@secure-exec/core 0.0.0-split-runtime-preview.7b0dded

package/dist/request-payloads.d.ts

@@ -0,0 +1,139 @@
+import { type LiveMountDescriptor, type LiveProjectedModuleDescriptor, type LiveSidecarPlacement, type LiveSoftwareDescriptor } from "./descriptors.js";
+import { type LiveExtEnvelope } from "./ext.js";
+import { type LiveRootFilesystemDescriptor, type LiveRootFilesystemEntry, type LiveRootFilesystemEntryEncoding } from "./filesystem.js";
+import type * as protocol from "./generated-protocol.js";
+import { type LivePermissionsPolicy } from "./permissions.js";
+import { type LiveDisposeReason, type LiveGuestFilesystemOperation, type LiveGuestRuntimeKind, type LiveRootFilesystemMode, type LiveWasmPermissionTier } from "./protocol-maps.js";
+export interface LiveRegisteredHostCallbackExample {
+    description: string;
+    input: unknown;
+}
+export interface LiveRegisteredHostCallbackDefinition {
+    description: string;
+    input_schema: unknown;
+    timeout_ms?: number;
+    examples?: LiveRegisteredHostCallbackExample[];
+}
+export type LiveRequestPayload = {
+    type: "authenticate";
+    client_name: string;
+    auth_token: string;
+    protocol_version: number;
+    bridge_version: number;
+} | {
+    type: "open_session";
+    placement: LiveSidecarPlacement;
+    metadata: Record<string, string>;
+} | {
+    type: "create_vm";
+    runtime: LiveGuestRuntimeKind;
+    metadata: Record<string, string>;
+    root_filesystem: LiveRootFilesystemDescriptor;
+    permissions?: LivePermissionsPolicy;
+} | {
+    type: "configure_vm";
+    mounts: LiveMountDescriptor[];
+    software: LiveSoftwareDescriptor[];
+    permissions?: LivePermissionsPolicy;
+    module_access_cwd?: string;
+    instructions: string[];
+    projected_modules: LiveProjectedModuleDescriptor[];
+    command_permissions: Record<string, LiveWasmPermissionTier>;
+    allowed_node_builtins?: string[];
+    loopback_exempt_ports?: number[];
+} | {
+    type: "register_host_callbacks";
+    name: string;
+    description: string;
+    command_aliases?: string[];
+    registry_command_aliases?: string[];
+    callbacks: Record<string, LiveRegisteredHostCallbackDefinition>;
+} | {
+    type: "dispose_vm";
+    reason: LiveDisposeReason;
+} | {
+    type: "bootstrap_root_filesystem";
+    entries: LiveRootFilesystemEntry[];
+} | {
+    type: "create_layer";
+} | {
+    type: "seal_layer";
+    layer_id: string;
+} | {
+    type: "import_snapshot";
+    entries: LiveRootFilesystemEntry[];
+} | {
+    type: "export_snapshot";
+    layer_id: string;
+} | {
+    type: "create_overlay";
+    mode?: LiveRootFilesystemMode;
+    upper_layer_id?: string;
+    lower_layer_ids: string[];
+} | {
+    type: "snapshot_root_filesystem";
+} | {
+    type: "guest_filesystem_call";
+    operation: LiveGuestFilesystemOperation;
+    path: string;
+    destination_path?: string;
+    target?: string;
+    content?: string;
+    encoding?: LiveRootFilesystemEntryEncoding;
+    recursive?: boolean;
+    mode?: number;
+    uid?: number;
+    gid?: number;
+    atime_ms?: number;
+    mtime_ms?: number;
+    len?: number;
+    offset?: number;
+} | {
+    type: "execute";
+    process_id: string;
+    command?: string;
+    runtime?: LiveGuestRuntimeKind;
+    entrypoint?: string;
+    args: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+    wasm_permission_tier?: LiveWasmPermissionTier;
+} | {
+    type: "write_stdin";
+    process_id: string;
+    chunk: Uint8Array;
+} | {
+    type: "close_stdin";
+    process_id: string;
+} | {
+    type: "kill_process";
+    process_id: string;
+    signal: string;
+} | {
+    type: "get_process_snapshot";
+} | {
+    type: "find_listener";
+    host?: string;
+    port?: number;
+    path?: string;
+} | {
+    type: "find_bound_udp";
+    host?: string;
+    port?: number;
+} | {
+    type: "vm_fetch";
+    port: number;
+    method: string;
+    path: string;
+    headers_json: string;
+    body?: string;
+} | {
+    type: "get_signal_state";
+    process_id: string;
+} | {
+    type: "get_zombie_timer_count";
+} | {
+    type: "ext";
+    envelope: LiveExtEnvelope;
+};
+export declare function toGeneratedRequestPayload(payload: LiveRequestPayload): protocol.RequestPayload;

package/dist/request-payloads.js

@@ -0,0 +1,213 @@
+import { toExactArrayBuffer } from "./bytes.js";
+import { toGeneratedMountDescriptor, toGeneratedProjectedModuleDescriptor, toGeneratedSidecarPlacement, toGeneratedSoftwareDescriptor, } from "./descriptors.js";
+import { toGeneratedExtEnvelope } from "./ext.js";
+import { toGeneratedRootFilesystemDescriptor, toGeneratedRootFilesystemEntry, } from "./filesystem.js";
+import { stringifyJsonUtf8 } from "./json.js";
+import { toGeneratedPermissionsPolicy, } from "./permissions.js";
+import { toGeneratedDisposeReason, toGeneratedGuestFilesystemOperation, toGeneratedGuestRuntimeKind, toGeneratedRootFilesystemEntryEncoding, toGeneratedRootFilesystemMode, toGeneratedWasmPermissionTier, } from "./protocol-maps.js";
+export function toGeneratedRequestPayload(payload) {
+    switch (payload.type) {
+        case "authenticate":
+            return {
+                tag: "AuthenticateRequest",
+                val: {
+                    clientName: payload.client_name,
+                    authToken: payload.auth_token,
+                    protocolVersion: payload.protocol_version,
+                    bridgeVersion: payload.bridge_version,
+                },
+            };
+        case "open_session":
+            return {
+                tag: "OpenSessionRequest",
+                val: {
+                    placement: toGeneratedSidecarPlacement(payload.placement),
+                    metadata: new Map(Object.entries(payload.metadata ?? {})),
+                },
+            };
+        case "create_vm":
+            return {
+                tag: "CreateVmRequest",
+                val: {
+                    runtime: toGeneratedGuestRuntimeKind(payload.runtime),
+                    metadata: new Map(Object.entries(payload.metadata ?? {})),
+                    rootFilesystem: toGeneratedRootFilesystemDescriptor(payload.root_filesystem),
+                    permissions: toGeneratedPermissionsPolicy(payload.permissions),
+                },
+            };
+        case "dispose_vm":
+            return {
+                tag: "DisposeVmRequest",
+                val: { reason: toGeneratedDisposeReason(payload.reason) },
+            };
+        case "bootstrap_root_filesystem":
+            return {
+                tag: "BootstrapRootFilesystemRequest",
+                val: { entries: payload.entries.map(toGeneratedRootFilesystemEntry) },
+            };
+        case "configure_vm":
+            return {
+                tag: "ConfigureVmRequest",
+                val: {
+                    mounts: (payload.mounts ?? []).map(toGeneratedMountDescriptor),
+                    software: (payload.software ?? []).map(toGeneratedSoftwareDescriptor),
+                    permissions: toGeneratedPermissionsPolicy(payload.permissions),
+                    moduleAccessCwd: payload.module_access_cwd ?? null,
+                    instructions: payload.instructions ?? [],
+                    projectedModules: (payload.projected_modules ?? []).map(toGeneratedProjectedModuleDescriptor),
+                    commandPermissions: new Map(Object.entries(payload.command_permissions ?? {}).map(([name, tier]) => [name, toGeneratedWasmPermissionTier(tier)])),
+                    allowedNodeBuiltins: payload.allowed_node_builtins ?? [],
+                    loopbackExemptPorts: new Uint16Array(payload.loopback_exempt_ports ?? []),
+                },
+            };
+        case "register_host_callbacks":
+            return {
+                tag: "RegisterHostCallbacksRequest",
+                val: {
+                    name: payload.name,
+                    description: payload.description,
+                    commandAliases: payload.command_aliases ?? [],
+                    registryCommandAliases: payload.registry_command_aliases ?? [],
+                    callbacks: new Map(Object.entries(payload.callbacks).map(([name, callback]) => [
+                        name,
+                        {
+                            description: callback.description,
+                            inputSchema: stringifyJsonUtf8(callback.input_schema, "register_host_callbacks.callback.input_schema"),
+                            timeoutMs: callback.timeout_ms === undefined
+                                ? null
+                                : BigInt(callback.timeout_ms),
+                            examples: (callback.examples ?? []).map((example) => ({
+                                description: example.description,
+                                input: stringifyJsonUtf8(example.input, "register_host_callbacks.callback.example.input"),
+                            })),
+                        },
+                    ])),
+                },
+            };
+        case "create_layer":
+            return { tag: "CreateLayerRequest", val: null };
+        case "seal_layer":
+            return { tag: "SealLayerRequest", val: { layerId: payload.layer_id } };
+        case "import_snapshot":
+            return {
+                tag: "ImportSnapshotRequest",
+                val: { entries: payload.entries.map(toGeneratedRootFilesystemEntry) },
+            };
+        case "export_snapshot":
+            return {
+                tag: "ExportSnapshotRequest",
+                val: { layerId: payload.layer_id },
+            };
+        case "create_overlay":
+            return {
+                tag: "CreateOverlayRequest",
+                val: {
+                    mode: toGeneratedRootFilesystemMode(payload.mode ?? "ephemeral"),
+                    upperLayerId: payload.upper_layer_id ?? null,
+                    lowerLayerIds: payload.lower_layer_ids ?? [],
+                },
+            };
+        case "guest_filesystem_call":
+            return {
+                tag: "GuestFilesystemCallRequest",
+                val: {
+                    operation: toGeneratedGuestFilesystemOperation(payload.operation),
+                    path: payload.path,
+                    destinationPath: payload.destination_path ?? null,
+                    target: payload.target ?? null,
+                    content: payload.content ?? null,
+                    encoding: payload.encoding === undefined
+                        ? null
+                        : toGeneratedRootFilesystemEntryEncoding(payload.encoding),
+                    recursive: payload.recursive ?? false,
+                    mode: payload.mode ?? null,
+                    uid: payload.uid ?? null,
+                    gid: payload.gid ?? null,
+                    atimeMs: toGeneratedOptionalU64(payload.atime_ms),
+                    mtimeMs: toGeneratedOptionalU64(payload.mtime_ms),
+                    len: toGeneratedOptionalU64(payload.len),
+                    offset: toGeneratedOptionalU64(payload.offset),
+                },
+            };
+        case "snapshot_root_filesystem":
+            return { tag: "SnapshotRootFilesystemRequest", val: null };
+        case "execute":
+            return {
+                tag: "ExecuteRequest",
+                val: {
+                    processId: payload.process_id,
+                    command: payload.command ?? null,
+                    runtime: payload.runtime === undefined
+                        ? null
+                        : toGeneratedGuestRuntimeKind(payload.runtime),
+                    entrypoint: payload.entrypoint ?? null,
+                    args: payload.args ?? [],
+                    env: new Map(Object.entries(payload.env ?? {})),
+                    cwd: payload.cwd ?? null,
+                    wasmPermissionTier: payload.wasm_permission_tier === undefined
+                        ? null
+                        : toGeneratedWasmPermissionTier(payload.wasm_permission_tier),
+                },
+            };
+        case "write_stdin":
+            return {
+                tag: "WriteStdinRequest",
+                val: {
+                    processId: payload.process_id,
+                    chunk: toExactArrayBuffer(payload.chunk),
+                },
+            };
+        case "close_stdin":
+            return {
+                tag: "CloseStdinRequest",
+                val: { processId: payload.process_id },
+            };
+        case "kill_process":
+            return {
+                tag: "KillProcessRequest",
+                val: { processId: payload.process_id, signal: payload.signal },
+            };
+        case "get_process_snapshot":
+            return { tag: "GetProcessSnapshotRequest", val: null };
+        case "find_listener":
+            return {
+                tag: "FindListenerRequest",
+                val: {
+                    host: payload.host ?? null,
+                    port: payload.port ?? null,
+                    path: payload.path ?? null,
+                },
+            };
+        case "find_bound_udp":
+            return {
+                tag: "FindBoundUdpRequest",
+                val: { host: payload.host ?? null, port: payload.port ?? null },
+            };
+        case "vm_fetch":
+            return {
+                tag: "VmFetchRequest",
+                val: {
+                    port: payload.port,
+                    method: payload.method,
+                    path: payload.path,
+                    headersJson: payload.headers_json,
+                    body: payload.body ?? null,
+                },
+            };
+        case "get_signal_state":
+            return {
+                tag: "GetSignalStateRequest",
+                val: { processId: payload.process_id },
+            };
+        case "get_zombie_timer_count":
+            return { tag: "GetZombieTimerCountRequest", val: null };
+        case "ext":
+            return {
+                tag: "ExtEnvelope",
+                val: toGeneratedExtEnvelope(payload.envelope),
+            };
+    }
+}
+function toGeneratedOptionalU64(value) {
+    return value === undefined ? null : BigInt(value);
+}

package/dist/response-payloads.d.ts

@@ -0,0 +1,107 @@
+import { type LiveRootFilesystemEntry, type LiveRootFilesystemEntryEncoding } from "./filesystem.js";
+import { type LiveExtEnvelope } from "./ext.js";
+import type * as protocol from "./generated-protocol.js";
+import { type LiveGuestFilesystemOperation, type LiveSignalDispositionAction } from "./protocol-maps.js";
+import { type LiveGuestFilesystemStat, type LiveProcessSnapshotEntry, type LiveSocketStateEntry } from "./state.js";
+export interface LiveSignalHandlerRegistration {
+    action: LiveSignalDispositionAction;
+    mask: number[];
+    flags: number;
+}
+export type LiveResponsePayload = {
+    type: "authenticated";
+    sidecar_id: string;
+    connection_id: string;
+    max_frame_bytes: number;
+} | {
+    type: "session_opened";
+    session_id: string;
+    owner_connection_id: string;
+} | {
+    type: "vm_created";
+    vm_id: string;
+} | {
+    type: "vm_configured";
+    applied_mounts: number;
+    applied_software: number;
+} | {
+    type: "host_callbacks_registered";
+    registration: string;
+    command_count: number;
+} | {
+    type: "layer_created";
+    layer_id: string;
+} | {
+    type: "layer_sealed";
+    layer_id: string;
+} | {
+    type: "snapshot_imported";
+    layer_id: string;
+} | {
+    type: "snapshot_exported";
+    layer_id: string;
+    entries: LiveRootFilesystemEntry[];
+} | {
+    type: "overlay_created";
+    layer_id: string;
+} | {
+    type: "root_filesystem_bootstrapped";
+    entry_count: number;
+} | {
+    type: "guest_filesystem_result";
+    operation: LiveGuestFilesystemOperation;
+    path: string;
+    content?: string;
+    encoding?: LiveRootFilesystemEntryEncoding;
+    entries?: string[];
+    stat?: LiveGuestFilesystemStat;
+    exists?: boolean;
+    target?: string;
+} | {
+    type: "root_filesystem_snapshot";
+    entries: LiveRootFilesystemEntry[];
+} | {
+    type: "vm_disposed";
+    vm_id: string;
+} | {
+    type: "process_started";
+    process_id: string;
+    pid?: number;
+} | {
+    type: "stdin_written";
+    process_id: string;
+    accepted_bytes: number;
+} | {
+    type: "stdin_closed";
+    process_id: string;
+} | {
+    type: "process_killed";
+    process_id: string;
+} | {
+    type: "process_snapshot";
+    processes: LiveProcessSnapshotEntry[];
+} | {
+    type: "listener_snapshot";
+    listener?: LiveSocketStateEntry;
+} | {
+    type: "bound_udp_snapshot";
+    socket?: LiveSocketStateEntry;
+} | {
+    type: "vm_fetch_result";
+    response_json: string;
+} | {
+    type: "signal_state";
+    process_id: string;
+    handlers: Record<string, LiveSignalHandlerRegistration>;
+} | {
+    type: "zombie_timer_count";
+    count: number;
+} | {
+    type: "rejected";
+    code: string;
+    message: string;
+} | {
+    type: "ext_result";
+    envelope: LiveExtEnvelope;
+};
+export declare function fromGeneratedResponsePayload(payload: protocol.ResponsePayload): LiveResponsePayload;

package/dist/response-payloads.js

@@ -0,0 +1,161 @@
+import { fromGeneratedRootFilesystemEntry, } from "./filesystem.js";
+import { fromGeneratedExtEnvelope } from "./ext.js";
+import { bigIntToSafeNumber } from "./numbers.js";
+import { fromGeneratedGuestFilesystemOperation, fromGeneratedRootFilesystemEntryEncoding, fromGeneratedSignalDispositionAction, } from "./protocol-maps.js";
+import { fromGeneratedGuestFilesystemStat, fromGeneratedProcessSnapshotEntry, fromGeneratedSocketStateEntry, } from "./state.js";
+export function fromGeneratedResponsePayload(payload) {
+    switch (payload.tag) {
+        case "AuthenticatedResponse":
+            return {
+                type: "authenticated",
+                sidecar_id: payload.val.sidecarId,
+                connection_id: payload.val.connectionId,
+                max_frame_bytes: payload.val.maxFrameBytes,
+            };
+        case "SessionOpenedResponse":
+            return {
+                type: "session_opened",
+                session_id: payload.val.sessionId,
+                owner_connection_id: payload.val.ownerConnectionId,
+            };
+        case "VmCreatedResponse":
+            return { type: "vm_created", vm_id: payload.val.vmId };
+        case "VmDisposedResponse":
+            return { type: "vm_disposed", vm_id: payload.val.vmId };
+        case "RootFilesystemBootstrappedResponse":
+            return {
+                type: "root_filesystem_bootstrapped",
+                entry_count: payload.val.entryCount,
+            };
+        case "VmConfiguredResponse":
+            return {
+                type: "vm_configured",
+                applied_mounts: payload.val.appliedMounts,
+                applied_software: payload.val.appliedSoftware,
+            };
+        case "HostCallbacksRegisteredResponse":
+            return {
+                type: "host_callbacks_registered",
+                registration: payload.val.registration,
+                command_count: payload.val.commandCount,
+            };
+        case "LayerCreatedResponse":
+            return { type: "layer_created", layer_id: payload.val.layerId };
+        case "LayerSealedResponse":
+            return { type: "layer_sealed", layer_id: payload.val.layerId };
+        case "SnapshotImportedResponse":
+            return { type: "snapshot_imported", layer_id: payload.val.layerId };
+        case "SnapshotExportedResponse":
+            return {
+                type: "snapshot_exported",
+                layer_id: payload.val.layerId,
+                entries: payload.val.entries.map(fromGeneratedRootFilesystemEntry),
+            };
+        case "OverlayCreatedResponse":
+            return { type: "overlay_created", layer_id: payload.val.layerId };
+        case "GuestFilesystemResultResponse":
+            return {
+                type: "guest_filesystem_result",
+                operation: fromGeneratedGuestFilesystemOperation(payload.val.operation),
+                path: payload.val.path,
+                ...(payload.val.content !== null
+                    ? { content: payload.val.content }
+                    : {}),
+                ...(payload.val.encoding !== null
+                    ? {
+                        encoding: fromGeneratedRootFilesystemEntryEncoding(payload.val.encoding),
+                    }
+                    : {}),
+                ...(payload.val.entries !== null
+                    ? { entries: [...payload.val.entries] }
+                    : {}),
+                ...(payload.val.stat !== null
+                    ? { stat: fromGeneratedGuestFilesystemStat(payload.val.stat) }
+                    : {}),
+                ...(payload.val.exists !== null ? { exists: payload.val.exists } : {}),
+                ...(payload.val.target !== null ? { target: payload.val.target } : {}),
+            };
+        case "RootFilesystemSnapshotResponse":
+            return {
+                type: "root_filesystem_snapshot",
+                entries: payload.val.entries.map(fromGeneratedRootFilesystemEntry),
+            };
+        case "ProcessStartedResponse":
+            return {
+                type: "process_started",
+                process_id: payload.val.processId,
+                ...(payload.val.pid !== null ? { pid: payload.val.pid } : {}),
+            };
+        case "StdinWrittenResponse":
+            return {
+                type: "stdin_written",
+                process_id: payload.val.processId,
+                accepted_bytes: bigIntToSafeNumber(payload.val.acceptedBytes, "stdin_written.accepted_bytes"),
+            };
+        case "StdinClosedResponse":
+            return { type: "stdin_closed", process_id: payload.val.processId };
+        case "ProcessKilledResponse":
+            return { type: "process_killed", process_id: payload.val.processId };
+        case "ProcessSnapshotResponse":
+            return {
+                type: "process_snapshot",
+                processes: payload.val.processes.map(fromGeneratedProcessSnapshotEntry),
+            };
+        case "ListenerSnapshotResponse":
+            return {
+                type: "listener_snapshot",
+                ...(payload.val.listener !== null
+                    ? { listener: fromGeneratedSocketStateEntry(payload.val.listener) }
+                    : {}),
+            };
+        case "BoundUdpSnapshotResponse":
+            return {
+                type: "bound_udp_snapshot",
+                ...(payload.val.socket !== null
+                    ? { socket: fromGeneratedSocketStateEntry(payload.val.socket) }
+                    : {}),
+            };
+        case "SignalStateResponse":
+            return {
+                type: "signal_state",
+                process_id: payload.val.processId,
+                handlers: Object.fromEntries([...payload.val.handlers].map(([signal, registration]) => [
+                    String(signal),
+                    {
+                        action: fromGeneratedSignalDispositionAction(registration.action),
+                        mask: Array.from(registration.mask),
+                        flags: registration.flags,
+                    },
+                ])),
+            };
+        case "ZombieTimerCountResponse":
+            return {
+                type: "zombie_timer_count",
+                count: bigIntToSafeNumber(payload.val.count, "zombie_timer_count.count"),
+            };
+        case "FilesystemResultResponse":
+            throw new Error("unsupported bare response payload tag: filesystem_result");
+        case "PermissionDecisionResponse":
+            throw new Error("unsupported bare response payload tag: permission_decision");
+        case "PersistenceStateResponse":
+            throw new Error("unsupported bare response payload tag: persistence_state");
+        case "PersistenceFlushedResponse":
+            throw new Error("unsupported bare response payload tag: persistence_flushed");
+        case "RejectedResponse":
+            return {
+                type: "rejected",
+                code: payload.val.code,
+                message: payload.val.message,
+            };
+        case "VmFetchResponse":
+            return {
+                type: "vm_fetch_result",
+                response_json: payload.val.responseJson,
+            };
+        case "ExtEnvelope":
+            return {
+                type: "ext_result",
+                envelope: fromGeneratedExtEnvelope(payload.val),
+            };
+    }
+}