Lines 7-47javascript
7 * Method bodies delegate to namespace classes (PromptBuilder, CompositionEngine,
8 * Navigator, LockManager) and viz/ functions. The old API surface is preserved
9 * as one-line delegates for backwards compatibility.
11 * 1:1 parity with Python dna.v3.kernel.instance.
13import { readSpecString, readSpecStringArray } from "./spec-access.js";
14import { ScannerPipeline } from "./safety-scanner.js";
15import { profileForOrchestrator } from "./composition-resolver.js";
16import { PromptBuilder } from "./prompt-builder.js";
17import { CompositionEngine } from "./composition-resolver.js";
18import { Navigator } from "./navigator.js";
19import { LockManager } from "./lock-manager.js";
20import { ReportBuilder } from "./reports.js";
21// Viz imports — all use `import type { ManifestInstance }` so no circular issue at runtime.
22import { dependencyTreeMermaid as vizDependencyTreeMermaid, compositionFlowchartMermaid as vizCompositionFlowchartMermaid, c4ComponentMermaid as vizC4ComponentMermaid, erDiagramMermaid as vizErDiagramMermaid, erModel as vizErModel, mindmapMermaid as vizMindmapMermaid, pieChartMermaid as vizPieChartMermaid, quadrantMermaid as vizQuadrantMermaid, timelineMermaid as vizTimelineMermaid, sankeyMermaid as vizSankeyMermaid, kindCatalogMermaid as vizKindCatalogMermaid, exportDiagramsMd as vizExportDiagramsMd, } from "../viz/mermaid.js";
23import { healthReport as vizHealthReport, impact as vizImpact } from "../viz/health.js";
24import { matrix as vizMatrix, matrixMarkdown as vizMatrixMarkdown } from "../viz/matrix.js";
25import { asciiTree as vizAsciiTree } from "../viz/ascii.js";
27 * s-kernel-sandbox-hook-exec — whether a Hook's `action: "script"` may run
28 * arbitrary code from `spec.body` via `new Function(...)`. OFF by default: a
29 * Hook doc is reachable via the normal doc-write path, so executing its body is
LowEval
Package source references a known benign dynamic code generation pattern.
dist/kernel/instance.jsView on unpkg · L27 30 * an unauthenticated RCE in the host process. Opt in with
31 * `DNA_ALLOW_HOOK_SCRIPT_EXEC=1` only in trusted single-tenant deployments.
32 * 1:1 with the Python twin (dna.operations._hook_script_exec_allowed).
34function hookScriptExecAllowed() {
35 return (typeof process !== "undefined" &&
36 process.env?.DNA_ALLOW_HOOK_SCRIPT_EXEC === "1");
38// ---------------------------------------------------------------------------
39// Deprecation plumbing (s-blessed-query-surface)
40// ---------------------------------------------------------------------------
41/** Methods that already fired their once-per-process deprecation warning. */
42const _deprecationWarned = new Set();
43/** `console.warn` a deprecation message once per method per process —
44 * mirror of the Python `DeprecationWarning` on the same members. */
45function warnDeprecatedOnce(method, message) {
46 if (_deprecationWarned.has(method))