACN,mBAAmB,EACnB,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AA8CxB,OAAO,EACN,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,0BAA0B,EAC1B,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,oBAAoB,EACpB,sBAAsB,EACtB,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,sCAAsC,EACtC,sBAAsB,EACtB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,0BAA0B,CAAC;AAoClC,OAAO,EACN,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,iCAAiC,EACjC,+BAA+B,EAC/B,gCAAgC,EAChC,8BAA8B,EAC9B,sBAAsB,EACtB,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAS7B,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAKvD,wBAAwB;AACxB,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,qBAAqB,CAAC;AAS7B,uEAAuE;AACvE,yFAAyF;AACzF,gGAAgG"}

package/dist/security/WebhookIpValidator.d.ts

@@ -0,0 +1,92 @@
+import { type ILogger } from "../logging/index.js";
+/**
+ * Known webhook source IPs/CIDRs for supported providers.
+ *
+ * Linear: https://linear.app/developers/webhooks#securing-webhooks
+ * GitHub: https://api.github.com/meta (hooks field)
+ * GitLab: https://docs.gitlab.com/ee/user/gitlab_com/#ip-range
+ */
+export declare const LINEAR_WEBHOOK_IPS: readonly ["35.231.147.226", "35.243.134.228", "34.140.253.14", "34.38.87.206", "34.134.222.122", "35.222.25.142"];
+/**
+ * Fallback GitHub webhook CIDRs (from /meta API as of 2025).
+ * These are used when the /meta API is unavailable.
+ */
+export declare const GITHUB_WEBHOOK_CIDRS_FALLBACK: readonly ["192.30.252.0/22", "185.199.108.0/22", "140.82.112.0/20", "143.55.64.0/20"];
+/**
+ * GitLab.com webhook source IPs.
+ * https://docs.gitlab.com/ee/user/gitlab_com/#ip-range
+ */
+export declare const GITLAB_WEBHOOK_CIDRS: readonly ["34.74.90.64/28", "34.74.226.0/24"];
+export type WebhookProvider = "linear" | "github" | "gitlab";
+/**
+ * Parse a CIDR notation string into a base IP (as 32-bit number) and mask.
+ * Supports both plain IPs ("1.2.3.4") and CIDR notation ("1.2.3.4/24").
+ */
+export declare function parseCidr(cidr: string): {
+    base: number;
+    mask: number;
+};
+/**
+ * Convert an IPv4 address string to a 32-bit unsigned integer.
+ */
+export declare function ipToNumber(ip: string): number;
+/**
+ * Check if an IPv4 address matches a CIDR range or exact IP.
+ */
+export declare function ipMatchesCidr(ip: string, cidr: string): boolean;
+/**
+ * Normalize an IP address by stripping IPv4-mapped IPv6 prefix (::ffff:).
+ * Returns the raw IPv4 string if it was mapped, otherwise returns the original.
+ */
+export declare function normalizeIp(ip: string): string;
+/**
+ * Check if an IP address matches any entry in an allowlist of IPs/CIDRs.
+ */
+export declare function ipMatchesAllowlist(ip: string, allowlist: readonly string[]): boolean;
+/**
+ * Options for creating a WebhookIpValidator
+ */
+export interface WebhookIpValidatorOptions {
+    /** Enable or disable IP validation globally */
+    enabled?: boolean;
+    /** Custom allowlists to merge with (or replace) defaults */
+    customAllowlists?: Partial<Record<WebhookProvider, readonly string[]>>;
+    /** Logger instance */
+    logger?: ILogger;
+}
+/**
+ * Validates webhook source IPs against known provider allowlists.
+ *
+ * For GitHub, call `refreshGitHubAllowlist()` after construction to fetch
+ * the latest CIDRs from the /meta API. Falls back to a static list if
+ * the API is unavailable.
+ */
+export declare class WebhookIpValidator {
+    private allowlists;
+    private enabled;
+    private logger;
+    constructor(options?: WebhookIpValidatorOptions);
+    /**
+     * Fetch the latest GitHub webhook CIDRs from the /meta API and update the allowlist.
+     * Falls back to the static fallback list on failure.
+     */
+    refreshGitHubAllowlist(): Promise<void>;
+    /**
+     * Validate an IP address against the allowlist for the given provider.
+     * Returns true if:
+     * - IP validation is disabled
+     * - The IP matches the provider's allowlist
+     *
+     * Returns false if the IP does not match.
+     */
+    validate(ip: string, provider: WebhookProvider): boolean;
+    /**
+     * Whether IP validation is currently enabled.
+     */
+    isEnabled(): boolean;
+    /**
+     * Get the current allowlist for a provider (for debugging/logging).
+     */
+    getAllowlist(provider: WebhookProvider): readonly string[];
+}
+//# sourceMappingURL=WebhookIpValidator.d.ts.map