@guilz-dev/belay 0.8.1 → 0.9.0

package/dist/core/contained-execution/docker.d.ts

@@ -0,0 +1,223 @@
+import type { BoundaryAttestation, ContainedExecutionAttestation, ContainedExecutionResourceLimits, DockerSubstrateIdentity } from '../capability/attestation.js';
+import type { BelayContainedExecutionConfig } from '../config.js';
+import { type ProcessOutputPolicy, type ShellRunResult } from '../process-runner.js';
+import { type BuildContainedDockerCreateArgsParams, buildContainedDockerCreateArgs } from './docker-policy.js';
+import { type ContainedExecutionFailureCode, ContainedExecutionFailureError } from './failure.js';
+import { type ContainedExecutionMirrorBackend, type ContainedExecutionMirrorHandle } from './mirror.js';
+export declare class ContainedDockerBoundaryUnavailableError extends ContainedExecutionFailureError {
+    readonly reason: ContainedExecutionFailureCode;
+    readonly receipt: undefined;
+    constructor(reason: ContainedExecutionFailureCode, options?: ErrorOptions);
+}
+export declare class ContainedDockerStartAttemptError extends ContainedExecutionFailureError {
+    constructor(options?: ErrorOptions);
+}
+export declare class ContainedDockerCleanupUnconfirmedError extends ContainedExecutionFailureError {
+    readonly containerName: string;
+    readonly executionStarted: boolean;
+    readonly cleanupConfirmed = false;
+    constructor(containerName: string, executionStarted: boolean, options?: ErrorOptions);
+}
+export interface ContainedDockerInspect {
+    Id: string;
+    Image: string;
+    Config: {
+        User: string;
+        Env: string[] | null;
+        Entrypoint: string[] | string | null;
+        Cmd: string[] | null;
+        WorkingDir: string;
+        Healthcheck: {
+            Test?: string[] | null;
+        } | null;
+    };
+    HostConfig: {
+        AutoRemove: boolean;
+        Privileged: boolean;
+        CapAdd: string[] | null;
+        CapDrop: string[] | null;
+        SecurityOpt: string[] | null;
+        LogConfig: {
+            Type: string;
+            Config: Record<string, string> | null;
+        } | null;
+        Devices: unknown[] | null;
+        DeviceRequests: unknown[] | null;
+        DeviceCgroupRules: string[] | null;
+        GroupAdd: string[] | null;
+        VolumesFrom: string[] | null;
+        Binds: string[] | null;
+        PortBindings: Record<string, unknown> | null;
+        PublishAllPorts: boolean;
+        Links: string[] | null;
+        ExtraHosts: string[] | null;
+        Dns: string[] | null;
+        DnsOptions: string[] | null;
+        DnsSearch: string[] | null;
+        NetworkMode: string;
+        ReadonlyRootfs: boolean;
+        Tmpfs: Record<string, string> | null;
+        Memory: number;
+        MemorySwap: number;
+        ShmSize: number;
+        NanoCpus: number;
+        PidsLimit: number | null;
+        RestartPolicy: {
+            Name: string;
+            MaximumRetryCount: number;
+        };
+        IpcMode: string;
+        PidMode: string;
+        UTSMode: string;
+        UsernsMode: string;
+        CgroupnsMode: string;
+    };
+    NetworkSettings: {
+        Ports: Record<string, unknown> | null;
+    };
+    Mounts: Array<{
+        Type: string;
+        Source: string;
+        Destination: string;
+        RW: boolean;
+    }>;
+}
+export interface ContainedDockerDependencies {
+    resolveSubstrate(params: {
+        executable: string;
+        host: string;
+        repoRoot: string;
+        protectedRoots: readonly string[];
+    }): Promise<DockerSubstrateIdentity>;
+    runProcess(file: string, args: string[], env: Record<string, string>, timeoutMs: number, outputPolicy?: ProcessOutputPolicy): Promise<ShellRunResult>;
+    now(): number;
+    randomUUID(): string;
+    uid(): number;
+    gid(): number;
+}
+export type { BuildContainedDockerCreateArgsParams };
+export { buildContainedDockerCreateArgs };
+export declare function probeContainedDockerBoundary(params: {
+    repoRoot: string;
+    protectedRoots: readonly string[];
+    imageReference: string;
+    dockerExecutable: string;
+    dockerHost: string;
+    hostProbeRoot: string;
+    guestWorkspacePath: string;
+    resourceLimits: ContainedExecutionResourceLimits;
+    dependencies?: ContainedDockerDependencies;
+}): Promise<ContainedExecutionAttestation>;
+export interface ContainedExecutionReceipt {
+    version: 1;
+    inputFingerprint: string;
+    actionFingerprint: string;
+    attestationDigest: string;
+    executionStarted: true;
+    timeoutMs: number;
+    dockerSubstrate: DockerSubstrateIdentity;
+    imageId: string;
+    mirror: {
+        backend: ContainedExecutionMirrorBackend;
+        type: 'bind';
+        cardinality: 1;
+        readWrite: true;
+        sourceFingerprint: string;
+        guestWorkspacePathFingerprint: string;
+        guestCwdFingerprint: string;
+    };
+    logging: {
+        driver: 'none';
+        config: Record<string, never>;
+    };
+    network: {
+        mode: 'none';
+        publishAllPorts: false;
+        portBindings: Record<string, never>;
+        links: [];
+        extraHosts: [];
+        dns: [];
+        dnsOptions: [];
+        dnsSearch: [];
+    };
+    readOnlyRoot: true;
+    tmpfs: {
+        path: '/tmp';
+        sizeBytes: number;
+        mode: 0o1777;
+        exec: false;
+        nosuid: true;
+        nodev: true;
+    };
+    environment: {
+        hostForwarded: false;
+        proxyEnvironment: 'neutralized-empty';
+        neutralizedVariables: readonly string[];
+        imageEnvironmentDigest: string;
+    };
+    privilege: {
+        privileged: false;
+        noNewPrivileges: true;
+        capAdd: [];
+        capDrop: ['ALL'];
+        groupAdd: [];
+    };
+    devices: {
+        devices: [];
+        deviceRequests: [];
+        deviceCgroupRules: [];
+    };
+    storage: {
+        volumesFrom: [];
+        bindsOutsideMirror: [];
+    };
+    namespaces: {
+        ipc: 'none';
+        pid: 'private';
+        uts: 'private';
+        cgroup: 'private';
+        user: 'default';
+    };
+    healthcheckDisabled: true;
+    lifecycle: {
+        autoRemove: false;
+        restart: 'no';
+        maximumRetryCount: 0;
+    };
+    resources: {
+        memoryMiB: number;
+        memorySwapMiB: number;
+        shmSizeMiB: number;
+        cpus: number;
+        nanoCpus: number;
+        pids: number;
+    };
+    user: string;
+    entrypoint: '/bin/sh';
+    exitCode: number | null;
+    timedOut: boolean;
+}
+export interface ContainedDockerExecutionResult extends ShellRunResult {
+    executionStarted: true;
+    receipt: ContainedExecutionReceipt;
+    receiptHash: string;
+}
+export interface ExecuteContainedDockerParams {
+    repoRoot: string;
+    controlPlaneDir: string;
+    protectedRoots: readonly string[];
+    config: BelayContainedExecutionConfig;
+    mirror: ContainedExecutionMirrorHandle;
+    guestCwd: string;
+    command: string;
+    inputFingerprint: string;
+    signedAttestation: unknown;
+    dependencies?: ContainedDockerDependencies;
+}
+export declare function executeContainedDocker(params: ExecuteContainedDockerParams): Promise<ContainedDockerExecutionResult>;
+export declare function probeContainedDockerForSession(params: {
+    repoRoot: string;
+    controlPlaneDir: string;
+    config: BelayContainedExecutionConfig;
+    dependencies?: ContainedDockerDependencies;
+}): Promise<BoundaryAttestation>;