eve 0.7.4 → 0.8.0

package/dist/src/compiled/just-bash/network/types.d.ts

@@ -1,155 +0,0 @@
-/**
- * Network configuration types
- *
- * Network access is disabled by default. To enable network access (e.g., for curl),
- * you must explicitly configure allowed URLs.
- */
-/**
- * DNS lookup result used for private IP resolution checks
- */
-export interface DnsLookupResult {
-    address: string;
-    family: number;
-}
-/**
- * HTTP methods that can be allowed
- */
-export type HttpMethod = "GET" | "HEAD" | "POST" | "PUT" | "DELETE" | "PATCH" | "OPTIONS";
-/**
- * Header transform applied at the fetch boundary.
- * Headers specified here override any user-supplied headers with the same name.
- */
-export interface RequestTransform {
-    headers: Record<string, string>;
-}
-/**
- * An allowed URL entry with optional header transforms.
- * Transforms are applied at the fetch boundary so secrets never enter the sandbox.
- */
-export interface AllowedUrl {
-    url: string;
-    transform?: RequestTransform[];
-}
-/**
- * An entry in the allowedUrlPrefixes list: either a plain URL string or
- * an object with a URL and optional transforms.
- */
-export type AllowedUrlEntry = string | AllowedUrl;
-/**
- * Configuration for network access
- */
-export interface NetworkConfig {
-    /**
-     * List of allowed URL prefixes. Each entry must be a full origin (scheme + host),
-     * optionally followed by a path prefix:
-     * - An origin: "https://api.example.com" - allows all paths on this origin
-     * - An origin + path prefix: "https://api.example.com/v1/" - allows only paths starting with /v1/
-     *
-     * Entries can be plain strings or objects with transforms for credentials brokering:
-     * ```
-     * allowedUrlPrefixes: [
-     *   "https://other-api.com",
-     *   {
-     *     url: "https://ai-gateway.vercel.sh",
-     *     transform: [{ headers: { "Authorization": "Bearer secret" } }],
-     *   },
-     * ]
-     * ```
-     *
-     * The check is performed on the full URL, so "https://api.example.com/v1" will allow:
-     * - https://api.example.com/v1
-     * - https://api.example.com/v1/users
-     * - https://api.example.com/v1/users/123
-     *
-     * But NOT:
-     * - https://api.example.com/v10
-     * - https://api.example.com/v1-admin
-     * - https://api.example.com/v2/users
-     * - https://api.example.org/v1/users (different origin)
-     * - URLs that rely on ambiguous encoded separators like %2f or %5c
-     *
-     * Invalid entries (missing scheme, missing host, relative paths) will throw an error.
-     */
-    allowedUrlPrefixes?: AllowedUrlEntry[];
-    /**
-     * List of allowed HTTP methods. Defaults to ["GET", "HEAD"] for safety.
-     * dangerouslyAllowFullInternetAccess to enables all methods.
-     */
-    allowedMethods?: HttpMethod[];
-    /**
-     * Bypass the allow-list and allow all URLs and methods.
-     * DANGEROUS: Only use this in trusted environments.
-     */
-    dangerouslyAllowFullInternetAccess?: boolean;
-    /**
-     * Maximum number of redirects to follow (default: 20)
-     */
-    maxRedirects?: number;
-    /**
-     * Request timeout in milliseconds (default: 30000)
-     */
-    timeoutMs?: number;
-    /**
-     * Maximum response body size in bytes (default: 10MB).
-     * Responses larger than this will be rejected with ResponseTooLargeError.
-     */
-    maxResponseSize?: number;
-    /**
-     * Reject URLs with private/loopback IP addresses as hostnames.
-     * Performs both lexical hostname checks and DNS resolution to catch
-     * domains that resolve to private IPs (e.g., DNS rebinding attacks).
-     * Useful for mitigating SSRF attacks. Default: false (opt-in).
-     *
-     * When enabled, the private IP check is enforced even when
-     * `dangerouslyAllowFullInternetAccess` is true, ensuring that
-     * internal/loopback addresses are never reachable.
-     */
-    denyPrivateRanges?: boolean;
-    /**
-     * @internal Override DNS resolution for testing.
-     * When set, used instead of the default `dns.lookup` for the
-     * denyPrivateRanges DNS rebinding check.
-     */
-    _dnsResolve?: (hostname: string) => Promise<DnsLookupResult[]>;
-}
-/**
- * Result of a network fetch operation
- */
-export interface FetchResult {
-    status: number;
-    statusText: string;
-    headers: Record<string, string>;
-    /** Raw response bytes (never decoded as UTF-8 text). */
-    body: Uint8Array;
-    url: string;
-}
-/**
- * Error thrown when a URL is not allowed
- */
-export declare class NetworkAccessDeniedError extends Error {
-    constructor(url: string, reason?: string);
-}
-/**
- * Error thrown when too many redirects occur
- */
-export declare class TooManyRedirectsError extends Error {
-    constructor(maxRedirects: number);
-}
-/**
- * Error thrown when a redirect target is not allowed
- */
-export declare class RedirectNotAllowedError extends Error {
-    constructor(url: string);
-}
-/**
- * Error thrown when an HTTP method is not allowed
- */
-export declare class MethodNotAllowedError extends Error {
-    constructor(method: string, allowedMethods: string[]);
-}
-/**
- * Error thrown when a response body exceeds the maximum allowed size
- */
-export declare class ResponseTooLargeError extends Error {
-    constructor(maxSize: number);
-}

package/dist/src/public/sandbox/backends/local.d.ts

@@ -1,16 +0,0 @@
-import type { SandboxBackend } from "#public/definitions/sandbox-backend.js";
-import type { LocalSandboxCreateOptions } from "#public/sandbox/local-sandbox.js";
-/**
- * Constructs the built-in local sandbox backend.
- *
- * The local backend runs the workspace under `just-bash` against an
- * application-local filesystem rooted under `.eve/sandbox-cache/`.
- * It is the default backend on developer machines (`pnpm eve dev`).
- *
- * Accepts an `opts` parameter for parity with other backends, but
- * `LocalSandboxCreateOptions` is empty today: `just-bash` exposes no
- * configuration to surface. To add options, widen
- * `LocalSandboxCreateOptions` and route them into the binding without
- * changing this signature.
- */
-export declare function localBackend(opts?: LocalSandboxCreateOptions): SandboxBackend;

package/dist/src/public/sandbox/backends/local.js

@@ -1 +0,0 @@
-import{createLocalSandboxBackend}from"#execution/sandbox/bindings/local.js";function localBackend(e){return createLocalSandboxBackend({createOptions:e})}export{localBackend};

package/dist/src/public/sandbox/local-sandbox.d.ts

@@ -1,7 +0,0 @@
-/**
- * Options accepted by `localBackend(opts)`. Reserved for future
- * widening: today the local backend exposes no consumer-controllable
- * create options, so this is an empty object. The parameter exists on
- * the factory so adding real fields here later is purely additive.
- */
-export type LocalSandboxCreateOptions = Record<string, never>;