@letterblack/lbe-sdk 0.4.0

package/dist/engine.js

@@ -0,0 +1,78 @@
+import l from'fs';import t from'path';import{fileURLToPath as f}from'url';
+var D=t.dirname(f(import.meta.url)),w=t.join(D,'../runtime/lbe_engine.wasm');
+var POLICY_MSGS={0:{allowed:true,reason:null,message:'Policy check passed'},1:{allowed:false,reason:'POLICY_NOT_CONFIGURED',message:'No policy configured'},2:{allowed:false,reason:'REQUESTER_NOT_ALLOWED',message:'Requester not in policy'},3:{allowed:false,reason:'COMMAND_NOT_ALLOWED',message:'Command not allowed for requester'},4:{allowed:false,reason:'ADAPTER_NOT_ALLOWED',message:'Adapter not allowed'},5:{allowed:false,reason:'NO_FILESYSTEM_ROOTS_DEFINED',message:'No filesystem roots defined for requester'},6:{allowed:false,reason:'CWD_OUTSIDE_ALLOWED_ROOT',message:'Path not under allowed roots'},7:{allowed:false,reason:'PATH_DENIED_BY_PATTERN',message:'Path matches deny pattern'},8:{allowed:false,reason:'SHELL_CMD_DENIED',message:'Shell command not allowed'}};
+var SCHEMA_MSGS={0:{valid:true,error:null},1:{valid:false,error:'Missing required field: id'},2:{valid:false,error:'Missing required field: commandId'},3:{valid:false,error:'Missing required field: requesterId'},4:{valid:false,error:'Missing required field: sessionId'},5:{valid:false,error:'Missing required field: timestamp'},6:{valid:false,error:'Missing required field: nonce'},7:{valid:false,error:'Missing required field: requires'},8:{valid:false,error:'Missing required field: payload'},9:{valid:false,error:'Missing required field: signature'},10:{valid:false,error:"Field 'id' is invalid"},11:{valid:false,error:"Field 'commandId' is invalid"},12:{valid:false,error:"Field 'requesterId' is invalid"},13:{valid:false,error:"Field 'sessionId' is invalid"},14:{valid:false,error:"Field 'timestamp' is invalid"},15:{valid:false,error:"Field 'nonce' is invalid"},16:{valid:false,error:"Field 'requires' is invalid"},17:{valid:false,error:'payload: missing required field: adapter'},18:{valid:false,error:"payload: field 'adapter' is invalid"},19:{valid:false,error:'signature: missing required field: alg'},20:{valid:false,error:'signature: missing required field: keyId'},21:{valid:false,error:'signature: missing required field: sig'},22:{valid:false,error:"signature: field 'alg' must be ed25519"},23:{valid:false,error:"signature: field 'sig' is invalid"},24:{valid:false,error:"Field 'risk' is invalid"}};
+var KEY_REASONS={1:'KEY_ID_INVALID',2:'KEY_NOT_TRUSTED',3:'KEY_DEPRECATED',4:'KEY_REQUESTER_MISMATCH',5:'KEY_LIFECYCLE_INVALID',6:'KEY_NOT_YET_VALID',7:'KEY_EXPIRED'};
+var PIPELINE_STAGES={0:'schema',1:'timestamp',2:'key',3:'signature',4:'rate_limit',5:'nonce',6:'policy',255:'ok'};
+var RISK_LABELS=['LOW','MEDIUM','HIGH','CRITICAL'];
+var CMD_TYPE={ECHO:0,READ_FILE:1,WRITE_FILE:2,PATCH_FILE:3,DELETE_FILE:4,RUN_SHELL:5};
+var _inst=null;
+function wasm(){if(_inst)return _inst;if(!l.existsSync(w))throw new Error(`LBE engine missing: ${w}`);_inst=new WebAssembly.Instance(new WebAssembly.Module(l.readFileSync(w)),{});return _inst}
+function mem(){return new Uint8Array(wasm().exports.memory.buffer)}
+function inPtr(){return wasm().exports.lbe_in_ptr()}
+function outPtr(){return wasm().exports.lbe_out_ptr()}
+function bufSz(){return wasm().exports.lbe_buf_size()}
+function writeIn(s){let e=new TextEncoder().encode(s),m=mem(),p=inPtr();m.set(e,p);m[p+e.length]=0}
+function readOut(){let m=mem(),p=outPtr(),e=p;while(m[e]!==0&&e-p<bufSz())e++;return new TextDecoder().decode(m.slice(p,e))}
+function writeInBin(a,b){let m=mem(),p=inPtr(),i=p;for(let x=0;x<a.length;x++)m[i++]=a[x];m[i++]=0;for(let x=0;x<b.length;x++)m[i++]=b[x];m[i]=0}
+function writePipeIn(fields){let m=mem(),p=inPtr(),v=new DataView(m.buffer,p);fields.forEach((f,i)=>v.setUint32(i*4,f>>>0,true))}
+function readPipeOut(){let m=mem(),p=outPtr(),v=new DataView(m.buffer,p);return{stage:v.getUint32(0,true),code:v.getUint32(4,true)}}
+export function getRuntimeInfo(){return{mode:'wasm',available:l.existsSync(w),wasmPath:w,localFirst:true}}
+export async function loadWasmEngine(){return{ok:true,mode:'wasm',version:wasm().exports.lbe_engine_version()}}
+export function runValidationPipeline(flags){
+  writePipeIn([
+    flags.hasId?1:0,flags.idValid?1:0,flags.hasCommandId?1:0,flags.commandIdValid?1:0,
+    flags.hasRequesterId?1:0,flags.requesterIdValid?1:0,flags.hasSessionId?1:0,flags.sessionIdValid?1:0,
+    flags.hasTimestamp?1:0,flags.timestampValid?1:0,flags.hasNonce?1:0,flags.nonceValid?1:0,
+    flags.hasRequires?1:0,flags.requiresValid?1:0,flags.hasPayload?1:0,
+    flags.hasPayloadAdapter?1:0,flags.payloadAdapterValid?1:0,flags.hasSignature?1:0,
+    flags.hasSignatureAlg?1:0,flags.signatureAlgValid?1:0,flags.hasSignatureKeyId?1:0,
+    flags.hasSignatureSig?1:0,flags.signatureSigValid?1:0,flags.hasRisk?1:0,flags.riskValid?1:0,
+    flags.cmdTimestamp>>>0,flags.nowSec>>>0,flags.maxClockSkewSec>>>0,
+    flags.keyIdFormatValid?1:0,flags.keyFound?1:0,flags.keyNotDeprecated?1:0,
+    flags.keyRequesterMatches?1:0,flags.keyNotBeforeOk?1:0,flags.keyNotExpired?1:0,
+    flags.keyLifecycleFieldsPresent?1:0,flags.signatureValid?1:0,
+    flags.rateLimitOk?1:0,flags.rateLimitRetryAfterSec>>>0,flags.nonceOk?1:0,
+    flags.policyConfigured?1:0,flags.requesterConfigured?1:0,flags.commandAllowed?1:0,
+    flags.adapterAllowed?1:0,flags.filesystemRequired?1:0,flags.filesystemRootsDefined?1:0,
+    flags.filesystemOk?1:0,flags.pathDenied?1:0,flags.shellRequired?1:0,flags.shellCommandOk?1:0,
+  ]);
+  wasm().exports.lbe_validate_pipeline();
+  let{stage,code}=readPipeOut(),ok=stage===255;
+  return{ok,stage,stageLabel:PIPELINE_STAGES[stage]||'unknown',code,
+    schemaError:stage===0?(SCHEMA_MSGS[code]?.error||'Schema invalid'):null,
+    keyReason:stage===2?(KEY_REASONS[code]||'KEY_ERROR'):null,
+    policyResult:stage===6?{...(POLICY_MSGS[code]||POLICY_MSGS[1]),code}:null,
+    retryAfterSec:stage===4?code:0,skewSec:stage===1?code:0}
+}
+export function checkNonce({ttlSec,nowSec,newKey,existingEntries}){
+  writeIn([`${ttlSec}:${nowSec}`,newKey,...existingEntries].join('\n')+'\n');
+  let isReplay=wasm().exports.lbe_nonce_check()!==0;
+  if(isReplay)return{ok:false,updatedEntriesText:null};
+  let out=readOut();
+  return{ok:true,updatedEntriesText:out.startsWith('OK\n')?out.slice(3):out}
+}
+export function checkRateLimit({windowSec,maxRequests,nowSec,requesterId,existingEntries}){
+  writeIn([`${windowSec}:${maxRequests}:${nowSec}`,requesterId,...existingEntries].join('\n')+'\n');
+  let exceeded=wasm().exports.lbe_rate_check()!==0,out=readOut();
+  if(exceeded){let r=parseInt(out.match(/^EXCEEDED:(\d+)/)?.[1]??'1',10);return{ok:false,retryAfterSec:r,updatedEntriesText:out.replace(/^EXCEEDED:\d+\n/,'')}}
+  return{ok:true,retryAfterSec:0,updatedEntriesText:out.startsWith('OK\n')?out.slice(3):out}
+}
+export function computeAuditHash(prevHash,entryJson){
+  let enc=new TextEncoder();writeInBin(enc.encode(prevHash),enc.encode(entryJson));
+  wasm().exports.lbe_audit_hash();return readOut().slice(0,64)
+}
+export function classifyRisk(commandId,shellCmdIsRm=false){
+  return RISK_LABELS[wasm().exports.lbe_classify_risk(CMD_TYPE[commandId]??0,shellCmdIsRm?1:0)]??'LOW'
+}
+export function shouldRollback({execFailed,postCheckFailed,backupExists,rollbackEnabled}){
+  return wasm().exports.lbe_rollback_decision(execFailed?1:0,postCheckFailed?1:0,backupExists?1:0,rollbackEnabled?1:0)===1
+}
+export function evaluatePolicyDecision(input){
+  let c=wasm().exports.lbe_policy_decision(input.policyConfigured?1:0,input.requesterConfigured?1:0,input.commandAllowed?1:0,input.adapterAllowed?1:0,input.filesystemRequired?1:0,input.filesystemRootsDefined?1:0,input.filesystemOk?1:0,input.pathDenied?1:0,input.shellRequired?1:0,input.shellCommandOk?1:0);
+  return{...(POLICY_MSGS[c]||POLICY_MSGS[1]),code:c}
+}
+export function evaluateSchemaDecision(input){
+  let c=wasm().exports.lbe_schema_decision(input.hasId?1:0,input.idValid?1:0,input.hasCommandId?1:0,input.commandIdValid?1:0,input.hasRequesterId?1:0,input.requesterIdValid?1:0,input.hasSessionId?1:0,input.sessionIdValid?1:0,input.hasTimestamp?1:0,input.timestampValid?1:0,input.hasNonce?1:0,input.nonceValid?1:0,input.hasRequires?1:0,input.requiresValid?1:0,input.hasPayload?1:0,input.hasPayloadAdapter?1:0,input.payloadAdapterValid?1:0,input.hasSignature?1:0,input.hasSignatureAlg?1:0,input.signatureAlgValid?1:0,input.hasSignatureKeyId?1:0,input.hasSignatureSig?1:0,input.signatureSigValid?1:0,input.hasRisk?1:0,input.riskValid?1:0);
+  return{...(SCHEMA_MSGS[c]||SCHEMA_MSGS[10]),code:c}
+}