@nekzus/liop 2.4.0-alpha.25 → 2.4.0-alpha.26

package/dist/chunk-R52TZEIL.js

@@ -1,426 +0,0 @@
-import crypto from 'crypto';
-import * as fs from 'fs/promises';
-import * as os from 'os';
-import * as path from 'path';
-import vm from 'vm';
-import { WASI } from 'wasi';
-import * as acorn from 'acorn';
-import { simple } from 'acorn-walk';
-
-// src/sandbox/guardian.ts
-var GuardianError = class extends Error {
-  constructor(message) {
-    super(`AST Sec-Policy Violation: ${message}`);
-    this.name = "GuardianError";
-  }
-};
-var ASTGuardian = {
-  /**
-   * Analyzes the WebAssembly Module interface proactively.
-   *
-   * @param module - The compiled WebAssembly.Module to inspect
-   * @throws {GuardianError} If illegal imports or capabilities are detected
-   */
-  analyze(module) {
-    const imports = WebAssembly.Module.imports(module);
-    let _importCount = 0;
-    const ALLOWED_WASI_FUNCTIONS = /* @__PURE__ */ new Set([
-      "fd_write",
-      "fd_read",
-      "fd_close",
-      "fd_seek",
-      "environ_get",
-      "environ_sizes_get",
-      "args_get",
-      "args_sizes_get",
-      "clock_time_get",
-      "random_get",
-      "proc_exit",
-      "fd_prestat_get",
-      "fd_prestat_dir_name",
-      "fd_fdstat_get"
-    ]);
-    for (const imp of imports) {
-      if (imp.module === "wasi_snapshot_preview1") {
-        if (!ALLOWED_WASI_FUNCTIONS.has(imp.name)) {
-          throw new GuardianError(
-            `Banned WASI Import Detected: ${imp.module}/${imp.name}`
-          );
-        }
-      } else {
-        throw new GuardianError(
-          `Banned Host Import Module Detected: ${imp.module}`
-        );
-      }
-      _importCount++;
-      if (_importCount > 128) {
-        throw new GuardianError(
-          "Import limit exceeded. Possible resource exhaustion attack."
-        );
-      }
-    }
-  }
-};
-var originalEmit = process.emit;
-process.emit = (name, data, ...args) => {
-  if (name === "warning" && typeof data === "object" && data.name === "ExperimentalWarning" && String(data.message).includes("WASI") || String(data.message).includes("importing WASI")) {
-    return false;
-  }
-  return originalEmit.call(process, name, data, ...args);
-};
-function getDefaultEnvironment() {
-  const isWindows = process.platform === "win32";
-  const safeKeys = isWindows ? [
-    "APPDATA",
-    "HOMEDRIVE",
-    "HOMEPATH",
-    "LOCALAPPDATA",
-    "PATH",
-    "PROCESSOR_ARCHITECTURE",
-    "SYSTEMDRIVE",
-    "SYSTEMROOT",
-    "TEMP",
-    "USERNAME",
-    "USERPROFILE",
-    "PROGRAMFILES"
-  ] : ["HOME", "LOGNAME", "PATH", "SHELL", "TERM", "USER"];
-  const env = {
-    NODE_ENV: "production",
-    LIOP_NODE: "true"
-  };
-  for (const key of safeKeys) {
-    const val = process.env[key];
-    if (val !== void 0 && !val.startsWith("()")) {
-      env[key] = val;
-    }
-  }
-  return env;
-}
-function calculateAstInstructionFuel(code) {
-  try {
-    const ast = acorn.parse(code, {
-      ecmaVersion: 2022,
-      sourceType: "script",
-      allowReturnOutsideFunction: true
-    });
-    let score = 100;
-    simple(ast, {
-      Identifier() {
-        score += 1;
-      },
-      Literal() {
-        score += 1;
-      },
-      BinaryExpression() {
-        score += 2;
-      },
-      UnaryExpression() {
-        score += 2;
-      },
-      LogicalExpression() {
-        score += 2;
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: ESTree node
-      VariableDeclaration(node) {
-        score += 5 * (node.declarations?.length || 1);
-      },
-      AssignmentExpression() {
-        score += 3;
-      },
-      MemberExpression() {
-        score += 3;
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: ESTree node
-      ObjectExpression(node) {
-        score += 5 + (node.properties?.length || 0) * 2;
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: ESTree node
-      ArrayExpression(node) {
-        score += 5 + (node.elements?.length || 0) * 2;
-      },
-      // biome-ignore lint/suspicious/noExplicitAny: ESTree node
-      CallExpression(node) {
-        score += 10 + (node.arguments?.length || 0) * 2;
-      },
-      FunctionDeclaration() {
-        score += 20;
-      },
-      FunctionExpression() {
-        score += 15;
-      },
-      ArrowFunctionExpression() {
-        score += 15;
-      },
-      IfStatement() {
-        score += 5;
-      },
-      SwitchStatement() {
-        score += 10;
-      },
-      ForStatement() {
-        score += 50;
-      },
-      ForInStatement() {
-        score += 50;
-      },
-      ForOfStatement() {
-        score += 50;
-      },
-      WhileStatement() {
-        score += 50;
-      },
-      DoWhileStatement() {
-        score += 50;
-      },
-      TryStatement() {
-        score += 15;
-      },
-      ReturnStatement() {
-        score += 2;
-      }
-    });
-    return Math.ceil(score / 100) * 100;
-  } catch (_e) {
-    return 500;
-  }
-}
-var WasiSandbox = class {
-  wasi;
-  sandboxId;
-  workingDir;
-  config;
-  stdoutHandle = null;
-  stderrHandle = null;
-  constructor(config = {}) {
-    this.sandboxId = crypto.randomUUID();
-    this.workingDir = path.join(
-      os.tmpdir(),
-      "liop-mesh",
-      "sandboxes",
-      this.sandboxId
-    );
-    this.config = config;
-  }
-  /**
-   * Initializes the physical sandbox environment with strict directory lockdown.
-   */
-  async init() {
-    try {
-      await fs.mkdir(this.workingDir, { recursive: true });
-      this.stdoutHandle = await fs.open(
-        path.join(this.workingDir, "stdout.log"),
-        "w+"
-      );
-      this.stderrHandle = await fs.open(
-        path.join(this.workingDir, "stderr.log"),
-        "w+"
-      );
-      this.wasi = new WASI({
-        version: "preview1",
-        args: ["liop_runtime"],
-        env: this.config.allowEnv ? { ...getDefaultEnvironment(), RUNTIME_ID: this.sandboxId } : {
-          NODE_ENV: "production",
-          LIOP_NODE: "true",
-          RUNTIME_ID: this.sandboxId
-        },
-        preopens: {
-          "/sandbox": this.workingDir,
-          ...this.config.allowedDirectories
-        },
-        stdout: this.stdoutHandle.fd,
-        stderr: this.stderrHandle.fd
-      });
-    } catch (error) {
-      throw new Error(
-        `Sandbox Initialization Failed: ${error instanceof Error ? error.message : "FS Error"}`
-      );
-    }
-  }
-  /**
-   * Executes logic (WASM or JS-Wrapped) with hard resource limits.
-   */
-  async execute(compiledLogic, records = [], inputs = {}) {
-    const startTime = performance.now();
-    if (compiledLogic instanceof Buffer) {
-      try {
-        const module = await WebAssembly.compile(new Uint8Array(compiledLogic));
-        ASTGuardian.analyze(module);
-        const instance = await WebAssembly.instantiate(
-          module,
-          this.wasi.getImportObject()
-        );
-        this.wasi.start(instance);
-        const stdoutPath = path.join(this.workingDir, "stdout.log");
-        const stderrPath = path.join(this.workingDir, "stderr.log");
-        const stdout = await fs.readFile(stdoutPath, "utf-8");
-        const stderr = await fs.readFile(stderrPath, "utf-8");
-        const duration = performance.now() - startTime;
-        return {
-          output: stdout || (stderr ? `Error: ${stderr}` : "WASM_EXECUTION_SUCCESS"),
-          fuelConsumed: Math.max(
-            100,
-            Math.ceil(Math.floor(duration * 1e3) / 100) * 100
-          )
-        };
-      } catch (error) {
-        throw new Error(
-          `WASM Runtime Error: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    } else {
-      const sandboxEnv = /* @__PURE__ */ Object.create(null);
-      const env = { records, ...inputs };
-      sandboxEnv.require = void 0;
-      sandboxEnv.process = void 0;
-      sandboxEnv.global = void 0;
-      sandboxEnv.globalThis = void 0;
-      sandboxEnv.Buffer = void 0;
-      sandboxEnv.setTimeout = void 0;
-      sandboxEnv.setInterval = void 0;
-      sandboxEnv.setImmediate = void 0;
-      sandboxEnv.queueMicrotask = void 0;
-      sandboxEnv.eval = void 0;
-      sandboxEnv.Function = void 0;
-      sandboxEnv.SharedArrayBuffer = void 0;
-      sandboxEnv.Date = void 0;
-      sandboxEnv.performance = void 0;
-      sandboxEnv.Intl = void 0;
-      sandboxEnv.ArrayBuffer = void 0;
-      sandboxEnv.Uint8Array = void 0;
-      sandboxEnv.Int8Array = void 0;
-      sandboxEnv.Uint16Array = void 0;
-      sandboxEnv.Int16Array = void 0;
-      sandboxEnv.Uint32Array = void 0;
-      sandboxEnv.Int32Array = void 0;
-      sandboxEnv.Float32Array = void 0;
-      sandboxEnv.Float64Array = void 0;
-      sandboxEnv.BigInt64Array = void 0;
-      sandboxEnv.BigUint64Array = void 0;
-      sandboxEnv.DataView = void 0;
-      const toNullPrototype = (obj) => {
-        if (!obj || typeof obj !== "object") {
-          return obj;
-        }
-        if (Array.isArray(obj)) {
-          return obj.map(toNullPrototype);
-        }
-        const clone = /* @__PURE__ */ Object.create(null);
-        for (const [key, val] of Object.entries(obj)) {
-          clone[key] = toNullPrototype(val);
-        }
-        return clone;
-      };
-      sandboxEnv.records = toNullPrototype(JSON.parse(JSON.stringify(records)));
-      sandboxEnv.env = toNullPrototype(JSON.parse(JSON.stringify(env)));
-      for (const [key, value] of Object.entries(inputs)) {
-        sandboxEnv[key] = toNullPrototype(JSON.parse(JSON.stringify(value)));
-      }
-      const deepFreeze = (obj) => {
-        if (obj && typeof obj === "object" && !Object.isFrozen(obj)) {
-          Object.freeze(obj);
-          for (const key of Object.keys(obj)) {
-            deepFreeze(obj[key]);
-          }
-        }
-        return obj;
-      };
-      deepFreeze(sandboxEnv.records);
-      deepFreeze(sandboxEnv.env);
-      for (const key of Object.keys(sandboxEnv)) {
-        Object.defineProperty(sandboxEnv, key, {
-          writable: false,
-          configurable: false
-        });
-      }
-      let processedLogic = String(compiledLogic);
-      if (/^\s*return\s/m.test(processedLogic) || !processedLogic.includes("function liop_main")) {
-        if (!processedLogic.includes("function liop_main")) {
-          processedLogic = `function liop_main(env) {
-${processedLogic}
-}`;
-        }
-      }
-      const scriptCode = `
-				(function() {
-					"use strict";
-					try {
-						// Pre-execution prototype freezing (PCI-DSS Compliance)
-						Object.freeze(Object.prototype);
-						Object.freeze(Array.prototype);
-						Object.freeze(String.prototype);
-						Object.freeze(Number.prototype);
-						Object.freeze(Boolean.prototype);
-						Object.freeze(RegExp.prototype);
-						Object.freeze(Map.prototype);
-						Object.freeze(Set.prototype);
-						Object.freeze(Promise.prototype);
-						Object.freeze(Error.prototype);
-						Object.freeze(Object.getPrototypeOf(function(){}));
-
-						${processedLogic}
-						if (typeof liop_main === 'function') {
-							return liop_main(env);
-						}
-						return "ERR_NO_ENTRY_POINT";
-					} catch(e) {
-						return "LogicError: " + e.message;
-					}
-				})();
-			`;
-      try {
-        const script = new vm.Script(scriptCode, {
-          filename: `liop-sandbox-${this.sandboxId.slice(0, 8)}.js`
-        });
-        if (!process.env.VITEST && typeof Object.prototype === "object" && !Object.isFrozen(Object.prototype)) {
-          Object.freeze(Object.prototype);
-          Object.freeze(Array.prototype);
-          Object.freeze(String.prototype);
-          Object.freeze(Number.prototype);
-          Object.freeze(Boolean.prototype);
-          Object.freeze(RegExp.prototype);
-          Object.freeze(Map.prototype);
-          Object.freeze(Set.prototype);
-          Object.freeze(Promise.prototype);
-          Object.freeze(Error.prototype);
-        }
-        const context = vm.createContext(sandboxEnv, {
-          name: "LIOP Isolate",
-          origin: "liop://sandbox",
-          microtaskMode: "afterEvaluate"
-        });
-        const output = script.runInContext(context, {
-          timeout: 5e3,
-          breakOnSigint: true,
-          displayErrors: true
-        });
-        const logicStr = typeof compiledLogic === "string" ? compiledLogic : compiledLogic.toString("utf-8");
-        const fuelUsed = calculateAstInstructionFuel(logicStr);
-        if (fuelUsed > 1e6) {
-          throw new Error(
-            "LIOP_RESOURCE_EXHAUSTED: Execution fuel limit exceeded."
-          );
-        }
-        return { output, fuelConsumed: fuelUsed };
-      } catch (error) {
-        throw new Error(
-          `V8 Isolate Fault: ${error instanceof Error ? error.message : "Execution Timeout"}`
-        );
-      }
-    }
-  }
-  /**
-   * Physically cleans up the sandbox and releases resources.
-   */
-  async teardown() {
-    try {
-      if (this.stdoutHandle) await this.stdoutHandle.close();
-      if (this.stderrHandle) await this.stderrHandle.close();
-      await fs.rm(this.workingDir, { recursive: true, force: true });
-    } catch (_e) {
-    }
-  }
-};
-
-export { ASTGuardian, WasiSandbox, calculateAstInstructionFuel, getDefaultEnvironment };
-//# sourceMappingURL=chunk-R52TZEIL.js.map
-//# sourceMappingURL=chunk-R52TZEIL.js.map