import { _ as hasNestedRepetition, g as compileSafeRegexDetailed, h as compileSafeRegex, s as redactSensitiveText, v as testRegexWithBoundedInput } from "../redact-CozhggBi.js";
import { i as formatErrorMessage, r as extractErrorCode } from "../errors-Cq_Pdh35.js";
import { a as canonicalPathFromExistingAncestor, b as resolveAbsolutePathForWrite, i as assertAbsolutePathInput, o as ensureAbsoluteDirectory, s as findExistingAncestor, y as resolveAbsolutePathForRead } from "../fs-safe-CmlZlB6k.js";
import { c as isRecord } from "../utils-FLBGJBzj.js";
import { n as resolvePreferredNodmixTmpDir } from "../tmp-nodmix-dir-C4-0E0hu.js";
import { i as replaceFileAtomicSync, r as replaceFileAtomic, t as movePathWithCopyFallback } from "../replace-file-DlzIPzco.js";
import { n as isPathInside, t as isNotFoundPathError } from "../path-guards-DYDM1EyF.js";
import { n as privateFileStoreSync, t as privateFileStore } from "../private-file-store-CkExsGri.js";
import { a as parseEnvValue, c as writeJsonFileSecure, i as parseDotPath, l as writeTextFileAtomic, n as isNonEmptyString, o as readTextFileIfExists, r as normalizePositiveInt, s as toDotPath, t as ensureDirForFile } from "../shared-6wL17I4Y.js";
import { a as isChannelAccountEffectivelyEnabled, c as pushInactiveSurfaceWarning, i as hasOwnProperty, l as pushWarning, n as collectSecretInputAssignment, o as isEnabledFlag, r as createResolverContext, s as pushAssignment, t as applyResolvedAssignments } from "../runtime-shared-21CeYSM0.js";
import { i as sanitizeUntrustedFileName, n as assertNoSymlinkParentsSync, o as writeViaSiblingTempPath, t as assertNoSymlinkParents } from "../fs-safe-advanced-d2XEMzjt.js";
import { t as safeEqualSecret } from "../secret-equal-DDhtiQsP.js";
import { r as ensurePortAvailable } from "../ports-J-OFxyiQ.js";
import { i as hasProxyEnvConfigured } from "../proxy-env-C1JTLMaY.js";
import { t as normalizeHostname } from "../hostname-BH0Sas5a.js";
import { _ as resolvePinnedHostnameWithPolicy, c as isBlockedHostnameOrIp, d as isPrivateNetworkAllowedByPolicy, p as matchesHostnameAllowlist, t as SsrFBlockedError } from "../ssrf-DHSaCLE-.js";
import { a as parseAccessGroupAllowFromEntry, t as ACCESS_GROUP_ALLOW_FROM_PREFIX } from "../allow-from-nO6JWkgv.js";
import { a as resolveDmGroupAccessWithCommandGate, c as resolveOpenDmAllowlistAccess, i as resolveDmGroupAccessDecision, l as resolvePinnedMainDmOwnerFromAllowlist, n as readStoreAllowFromForDmPolicy, o as resolveDmGroupAccessWithLists, r as resolveDmAllowState, s as resolveEffectiveAllowFromLists, t as DM_GROUP_ACCESS_REASON } from "../dm-policy-shared-DfWcWVlK.js";
import { t as writeSiblingTempFile } from "../sibling-temp-file-ByfkeKYe.js";
import { i as generateSecureToken } from "../secure-random-BxnbXS5x.js";
import { a as getChannelSurface, c as normalizeSecretStringValue, i as getChannelRecord, l as resolveChannelAccountSurface, n as collectNestedChannelFieldAssignments, o as hasConfiguredSecretInputValue, r as collectSimpleChannelFieldAssignments, s as isBaseFieldActiveForChannelSurface, t as collectConditionalChannelFieldAssignments } from "../channel-secret-basic-runtime-BzD9Y9Jl.js";
import { t as collectNestedChannelTtsAssignments } from "../channel-secret-tts-runtime-Ccn5usld.js";
import { a as wrapWebContent, c as resolveHookExternalContentSource, i as wrapExternalContent, n as detectSuspiciousPatterns, o as isExternalHookSession, r as getHookType, s as mapHookExternalContentSource, t as buildSafeExternalPrompt } from "../external-content-DjKXXY5B.js";
import { C as resolveStrictExistingPathsWithinRoot, S as resolvePathsWithinRoot, T as buildUntrustedChannelMetadata, _ as writeExternalFileWithinRoot, a as openFileWithinRoot, b as resolveExistingPathsWithinRoot, c as pathExistsSync, d as resolveLocalPathFromRootsSync, f as resolveRegularFileAppendFlags, g as withTimeout, h as statRegularFileSync, i as appendRegularFileSync, l as readRegularFile, m as statRegularFile, n as SafeOpenError, o as openLocalFileSafely, p as root, r as appendRegularFile, s as pathExists, t as FsSafeError, u as readRegularFileSync, v as writeFileFromPathWithinRoot, w as resolveWritablePathWithinRoot, x as resolvePathWithinRoot, y as pathScope } from "../security-runtime-B3p68eQB.js";
import { n as filterSupplementalContextItems, r as shouldIncludeSupplementalContext, t as evaluateSupplementalContextVisibility } from "../context-visibility-C9pX_aod.js";
import { n as resolveAccessGroupAllowFromMatches, r as resolveAccessGroupAllowFromState, t as expandAllowFromWithAccessGroups } from "../access-groups-CiAST67J.js";
export { ACCESS_GROUP_ALLOW_FROM_PREFIX, DM_GROUP_ACCESS_REASON, FsSafeError, SafeOpenError, SsrFBlockedError, appendRegularFile, appendRegularFileSync, applyResolvedAssignments, assertAbsolutePathInput, assertNoSymlinkParents, assertNoSymlinkParentsSync, buildSafeExternalPrompt, buildUntrustedChannelMetadata, canonicalPathFromExistingAncestor, collectConditionalChannelFieldAssignments, collectNestedChannelFieldAssignments, collectNestedChannelTtsAssignments, collectSecretInputAssignment, collectSimpleChannelFieldAssignments, compileSafeRegex, compileSafeRegexDetailed, createResolverContext, detectSuspiciousPatterns, ensureAbsoluteDirectory, ensureDirForFile, ensurePortAvailable, evaluateSupplementalContextVisibility, expandAllowFromWithAccessGroups, extractErrorCode, filterSupplementalContextItems, findExistingAncestor, formatErrorMessage, generateSecureToken, getChannelRecord, getChannelSurface, getHookType, hasConfiguredSecretInputValue, hasNestedRepetition, hasOwnProperty, hasProxyEnvConfigured, isBaseFieldActiveForChannelSurface, isBlockedHostnameOrIp, isChannelAccountEffectivelyEnabled, isEnabledFlag, isExternalHookSession, isNonEmptyString, isNotFoundPathError, isPathInside, isPrivateNetworkAllowedByPolicy, isRecord, mapHookExternalContentSource, matchesHostnameAllowlist, movePathWithCopyFallback, normalizeHostname, normalizePositiveInt, normalizeSecretStringValue, openFileWithinRoot, openLocalFileSafely, parseAccessGroupAllowFromEntry, parseDotPath, parseEnvValue, pathExists, pathExistsSync, pathScope, privateFileStore, privateFileStoreSync, pushAssignment, pushInactiveSurfaceWarning, pushWarning, readRegularFile, readRegularFileSync, readStoreAllowFromForDmPolicy, readTextFileIfExists, redactSensitiveText, replaceFileAtomic, replaceFileAtomicSync, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, resolveAccessGroupAllowFromMatches, resolveAccessGroupAllowFromState, resolveChannelAccountSurface, resolveDmAllowState, resolveDmGroupAccessDecision, resolveDmGroupAccessWithCommandGate, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveExistingPathsWithinRoot, resolveHookExternalContentSource, resolveLocalPathFromRootsSync, resolveOpenDmAllowlistAccess, resolvePathWithinRoot, resolvePathsWithinRoot, resolvePinnedHostnameWithPolicy, resolvePinnedMainDmOwnerFromAllowlist, resolvePreferredNodmixTmpDir, resolveRegularFileAppendFlags, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, root, safeEqualSecret, sanitizeUntrustedFileName, shouldIncludeSupplementalContext, statRegularFile, statRegularFileSync, testRegexWithBoundedInput, toDotPath, withTimeout, wrapExternalContent, wrapWebContent, writeExternalFileWithinRoot, writeFileFromPathWithinRoot, writeJsonFileSecure, writeSiblingTempFile, writeTextFileAtomic, writeViaSiblingTempPath };
