sim-setup 1.0.6-dev.63.1 → 1.0.6-dev.77.1

package/dist/index.js

@@ -1570,7 +1570,7 @@ var init_env_capabilities = __esm(() => {
 var integrations_default;
 var init_integrations = __esm(() => {
   integrations_default = {
-    updatedAt: "2026-08-28",
+    updatedAt: "2026-09-01",
     integrations: [
       {
         type: "onepassword",
@@ -5376,6 +5376,121 @@ var init_integrations = __esm(() => {
         integrationType: "sales",
         tags: ["enrichment", "data-analytics"]
       },
+      {
+        type: "circleback",
+        slug: "circleback",
+        name: "Circleback",
+        description: "AI-powered meeting notes, action items, and transcripts",
+        longDescription: "Integrate Circleback into your workflow to read meetings, notes, transcripts, and insights, search across meetings, manage action items and tags, and browse the people and companies you meet with. Circleback can also trigger workflows when meetings are processed.",
+        bgColor: "linear-gradient(180deg, #E0F7FA 0%, #FFFFFF 100%)",
+        iconName: "CirclebackIcon",
+        docsUrl: "https://docs.sim.ai/integrations/circleback",
+        operations: [
+          {
+            name: "List Meetings",
+            description: "Lists meetings from Circleback with optional ownership, status, tag, and attendee filters."
+          },
+          {
+            name: "Get Meeting",
+            description: "Gets a Circleback meeting by ID, including notes, attendees, action items, insights, and recording details."
+          },
+          {
+            name: "Search Meetings",
+            description: "Searches Circleback meetings by name and content, with optional filters for specific meetings, tags, and people."
+          },
+          {
+            name: "Get Transcript",
+            description: "Gets the full transcript for a Circleback meeting."
+          },
+          {
+            name: "Update Meeting",
+            description: "Updates the name, notes, or private notes of a Circleback meeting. The API returns only the fields that were updated."
+          },
+          {
+            name: "Delete Meeting",
+            description: "Deletes a Circleback meeting. Only the owner of the meeting can delete it. Returns the deleted meeting."
+          },
+          {
+            name: "List Action Items",
+            description: "Lists action items across the authenticated user meetings, filtered by assignee, status, tags, and attendees. Defaults to incomplete action items assigned to the API key owner."
+          },
+          {
+            name: "Update Action Item",
+            description: "Updates the title, description, status, or assignee of a Circleback action item. Returns the updated action item."
+          },
+          {
+            name: "Delete Action Item",
+            description: "Deletes a Circleback action item. Returns the deleted action item."
+          },
+          {
+            name: "List Calendar Events",
+            description: "Lists upcoming calendar events from the authenticated user connected calendars, with pagination and a configurable time window."
+          },
+          {
+            name: "List Companies",
+            description: "Lists the companies whose people attend the authenticated user meetings, with optional tag filters."
+          },
+          {
+            name: "Get Company",
+            description: "Gets a company by its domain from Circleback, including its people and external links."
+          },
+          {
+            name: "List People",
+            description: "Lists the people who attend the authenticated user meetings, ordered by most recent meeting, with optional company and tag filters."
+          },
+          {
+            name: "Get Person",
+            description: "Gets a person by their profile ID from Circleback, including their profile details and external links."
+          },
+          {
+            name: "List Tags",
+            description: "Lists every tag available to the authenticated Circleback user."
+          },
+          {
+            name: "Create Tag",
+            description: "Creates a new tag in Circleback. If a tag with the same name already exists, a conflict error is returned."
+          },
+          {
+            name: "Update Tag",
+            description: "Updates the name or description of a Circleback tag."
+          },
+          {
+            name: "Delete Tag",
+            description: "Permanently deletes a Circleback tag and removes it from every meeting it was applied to."
+          },
+          {
+            name: "Add Tag to Meetings",
+            description: "Applies an existing Circleback tag to one or more meetings and returns the updated meetings."
+          },
+          {
+            name: "Remove Tag from Meetings",
+            description: "Removes a Circleback tag from one or more meetings and returns the updated meetings."
+          }
+        ],
+        operationCount: 20,
+        triggers: [
+          {
+            id: "circleback_meeting_completed",
+            name: "Circleback Meeting Completed",
+            description: "Trigger workflow when a meeting is processed and ready in Circleback"
+          },
+          {
+            id: "circleback_meeting_notes",
+            name: "Circleback Meeting Notes Ready",
+            description: "Trigger workflow when meeting notes and action items are ready"
+          },
+          {
+            id: "circleback_webhook",
+            name: "Circleback Webhook",
+            description: "Generic webhook trigger for all Circleback events"
+          }
+        ],
+        triggerCount: 3,
+        authType: "api-key",
+        category: "tools",
+        integrationType: "ai",
+        tags: ["meeting", "note-taking"]
+      },
       {
         type: "managed_agent",
         slug: "claude-managed-agents",
@@ -9584,7 +9699,7 @@ var init_integrations = __esm(() => {
           },
           {
             name: "List workflow runs",
-            description: "List workflow runs for a repository. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links."
+            description: "List workflow runs for a repository, or for a single workflow when a workflow ID or filename is given. Supports filtering by actor, branch, event, and status. Returns run details including status, conclusion, and links."
           },
           {
             name: "Get workflow run",
@@ -20897,6 +21012,185 @@ var init_integrations = __esm(() => {
         integrationType: "documents",
         tags: ["cloud", "automation"]
       },
+      {
+        type: "sailpoint",
+        slug: "sailpoint",
+        name: "SailPoint",
+        description: "Govern identities and access in SailPoint Identity Security Cloud",
+        longDescription: "Read and act on identity-governance data in SailPoint Identity Security Cloud (ISC) with a Personal Access Token (PAT) exchanged through OAuth2 client credentials at https://TENANT.api.identitynow.com/oauth/token. SailPoint versions each service independently, so the integration uses current service paths such as /search/v1, /identities/v1, and /access-requests/v1; there is no shared annual API-version setting. Use a PAT whose owner has the ISC user level required by each endpoint because many identity, role, access-profile, certification, approval, and access-request operations require user context in addition to scopes. Common read scopes include sp:search:read, idn:identity:read, idn:accounts:read, idn:entitlement:read, idn:role-unchecked:read or idn:role-checked:read, idn:access-profile:read, idn:sources:read, idn:campaign:read, idn:access-request-status:read, idn:access-request-config:read, idn:task-management:read, and idn:access-request-approvals:read. Mutations additionally use idn:sources:manage for account aggregation, idn:entitlement:manage for entitlement aggregation and entitlement request configuration, idn:campaign:manage for certification decisions and sign-off, the access-request scopes listed by SailPoint for request submission, idn:access-request:create for account-selection discovery, and idn:access-request-approvals:manage for approval actions. A scope alone does not grant authority beyond the PAT owner's ISC permissions, and authorization failures may be returned as provider errors or filtered visibility depending on the endpoint and tenant policy.",
+        bgColor: "#FFFFFF",
+        iconName: "SailPointIcon",
+        docsUrl: "https://docs.sim.ai/integrations/sailpoint",
+        operations: [
+          {
+            name: "Search",
+            description: "Search current SailPoint indices with every documented search query mode."
+          },
+          {
+            name: "Search Count",
+            description: "Count documents matching a complete SailPoint search body."
+          },
+          {
+            name: "Search Aggregate",
+            description: "Run an Elasticsearch DSL or SailPoint aggregation over current search indices."
+          },
+          {
+            name: "List Identities",
+            description: "List identities with documented filtering, sorting, and pagination."
+          },
+          {
+            name: "Get Identity",
+            description: "Get an identity from the current /identities/v1 service by ID."
+          },
+          {
+            name: "List Accounts",
+            description: "List accounts with documented filtering, sorting, detail, and pagination."
+          },
+          {
+            name: "Get Account",
+            description: "Get an account from the current /accounts/v1 service by ID."
+          },
+          {
+            name: "Get Account Entitlements",
+            description: "List entitlements granted to one account."
+          },
+          {
+            name: "Get Account Selections",
+            description: "Resolve eligible source accounts before submitting a machine or multi-account access request."
+          },
+          {
+            name: "List Entitlements",
+            description: "List entitlements with current segmentation, cursor, filter, and page controls."
+          },
+          {
+            name: "Get Entitlement",
+            description: "Get an entitlement by ID."
+          },
+          {
+            name: "Get Entitlement Request Config",
+            description: "Get grant, revocation, duration, approval, and form settings for an entitlement."
+          },
+          {
+            name: "List Identity Entitlements",
+            description: "List tagged entitlement references held by one identity."
+          },
+          {
+            name: "List Roles",
+            description: "List roles with current visibility, segmentation, filtering, and pagination controls."
+          },
+          {
+            name: "Get Role",
+            description: "Get a role by ID."
+          },
+          {
+            name: "Get Role Entitlements",
+            description: "List entitlements in one role using the current non-experimental roles service."
+          },
+          {
+            name: "List Access Profiles",
+            description: "List access profiles with current visibility and segmentation controls."
+          },
+          {
+            name: "Get Access Profile",
+            description: "Get an access profile by ID."
+          },
+          {
+            name: "Get Access Profile Entitlements",
+            description: "List entitlements in one access profile."
+          },
+          {
+            name: "Get Access Request Config",
+            description: "Get tenant access-request, request-on-behalf-of, and machine-identity configuration."
+          },
+          {
+            name: "List Sources",
+            description: "List identity sources with visibility, filtering, sorting, and pagination controls."
+          },
+          {
+            name: "Get Source",
+            description: "Get an identity source by ID."
+          },
+          {
+            name: "List Account Activities",
+            description: "List provisioning activities with identity, filter, sort, and page controls."
+          },
+          {
+            name: "Get Account Activity",
+            description: "Get an account activity by ID."
+          },
+          {
+            name: "List Campaigns",
+            description: "List certification campaigns with detail, filtering, sorting, and pagination."
+          },
+          {
+            name: "Get Campaign",
+            description: "Get a certification campaign by ID."
+          },
+          {
+            name: "List Certifications",
+            description: "List identity certifications assigned to a reviewer."
+          },
+          {
+            name: "Get Certification",
+            description: "Get an identity certification by ID."
+          },
+          {
+            name: "List Certification Review Items",
+            description: "List access-review items in one identity certification."
+          },
+          {
+            name: "Decide Certification Review Items",
+            description: "Approve or revoke 1-250 review items in an identity certification."
+          },
+          {
+            name: "Sign Off Certification",
+            description: "Sign off a completed identity certification."
+          },
+          {
+            name: "Request Access",
+            description: "Submit a current human or machine identity access request."
+          },
+          {
+            name: "Cancel Access Request",
+            description: "Cancel an access request that has not passed approval."
+          },
+          {
+            name: "Get Access Request Status",
+            description: "List requested-item status records for access requests."
+          },
+          {
+            name: "List Pending Access Request Approvals",
+            description: "List pending access-request approvals visible to the caller."
+          },
+          {
+            name: "Approve Access Request",
+            description: "Approve one pending access-request approval."
+          },
+          {
+            name: "Reject Access Request",
+            description: "Reject one pending access-request approval with a reviewer comment."
+          },
+          {
+            name: "Load Accounts (CSV)",
+            description: "Start account aggregation for a source, optionally using a CSV file."
+          },
+          {
+            name: "Load Entitlements (CSV)",
+            description: "Start entitlement aggregation for a source, optionally using a CSV file."
+          },
+          {
+            name: "Get Task Status",
+            description: "Get the current status of a SailPoint background task by ID."
+          }
+        ],
+        operationCount: 40,
+        triggers: [],
+        triggerCount: 0,
+        authType: "api-key",
+        category: "tools",
+        integrationType: "security",
+        tags: ["identity", "automation"]
+      },
       {
         type: "salesforce",
         slug: "salesforce",
@@ -22519,8 +22813,8 @@ var init_integrations = __esm(() => {
         type: "slack_v2",
         slug: "slack",
         name: "Slack",
-        description: "Send, update, delete messages, manage views and modals, add or remove reactions, manage canvases, get channel info and user presence in Slack",
-        longDescription: "Integrate Slack into the workflow. Can send, update, and delete messages, send ephemeral messages visible only to a specific user, open/update/push modal views, publish Home tab views, create canvases, read messages, and add or remove reactions. Requires Bot Token instead of OAuth in advanced mode. Can be used in trigger mode to trigger a workflow when a message is sent to a channel.",
+        description: "Send and manage Slack messages, Agent Sessions, streamed replies, views, reactions, conversations, and canvases",
+        longDescription: "Integrate Slack messaging and administration into a workflow. Custom Slack bots can manage Agent Sessions, stream incremental Markdown or structured chunks, react to Agent Session events, and configure Agent View suggested prompts. Standard messaging and management operations support both the Sim app and custom bot credentials.",
         bgColor: "#611f69",
         iconName: "SlackIcon",
         docsUrl: "https://docs.sim.ai/integrations/slack",
@@ -22570,12 +22864,24 @@ var init_integrations = __esm(() => {
             description: "Set the title of a Slack assistant thread (shown in the AI app thread header)."
           },
           {
-            name: "Set Suggested Prompts",
+            name: "Set Assistant Suggested Prompts",
             description: "Set the clickable suggested prompts shown in a Slack assistant thread (the prompt chips in an AI app)."
           },
+          {
+            name: "Set Agent Suggested Prompts",
+            description: "Set suggested prompts in Slack Agent View, optionally scoped to a specific thread."
+          },
+          {
+            name: "Set Agent Session Status",
+            description: "Create or update the state of a Slack agent session associated with a thread."
+          },
+          {
+            name: "Rename Agent Session",
+            description: "Rename the Slack agent session associated with a thread."
+          },
           {
             name: "List Channels",
-            description: "List all channels in a Slack workspace. Returns public and private channels the bot has access to."
+            description: "List accessible Slack conversations. Credential-group user tokens also return one-to-one and group direct messages."
           },
           {
             name: "List Channel Members",
@@ -22694,12 +23000,12 @@ var init_integrations = __esm(() => {
             description: "Set the purpose (description) for a Slack channel (max 250 characters)."
           }
         ],
-        operationCount: 42,
+        operationCount: 45,
         triggers: [
           {
             id: "slack_oauth",
             name: "Slack",
-            description: "Trigger from Slack events (mentions, messages, reactions)"
+            description: "Trigger from Slack events, interactions, and slash commands"
           }
         ],
         triggerCount: 1,
@@ -26494,7 +26800,7 @@ var init_integrations = __esm(() => {
         operations: [
           {
             name: "List Items",
-            description: "List all items from a Webflow CMS collection"
+            description: "List items from a Webflow CMS collection"
           },
           {
             name: "Get Item",
@@ -35827,6 +36133,923 @@ var init_capability_setup = __esm(() => {
   init_prompter();
 });
 
+// ../../node_modules/ipaddr.js/lib/ipaddr.js
+var require_ipaddr = __commonJS((exports, module) => {
+  (function(root) {
+    const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
+    const ipv4Regexes = {
+      fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+      threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+      twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
+      longValue: new RegExp(`^${ipv4Part}$`, "i")
+    };
+    const octalRegex = new RegExp(`^0[0-7]+$`, "i");
+    const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
+    const zoneIndex = "%[0-9a-z]{1,}";
+    const ipv6Part = "(?:[0-9a-f]+::?)+";
+    const ipv6Regexes = {
+      zoneIndex: new RegExp(zoneIndex, "i"),
+      native: new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
+      deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
+      transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
+    };
+    function expandIPv6(string, parts) {
+      if (string.indexOf("::") !== string.lastIndexOf("::")) {
+        return null;
+      }
+      let colonCount = 0;
+      let lastColon = -1;
+      let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
+      let replacement, replacementCount;
+      if (zoneId) {
+        zoneId = zoneId.substring(1);
+        string = string.replace(/%.+$/, "");
+      }
+      while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) {
+        colonCount++;
+      }
+      if (string.substr(0, 2) === "::") {
+        colonCount--;
+      }
+      if (string.substr(-2, 2) === "::") {
+        colonCount--;
+      }
+      if (colonCount > parts) {
+        return null;
+      }
+      replacementCount = parts - colonCount;
+      replacement = ":";
+      while (replacementCount--) {
+        replacement += "0:";
+      }
+      string = string.replace("::", replacement);
+      if (string[0] === ":") {
+        string = string.slice(1);
+      }
+      if (string[string.length - 1] === ":") {
+        string = string.slice(0, -1);
+      }
+      parts = function() {
+        const ref = string.split(":");
+        const results = [];
+        for (let i2 = 0;i2 < ref.length; i2++) {
+          results.push(parseInt(ref[i2], 16));
+        }
+        return results;
+      }();
+      return {
+        parts,
+        zoneId
+      };
+    }
+    function matchCIDR(first, second, partSize, cidrBits) {
+      if (first.length !== second.length) {
+        throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
+      }
+      let part = 0;
+      let shift;
+      while (cidrBits > 0) {
+        shift = partSize - cidrBits;
+        if (shift < 0) {
+          shift = 0;
+        }
+        if (first[part] >> shift !== second[part] >> shift) {
+          return false;
+        }
+        cidrBits -= partSize;
+        part += 1;
+      }
+      return true;
+    }
+    function parseIntAuto(string) {
+      if (hexRegex.test(string)) {
+        return parseInt(string, 16);
+      }
+      if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
+        if (octalRegex.test(string)) {
+          return parseInt(string, 8);
+        }
+        throw new Error(`ipaddr: cannot parse ${string} as octal`);
+      }
+      return parseInt(string, 10);
+    }
+    function padPart(part, length) {
+      while (part.length < length) {
+        part = `0${part}`;
+      }
+      return part;
+    }
+    const ipaddr = {};
+    ipaddr.IPv4 = function() {
+      function IPv4(octets) {
+        if (octets.length !== 4) {
+          throw new Error("ipaddr: ipv4 octet count should be 4");
+        }
+        let i2, octet;
+        for (i2 = 0;i2 < octets.length; i2++) {
+          octet = octets[i2];
+          if (!(0 <= octet && octet <= 255)) {
+            throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
+          }
+        }
+        this.octets = octets;
+      }
+      IPv4.prototype.SpecialRanges = {
+        unspecified: [[new IPv4([0, 0, 0, 0]), 8]],
+        broadcast: [[new IPv4([255, 255, 255, 255]), 32]],
+        multicast: [[new IPv4([224, 0, 0, 0]), 4]],
+        linkLocal: [[new IPv4([169, 254, 0, 0]), 16]],
+        loopback: [[new IPv4([127, 0, 0, 0]), 8]],
+        carrierGradeNat: [[new IPv4([100, 64, 0, 0]), 10]],
+        private: [
+          [new IPv4([10, 0, 0, 0]), 8],
+          [new IPv4([172, 16, 0, 0]), 12],
+          [new IPv4([192, 168, 0, 0]), 16]
+        ],
+        reserved: [
+          [new IPv4([192, 0, 0, 0]), 24],
+          [new IPv4([192, 0, 2, 0]), 24],
+          [new IPv4([192, 88, 99, 0]), 24],
+          [new IPv4([198, 18, 0, 0]), 15],
+          [new IPv4([198, 51, 100, 0]), 24],
+          [new IPv4([203, 0, 113, 0]), 24],
+          [new IPv4([240, 0, 0, 0]), 4]
+        ],
+        as112: [
+          [new IPv4([192, 175, 48, 0]), 24],
+          [new IPv4([192, 31, 196, 0]), 24]
+        ],
+        amt: [
+          [new IPv4([192, 52, 193, 0]), 24]
+        ]
+      };
+      IPv4.prototype.kind = function() {
+        return "ipv4";
+      };
+      IPv4.prototype.match = function(other, cidrRange) {
+        let ref;
+        if (cidrRange === undefined) {
+          ref = other;
+          other = ref[0];
+          cidrRange = ref[1];
+        }
+        if (other.kind() !== "ipv4") {
+          throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
+        }
+        return matchCIDR(this.octets, other.octets, 8, cidrRange);
+      };
+      IPv4.prototype.prefixLengthFromSubnetMask = function() {
+        let cidr = 0;
+        let stop = false;
+        const zerotable = {
+          0: 8,
+          128: 7,
+          192: 6,
+          224: 5,
+          240: 4,
+          248: 3,
+          252: 2,
+          254: 1,
+          255: 0
+        };
+        let i2, octet, zeros;
+        for (i2 = 3;i2 >= 0; i2 -= 1) {
+          octet = this.octets[i2];
+          if (octet in zerotable) {
+            zeros = zerotable[octet];
+            if (stop && zeros !== 0) {
+              return null;
+            }
+            if (zeros !== 8) {
+              stop = true;
+            }
+            cidr += zeros;
+          } else {
+            return null;
+          }
+        }
+        return 32 - cidr;
+      };
+      IPv4.prototype.range = function() {
+        return ipaddr.subnetMatch(this, this.SpecialRanges);
+      };
+      IPv4.prototype.toByteArray = function() {
+        return this.octets.slice(0);
+      };
+      IPv4.prototype.toIPv4MappedAddress = function() {
+        return ipaddr.IPv6.parse(`::ffff:${this.toString()}`);
+      };
+      IPv4.prototype.toNormalizedString = function() {
+        return this.toString();
+      };
+      IPv4.prototype.toString = function() {
+        return this.octets.join(".");
+      };
+      return IPv4;
+    }();
+    ipaddr.IPv4.broadcastAddressFromCIDR = function(string) {
+      try {
+        const cidr = this.parseCIDR(string);
+        const ipInterfaceOctets = cidr[0].toByteArray();
+        const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        const octets = [];
+        let i2 = 0;
+        while (i2 < 4) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) | parseInt(subnetMaskOctets[i2], 10) ^ 255);
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+      }
+    };
+    ipaddr.IPv4.isIPv4 = function(string) {
+      return this.parser(string) !== null;
+    };
+    ipaddr.IPv4.isValid = function(string) {
+      try {
+        new this(this.parser(string));
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidCIDR = function(string) {
+      try {
+        this.parseCIDR(string);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidFourPartDecimal = function(string) {
+      if (ipaddr.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) {
+        return true;
+      } else {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidCIDRFourPartDecimal = function(string) {
+      const match = string.match(/^(.+)\/(\d+)$/);
+      if (!ipaddr.IPv4.isValidCIDR(string) || !match) {
+        return false;
+      }
+      return ipaddr.IPv4.isValidFourPartDecimal(match[1]);
+    };
+    ipaddr.IPv4.networkAddressFromCIDR = function(string) {
+      let cidr, i2, ipInterfaceOctets, octets, subnetMaskOctets;
+      try {
+        cidr = this.parseCIDR(string);
+        ipInterfaceOctets = cidr[0].toByteArray();
+        subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        octets = [];
+        i2 = 0;
+        while (i2 < 4) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) & parseInt(subnetMaskOctets[i2], 10));
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+      }
+    };
+    ipaddr.IPv4.parse = function(string) {
+      const parts = this.parser(string);
+      if (parts === null) {
+        throw new Error("ipaddr: string is not formatted like an IPv4 Address");
+      }
+      return new this(parts);
+    };
+    ipaddr.IPv4.parseCIDR = function(string) {
+      let match;
+      if (match = string.match(/^(.+)\/(\d+)$/)) {
+        const maskLength = parseInt(match[2]);
+        if (maskLength >= 0 && maskLength <= 32) {
+          const parsed = [this.parse(match[1]), maskLength];
+          Object.defineProperty(parsed, "toString", {
+            value: function() {
+              return this.join("/");
+            }
+          });
+          return parsed;
+        }
+      }
+      throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
+    };
+    ipaddr.IPv4.parser = function(string) {
+      let match, part, value;
+      if (match = string.match(ipv4Regexes.fourOctet)) {
+        return function() {
+          const ref = match.slice(1, 6);
+          const results = [];
+          for (let i2 = 0;i2 < ref.length; i2++) {
+            part = ref[i2];
+            results.push(parseIntAuto(part));
+          }
+          return results;
+        }();
+      } else if (match = string.match(ipv4Regexes.longValue)) {
+        value = parseIntAuto(match[1]);
+        if (value > 4294967295 || value < 0) {
+          throw new Error("ipaddr: address outside defined range");
+        }
+        return function() {
+          const results = [];
+          let shift;
+          for (shift = 0;shift <= 24; shift += 8) {
+            results.push(value >> shift & 255);
+          }
+          return results;
+        }().reverse();
+      } else if (match = string.match(ipv4Regexes.twoOctet)) {
+        return function() {
+          const ref = match.slice(1, 4);
+          const results = [];
+          value = parseIntAuto(ref[1]);
+          if (value > 16777215 || value < 0) {
+            throw new Error("ipaddr: address outside defined range");
+          }
+          results.push(parseIntAuto(ref[0]));
+          results.push(value >> 16 & 255);
+          results.push(value >> 8 & 255);
+          results.push(value & 255);
+          return results;
+        }();
+      } else if (match = string.match(ipv4Regexes.threeOctet)) {
+        return function() {
+          const ref = match.slice(1, 5);
+          const results = [];
+          value = parseIntAuto(ref[2]);
+          if (value > 65535 || value < 0) {
+            throw new Error("ipaddr: address outside defined range");
+          }
+          results.push(parseIntAuto(ref[0]));
+          results.push(parseIntAuto(ref[1]));
+          results.push(value >> 8 & 255);
+          results.push(value & 255);
+          return results;
+        }();
+      } else {
+        return null;
+      }
+    };
+    ipaddr.IPv4.subnetMaskFromPrefixLength = function(prefix) {
+      prefix = parseInt(prefix);
+      if (prefix < 0 || prefix > 32) {
+        throw new Error("ipaddr: invalid IPv4 prefix length");
+      }
+      const octets = [0, 0, 0, 0];
+      let j = 0;
+      const filledOctetCount = Math.floor(prefix / 8);
+      while (j < filledOctetCount) {
+        octets[j] = 255;
+        j++;
+      }
+      if (filledOctetCount < 4) {
+        octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+      }
+      return new this(octets);
+    };
+    ipaddr.IPv6 = function() {
+      function IPv6(parts, zoneId) {
+        let i2, part;
+        if (parts.length === 16) {
+          this.parts = [];
+          for (i2 = 0;i2 <= 14; i2 += 2) {
+            this.parts.push(parts[i2] << 8 | parts[i2 + 1]);
+          }
+        } else if (parts.length === 8) {
+          this.parts = parts;
+        } else {
+          throw new Error("ipaddr: ipv6 part count should be 8 or 16");
+        }
+        for (i2 = 0;i2 < this.parts.length; i2++) {
+          part = this.parts[i2];
+          if (!(0 <= part && part <= 65535)) {
+            throw new Error("ipaddr: ipv6 part should fit in 16 bits");
+          }
+        }
+        if (zoneId) {
+          this.zoneId = zoneId;
+        }
+      }
+      IPv6.prototype.SpecialRanges = {
+        unspecified: [new IPv6([0, 0, 0, 0, 0, 0, 0, 0]), 128],
+        linkLocal: [new IPv6([65152, 0, 0, 0, 0, 0, 0, 0]), 10],
+        multicast: [new IPv6([65280, 0, 0, 0, 0, 0, 0, 0]), 8],
+        loopback: [new IPv6([0, 0, 0, 0, 0, 0, 0, 1]), 128],
+        uniqueLocal: [new IPv6([64512, 0, 0, 0, 0, 0, 0, 0]), 7],
+        ipv4Mapped: [new IPv6([0, 0, 0, 0, 0, 65535, 0, 0]), 96],
+        discard: [new IPv6([256, 0, 0, 0, 0, 0, 0, 0]), 64],
+        rfc6145: [new IPv6([0, 0, 0, 0, 65535, 0, 0, 0]), 96],
+        rfc6052: [new IPv6([100, 65435, 0, 0, 0, 0, 0, 0]), 96],
+        "6to4": [new IPv6([8194, 0, 0, 0, 0, 0, 0, 0]), 16],
+        teredo: [new IPv6([8193, 0, 0, 0, 0, 0, 0, 0]), 32],
+        benchmarking: [new IPv6([8193, 2, 0, 0, 0, 0, 0, 0]), 48],
+        amt: [new IPv6([8193, 3, 0, 0, 0, 0, 0, 0]), 32],
+        as112v6: [
+          [new IPv6([8193, 4, 274, 0, 0, 0, 0, 0]), 48],
+          [new IPv6([9760, 79, 32768, 0, 0, 0, 0, 0]), 48]
+        ],
+        deprecated: [new IPv6([8193, 16, 0, 0, 0, 0, 0, 0]), 28],
+        orchid2: [new IPv6([8193, 32, 0, 0, 0, 0, 0, 0]), 28],
+        droneRemoteIdProtocolEntityTags: [new IPv6([8193, 48, 0, 0, 0, 0, 0, 0]), 28],
+        reserved: [
+          [new IPv6([8193, 0, 0, 0, 0, 0, 0, 0]), 23],
+          [new IPv6([8193, 3512, 0, 0, 0, 0, 0, 0]), 32]
+        ]
+      };
+      IPv6.prototype.isIPv4MappedAddress = function() {
+        return this.range() === "ipv4Mapped";
+      };
+      IPv6.prototype.kind = function() {
+        return "ipv6";
+      };
+      IPv6.prototype.match = function(other, cidrRange) {
+        let ref;
+        if (cidrRange === undefined) {
+          ref = other;
+          other = ref[0];
+          cidrRange = ref[1];
+        }
+        if (other.kind() !== "ipv6") {
+          throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
+        }
+        return matchCIDR(this.parts, other.parts, 16, cidrRange);
+      };
+      IPv6.prototype.prefixLengthFromSubnetMask = function() {
+        let cidr = 0;
+        let stop = false;
+        const zerotable = {
+          0: 16,
+          32768: 15,
+          49152: 14,
+          57344: 13,
+          61440: 12,
+          63488: 11,
+          64512: 10,
+          65024: 9,
+          65280: 8,
+          65408: 7,
+          65472: 6,
+          65504: 5,
+          65520: 4,
+          65528: 3,
+          65532: 2,
+          65534: 1,
+          65535: 0
+        };
+        let part, zeros;
+        for (let i2 = 7;i2 >= 0; i2 -= 1) {
+          part = this.parts[i2];
+          if (part in zerotable) {
+            zeros = zerotable[part];
+            if (stop && zeros !== 0) {
+              return null;
+            }
+            if (zeros !== 16) {
+              stop = true;
+            }
+            cidr += zeros;
+          } else {
+            return null;
+          }
+        }
+        return 128 - cidr;
+      };
+      IPv6.prototype.range = function() {
+        return ipaddr.subnetMatch(this, this.SpecialRanges);
+      };
+      IPv6.prototype.toByteArray = function() {
+        let part;
+        const bytes = [];
+        const ref = this.parts;
+        for (let i2 = 0;i2 < ref.length; i2++) {
+          part = ref[i2];
+          bytes.push(part >> 8);
+          bytes.push(part & 255);
+        }
+        return bytes;
+      };
+      IPv6.prototype.toFixedLengthString = function() {
+        const addr = function() {
+          const results = [];
+          for (let i2 = 0;i2 < this.parts.length; i2++) {
+            results.push(padPart(this.parts[i2].toString(16), 4));
+          }
+          return results;
+        }.call(this).join(":");
+        let suffix = "";
+        if (this.zoneId) {
+          suffix = `%${this.zoneId}`;
+        }
+        return addr + suffix;
+      };
+      IPv6.prototype.toIPv4Address = function() {
+        if (!this.isIPv4MappedAddress()) {
+          throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
+        }
+        const ref = this.parts.slice(-2);
+        const high = ref[0];
+        const low = ref[1];
+        return new ipaddr.IPv4([high >> 8, high & 255, low >> 8, low & 255]);
+      };
+      IPv6.prototype.toNormalizedString = function() {
+        const addr = function() {
+          const results = [];
+          for (let i2 = 0;i2 < this.parts.length; i2++) {
+            results.push(this.parts[i2].toString(16));
+          }
+          return results;
+        }.call(this).join(":");
+        let suffix = "";
+        if (this.zoneId) {
+          suffix = `%${this.zoneId}`;
+        }
+        return addr + suffix;
+      };
+      IPv6.prototype.toRFC5952String = function() {
+        const regex = /((^|:)(0(:|$)){2,})/g;
+        const string = this.toNormalizedString();
+        let bestMatchIndex = 0;
+        let bestMatchLength = -1;
+        let match;
+        while (match = regex.exec(string)) {
+          if (match[0].length > bestMatchLength) {
+            bestMatchIndex = match.index;
+            bestMatchLength = match[0].length;
+          }
+        }
+        if (bestMatchLength < 0) {
+          return string;
+        }
+        return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}`;
+      };
+      IPv6.prototype.toString = function() {
+        return this.toRFC5952String();
+      };
+      return IPv6;
+    }();
+    ipaddr.IPv6.broadcastAddressFromCIDR = function(string) {
+      try {
+        const cidr = this.parseCIDR(string);
+        const ipInterfaceOctets = cidr[0].toByteArray();
+        const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        const octets = [];
+        let i2 = 0;
+        while (i2 < 16) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) | parseInt(subnetMaskOctets[i2], 10) ^ 255);
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+      }
+    };
+    ipaddr.IPv6.isIPv6 = function(string) {
+      return this.parser(string) !== null;
+    };
+    ipaddr.IPv6.isValid = function(string) {
+      if (typeof string === "string" && string.indexOf(":") === -1) {
+        return false;
+      }
+      try {
+        const addr = this.parser(string);
+        new this(addr.parts, addr.zoneId);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv6.isValidCIDR = function(string) {
+      if (typeof string === "string" && string.indexOf(":") === -1) {
+        return false;
+      }
+      try {
+        this.parseCIDR(string);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv6.networkAddressFromCIDR = function(string) {
+      let cidr, i2, ipInterfaceOctets, octets, subnetMaskOctets;
+      try {
+        cidr = this.parseCIDR(string);
+        ipInterfaceOctets = cidr[0].toByteArray();
+        subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        octets = [];
+        i2 = 0;
+        while (i2 < 16) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) & parseInt(subnetMaskOctets[i2], 10));
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+      }
+    };
+    ipaddr.IPv6.parse = function(string) {
+      const addr = this.parser(string);
+      if (addr.parts === null) {
+        throw new Error("ipaddr: string is not formatted like an IPv6 Address");
+      }
+      return new this(addr.parts, addr.zoneId);
+    };
+    ipaddr.IPv6.parseCIDR = function(string) {
+      let maskLength, match, parsed;
+      if (match = string.match(/^(.+)\/(\d+)$/)) {
+        maskLength = parseInt(match[2]);
+        if (maskLength >= 0 && maskLength <= 128) {
+          parsed = [this.parse(match[1]), maskLength];
+          Object.defineProperty(parsed, "toString", {
+            value: function() {
+              return this.join("/");
+            }
+          });
+          return parsed;
+        }
+      }
+      throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
+    };
+    ipaddr.IPv6.parser = function(string) {
+      let addr, i2, match, octet, octets, zoneId;
+      if (match = string.match(ipv6Regexes.deprecatedTransitional)) {
+        return this.parser(`::ffff:${match[1]}`);
+      }
+      if (ipv6Regexes.native.test(string)) {
+        return expandIPv6(string, 8);
+      }
+      if (match = string.match(ipv6Regexes.transitional)) {
+        zoneId = match[6] || "";
+        addr = match[1];
+        if (!match[1].endsWith("::")) {
+          addr = addr.slice(0, -1);
+        }
+        addr = expandIPv6(addr + zoneId, 6);
+        if (addr.parts) {
+          octets = [
+            parseInt(match[2]),
+            parseInt(match[3]),
+            parseInt(match[4]),
+            parseInt(match[5])
+          ];
+          for (i2 = 0;i2 < octets.length; i2++) {
+            octet = octets[i2];
+            if (!(0 <= octet && octet <= 255)) {
+              return null;
+            }
+          }
+          addr.parts.push(octets[0] << 8 | octets[1]);
+          addr.parts.push(octets[2] << 8 | octets[3]);
+          return {
+            parts: addr.parts,
+            zoneId: addr.zoneId
+          };
+        }
+      }
+      return null;
+    };
+    ipaddr.IPv6.subnetMaskFromPrefixLength = function(prefix) {
+      prefix = parseInt(prefix);
+      if (prefix < 0 || prefix > 128) {
+        throw new Error("ipaddr: invalid IPv6 prefix length");
+      }
+      const octets = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+      let j = 0;
+      const filledOctetCount = Math.floor(prefix / 8);
+      while (j < filledOctetCount) {
+        octets[j] = 255;
+        j++;
+      }
+      if (filledOctetCount < 16) {
+        octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+      }
+      return new this(octets);
+    };
+    ipaddr.fromByteArray = function(bytes) {
+      const length = bytes.length;
+      if (length === 4) {
+        return new ipaddr.IPv4(bytes);
+      } else if (length === 16) {
+        return new ipaddr.IPv6(bytes);
+      } else {
+        throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
+      }
+    };
+    ipaddr.isValid = function(string) {
+      return ipaddr.IPv6.isValid(string) || ipaddr.IPv4.isValid(string);
+    };
+    ipaddr.isValidCIDR = function(string) {
+      return ipaddr.IPv6.isValidCIDR(string) || ipaddr.IPv4.isValidCIDR(string);
+    };
+    ipaddr.parse = function(string) {
+      if (ipaddr.IPv6.isValid(string)) {
+        return ipaddr.IPv6.parse(string);
+      } else if (ipaddr.IPv4.isValid(string)) {
+        return ipaddr.IPv4.parse(string);
+      } else {
+        throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
+      }
+    };
+    ipaddr.parseCIDR = function(string) {
+      try {
+        return ipaddr.IPv6.parseCIDR(string);
+      } catch (e) {
+        try {
+          return ipaddr.IPv4.parseCIDR(string);
+        } catch (e2) {
+          throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format");
+        }
+      }
+    };
+    ipaddr.process = function(string) {
+      const addr = this.parse(string);
+      if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+        return addr.toIPv4Address();
+      } else {
+        return addr;
+      }
+    };
+    ipaddr.subnetMatch = function(address, rangeList, defaultName) {
+      let i2, rangeName, rangeSubnets, subnet;
+      if (defaultName === undefined || defaultName === null) {
+        defaultName = "unicast";
+      }
+      for (rangeName in rangeList) {
+        if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
+          rangeSubnets = rangeList[rangeName];
+          if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) {
+            rangeSubnets = [rangeSubnets];
+          }
+          for (i2 = 0;i2 < rangeSubnets.length; i2++) {
+            subnet = rangeSubnets[i2];
+            if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) {
+              return rangeName;
+            }
+          }
+        }
+      }
+      return defaultName;
+    };
+    if (typeof module !== "undefined" && module.exports) {
+      module.exports = ipaddr;
+    } else {
+      root.ipaddr = ipaddr;
+    }
+  })(exports);
+});
+
+// ../security/src/hostnames.ts
+function unwrapIpv6Brackets(host) {
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+var LOOPBACK_HOSTNAMES;
+var init_hostnames = __esm(() => {
+  LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1"]);
+});
+
+// ../security/src/egress.ts
+function splitEntries(value) {
+  if (value === undefined)
+    return [];
+  const parts = typeof value === "string" ? value.split(",") : value;
+  return parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function normalizeHost(host) {
+  return unwrapIpv6Brackets(host.toLowerCase()).replace(/\.$/, "");
+}
+function parseHostPattern(entry, sourceName) {
+  const value = normalizeHost(entry);
+  const wildcard = value.startsWith("*.");
+  const host = wildcard ? value.slice(2) : value;
+  if (host.includes("*")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a wildcard is only supported as a leading "*." label`);
+  }
+  if (host.includes("/") || /\s/.test(host)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": expected a hostname, not a URL or CIDR`);
+  }
+  if (host.includes(",") || host.includes(":")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a hostname has no port, comma, or colon`);
+  }
+  if (host.length === 0 || host.split(".").some((label) => label.length === 0)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": every label must be non-empty`);
+  }
+  if (/[^\x21-\x7e]/.test(host)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": use the punycode form of an internationalized name`);
+  }
+  if (wildcard && !host.includes(".")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a wildcard must cover at least two labels, e.g. "*.example.com"`);
+  }
+  return wildcard ? { value: `.${host}`, wildcard: true } : { value: host, wildcard: false };
+}
+function parseCidrRange(entry, sourceName) {
+  if (entry.includes("/")) {
+    if (!ipaddr.isValidCIDR(entry)) {
+      throw new Error(`Invalid ${sourceName} entry "${entry}"`);
+    }
+    const [address2, prefixLength] = ipaddr.parseCIDR(entry);
+    if (prefixLength < 8) {
+      throw new Error(`Invalid ${sourceName} entry "${entry}": catch-all networks are unsafe`);
+    }
+    return { address: address2, prefixLength };
+  }
+  const value = unwrapIpv6Brackets(entry);
+  if (!ipaddr.isValid(value)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}"`);
+  }
+  const address = ipaddr.parse(value);
+  return { address, prefixLength: address.kind() === "ipv4" ? 32 : 128 };
+}
+function createEgressPolicy(spec = {}) {
+  const sourceNames = spec.sourceNames ?? DEFAULT_SOURCE_NAMES;
+  return {
+    insecureHttp: spec.insecureHttp ?? "never",
+    allowLoopback: spec.allowLoopback ?? false,
+    allowPrivate: spec.allowPrivate ?? false,
+    allowedHosts: splitEntries(spec.allowedHosts).map((entry) => parseHostPattern(entry, sourceNames.hosts)),
+    allowedRanges: splitEntries(spec.allowedRanges).map((entry) => parseCidrRange(entry, sourceNames.ranges))
+  };
+}
+function embeddedIpv4(parts) {
+  return ipaddr.fromByteArray([
+    parts[6] >> 8 & 255,
+    parts[6] & 255,
+    parts[7] >> 8 & 255,
+    parts[7] & 255
+  ]).toString();
+}
+function transitionIpv4(parts) {
+  if (parts[0] === 8194) {
+    return ipaddr.fromByteArray([
+      parts[1] >> 8 & 255,
+      parts[1] & 255,
+      parts[2] >> 8 & 255,
+      parts[2] & 255
+    ]).toString();
+  }
+  if (isTeredo(parts))
+    return null;
+  if (parts[4] === 0 && parts[5] === 24318)
+    return embeddedIpv4(parts);
+  if (parts[4] === 512 && parts[5] === 24318)
+    return embeddedIpv4(parts);
+  return null;
+}
+function isTeredo(parts) {
+  return parts[0] === 8193 && parts[1] === 0;
+}
+function canonicalAddress(address) {
+  const clean = unwrapIpv6Brackets(address).split("%")[0];
+  if (!ipaddr.isValid(clean))
+    return null;
+  const parsed = ipaddr.process(clean);
+  if (parsed.kind() === "ipv6") {
+    const parts = parsed.parts;
+    if (IPV4_EMBEDDING_PREFIXES.some((prefix) => prefix.every((part, index) => parts[index] === part))) {
+      return embeddedIpv4(parts);
+    }
+    const embedded = (parts[6] << 16 >>> 0) + parts[7];
+    if (parts.slice(0, 6).every((part) => part === 0) && embedded > 1) {
+      return embeddedIpv4(parts);
+    }
+    const transition = transitionIpv4(parts);
+    if (transition !== null)
+      return transition;
+  }
+  return parsed.toString();
+}
+var ipaddr, METADATA_ADDRESSES, DENIED_PORTS, DEFAULT_SOURCE_NAMES, STRICT_EGRESS_POLICY, IPV4_EMBEDDING_PREFIXES, CANONICAL_METADATA_ADDRESSES;
+var init_egress = __esm(() => {
+  init_hostnames();
+  ipaddr = __toESM(require_ipaddr(), 1);
+  METADATA_ADDRESSES = [
+    "169.254.169.254",
+    "169.254.170.2",
+    "100.100.100.200",
+    "192.0.0.192",
+    "168.63.129.16",
+    "fd00:ec2::254"
+  ];
+  DENIED_PORTS = new Set([
+    22,
+    23,
+    25,
+    3306,
+    5432,
+    6379,
+    27017,
+    9200
+  ]);
+  DEFAULT_SOURCE_NAMES = { hosts: "allowedHosts", ranges: "allowedRanges" };
+  STRICT_EGRESS_POLICY = createEgressPolicy();
+  IPV4_EMBEDDING_PREFIXES = [
+    [100, 65435, 0, 0, 0, 0],
+    [0, 0, 0, 0, 65535, 0]
+  ];
+  CANONICAL_METADATA_ADDRESSES = new Set(METADATA_ADDRESSES.map((address) => canonicalAddress(address) ?? address));
+});
+
 // ../security/src/hash.ts
 import { createHash } from "node:crypto";
 function sha256Base64Url(input) {
@@ -36095,6 +37318,18 @@ function collectSecrets(existing) {
   }
   return secrets;
 }
+function validateEgressEntries(spec) {
+  try {
+    createEgressPolicy({
+      allowedHosts: spec.allowedHosts?.trim() || undefined,
+      allowedRanges: spec.allowedRanges?.trim() || undefined,
+      sourceNames: { hosts: "EGRESS_ALLOWED_HOSTS", ranges: "EGRESS_ALLOWED_IP_RANGES" }
+    });
+    return;
+  } catch (error) {
+    return getErrorMessage(error, "invalid entry");
+  }
+}
 async function promptCopilotKey(existing) {
   if (existing) {
     const keep = await confirm2({
@@ -36214,12 +37449,28 @@ async function promptSecurity(vars) {
     sim.DISABLE_AUTH = "true";
     mirrorToRealtime.DISABLE_AUTH = "true";
   }
-  const privateHosts = await confirm2({
-    message: "Allow DB/connector tools to reach private hosts? (Docker/K8s service names, localhost — loosens the SSRF guard)",
-    initialValue: isTruthy(vars.get("ALLOW_PRIVATE_DATABASE_HOSTS"))
+  const existingEgressHosts = vars.get("EGRESS_ALLOWED_HOSTS");
+  const egressHosts = await text2({
+    message: "Hosts on your private network that workflows may reach? (comma-separated, blank for none — widens the SSRF guard)",
+    placeholder: "host.docker.internal,*.svc.cluster.local",
+    initialValue: existingEgressHosts ?? "",
+    defaultValue: "",
+    validate: (value) => validateEgressEntries({ allowedHosts: value })
+  });
+  if (typeof egressHosts === "string" && egressHosts.trim()) {
+    sim.EGRESS_ALLOWED_HOSTS = egressHosts.trim();
+  }
+  const existingEgressRanges = vars.get("EGRESS_ALLOWED_IP_RANGES");
+  const egressRanges = await text2({
+    message: "Address ranges on your private network that workflows may reach? (CIDRs, comma-separated)",
+    placeholder: "10.0.0.0/8,192.168.65.254/32",
+    initialValue: existingEgressRanges ?? "",
+    defaultValue: "",
+    validate: (value) => validateEgressEntries({ allowedRanges: value })
   });
-  if (privateHosts)
-    sim.ALLOW_PRIVATE_DATABASE_HOSTS = "true";
+  if (typeof egressRanges === "string" && egressRanges.trim()) {
+    sim.EGRESS_ALLOWED_IP_RANGES = egressRanges.trim();
+  }
   const existingAdminKey = vars.get("ADMIN_API_KEY");
   if (!existingAdminKey || isPlaceholder(existingAdminKey)) {
     const wantsAdmin = await confirm2({
@@ -36264,6 +37515,7 @@ async function promptUnlocks(vars) {
 }
 var DEFAULT_CLI_AUTH_ORIGIN = "https://www.sim.ai", PROVIDER_CONSOLES;
 var init_steps = __esm(() => {
+  init_egress();
   init_capability_config();
   init_capability_setup();
   init_cli_auth();