sim-setup 1.0.6-preview.65.1 → 1.0.6-preview.67.1

package/dist/docker-compose.prod.yml

@@ -50,6 +50,11 @@ services:
       # different host:port (e.g. wss://socket.example.com).
       - NEXT_PUBLIC_SOCKET_URL=${NEXT_PUBLIC_SOCKET_URL:-}
       - ADMISSION_GATE_MAX_INFLIGHT=${ADMISSION_GATE_MAX_INFLIGHT:-500}
+    # Lets a workflow reach a service on the Docker host. Reaching it also
+    # requires naming it in EGRESS_ALLOWED_HOSTS; this only makes the name
+    # resolve, which it does not on Linux by default.
+    extra_hosts:
+      - 'host.docker.internal:host-gateway'
     depends_on:
       db:
         condition: service_healthy

package/dist/index.js

@@ -35827,6 +35827,923 @@ var init_capability_setup = __esm(() => {
   init_prompter();
 });
 
+// ../../node_modules/ipaddr.js/lib/ipaddr.js
+var require_ipaddr = __commonJS((exports, module) => {
+  (function(root) {
+    const ipv4Part = "(0?\\d+|0x[a-f0-9]+)";
+    const ipv4Regexes = {
+      fourOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+      threeOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}$`, "i"),
+      twoOctet: new RegExp(`^${ipv4Part}\\.${ipv4Part}$`, "i"),
+      longValue: new RegExp(`^${ipv4Part}$`, "i")
+    };
+    const octalRegex = new RegExp(`^0[0-7]+$`, "i");
+    const hexRegex = new RegExp(`^0x[a-f0-9]+$`, "i");
+    const zoneIndex = "%[0-9a-z]{1,}";
+    const ipv6Part = "(?:[0-9a-f]+::?)+";
+    const ipv6Regexes = {
+      zoneIndex: new RegExp(zoneIndex, "i"),
+      native: new RegExp(`^(::)?(${ipv6Part})?([0-9a-f]+)?(::)?(${zoneIndex})?$`, "i"),
+      deprecatedTransitional: new RegExp(`^(?:::)(${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?)$`, "i"),
+      transitional: new RegExp(`^((?:${ipv6Part})|(?:::)(?:${ipv6Part})?)${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}\\.${ipv4Part}(${zoneIndex})?$`, "i")
+    };
+    function expandIPv6(string, parts) {
+      if (string.indexOf("::") !== string.lastIndexOf("::")) {
+        return null;
+      }
+      let colonCount = 0;
+      let lastColon = -1;
+      let zoneId = (string.match(ipv6Regexes.zoneIndex) || [])[0];
+      let replacement, replacementCount;
+      if (zoneId) {
+        zoneId = zoneId.substring(1);
+        string = string.replace(/%.+$/, "");
+      }
+      while ((lastColon = string.indexOf(":", lastColon + 1)) >= 0) {
+        colonCount++;
+      }
+      if (string.substr(0, 2) === "::") {
+        colonCount--;
+      }
+      if (string.substr(-2, 2) === "::") {
+        colonCount--;
+      }
+      if (colonCount > parts) {
+        return null;
+      }
+      replacementCount = parts - colonCount;
+      replacement = ":";
+      while (replacementCount--) {
+        replacement += "0:";
+      }
+      string = string.replace("::", replacement);
+      if (string[0] === ":") {
+        string = string.slice(1);
+      }
+      if (string[string.length - 1] === ":") {
+        string = string.slice(0, -1);
+      }
+      parts = function() {
+        const ref = string.split(":");
+        const results = [];
+        for (let i2 = 0;i2 < ref.length; i2++) {
+          results.push(parseInt(ref[i2], 16));
+        }
+        return results;
+      }();
+      return {
+        parts,
+        zoneId
+      };
+    }
+    function matchCIDR(first, second, partSize, cidrBits) {
+      if (first.length !== second.length) {
+        throw new Error("ipaddr: cannot match CIDR for objects with different lengths");
+      }
+      let part = 0;
+      let shift;
+      while (cidrBits > 0) {
+        shift = partSize - cidrBits;
+        if (shift < 0) {
+          shift = 0;
+        }
+        if (first[part] >> shift !== second[part] >> shift) {
+          return false;
+        }
+        cidrBits -= partSize;
+        part += 1;
+      }
+      return true;
+    }
+    function parseIntAuto(string) {
+      if (hexRegex.test(string)) {
+        return parseInt(string, 16);
+      }
+      if (string[0] === "0" && !isNaN(parseInt(string[1], 10))) {
+        if (octalRegex.test(string)) {
+          return parseInt(string, 8);
+        }
+        throw new Error(`ipaddr: cannot parse ${string} as octal`);
+      }
+      return parseInt(string, 10);
+    }
+    function padPart(part, length) {
+      while (part.length < length) {
+        part = `0${part}`;
+      }
+      return part;
+    }
+    const ipaddr = {};
+    ipaddr.IPv4 = function() {
+      function IPv4(octets) {
+        if (octets.length !== 4) {
+          throw new Error("ipaddr: ipv4 octet count should be 4");
+        }
+        let i2, octet;
+        for (i2 = 0;i2 < octets.length; i2++) {
+          octet = octets[i2];
+          if (!(0 <= octet && octet <= 255)) {
+            throw new Error("ipaddr: ipv4 octet should fit in 8 bits");
+          }
+        }
+        this.octets = octets;
+      }
+      IPv4.prototype.SpecialRanges = {
+        unspecified: [[new IPv4([0, 0, 0, 0]), 8]],
+        broadcast: [[new IPv4([255, 255, 255, 255]), 32]],
+        multicast: [[new IPv4([224, 0, 0, 0]), 4]],
+        linkLocal: [[new IPv4([169, 254, 0, 0]), 16]],
+        loopback: [[new IPv4([127, 0, 0, 0]), 8]],
+        carrierGradeNat: [[new IPv4([100, 64, 0, 0]), 10]],
+        private: [
+          [new IPv4([10, 0, 0, 0]), 8],
+          [new IPv4([172, 16, 0, 0]), 12],
+          [new IPv4([192, 168, 0, 0]), 16]
+        ],
+        reserved: [
+          [new IPv4([192, 0, 0, 0]), 24],
+          [new IPv4([192, 0, 2, 0]), 24],
+          [new IPv4([192, 88, 99, 0]), 24],
+          [new IPv4([198, 18, 0, 0]), 15],
+          [new IPv4([198, 51, 100, 0]), 24],
+          [new IPv4([203, 0, 113, 0]), 24],
+          [new IPv4([240, 0, 0, 0]), 4]
+        ],
+        as112: [
+          [new IPv4([192, 175, 48, 0]), 24],
+          [new IPv4([192, 31, 196, 0]), 24]
+        ],
+        amt: [
+          [new IPv4([192, 52, 193, 0]), 24]
+        ]
+      };
+      IPv4.prototype.kind = function() {
+        return "ipv4";
+      };
+      IPv4.prototype.match = function(other, cidrRange) {
+        let ref;
+        if (cidrRange === undefined) {
+          ref = other;
+          other = ref[0];
+          cidrRange = ref[1];
+        }
+        if (other.kind() !== "ipv4") {
+          throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");
+        }
+        return matchCIDR(this.octets, other.octets, 8, cidrRange);
+      };
+      IPv4.prototype.prefixLengthFromSubnetMask = function() {
+        let cidr = 0;
+        let stop = false;
+        const zerotable = {
+          0: 8,
+          128: 7,
+          192: 6,
+          224: 5,
+          240: 4,
+          248: 3,
+          252: 2,
+          254: 1,
+          255: 0
+        };
+        let i2, octet, zeros;
+        for (i2 = 3;i2 >= 0; i2 -= 1) {
+          octet = this.octets[i2];
+          if (octet in zerotable) {
+            zeros = zerotable[octet];
+            if (stop && zeros !== 0) {
+              return null;
+            }
+            if (zeros !== 8) {
+              stop = true;
+            }
+            cidr += zeros;
+          } else {
+            return null;
+          }
+        }
+        return 32 - cidr;
+      };
+      IPv4.prototype.range = function() {
+        return ipaddr.subnetMatch(this, this.SpecialRanges);
+      };
+      IPv4.prototype.toByteArray = function() {
+        return this.octets.slice(0);
+      };
+      IPv4.prototype.toIPv4MappedAddress = function() {
+        return ipaddr.IPv6.parse(`::ffff:${this.toString()}`);
+      };
+      IPv4.prototype.toNormalizedString = function() {
+        return this.toString();
+      };
+      IPv4.prototype.toString = function() {
+        return this.octets.join(".");
+      };
+      return IPv4;
+    }();
+    ipaddr.IPv4.broadcastAddressFromCIDR = function(string) {
+      try {
+        const cidr = this.parseCIDR(string);
+        const ipInterfaceOctets = cidr[0].toByteArray();
+        const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        const octets = [];
+        let i2 = 0;
+        while (i2 < 4) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) | parseInt(subnetMaskOctets[i2], 10) ^ 255);
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+      }
+    };
+    ipaddr.IPv4.isIPv4 = function(string) {
+      return this.parser(string) !== null;
+    };
+    ipaddr.IPv4.isValid = function(string) {
+      try {
+        new this(this.parser(string));
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidCIDR = function(string) {
+      try {
+        this.parseCIDR(string);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidFourPartDecimal = function(string) {
+      if (ipaddr.IPv4.isValid(string) && string.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/)) {
+        return true;
+      } else {
+        return false;
+      }
+    };
+    ipaddr.IPv4.isValidCIDRFourPartDecimal = function(string) {
+      const match = string.match(/^(.+)\/(\d+)$/);
+      if (!ipaddr.IPv4.isValidCIDR(string) || !match) {
+        return false;
+      }
+      return ipaddr.IPv4.isValidFourPartDecimal(match[1]);
+    };
+    ipaddr.IPv4.networkAddressFromCIDR = function(string) {
+      let cidr, i2, ipInterfaceOctets, octets, subnetMaskOctets;
+      try {
+        cidr = this.parseCIDR(string);
+        ipInterfaceOctets = cidr[0].toByteArray();
+        subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        octets = [];
+        i2 = 0;
+        while (i2 < 4) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) & parseInt(subnetMaskOctets[i2], 10));
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error("ipaddr: the address does not have IPv4 CIDR format");
+      }
+    };
+    ipaddr.IPv4.parse = function(string) {
+      const parts = this.parser(string);
+      if (parts === null) {
+        throw new Error("ipaddr: string is not formatted like an IPv4 Address");
+      }
+      return new this(parts);
+    };
+    ipaddr.IPv4.parseCIDR = function(string) {
+      let match;
+      if (match = string.match(/^(.+)\/(\d+)$/)) {
+        const maskLength = parseInt(match[2]);
+        if (maskLength >= 0 && maskLength <= 32) {
+          const parsed = [this.parse(match[1]), maskLength];
+          Object.defineProperty(parsed, "toString", {
+            value: function() {
+              return this.join("/");
+            }
+          });
+          return parsed;
+        }
+      }
+      throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range");
+    };
+    ipaddr.IPv4.parser = function(string) {
+      let match, part, value;
+      if (match = string.match(ipv4Regexes.fourOctet)) {
+        return function() {
+          const ref = match.slice(1, 6);
+          const results = [];
+          for (let i2 = 0;i2 < ref.length; i2++) {
+            part = ref[i2];
+            results.push(parseIntAuto(part));
+          }
+          return results;
+        }();
+      } else if (match = string.match(ipv4Regexes.longValue)) {
+        value = parseIntAuto(match[1]);
+        if (value > 4294967295 || value < 0) {
+          throw new Error("ipaddr: address outside defined range");
+        }
+        return function() {
+          const results = [];
+          let shift;
+          for (shift = 0;shift <= 24; shift += 8) {
+            results.push(value >> shift & 255);
+          }
+          return results;
+        }().reverse();
+      } else if (match = string.match(ipv4Regexes.twoOctet)) {
+        return function() {
+          const ref = match.slice(1, 4);
+          const results = [];
+          value = parseIntAuto(ref[1]);
+          if (value > 16777215 || value < 0) {
+            throw new Error("ipaddr: address outside defined range");
+          }
+          results.push(parseIntAuto(ref[0]));
+          results.push(value >> 16 & 255);
+          results.push(value >> 8 & 255);
+          results.push(value & 255);
+          return results;
+        }();
+      } else if (match = string.match(ipv4Regexes.threeOctet)) {
+        return function() {
+          const ref = match.slice(1, 5);
+          const results = [];
+          value = parseIntAuto(ref[2]);
+          if (value > 65535 || value < 0) {
+            throw new Error("ipaddr: address outside defined range");
+          }
+          results.push(parseIntAuto(ref[0]));
+          results.push(parseIntAuto(ref[1]));
+          results.push(value >> 8 & 255);
+          results.push(value & 255);
+          return results;
+        }();
+      } else {
+        return null;
+      }
+    };
+    ipaddr.IPv4.subnetMaskFromPrefixLength = function(prefix) {
+      prefix = parseInt(prefix);
+      if (prefix < 0 || prefix > 32) {
+        throw new Error("ipaddr: invalid IPv4 prefix length");
+      }
+      const octets = [0, 0, 0, 0];
+      let j = 0;
+      const filledOctetCount = Math.floor(prefix / 8);
+      while (j < filledOctetCount) {
+        octets[j] = 255;
+        j++;
+      }
+      if (filledOctetCount < 4) {
+        octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+      }
+      return new this(octets);
+    };
+    ipaddr.IPv6 = function() {
+      function IPv6(parts, zoneId) {
+        let i2, part;
+        if (parts.length === 16) {
+          this.parts = [];
+          for (i2 = 0;i2 <= 14; i2 += 2) {
+            this.parts.push(parts[i2] << 8 | parts[i2 + 1]);
+          }
+        } else if (parts.length === 8) {
+          this.parts = parts;
+        } else {
+          throw new Error("ipaddr: ipv6 part count should be 8 or 16");
+        }
+        for (i2 = 0;i2 < this.parts.length; i2++) {
+          part = this.parts[i2];
+          if (!(0 <= part && part <= 65535)) {
+            throw new Error("ipaddr: ipv6 part should fit in 16 bits");
+          }
+        }
+        if (zoneId) {
+          this.zoneId = zoneId;
+        }
+      }
+      IPv6.prototype.SpecialRanges = {
+        unspecified: [new IPv6([0, 0, 0, 0, 0, 0, 0, 0]), 128],
+        linkLocal: [new IPv6([65152, 0, 0, 0, 0, 0, 0, 0]), 10],
+        multicast: [new IPv6([65280, 0, 0, 0, 0, 0, 0, 0]), 8],
+        loopback: [new IPv6([0, 0, 0, 0, 0, 0, 0, 1]), 128],
+        uniqueLocal: [new IPv6([64512, 0, 0, 0, 0, 0, 0, 0]), 7],
+        ipv4Mapped: [new IPv6([0, 0, 0, 0, 0, 65535, 0, 0]), 96],
+        discard: [new IPv6([256, 0, 0, 0, 0, 0, 0, 0]), 64],
+        rfc6145: [new IPv6([0, 0, 0, 0, 65535, 0, 0, 0]), 96],
+        rfc6052: [new IPv6([100, 65435, 0, 0, 0, 0, 0, 0]), 96],
+        "6to4": [new IPv6([8194, 0, 0, 0, 0, 0, 0, 0]), 16],
+        teredo: [new IPv6([8193, 0, 0, 0, 0, 0, 0, 0]), 32],
+        benchmarking: [new IPv6([8193, 2, 0, 0, 0, 0, 0, 0]), 48],
+        amt: [new IPv6([8193, 3, 0, 0, 0, 0, 0, 0]), 32],
+        as112v6: [
+          [new IPv6([8193, 4, 274, 0, 0, 0, 0, 0]), 48],
+          [new IPv6([9760, 79, 32768, 0, 0, 0, 0, 0]), 48]
+        ],
+        deprecated: [new IPv6([8193, 16, 0, 0, 0, 0, 0, 0]), 28],
+        orchid2: [new IPv6([8193, 32, 0, 0, 0, 0, 0, 0]), 28],
+        droneRemoteIdProtocolEntityTags: [new IPv6([8193, 48, 0, 0, 0, 0, 0, 0]), 28],
+        reserved: [
+          [new IPv6([8193, 0, 0, 0, 0, 0, 0, 0]), 23],
+          [new IPv6([8193, 3512, 0, 0, 0, 0, 0, 0]), 32]
+        ]
+      };
+      IPv6.prototype.isIPv4MappedAddress = function() {
+        return this.range() === "ipv4Mapped";
+      };
+      IPv6.prototype.kind = function() {
+        return "ipv6";
+      };
+      IPv6.prototype.match = function(other, cidrRange) {
+        let ref;
+        if (cidrRange === undefined) {
+          ref = other;
+          other = ref[0];
+          cidrRange = ref[1];
+        }
+        if (other.kind() !== "ipv6") {
+          throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");
+        }
+        return matchCIDR(this.parts, other.parts, 16, cidrRange);
+      };
+      IPv6.prototype.prefixLengthFromSubnetMask = function() {
+        let cidr = 0;
+        let stop = false;
+        const zerotable = {
+          0: 16,
+          32768: 15,
+          49152: 14,
+          57344: 13,
+          61440: 12,
+          63488: 11,
+          64512: 10,
+          65024: 9,
+          65280: 8,
+          65408: 7,
+          65472: 6,
+          65504: 5,
+          65520: 4,
+          65528: 3,
+          65532: 2,
+          65534: 1,
+          65535: 0
+        };
+        let part, zeros;
+        for (let i2 = 7;i2 >= 0; i2 -= 1) {
+          part = this.parts[i2];
+          if (part in zerotable) {
+            zeros = zerotable[part];
+            if (stop && zeros !== 0) {
+              return null;
+            }
+            if (zeros !== 16) {
+              stop = true;
+            }
+            cidr += zeros;
+          } else {
+            return null;
+          }
+        }
+        return 128 - cidr;
+      };
+      IPv6.prototype.range = function() {
+        return ipaddr.subnetMatch(this, this.SpecialRanges);
+      };
+      IPv6.prototype.toByteArray = function() {
+        let part;
+        const bytes = [];
+        const ref = this.parts;
+        for (let i2 = 0;i2 < ref.length; i2++) {
+          part = ref[i2];
+          bytes.push(part >> 8);
+          bytes.push(part & 255);
+        }
+        return bytes;
+      };
+      IPv6.prototype.toFixedLengthString = function() {
+        const addr = function() {
+          const results = [];
+          for (let i2 = 0;i2 < this.parts.length; i2++) {
+            results.push(padPart(this.parts[i2].toString(16), 4));
+          }
+          return results;
+        }.call(this).join(":");
+        let suffix = "";
+        if (this.zoneId) {
+          suffix = `%${this.zoneId}`;
+        }
+        return addr + suffix;
+      };
+      IPv6.prototype.toIPv4Address = function() {
+        if (!this.isIPv4MappedAddress()) {
+          throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");
+        }
+        const ref = this.parts.slice(-2);
+        const high = ref[0];
+        const low = ref[1];
+        return new ipaddr.IPv4([high >> 8, high & 255, low >> 8, low & 255]);
+      };
+      IPv6.prototype.toNormalizedString = function() {
+        const addr = function() {
+          const results = [];
+          for (let i2 = 0;i2 < this.parts.length; i2++) {
+            results.push(this.parts[i2].toString(16));
+          }
+          return results;
+        }.call(this).join(":");
+        let suffix = "";
+        if (this.zoneId) {
+          suffix = `%${this.zoneId}`;
+        }
+        return addr + suffix;
+      };
+      IPv6.prototype.toRFC5952String = function() {
+        const regex = /((^|:)(0(:|$)){2,})/g;
+        const string = this.toNormalizedString();
+        let bestMatchIndex = 0;
+        let bestMatchLength = -1;
+        let match;
+        while (match = regex.exec(string)) {
+          if (match[0].length > bestMatchLength) {
+            bestMatchIndex = match.index;
+            bestMatchLength = match[0].length;
+          }
+        }
+        if (bestMatchLength < 0) {
+          return string;
+        }
+        return `${string.substring(0, bestMatchIndex)}::${string.substring(bestMatchIndex + bestMatchLength)}`;
+      };
+      IPv6.prototype.toString = function() {
+        return this.toRFC5952String();
+      };
+      return IPv6;
+    }();
+    ipaddr.IPv6.broadcastAddressFromCIDR = function(string) {
+      try {
+        const cidr = this.parseCIDR(string);
+        const ipInterfaceOctets = cidr[0].toByteArray();
+        const subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        const octets = [];
+        let i2 = 0;
+        while (i2 < 16) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) | parseInt(subnetMaskOctets[i2], 10) ^ 255);
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+      }
+    };
+    ipaddr.IPv6.isIPv6 = function(string) {
+      return this.parser(string) !== null;
+    };
+    ipaddr.IPv6.isValid = function(string) {
+      if (typeof string === "string" && string.indexOf(":") === -1) {
+        return false;
+      }
+      try {
+        const addr = this.parser(string);
+        new this(addr.parts, addr.zoneId);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv6.isValidCIDR = function(string) {
+      if (typeof string === "string" && string.indexOf(":") === -1) {
+        return false;
+      }
+      try {
+        this.parseCIDR(string);
+        return true;
+      } catch (e) {
+        return false;
+      }
+    };
+    ipaddr.IPv6.networkAddressFromCIDR = function(string) {
+      let cidr, i2, ipInterfaceOctets, octets, subnetMaskOctets;
+      try {
+        cidr = this.parseCIDR(string);
+        ipInterfaceOctets = cidr[0].toByteArray();
+        subnetMaskOctets = this.subnetMaskFromPrefixLength(cidr[1]).toByteArray();
+        octets = [];
+        i2 = 0;
+        while (i2 < 16) {
+          octets.push(parseInt(ipInterfaceOctets[i2], 10) & parseInt(subnetMaskOctets[i2], 10));
+          i2++;
+        }
+        return new this(octets);
+      } catch (e) {
+        throw new Error(`ipaddr: the address does not have IPv6 CIDR format (${e})`);
+      }
+    };
+    ipaddr.IPv6.parse = function(string) {
+      const addr = this.parser(string);
+      if (addr.parts === null) {
+        throw new Error("ipaddr: string is not formatted like an IPv6 Address");
+      }
+      return new this(addr.parts, addr.zoneId);
+    };
+    ipaddr.IPv6.parseCIDR = function(string) {
+      let maskLength, match, parsed;
+      if (match = string.match(/^(.+)\/(\d+)$/)) {
+        maskLength = parseInt(match[2]);
+        if (maskLength >= 0 && maskLength <= 128) {
+          parsed = [this.parse(match[1]), maskLength];
+          Object.defineProperty(parsed, "toString", {
+            value: function() {
+              return this.join("/");
+            }
+          });
+          return parsed;
+        }
+      }
+      throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range");
+    };
+    ipaddr.IPv6.parser = function(string) {
+      let addr, i2, match, octet, octets, zoneId;
+      if (match = string.match(ipv6Regexes.deprecatedTransitional)) {
+        return this.parser(`::ffff:${match[1]}`);
+      }
+      if (ipv6Regexes.native.test(string)) {
+        return expandIPv6(string, 8);
+      }
+      if (match = string.match(ipv6Regexes.transitional)) {
+        zoneId = match[6] || "";
+        addr = match[1];
+        if (!match[1].endsWith("::")) {
+          addr = addr.slice(0, -1);
+        }
+        addr = expandIPv6(addr + zoneId, 6);
+        if (addr.parts) {
+          octets = [
+            parseInt(match[2]),
+            parseInt(match[3]),
+            parseInt(match[4]),
+            parseInt(match[5])
+          ];
+          for (i2 = 0;i2 < octets.length; i2++) {
+            octet = octets[i2];
+            if (!(0 <= octet && octet <= 255)) {
+              return null;
+            }
+          }
+          addr.parts.push(octets[0] << 8 | octets[1]);
+          addr.parts.push(octets[2] << 8 | octets[3]);
+          return {
+            parts: addr.parts,
+            zoneId: addr.zoneId
+          };
+        }
+      }
+      return null;
+    };
+    ipaddr.IPv6.subnetMaskFromPrefixLength = function(prefix) {
+      prefix = parseInt(prefix);
+      if (prefix < 0 || prefix > 128) {
+        throw new Error("ipaddr: invalid IPv6 prefix length");
+      }
+      const octets = [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0];
+      let j = 0;
+      const filledOctetCount = Math.floor(prefix / 8);
+      while (j < filledOctetCount) {
+        octets[j] = 255;
+        j++;
+      }
+      if (filledOctetCount < 16) {
+        octets[filledOctetCount] = Math.pow(2, prefix % 8) - 1 << 8 - prefix % 8;
+      }
+      return new this(octets);
+    };
+    ipaddr.fromByteArray = function(bytes) {
+      const length = bytes.length;
+      if (length === 4) {
+        return new ipaddr.IPv4(bytes);
+      } else if (length === 16) {
+        return new ipaddr.IPv6(bytes);
+      } else {
+        throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address");
+      }
+    };
+    ipaddr.isValid = function(string) {
+      return ipaddr.IPv6.isValid(string) || ipaddr.IPv4.isValid(string);
+    };
+    ipaddr.isValidCIDR = function(string) {
+      return ipaddr.IPv6.isValidCIDR(string) || ipaddr.IPv4.isValidCIDR(string);
+    };
+    ipaddr.parse = function(string) {
+      if (ipaddr.IPv6.isValid(string)) {
+        return ipaddr.IPv6.parse(string);
+      } else if (ipaddr.IPv4.isValid(string)) {
+        return ipaddr.IPv4.parse(string);
+      } else {
+        throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format");
+      }
+    };
+    ipaddr.parseCIDR = function(string) {
+      try {
+        return ipaddr.IPv6.parseCIDR(string);
+      } catch (e) {
+        try {
+          return ipaddr.IPv4.parseCIDR(string);
+        } catch (e2) {
+          throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format");
+        }
+      }
+    };
+    ipaddr.process = function(string) {
+      const addr = this.parse(string);
+      if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+        return addr.toIPv4Address();
+      } else {
+        return addr;
+      }
+    };
+    ipaddr.subnetMatch = function(address, rangeList, defaultName) {
+      let i2, rangeName, rangeSubnets, subnet;
+      if (defaultName === undefined || defaultName === null) {
+        defaultName = "unicast";
+      }
+      for (rangeName in rangeList) {
+        if (Object.prototype.hasOwnProperty.call(rangeList, rangeName)) {
+          rangeSubnets = rangeList[rangeName];
+          if (rangeSubnets[0] && !(rangeSubnets[0] instanceof Array)) {
+            rangeSubnets = [rangeSubnets];
+          }
+          for (i2 = 0;i2 < rangeSubnets.length; i2++) {
+            subnet = rangeSubnets[i2];
+            if (address.kind() === subnet[0].kind() && address.match.apply(address, subnet)) {
+              return rangeName;
+            }
+          }
+        }
+      }
+      return defaultName;
+    };
+    if (typeof module !== "undefined" && module.exports) {
+      module.exports = ipaddr;
+    } else {
+      root.ipaddr = ipaddr;
+    }
+  })(exports);
+});
+
+// ../security/src/hostnames.ts
+function unwrapIpv6Brackets(host) {
+  return host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
+}
+var LOOPBACK_HOSTNAMES;
+var init_hostnames = __esm(() => {
+  LOOPBACK_HOSTNAMES = new Set(["localhost", "127.0.0.1", "::1"]);
+});
+
+// ../security/src/egress.ts
+function splitEntries(value) {
+  if (value === undefined)
+    return [];
+  const parts = typeof value === "string" ? value.split(",") : value;
+  return parts.map((entry) => entry.trim()).filter((entry) => entry.length > 0);
+}
+function normalizeHost(host) {
+  return unwrapIpv6Brackets(host.toLowerCase()).replace(/\.$/, "");
+}
+function parseHostPattern(entry, sourceName) {
+  const value = normalizeHost(entry);
+  const wildcard = value.startsWith("*.");
+  const host = wildcard ? value.slice(2) : value;
+  if (host.includes("*")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a wildcard is only supported as a leading "*." label`);
+  }
+  if (host.includes("/") || /\s/.test(host)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": expected a hostname, not a URL or CIDR`);
+  }
+  if (host.includes(",") || host.includes(":")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a hostname has no port, comma, or colon`);
+  }
+  if (host.length === 0 || host.split(".").some((label) => label.length === 0)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": every label must be non-empty`);
+  }
+  if (/[^\x21-\x7e]/.test(host)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": use the punycode form of an internationalized name`);
+  }
+  if (wildcard && !host.includes(".")) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}": a wildcard must cover at least two labels, e.g. "*.example.com"`);
+  }
+  return wildcard ? { value: `.${host}`, wildcard: true } : { value: host, wildcard: false };
+}
+function parseCidrRange(entry, sourceName) {
+  if (entry.includes("/")) {
+    if (!ipaddr.isValidCIDR(entry)) {
+      throw new Error(`Invalid ${sourceName} entry "${entry}"`);
+    }
+    const [address2, prefixLength] = ipaddr.parseCIDR(entry);
+    if (prefixLength < 8) {
+      throw new Error(`Invalid ${sourceName} entry "${entry}": catch-all networks are unsafe`);
+    }
+    return { address: address2, prefixLength };
+  }
+  const value = unwrapIpv6Brackets(entry);
+  if (!ipaddr.isValid(value)) {
+    throw new Error(`Invalid ${sourceName} entry "${entry}"`);
+  }
+  const address = ipaddr.parse(value);
+  return { address, prefixLength: address.kind() === "ipv4" ? 32 : 128 };
+}
+function createEgressPolicy(spec = {}) {
+  const sourceNames = spec.sourceNames ?? DEFAULT_SOURCE_NAMES;
+  return {
+    insecureHttp: spec.insecureHttp ?? "never",
+    allowLoopback: spec.allowLoopback ?? false,
+    allowPrivate: spec.allowPrivate ?? false,
+    allowedHosts: splitEntries(spec.allowedHosts).map((entry) => parseHostPattern(entry, sourceNames.hosts)),
+    allowedRanges: splitEntries(spec.allowedRanges).map((entry) => parseCidrRange(entry, sourceNames.ranges))
+  };
+}
+function embeddedIpv4(parts) {
+  return ipaddr.fromByteArray([
+    parts[6] >> 8 & 255,
+    parts[6] & 255,
+    parts[7] >> 8 & 255,
+    parts[7] & 255
+  ]).toString();
+}
+function transitionIpv4(parts) {
+  if (parts[0] === 8194) {
+    return ipaddr.fromByteArray([
+      parts[1] >> 8 & 255,
+      parts[1] & 255,
+      parts[2] >> 8 & 255,
+      parts[2] & 255
+    ]).toString();
+  }
+  if (isTeredo(parts))
+    return null;
+  if (parts[4] === 0 && parts[5] === 24318)
+    return embeddedIpv4(parts);
+  if (parts[4] === 512 && parts[5] === 24318)
+    return embeddedIpv4(parts);
+  return null;
+}
+function isTeredo(parts) {
+  return parts[0] === 8193 && parts[1] === 0;
+}
+function canonicalAddress(address) {
+  const clean = unwrapIpv6Brackets(address).split("%")[0];
+  if (!ipaddr.isValid(clean))
+    return null;
+  const parsed = ipaddr.process(clean);
+  if (parsed.kind() === "ipv6") {
+    const parts = parsed.parts;
+    if (IPV4_EMBEDDING_PREFIXES.some((prefix) => prefix.every((part, index) => parts[index] === part))) {
+      return embeddedIpv4(parts);
+    }
+    const embedded = (parts[6] << 16 >>> 0) + parts[7];
+    if (parts.slice(0, 6).every((part) => part === 0) && embedded > 1) {
+      return embeddedIpv4(parts);
+    }
+    const transition = transitionIpv4(parts);
+    if (transition !== null)
+      return transition;
+  }
+  return parsed.toString();
+}
+var ipaddr, METADATA_ADDRESSES, DENIED_PORTS, DEFAULT_SOURCE_NAMES, STRICT_EGRESS_POLICY, IPV4_EMBEDDING_PREFIXES, CANONICAL_METADATA_ADDRESSES;
+var init_egress = __esm(() => {
+  init_hostnames();
+  ipaddr = __toESM(require_ipaddr(), 1);
+  METADATA_ADDRESSES = [
+    "169.254.169.254",
+    "169.254.170.2",
+    "100.100.100.200",
+    "192.0.0.192",
+    "168.63.129.16",
+    "fd00:ec2::254"
+  ];
+  DENIED_PORTS = new Set([
+    22,
+    23,
+    25,
+    3306,
+    5432,
+    6379,
+    27017,
+    9200
+  ]);
+  DEFAULT_SOURCE_NAMES = { hosts: "allowedHosts", ranges: "allowedRanges" };
+  STRICT_EGRESS_POLICY = createEgressPolicy();
+  IPV4_EMBEDDING_PREFIXES = [
+    [100, 65435, 0, 0, 0, 0],
+    [0, 0, 0, 0, 65535, 0]
+  ];
+  CANONICAL_METADATA_ADDRESSES = new Set(METADATA_ADDRESSES.map((address) => canonicalAddress(address) ?? address));
+});
+
 // ../security/src/hash.ts
 import { createHash } from "node:crypto";
 function sha256Base64Url(input) {
@@ -36095,6 +37012,18 @@ function collectSecrets(existing) {
   }
   return secrets;
 }
+function validateEgressEntries(spec) {
+  try {
+    createEgressPolicy({
+      allowedHosts: spec.allowedHosts?.trim() || undefined,
+      allowedRanges: spec.allowedRanges?.trim() || undefined,
+      sourceNames: { hosts: "EGRESS_ALLOWED_HOSTS", ranges: "EGRESS_ALLOWED_IP_RANGES" }
+    });
+    return;
+  } catch (error) {
+    return getErrorMessage(error, "invalid entry");
+  }
+}
 async function promptCopilotKey(existing) {
   if (existing) {
     const keep = await confirm2({
@@ -36214,12 +37143,28 @@ async function promptSecurity(vars) {
     sim.DISABLE_AUTH = "true";
     mirrorToRealtime.DISABLE_AUTH = "true";
   }
-  const privateHosts = await confirm2({
-    message: "Allow DB/connector tools to reach private hosts? (Docker/K8s service names, localhost — loosens the SSRF guard)",
-    initialValue: isTruthy(vars.get("ALLOW_PRIVATE_DATABASE_HOSTS"))
+  const existingEgressHosts = vars.get("EGRESS_ALLOWED_HOSTS");
+  const egressHosts = await text2({
+    message: "Hosts on your private network that workflows may reach? (comma-separated, blank for none — widens the SSRF guard)",
+    placeholder: "host.docker.internal,*.svc.cluster.local",
+    initialValue: existingEgressHosts ?? "",
+    defaultValue: "",
+    validate: (value) => validateEgressEntries({ allowedHosts: value })
+  });
+  if (typeof egressHosts === "string" && egressHosts.trim()) {
+    sim.EGRESS_ALLOWED_HOSTS = egressHosts.trim();
+  }
+  const existingEgressRanges = vars.get("EGRESS_ALLOWED_IP_RANGES");
+  const egressRanges = await text2({
+    message: "Address ranges on your private network that workflows may reach? (CIDRs, comma-separated)",
+    placeholder: "10.0.0.0/8,192.168.65.254/32",
+    initialValue: existingEgressRanges ?? "",
+    defaultValue: "",
+    validate: (value) => validateEgressEntries({ allowedRanges: value })
   });
-  if (privateHosts)
-    sim.ALLOW_PRIVATE_DATABASE_HOSTS = "true";
+  if (typeof egressRanges === "string" && egressRanges.trim()) {
+    sim.EGRESS_ALLOWED_IP_RANGES = egressRanges.trim();
+  }
   const existingAdminKey = vars.get("ADMIN_API_KEY");
   if (!existingAdminKey || isPlaceholder(existingAdminKey)) {
     const wantsAdmin = await confirm2({
@@ -36264,6 +37209,7 @@ async function promptUnlocks(vars) {
 }
 var DEFAULT_CLI_AUTH_ORIGIN = "https://www.sim.ai", PROVIDER_CONSOLES;
 var init_steps = __esm(() => {
+  init_egress();
   init_capability_config();
   init_capability_setup();
   init_cli_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sim-setup",
-  "version": "1.0.6-preview.65.1",
+  "version": "1.0.6-preview.67.1",
   "description": "Set up and manage a self-hosted Sim installation",
   "type": "module",
   "bin": {