isol8 0.10.2 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.js CHANGED
@@ -336,6 +336,180 @@ var init_audit = __esm(() => {
336
336
  init_logger();
337
337
  });
338
338
 
339
+ // src/engine/code-fetcher.ts
340
+ import { createHash } from "node:crypto";
341
+ import { lookup as dnsLookup } from "node:dns/promises";
342
+ import { isIP } from "node:net";
343
+ function sha256Hex(input) {
344
+ return createHash("sha256").update(input, "utf-8").digest("hex");
345
+ }
346
+ function normalizeScheme(url) {
347
+ return url.protocol.replace(/:$/, "").toLowerCase();
348
+ }
349
+ function isBlockedByPattern(host, patterns) {
350
+ return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
351
+ }
352
+ function isAllowedByPattern(host, patterns) {
353
+ if (patterns.length === 0) {
354
+ return true;
355
+ }
356
+ return patterns.some((pattern) => new RegExp(pattern, "i").test(host));
357
+ }
358
+ function isPrivateIpv4(ip) {
359
+ const parts = ip.split(IPV4_SEPARATOR).map((v) => Number.parseInt(v, 10));
360
+ if (parts.length !== 4 || parts.some((p) => Number.isNaN(p))) {
361
+ return false;
362
+ }
363
+ const a = parts[0];
364
+ const b = parts[1];
365
+ if (a === 10 || a === 127 || a === 0) {
366
+ return true;
367
+ }
368
+ if (a === 169 && b === 254) {
369
+ return true;
370
+ }
371
+ if (a === 172 && b >= 16 && b <= 31) {
372
+ return true;
373
+ }
374
+ if (a === 192 && b === 168) {
375
+ return true;
376
+ }
377
+ if (a === 100 && b >= 64 && b <= 127) {
378
+ return true;
379
+ }
380
+ return false;
381
+ }
382
+ function isPrivateIpv6(ip) {
383
+ const normalized = ip.toLowerCase();
384
+ if (normalized === IPV6_LOOPBACK) {
385
+ return true;
386
+ }
387
+ return normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
388
+ }
389
+ function isPrivateIp(ip) {
390
+ const family = isIP(ip);
391
+ if (family === 4) {
392
+ return isPrivateIpv4(ip);
393
+ }
394
+ if (family === 6) {
395
+ return isPrivateIpv6(ip);
396
+ }
397
+ return false;
398
+ }
399
+ async function assertHostResolvesPublic(host, lookupFn) {
400
+ if (isIP(host) && isPrivateIp(host)) {
401
+ throw new Error(`Blocked code URL host: ${host}`);
402
+ }
403
+ try {
404
+ const records = await lookupFn(host);
405
+ for (const record of records) {
406
+ if (isPrivateIp(record.address)) {
407
+ throw new Error(`Blocked code URL host: ${host}`);
408
+ }
409
+ }
410
+ } catch (err) {
411
+ if (err instanceof Error && err.message.startsWith("Blocked code URL host:")) {
412
+ throw err;
413
+ }
414
+ throw new Error(`Failed to resolve code URL host: ${host}`);
415
+ }
416
+ }
417
+ function decodeUtf8(content) {
418
+ const decoder = new TextDecoder("utf-8", { fatal: true });
419
+ const text = decoder.decode(content);
420
+ if (text.includes("\x00")) {
421
+ throw new Error("Fetched code appears to be binary content");
422
+ }
423
+ return text;
424
+ }
425
+ async function fetchRemoteCode(request, policy, deps = {}) {
426
+ if (!policy.enabled) {
427
+ throw new Error("Remote code fetching is disabled. Set remoteCode.enabled=true to allow it.");
428
+ }
429
+ const fetchFn = deps.fetchFn ?? globalThis.fetch;
430
+ const lookupFn = deps.lookupFn ?? (async (hostname) => {
431
+ const records = await dnsLookup(hostname, { all: true, verbatim: true });
432
+ return records;
433
+ });
434
+ if (!request.codeUrl) {
435
+ throw new Error("codeUrl is required for remote code fetching");
436
+ }
437
+ const url = new URL(request.codeUrl);
438
+ const scheme = normalizeScheme(url);
439
+ if (scheme === "http" && !request.allowInsecureCodeUrl) {
440
+ throw new Error("Insecure code URL blocked. Use allowInsecureCodeUrl=true to allow HTTP.");
441
+ }
442
+ if (!policy.allowedSchemes.map((s) => s.toLowerCase()).includes(scheme)) {
443
+ throw new Error(`URL scheme not allowed: ${scheme}`);
444
+ }
445
+ const host = url.hostname.toLowerCase();
446
+ if (!isAllowedByPattern(host, policy.allowedHosts) || isBlockedByPattern(host, policy.blockedHosts)) {
447
+ throw new Error(`Blocked code URL host: ${host}`);
448
+ }
449
+ await assertHostResolvesPublic(host, lookupFn);
450
+ if (policy.requireHash && !request.codeHash) {
451
+ throw new Error("Hash verification required: provide codeHash for remote code execution.");
452
+ }
453
+ const controller = new AbortController;
454
+ const timeout = setTimeout(() => controller.abort(), policy.fetchTimeoutMs);
455
+ let response;
456
+ try {
457
+ response = await fetchFn(url.toString(), {
458
+ method: "GET",
459
+ redirect: "follow",
460
+ signal: controller.signal
461
+ });
462
+ } catch (err) {
463
+ throw new Error(err instanceof Error && err.name === "AbortError" ? `Remote code fetch timed out after ${policy.fetchTimeoutMs}ms` : `Failed to fetch remote code: ${err instanceof Error ? err.message : String(err)}`);
464
+ } finally {
465
+ clearTimeout(timeout);
466
+ }
467
+ if (!response.ok) {
468
+ throw new Error(`Failed to fetch remote code: HTTP ${response.status}`);
469
+ }
470
+ const contentLengthHeader = response.headers.get("content-length");
471
+ if (contentLengthHeader) {
472
+ const parsedLength = Number.parseInt(contentLengthHeader, 10);
473
+ if (!Number.isNaN(parsedLength) && parsedLength > policy.maxCodeSize) {
474
+ throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes): ${parsedLength} bytes`);
475
+ }
476
+ }
477
+ if (!response.body) {
478
+ throw new Error("Remote code response body is empty");
479
+ }
480
+ const reader = response.body.getReader();
481
+ const chunks = [];
482
+ let totalBytes = 0;
483
+ while (true) {
484
+ const { done, value } = await reader.read();
485
+ if (done) {
486
+ break;
487
+ }
488
+ if (!value) {
489
+ continue;
490
+ }
491
+ totalBytes += value.byteLength;
492
+ if (totalBytes > policy.maxCodeSize) {
493
+ throw new Error(`Remote code exceeds maxCodeSize (${policy.maxCodeSize} bytes)`);
494
+ }
495
+ chunks.push(value);
496
+ }
497
+ const buffer = new Uint8Array(totalBytes);
498
+ let offset = 0;
499
+ for (const chunk of chunks) {
500
+ buffer.set(chunk, offset);
501
+ offset += chunk.byteLength;
502
+ }
503
+ const code = decodeUtf8(buffer);
504
+ const hash = sha256Hex(code);
505
+ if (request.codeHash && hash.toLowerCase() !== request.codeHash.toLowerCase()) {
506
+ throw new Error("Remote code hash mismatch");
507
+ }
508
+ return { code, url: url.toString(), hash };
509
+ }
510
+ var IPV4_SEPARATOR = ".", IPV6_LOOPBACK = "::1";
511
+ var init_code_fetcher = () => {};
512
+
339
513
  // src/engine/concurrency.ts
340
514
  class Semaphore {
341
515
  max;
@@ -967,10 +1141,30 @@ class DockerIsol8 {
967
1141
  poolStrategy;
968
1142
  poolSize;
969
1143
  auditLogger;
1144
+ remoteCodePolicy;
970
1145
  container = null;
971
1146
  persistentRuntime = null;
972
1147
  pool = null;
973
1148
  imageCache = new Map;
1149
+ async resolveExecutionRequest(req) {
1150
+ const inlineCode = req.code?.trim();
1151
+ const codeUrl = req.codeUrl?.trim();
1152
+ if (inlineCode && codeUrl) {
1153
+ throw new Error("ExecutionRequest.code and ExecutionRequest.codeUrl are mutually exclusive.");
1154
+ }
1155
+ if (!(inlineCode || codeUrl)) {
1156
+ throw new Error("ExecutionRequest must include either code or codeUrl.");
1157
+ }
1158
+ if (inlineCode) {
1159
+ return { ...req, code: req.code };
1160
+ }
1161
+ const fetched = await fetchRemoteCode({
1162
+ codeUrl,
1163
+ codeHash: req.codeHash,
1164
+ allowInsecureCodeUrl: req.allowInsecureCodeUrl
1165
+ }, this.remoteCodePolicy);
1166
+ return { ...req, code: fetched.code };
1167
+ }
974
1168
  constructor(options = {}, maxConcurrent = 10) {
975
1169
  this.docker = options.docker ?? new Docker;
976
1170
  this.mode = options.mode ?? "ephemeral";
@@ -992,6 +1186,17 @@ class DockerIsol8 {
992
1186
  this.logNetwork = options.logNetwork ?? false;
993
1187
  this.poolStrategy = options.poolStrategy ?? "fast";
994
1188
  this.poolSize = options.poolSize ?? { clean: 1, dirty: 1 };
1189
+ this.remoteCodePolicy = options.remoteCode ?? {
1190
+ enabled: false,
1191
+ allowedSchemes: ["https"],
1192
+ allowedHosts: [],
1193
+ blockedHosts: [],
1194
+ maxCodeSize: 10 * 1024 * 1024,
1195
+ fetchTimeoutMs: 30000,
1196
+ requireHash: false,
1197
+ enableCache: true,
1198
+ cacheTtl: 3600
1199
+ };
995
1200
  if (options.audit) {
996
1201
  this.auditLogger = new AuditLogger(options.audit);
997
1202
  }
@@ -1020,7 +1225,8 @@ class DockerIsol8 {
1020
1225
  await this.semaphore.acquire();
1021
1226
  const startTime = Date.now();
1022
1227
  try {
1023
- const result = this.mode === "persistent" ? await this.executePersistent(req, startTime) : await this.executeEphemeral(req, startTime);
1228
+ const request = await this.resolveExecutionRequest(req);
1229
+ const result = this.mode === "persistent" ? await this.executePersistent(request, startTime) : await this.executeEphemeral(request, startTime);
1024
1230
  return result;
1025
1231
  } finally {
1026
1232
  this.semaphore.release();
@@ -1174,8 +1380,9 @@ class DockerIsol8 {
1174
1380
  async* executeStream(req) {
1175
1381
  await this.semaphore.acquire();
1176
1382
  try {
1177
- const adapter = this.getAdapter(req.runtime);
1178
- const timeoutMs = req.timeoutMs ?? this.defaultTimeoutMs;
1383
+ const request = await this.resolveExecutionRequest(req);
1384
+ const adapter = this.getAdapter(request.runtime);
1385
+ const timeoutMs = request.timeoutMs ?? this.defaultTimeoutMs;
1179
1386
  const image = await this.resolveImage(adapter);
1180
1387
  const container = await this.docker.createContainer({
1181
1388
  Image: image,
@@ -1192,23 +1399,23 @@ class DockerIsol8 {
1192
1399
  await startProxy(container, this.networkFilter);
1193
1400
  await setupIptables(container);
1194
1401
  }
1195
- const ext = req.fileExtension ?? adapter.getFileExtension();
1402
+ const ext = request.fileExtension ?? adapter.getFileExtension();
1196
1403
  const filePath = `${SANDBOX_WORKDIR}/main${ext}`;
1197
- await writeFileViaExec(container, filePath, req.code);
1198
- if (req.installPackages?.length) {
1199
- await installPackages(container, req.runtime, req.installPackages);
1404
+ await writeFileViaExec(container, filePath, request.code);
1405
+ if (request.installPackages?.length) {
1406
+ await installPackages(container, request.runtime, request.installPackages);
1200
1407
  }
1201
- if (req.files) {
1202
- for (const [fPath, fContent] of Object.entries(req.files)) {
1408
+ if (request.files) {
1409
+ for (const [fPath, fContent] of Object.entries(request.files)) {
1203
1410
  await writeFileViaExec(container, fPath, fContent);
1204
1411
  }
1205
1412
  }
1206
- const rawCmd = adapter.getCommand(req.code, filePath);
1413
+ const rawCmd = adapter.getCommand(request.code, filePath);
1207
1414
  const timeoutSec = Math.ceil(timeoutMs / 1000);
1208
1415
  let cmd;
1209
- if (req.stdin) {
1416
+ if (request.stdin) {
1210
1417
  const stdinPath = `${SANDBOX_WORKDIR}/_stdin`;
1211
- await writeFileViaExec(container, stdinPath, req.stdin);
1418
+ await writeFileViaExec(container, stdinPath, request.stdin);
1212
1419
  const cmdStr = rawCmd.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
1213
1420
  cmd = wrapWithTimeout(["sh", "-c", `cat ${stdinPath} | ${cmdStr}`], timeoutSec);
1214
1421
  } else {
@@ -1216,7 +1423,7 @@ class DockerIsol8 {
1216
1423
  }
1217
1424
  const exec = await container.exec({
1218
1425
  Cmd: cmd,
1219
- Env: this.buildEnv(req.env),
1426
+ Env: this.buildEnv(request.env),
1220
1427
  AttachStdout: true,
1221
1428
  AttachStderr: true,
1222
1429
  WorkingDir: SANDBOX_WORKDIR,
@@ -1775,6 +1982,7 @@ var init_docker = __esm(() => {
1775
1982
  init_runtime();
1776
1983
  init_logger();
1777
1984
  init_audit();
1985
+ init_code_fetcher();
1778
1986
  init_pool();
1779
1987
  MAX_OUTPUT_BYTES = 1024 * 1024;
1780
1988
  });
@@ -1931,6 +2139,28 @@ var DEFAULT_CONFIG = {
1931
2139
  security: {
1932
2140
  seccomp: "strict"
1933
2141
  },
2142
+ remoteCode: {
2143
+ enabled: false,
2144
+ allowedSchemes: ["https"],
2145
+ allowedHosts: [],
2146
+ blockedHosts: [
2147
+ "^localhost$",
2148
+ "^127(?:\\.[0-9]{1,3}){3}$",
2149
+ "^\\[::1\\]$",
2150
+ "^::1$",
2151
+ "^10(?:\\.[0-9]{1,3}){3}$",
2152
+ "^172\\.(?:1[6-9]|2[0-9]|3[0-1])(?:\\.[0-9]{1,3}){2}$",
2153
+ "^192\\.168(?:\\.[0-9]{1,3}){2}$",
2154
+ "^169\\.254(?:\\.[0-9]{1,3}){2}$",
2155
+ "^metadata\\.google\\.internal$",
2156
+ "^169\\.254\\.169\\.254$"
2157
+ ],
2158
+ maxCodeSize: 10 * 1024 * 1024,
2159
+ fetchTimeoutMs: 30000,
2160
+ requireHash: false,
2161
+ enableCache: true,
2162
+ cacheTtl: 3600
2163
+ },
1934
2164
  audit: {
1935
2165
  enabled: false,
1936
2166
  destination: "filesystem",
@@ -1980,6 +2210,13 @@ function mergeConfig(defaults, overrides) {
1980
2210
  seccomp: overrides.security?.seccomp ?? defaults.security.seccomp,
1981
2211
  customProfilePath: overrides.security?.customProfilePath ?? defaults.security.customProfilePath
1982
2212
  },
2213
+ remoteCode: {
2214
+ ...defaults.remoteCode,
2215
+ ...overrides.remoteCode,
2216
+ allowedSchemes: overrides.remoteCode?.allowedSchemes ?? defaults.remoteCode.allowedSchemes,
2217
+ allowedHosts: overrides.remoteCode?.allowedHosts ?? defaults.remoteCode.allowedHosts,
2218
+ blockedHosts: overrides.remoteCode?.blockedHosts ?? defaults.remoteCode.blockedHosts
2219
+ },
1983
2220
  audit: {
1984
2221
  ...defaults.audit,
1985
2222
  ...overrides.audit
@@ -1998,7 +2235,7 @@ init_logger();
1998
2235
  // package.json
1999
2236
  var package_default = {
2000
2237
  name: "isol8",
2001
- version: "0.10.1",
2238
+ version: "0.10.3",
2002
2239
  description: "Secure code execution engine for AI agents",
2003
2240
  author: "Illusion47586",
2004
2241
  license: "MIT",
@@ -2153,7 +2390,7 @@ async function createServer(options) {
2153
2390
  app.post("/execute", async (c) => {
2154
2391
  const body = await c.req.json();
2155
2392
  logger.debug(`[Server] POST /execute runtime=${body.request.runtime} sessionId=${body.sessionId ?? "ephemeral"}`);
2156
- logger.debug(`[Server] Code length: ${body.request.code.length} chars`);
2393
+ logger.debug(`[Server] Code source: ${body.request.codeUrl ? `url=${body.request.codeUrl}` : `inline (${body.request.code?.length ?? 0} chars)`}`);
2157
2394
  const engineOptions = {
2158
2395
  network: config.defaults.network,
2159
2396
  memoryLimit: config.defaults.memoryLimit,
@@ -2161,6 +2398,7 @@ async function createServer(options) {
2161
2398
  timeoutMs: config.defaults.timeoutMs,
2162
2399
  sandboxSize: config.defaults.sandboxSize,
2163
2400
  tmpSize: config.defaults.tmpSize,
2401
+ remoteCode: config.remoteCode,
2164
2402
  ...body.options,
2165
2403
  mode: body.sessionId ? "persistent" : "ephemeral",
2166
2404
  audit: config.audit
@@ -2172,11 +2410,12 @@ async function createServer(options) {
2172
2410
  logger.debug(`[Server] Reusing existing session: ${body.sessionId}`);
2173
2411
  engine = session.engine;
2174
2412
  session.lastAccessedAt = Date.now();
2413
+ session.isActive = true;
2175
2414
  } else {
2176
2415
  logger.debug(`[Server] Creating new session: ${body.sessionId}`);
2177
2416
  engine = new DockerIsol82(engineOptions, config.maxConcurrent);
2178
2417
  await engine.start();
2179
- sessions.set(body.sessionId, { engine, lastAccessedAt: Date.now() });
2418
+ sessions.set(body.sessionId, { engine, lastAccessedAt: Date.now(), isActive: true });
2180
2419
  }
2181
2420
  } else {
2182
2421
  logger.debug("[Server] Creating ephemeral engine");
@@ -2198,7 +2437,13 @@ async function createServer(options) {
2198
2437
  logger.debug(`[Server] Execution error: ${message}`);
2199
2438
  return c.json({ error: message }, 500);
2200
2439
  } finally {
2201
- if (!body.sessionId) {
2440
+ if (body.sessionId) {
2441
+ const session = sessions.get(body.sessionId);
2442
+ if (session) {
2443
+ session.isActive = false;
2444
+ session.lastAccessedAt = Date.now();
2445
+ }
2446
+ } else {
2202
2447
  logger.debug("[Server] Cleaning up ephemeral engine");
2203
2448
  await engine.stop();
2204
2449
  }
@@ -2207,7 +2452,7 @@ async function createServer(options) {
2207
2452
  app.post("/execute/stream", async (c) => {
2208
2453
  const body = await c.req.json();
2209
2454
  logger.debug(`[Server] POST /execute/stream runtime=${body.request.runtime}`);
2210
- logger.debug(`[Server] Code length: ${body.request.code.length} chars`);
2455
+ logger.debug(`[Server] Code source: ${body.request.codeUrl ? `url=${body.request.codeUrl}` : `inline (${body.request.code?.length ?? 0} chars)`}`);
2211
2456
  const engineOptions = {
2212
2457
  network: config.defaults.network,
2213
2458
  memoryLimit: config.defaults.memoryLimit,
@@ -2215,6 +2460,7 @@ async function createServer(options) {
2215
2460
  timeoutMs: config.defaults.timeoutMs,
2216
2461
  sandboxSize: config.defaults.sandboxSize,
2217
2462
  tmpSize: config.defaults.tmpSize,
2463
+ remoteCode: config.remoteCode,
2218
2464
  ...body.options,
2219
2465
  mode: "ephemeral"
2220
2466
  };
@@ -2308,6 +2554,9 @@ async function createServer(options) {
2308
2554
  const maxAge = config.cleanup.maxContainerAgeMs;
2309
2555
  const now = Date.now();
2310
2556
  for (const [id, session] of sessions) {
2557
+ if (session.isActive) {
2558
+ continue;
2559
+ }
2311
2560
  if (now - session.lastAccessedAt > maxAge) {
2312
2561
  logger.debug(`[Server] Auto-pruning stale session: ${id}`);
2313
2562
  await session.engine.stop();
@@ -2336,4 +2585,4 @@ export {
2336
2585
  BunAdapter
2337
2586
  };
2338
2587
 
2339
- //# debugId=C44D450DD130A4AD64756E2164756E21
2588
+ //# debugId=67CAC3EDCF50B21864756E2164756E21
@@ -1 +1 @@
1
- {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;GAGG;AACH,QAAA,MAAM,cAAc,EAAE,WAiCrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAepD;AAuCD,OAAO,EAAE,cAAc,EAAE,CAAC"}
1
+ {"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3C;;;GAGG;AACH,QAAA,MAAM,cAAc,EAAE,WAuDrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,UAAU,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,WAAW,CAepD;AA8CD,OAAO,EAAE,cAAc,EAAE,CAAC"}
@@ -0,0 +1,21 @@
1
+ import type { RemoteCodePolicy } from "../types";
2
+ export interface FetchCodeRequest {
3
+ codeUrl: string;
4
+ codeHash?: string;
5
+ allowInsecureCodeUrl?: boolean;
6
+ }
7
+ export interface FetchCodeResult {
8
+ code: string;
9
+ url: string;
10
+ hash: string;
11
+ }
12
+ interface CodeFetcherDeps {
13
+ fetchFn?: (input: string, init?: RequestInit) => Promise<Response>;
14
+ lookupFn?: (hostname: string) => Promise<Array<{
15
+ address: string;
16
+ family: number;
17
+ }>>;
18
+ }
19
+ export declare function fetchRemoteCode(request: FetchCodeRequest, policy: RemoteCodePolicy, deps?: CodeFetcherDeps): Promise<FetchCodeResult>;
20
+ export {};
21
+ //# sourceMappingURL=code-fetcher.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"code-fetcher.d.ts","sourceRoot":"","sources":["../../../src/engine/code-fetcher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,eAAe;IACvB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnE,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CACtF;AA2GD,wBAAsB,eAAe,CACnC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,gBAAgB,EACxB,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,eAAe,CAAC,CAkH1B"}
@@ -49,10 +49,12 @@ export declare class DockerIsol8 implements Isol8Engine {
49
49
  private readonly poolStrategy;
50
50
  private readonly poolSize;
51
51
  private readonly auditLogger?;
52
+ private readonly remoteCodePolicy;
52
53
  private container;
53
54
  private persistentRuntime;
54
55
  private pool;
55
56
  private readonly imageCache;
57
+ private resolveExecutionRequest;
56
58
  /**
57
59
  * @param options - Sandbox configuration options.
58
60
  * @param maxConcurrent - Maximum number of concurrent executions (controls the internal semaphore).
@@ -1 +1 @@
1
- {"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,EAIZ,WAAW,EACZ,MAAM,UAAU,CAAC;AAyUlB,2HAA2H;AAC3H,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAE3C,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;IAExD;;;OAGG;gBACS,OAAO,GAAE,kBAAuB,EAAE,aAAa,SAAK;IAgChE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,kFAAkF;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAe9D;;OAEG;YACW,WAAW;IAoDzB;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;YACW,kBAAkB;IA+DhC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5C,6GAA6G;IAC7G,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC;YAsFzD,YAAY;YAwBZ,gBAAgB;YA8JhB,iBAAiB;YAwIjB,aAAa;YAkBb,oBAAoB;YASpB,wBAAwB;IA4BtC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,QAAQ;YAwCD,gBAAgB;YA8EjB,iBAAiB;IAiG/B,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;;;;;;;;;;;;;OAoBG;WACU,OAAO,CAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA2BlE"}
1
+ {"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../src/engine/docker.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EAEX,YAAY,EAKZ,WAAW,EACZ,MAAM,UAAU,CAAC;AA0UlB,2HAA2H;AAC3H,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAY,YAAW,WAAW;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAY;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAc;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAsB;IACrD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyB;IACjD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAU;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAU;IACrC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA4C;IACrE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAc;IAC3C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAmB;IAEpD,OAAO,CAAC,SAAS,CAAiC;IAClD,OAAO,CAAC,iBAAiB,CAA+B;IACxD,OAAO,CAAC,IAAI,CAA8B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;YAE1C,uBAAuB;IA6BrC;;;OAGG;gBACS,OAAO,GAAE,kBAAuB,EAAE,aAAa,SAAK;IA2ChE;;;OAGG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAK5B,kFAAkF;IAC5E,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAuB3B;;;OAGG;IACG,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAgB9D;;OAEG;YACW,WAAW;IAoDzB;;OAEG;YACW,qBAAqB;IA8CnC;;OAEG;YACW,kBAAkB;IA+DhC;;;;;;;OAOG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYpE;;;;;;OAMG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmB5C,6GAA6G;IAC7G,IAAI,WAAW,IAAI,MAAM,GAAG,IAAI,CAE/B;IAED;;;OAGG;IACI,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC;YAuFzD,YAAY;YAwBZ,gBAAgB;YA8JhB,iBAAiB;YAwIjB,aAAa;YAkBb,oBAAoB;YASpB,wBAAwB;IA4BtC,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IA2BvB,OAAO,CAAC,iBAAiB;IA+BzB,OAAO,CAAC,yBAAyB;IAyBjC,OAAO,CAAC,QAAQ;YAwCD,gBAAgB;YA8EjB,iBAAiB;IAiG/B,OAAO,CAAC,iBAAiB;IAYzB;;;;;;;;;;;;;;;;;;;;OAoBG;WACU,OAAO,CAClB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CA2BlE"}
@@ -21,19 +21,29 @@ type ProgressCallback = (progress: BuildProgress) => void;
21
21
  * Builds the base `isol8:<runtime>` images for all registered runtimes.
22
22
  * Each image is built from the multi-stage Dockerfile in `docker/`.
23
23
  *
24
+ * Uses smart build logic: computes a hash of the docker directory contents
25
+ * and skips builds if the image already exists with matching hash.
26
+ * Cleans up dangling images after rebuilding.
27
+ *
24
28
  * @param docker - Dockerode instance.
25
29
  * @param onProgress - Optional callback for build progress updates.
30
+ * @param force - If true, always rebuild even if image is up to date.
26
31
  */
27
- export declare function buildBaseImages(docker: Docker, onProgress?: ProgressCallback): Promise<void>;
32
+ export declare function buildBaseImages(docker: Docker, onProgress?: ProgressCallback, force?: boolean): Promise<void>;
28
33
  /**
29
34
  * Builds custom images with user-specified dependencies layered on top of
30
35
  * the base images. Reads package lists from the config's `dependencies` field.
31
36
  *
37
+ * Uses smart build logic: computes a hash of the dependency list and
38
+ * skips builds if the image already exists with matching hash.
39
+ * Cleans up dangling images after rebuilding.
40
+ *
32
41
  * @param docker - Dockerode instance.
33
42
  * @param config - Resolved isol8 configuration.
34
43
  * @param onProgress - Optional callback for build progress updates.
44
+ * @param force - If true, always rebuild even if image is up to date.
35
45
  */
36
- export declare function buildCustomImages(docker: Docker, config: Isol8Config, onProgress?: ProgressCallback): Promise<void>;
46
+ export declare function buildCustomImages(docker: Docker, config: Isol8Config, onProgress?: ProgressCallback, force?: boolean): Promise<void>;
37
47
  /**
38
48
  * Checks if an image exists locally.
39
49
  */
@@ -1 +1 @@
1
- {"version":3,"file":"image-builder.d.ts","sourceRoot":"","sources":["../../../src/engine/image-builder.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAsB5C,mDAAmD;AACnD,UAAU,aAAa;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACtC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,gBAAgB,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,gBAAgB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,gBAAgB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAkBf;AAgED;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOrF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F"}
1
+ {"version":3,"file":"image-builder.d.ts","sourceRoot":"","sources":["../../../src/engine/image-builder.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAEpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAmG5C,mDAAmD;AACnD,UAAU,aAAa;IACrB,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,4BAA4B;IAC5B,MAAM,EAAE,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;IACtC,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,gBAAgB,GAAG,CAAC,QAAQ,EAAE,aAAa,KAAK,IAAI,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAoEf;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,gBAAgB,EAC7B,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CAkBf;AAgGD;;GAEG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOrF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAa/F"}
@@ -12,6 +12,6 @@ export { DockerIsol8 } from "./engine/docker";
12
12
  export { BunAdapter, bashAdapter, DenoAdapter, NodeAdapter, PythonAdapter, RuntimeRegistry, } from "./runtime";
13
13
  export type { RuntimeAdapter } from "./runtime/adapter";
14
14
  export { createServer } from "./server/index";
15
- export type { ExecutionRequest, ExecutionResult, Isol8Config, Isol8Engine, Isol8Mode, Isol8Options, NetworkFilterConfig, NetworkMode, Runtime, StreamEvent, } from "./types";
15
+ export type { ExecutionRequest, ExecutionResult, Isol8Config, Isol8Engine, Isol8Mode, Isol8Options, NetworkFilterConfig, NetworkMode, RemoteCodePolicy, Runtime, StreamEvent, } from "./types";
16
16
  export { VERSION } from "./version";
17
17
  //# sourceMappingURL=index.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EACL,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,OAAO,EACP,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACtC,YAAY,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,EACL,UAAU,EACV,WAAW,EACX,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,WAAW,CAAC;AACnB,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,WAAW,EACX,WAAW,EACX,SAAS,EACT,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,OAAO,EACP,WAAW,GACZ,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC"}
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAWD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa;;;;GAgPxD"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/server/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,+CAA+C;AAC/C,MAAM,WAAW,aAAa;IAC5B,yBAAyB;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAaD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,aAAa;;;;GAiQxD"}
@@ -27,8 +27,23 @@ export type NetworkMode = "none" | "host" | "filtered";
27
27
  * A request to execute code inside isol8.
28
28
  */
29
29
  export interface ExecutionRequest {
30
- /** Source code to execute. */
31
- code: string;
30
+ /**
31
+ * Source code to execute.
32
+ * Mutually exclusive with {@link codeUrl}.
33
+ */
34
+ code?: string;
35
+ /**
36
+ * Remote URL to fetch source code from before execution.
37
+ * Mutually exclusive with {@link code}.
38
+ */
39
+ codeUrl?: string;
40
+ /** Expected SHA-256 hash (hex) of the fetched source code. */
41
+ codeHash?: string;
42
+ /**
43
+ * Allow `http://` code URLs for this request.
44
+ * By default, only `https://` is allowed.
45
+ */
46
+ allowInsecureCodeUrl?: boolean;
32
47
  /** Target runtime. Must match a registered {@link RuntimeAdapter}. */
33
48
  runtime: Runtime;
34
49
  /**
@@ -248,6 +263,8 @@ export interface Isol8Options {
248
263
  security?: SecurityConfig;
249
264
  /** Audit logging configuration. */
250
265
  audit?: AuditConfig;
266
+ /** Remote code fetching policy. */
267
+ remoteCode?: RemoteCodePolicy;
251
268
  /**
252
269
  * Pool strategy for container reuse.
253
270
  * - "secure": Clean container before returning (slower but ensures clean state)
@@ -316,6 +333,27 @@ export interface NetworkFilterConfig {
316
333
  /** Regex patterns for blocked hostnames. Matching hosts are always denied, even if whitelisted. */
317
334
  blacklist: string[];
318
335
  }
336
+ /** Policy for fetching remote source code. */
337
+ export interface RemoteCodePolicy {
338
+ /** Enable URL-based source fetching. @default false */
339
+ enabled: boolean;
340
+ /** Allowed URL schemes. @default ["https"] */
341
+ allowedSchemes: string[];
342
+ /** Allowed hostname regex patterns. Empty means allow all (subject to blocklist). */
343
+ allowedHosts: string[];
344
+ /** Blocked hostname regex patterns. */
345
+ blockedHosts: string[];
346
+ /** Max fetched source size in bytes. @default 10485760 (10MB) */
347
+ maxCodeSize: number;
348
+ /** Fetch timeout in milliseconds. @default 30000 */
349
+ fetchTimeoutMs: number;
350
+ /** Require `ExecutionRequest.codeHash` for URL-based execution. @default false */
351
+ requireHash: boolean;
352
+ /** Cache support toggle for future use. @default true */
353
+ enableCache: boolean;
354
+ /** Cache TTL in seconds for future use. @default 3600 */
355
+ cacheTtl: number;
356
+ }
319
357
  /** Configuration for default execution settings. */
320
358
  export interface Isol8Defaults {
321
359
  /** Default timeout in milliseconds. @default 30000 */
@@ -409,6 +447,8 @@ export interface Isol8Config {
409
447
  dependencies: Isol8Dependencies;
410
448
  /** Security settings. */
411
449
  security: SecurityConfig;
450
+ /** Remote code fetching policy. */
451
+ remoteCode: RemoteCodePolicy;
412
452
  /** Audit logging configuration. */
413
453
  audit: AuditConfig;
414
454
  /** Enable debug logging. @default false */
@@ -435,6 +475,8 @@ export interface Isol8UserConfig {
435
475
  dependencies?: Isol8Dependencies;
436
476
  /** Security settings. */
437
477
  security?: SecurityConfig;
478
+ /** Remote code fetching policy. (Partial override allowed). */
479
+ remoteCode?: Partial<RemoteCodePolicy>;
438
480
  /** Audit logging configuration. */
439
481
  audit?: Partial<AuditConfig>;
440
482
  }
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8BAA8B;IAC9B,IAAI,EAAE,MAAM,CAAC;IAEb,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IAEnB,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAElB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC;;;;GAIC;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAID;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,kEAAkE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;CAClE;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,mGAAmG;IACnG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAID,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IAExB,4DAA4D;IAC5D,OAAO,EAAE,mBAAmB,CAAC;IAE7B,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IAEtB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,KAAK,EAAE,WAAW,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAElC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhC,mEAAmE;IACnE,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9B"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;;;;;;;GAQG;AACH,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAE/B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IAEjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE7B;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAExC;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IAEf,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IAEjB,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IAEnB,0FAA0F;IAC1F,SAAS,EAAE,OAAO,CAAC;IAEnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IAEpB,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IAEjB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAC;IAElB,0CAA0C;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B;;;OAGG;IACH,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IAEF;;;OAGG;IACH,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;CACjC,CAAC;;;;GAIC;AACH,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,wEAAwE;IACxE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;IAC1B,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QACd,kDAAkD;QAClD,UAAU,EAAE,MAAM,CAAC;QACnB,wCAAwC;QACxC,QAAQ,EAAE,MAAM,CAAC;QACjB,kDAAkD;QAClD,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,sCAAsC;QACtC,cAAc,EAAE,MAAM,CAAC;QACvB,kCAAkC;QAClC,eAAe,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAEhC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAID;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,YAAY,CAAC;AAEnD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAEpC,mFAAmF;IACnF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4DAA4D;IAC5D,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,6EAA6E;IAC7E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wIAAwI;IACxI,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,mCAAmC;IACnC,KAAK,CAAC,EAAE,WAAW,CAAC;IAEpB,mCAAmC;IACnC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAE9B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAEjC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEvB,kEAAkE;IAClE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtB,0CAA0C;IAC1C,OAAO,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAEzD;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;;;;;OAMG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEvC;;;;;OAKG;IACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;CAClE;AAID;;;;;;;;GAQG;AACH,MAAM,WAAW,mBAAmB;IAClC,2FAA2F;IAC3F,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,mGAAmG;IACnG,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,OAAO,EAAE,OAAO,CAAC;IACjB,8CAA8C;IAC9C,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qFAAqF;IACrF,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,uCAAuC;IACvC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iEAAiE;IACjE,WAAW,EAAE,MAAM,CAAC;IACpB,oDAAoD;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,WAAW,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,WAAW,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,4CAA4C;IAC5C,OAAO,EAAE,WAAW,CAAC;IACrB,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,yDAAyD;AACzD,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,SAAS,EAAE,OAAO,CAAC;IACnB,kFAAkF;IAClF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,wCAAwC;IACxC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,qCAAqC;IACrC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC7C,mFAAmF;IACnF,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,WAAW,EAAE,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC9C,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6FAA6F;IAC7F,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,EAAE,OAAO,CAAC;IACxB,0DAA0D;IAC1D,aAAa,EAAE,MAAM,CAAC;IACtB,sEAAsE;IACtE,WAAW,EAAE,OAAO,CAAC;IACrB,6EAA6E;IAC7E,aAAa,EAAE,OAAO,CAAC;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IAEtB,sDAAsD;IACtD,QAAQ,EAAE,aAAa,CAAC;IAExB,4DAA4D;IAC5D,OAAO,EAAE,mBAAmB,CAAC;IAE7B,gDAAgD;IAChD,OAAO,EAAE,YAAY,CAAC;IAEtB,mEAAmE;IACnE,YAAY,EAAE,iBAAiB,CAAC;IAEhC,yBAAyB;IACzB,QAAQ,EAAE,cAAc,CAAC;IAEzB,mCAAmC;IACnC,UAAU,EAAE,gBAAgB,CAAC;IAE7B,mCAAmC;IACnC,KAAK,EAAE,WAAW,CAAC;IAEnB,2CAA2C;IAC3C,KAAK,EAAE,OAAO,CAAC;CAChB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,OAAO,CAAC;IAEhB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,kFAAkF;IAClF,QAAQ,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAElC,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAEvC,4EAA4E;IAC5E,OAAO,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAEhC,mEAAmE;IACnE,YAAY,CAAC,EAAE,iBAAiB,CAAC;IAEjC,yBAAyB;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAEvC,mCAAmC;IACnC,KAAK,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;CAC9B"}