@secure-exec/core 0.2.1-rc.1 → 0.3.0-rc.1

package/dist/frame-stream.js

@@ -0,0 +1,99 @@
+import { encodeLengthPrefixedPayload, tryDecodeLengthPrefixedPayload, } from "./framing.js";
+export class StdioFrameTransport {
+    stdin;
+    stdout;
+    encodeFrame;
+    decodeFrame;
+    frameListeners = new Set();
+    errorListeners = new Set();
+    endListeners = new Set();
+    stdoutBuffer = Buffer.alloc(0);
+    constructor(options) {
+        this.stdin = options.stdin;
+        this.stdout = options.stdout;
+        this.encodeFrame = options.encodeFrame;
+        this.decodeFrame = options.decodeFrame;
+        this.stdout.on("data", this.handleData);
+        this.stdout.on("end", this.handleEnd);
+        this.stdout.on("error", this.handleError);
+    }
+    onFrame(handler) {
+        this.frameListeners.add(handler);
+        return () => {
+            this.frameListeners.delete(handler);
+        };
+    }
+    onError(handler) {
+        this.errorListeners.add(handler);
+        return () => {
+            this.errorListeners.delete(handler);
+        };
+    }
+    onEnd(handler) {
+        this.endListeners.add(handler);
+        return () => {
+            this.endListeners.delete(handler);
+        };
+    }
+    async writeFrame(frame) {
+        const payload = this.encodeFrame(frame);
+        const encoded = encodeLengthPrefixedPayload(payload);
+        await new Promise((resolve, reject) => {
+            this.stdin.write(encoded, (error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                resolve();
+            });
+        });
+    }
+    dispose() {
+        this.stdout.off("data", this.handleData);
+        this.stdout.off("end", this.handleEnd);
+        this.stdout.off("error", this.handleError);
+        this.frameListeners.clear();
+        this.errorListeners.clear();
+        this.endListeners.clear();
+    }
+    handleData = (chunk) => {
+        const bytes = typeof chunk === "string"
+            ? Buffer.from(chunk)
+            : Buffer.isBuffer(chunk)
+                ? chunk
+                : Buffer.from(chunk);
+        this.stdoutBuffer = Buffer.concat([this.stdoutBuffer, bytes]);
+        this.drainFrames();
+    };
+    handleEnd = () => {
+        for (const listener of this.endListeners) {
+            listener();
+        }
+    };
+    handleError = (error) => {
+        const normalized = error instanceof Error ? error : new Error(String(error));
+        for (const listener of this.errorListeners) {
+            listener(normalized);
+        }
+    };
+    drainFrames() {
+        for (;;) {
+            const decoded = tryDecodeLengthPrefixedPayload(this.stdoutBuffer);
+            if (!decoded) {
+                return;
+            }
+            this.stdoutBuffer = decoded.remaining;
+            let frame;
+            try {
+                frame = this.decodeFrame(decoded.payload);
+            }
+            catch (error) {
+                this.handleError(error);
+                continue;
+            }
+            for (const listener of this.frameListeners) {
+                listener(frame);
+            }
+        }
+    }
+}

package/dist/framing.d.ts

@@ -0,0 +1,7 @@
+export declare const LENGTH_PREFIX_BYTES = 4;
+export interface LengthPrefixedPayload {
+    payload: Buffer;
+    remaining: Buffer;
+}
+export declare function encodeLengthPrefixedPayload(payload: Uint8Array): Buffer;
+export declare function tryDecodeLengthPrefixedPayload(buffer: Uint8Array): LengthPrefixedPayload | null;

package/dist/framing.js

@@ -0,0 +1,22 @@
+export const LENGTH_PREFIX_BYTES = 4;
+export function encodeLengthPrefixedPayload(payload) {
+    const encoded = Buffer.allocUnsafe(LENGTH_PREFIX_BYTES + payload.length);
+    encoded.writeUInt32BE(payload.length, 0);
+    encoded.set(payload, LENGTH_PREFIX_BYTES);
+    return encoded;
+}
+export function tryDecodeLengthPrefixedPayload(buffer) {
+    const source = Buffer.isBuffer(buffer) ? buffer : Buffer.from(buffer);
+    if (source.length < LENGTH_PREFIX_BYTES) {
+        return null;
+    }
+    const declaredLength = source.readUInt32BE(0);
+    const frameEnd = LENGTH_PREFIX_BYTES + declaredLength;
+    if (source.length < frameEnd) {
+        return null;
+    }
+    return {
+        payload: source.subarray(LENGTH_PREFIX_BYTES, frameEnd),
+        remaining: source.subarray(frameEnd),
+    };
+}

package/dist/generated/AcpLimitsConfig.d.ts

@@ -0,0 +1,4 @@
+export type AcpLimitsConfig = {
+    maxReadLineBytes?: number;
+    stdoutBufferByteLimit?: number;
+};

package/dist/generated/AcpLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/CreateVmConfig.d.ts

@@ -0,0 +1,19 @@
+import type { JsRuntimeConfig } from "./JsRuntimeConfig.js";
+import type { NativeRootFilesystemConfig } from "./NativeRootFilesystemConfig.js";
+import type { PermissionsPolicy } from "./PermissionsPolicy.js";
+import type { RootFilesystemConfig } from "./RootFilesystemConfig.js";
+import type { VmDnsConfig } from "./VmDnsConfig.js";
+import type { VmLimitsConfig } from "./VmLimitsConfig.js";
+import type { VmListenPolicyConfig } from "./VmListenPolicyConfig.js";
+export type CreateVmConfig = {
+    cwd?: string;
+    env: Record<string, string>;
+    rootFilesystem: RootFilesystemConfig;
+    permissions?: PermissionsPolicy;
+    limits?: VmLimitsConfig;
+    dns?: VmDnsConfig;
+    nativeRoot?: NativeRootFilesystemConfig;
+    listen?: VmListenPolicyConfig;
+    loopbackExemptPorts: Array<number>;
+    jsRuntime?: JsRuntimeConfig;
+};

package/dist/generated/FsPermissionRule.d.ts

@@ -0,0 +1,6 @@
+import type { PermissionMode } from "./PermissionMode.js";
+export type FsPermissionRule = {
+    mode: PermissionMode;
+    operations: Array<string>;
+    paths: Array<string>;
+};

package/dist/generated/FsPermissionRuleSet.d.ts

@@ -0,0 +1,6 @@
+import type { FsPermissionRule } from "./FsPermissionRule.js";
+import type { PermissionMode } from "./PermissionMode.js";
+export type FsPermissionRuleSet = {
+    default?: PermissionMode;
+    rules: Array<FsPermissionRule>;
+};

package/dist/generated/FsPermissionRuleSet.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/FsPermissionScope.d.ts

@@ -0,0 +1,3 @@
+import type { FsPermissionRuleSet } from "./FsPermissionRuleSet.js";
+import type { PermissionMode } from "./PermissionMode.js";
+export type FsPermissionScope = PermissionMode | FsPermissionRuleSet;

package/dist/generated/FsPermissionScope.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/HttpLimitsConfig.d.ts

@@ -0,0 +1,3 @@
+export type HttpLimitsConfig = {
+    maxFetchResponseBytes?: number;
+};

package/dist/generated/HttpLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/JsModuleResolution.d.ts

@@ -0,0 +1 @@
+export type JsModuleResolution = "node" | "relative" | "none";

package/dist/generated/JsModuleResolution.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/JsRuntimeConfig.d.ts

@@ -0,0 +1,26 @@
+import type { JsModuleResolution } from "./JsModuleResolution.js";
+import type { JsRuntimePlatform } from "./JsRuntimePlatform.js";
+/**
+ * Guest JavaScript host-environment configuration.
+ *
+ * Selects which globals/builtins/module-resolution surface guest JS sees,
+ * modeled on esbuild's `platform`. Omitting this preserves full Node.js
+ * emulation (`platform = node`).
+ */
+export type JsRuntimeConfig = {
+    /**
+     * Which host environment to emulate for guest JS. Default `node`.
+     */
+    platform: JsRuntimePlatform;
+    /**
+     * How bare import specifiers resolve. Independent of `platform`.
+     * Default `node`.
+     */
+    moduleResolution: JsModuleResolution;
+    /**
+     * Node builtin-module allow-list. Only valid when `platform = node`.
+     * `None` => engine default allow-list. `Some([])` => deny all builtins.
+     * `Some([..])` => exactly those.
+     */
+    allowedBuiltins?: Array<string>;
+};

package/dist/generated/JsRuntimeConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/JsRuntimeLimitsConfig.d.ts

@@ -0,0 +1,7 @@
+export type JsRuntimeLimitsConfig = {
+    v8HeapLimitMb?: number;
+    capturedOutputLimitBytes?: number;
+    stdinBufferLimitBytes?: number;
+    eventPayloadLimitBytes?: number;
+    v8IpcMaxFrameBytes?: number;
+};

package/dist/generated/JsRuntimeLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/JsRuntimePlatform.d.ts

@@ -0,0 +1 @@
+export type JsRuntimePlatform = "node" | "browser" | "neutral" | "bare";

package/dist/generated/JsRuntimePlatform.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/MountPluginDescriptor.d.ts

@@ -0,0 +1,4 @@
+export type MountPluginDescriptor = {
+    id: string;
+    config: import("../descriptors.js").MountConfigJsonValue;
+};

package/dist/generated/MountPluginDescriptor.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/NativeRootFilesystemConfig.d.ts

@@ -0,0 +1,5 @@
+import type { MountPluginDescriptor } from "./MountPluginDescriptor.js";
+export type NativeRootFilesystemConfig = {
+    plugin: MountPluginDescriptor;
+    readOnly: boolean;
+};

package/dist/generated/NativeRootFilesystemConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/PatternPermissionRule.d.ts

@@ -0,0 +1,6 @@
+import type { PermissionMode } from "./PermissionMode.js";
+export type PatternPermissionRule = {
+    mode: PermissionMode;
+    operations: Array<string>;
+    patterns: Array<string>;
+};

package/dist/generated/PatternPermissionRule.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/PatternPermissionRuleSet.d.ts

@@ -0,0 +1,6 @@
+import type { PatternPermissionRule } from "./PatternPermissionRule.js";
+import type { PermissionMode } from "./PermissionMode.js";
+export type PatternPermissionRuleSet = {
+    default?: PermissionMode;
+    rules: Array<PatternPermissionRule>;
+};

package/dist/generated/PatternPermissionRuleSet.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/PatternPermissionScope.d.ts

@@ -0,0 +1,3 @@
+import type { PatternPermissionRuleSet } from "./PatternPermissionRuleSet.js";
+import type { PermissionMode } from "./PermissionMode.js";
+export type PatternPermissionScope = PermissionMode | PatternPermissionRuleSet;

package/dist/generated/PatternPermissionScope.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/PermissionMode.d.ts

@@ -0,0 +1 @@
+export type PermissionMode = "allow" | "ask" | "deny";

package/dist/generated/PermissionMode.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/PermissionsPolicy.d.ts

@@ -0,0 +1,10 @@
+import type { FsPermissionScope } from "./FsPermissionScope.js";
+import type { PatternPermissionScope } from "./PatternPermissionScope.js";
+export type PermissionsPolicy = {
+    fs?: FsPermissionScope;
+    network?: PatternPermissionScope;
+    childProcess?: PatternPermissionScope;
+    process?: PatternPermissionScope;
+    env?: PatternPermissionScope;
+    tool?: PatternPermissionScope;
+};

package/dist/generated/PermissionsPolicy.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/PluginLimitsConfig.d.ts

@@ -0,0 +1,4 @@
+export type PluginLimitsConfig = {
+    maxPersistedManifestBytes?: number;
+    maxPersistedManifestFileBytes?: number;
+};

package/dist/generated/PluginLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/PythonLimitsConfig.d.ts

@@ -0,0 +1,5 @@
+export type PythonLimitsConfig = {
+    outputBufferMaxBytes?: number;
+    executionTimeoutMs?: number;
+    vfsRpcTimeoutMs?: number;
+};

package/dist/generated/PythonLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/ResourceLimitsConfig.d.ts

@@ -0,0 +1,22 @@
+export type ResourceLimitsConfig = {
+    cpuCount?: number;
+    maxProcesses?: number;
+    maxOpenFds?: number;
+    maxPipes?: number;
+    maxPtys?: number;
+    maxSockets?: number;
+    maxConnections?: number;
+    maxSocketBufferedBytes?: number;
+    maxSocketDatagramQueueLen?: number;
+    maxFilesystemBytes?: number;
+    maxInodeCount?: number;
+    maxBlockingReadMs?: number;
+    maxPreadBytes?: number;
+    maxFdWriteBytes?: number;
+    maxProcessArgvBytes?: number;
+    maxProcessEnvBytes?: number;
+    maxReaddirEntries?: number;
+    maxWasmFuel?: number;
+    maxWasmMemoryBytes?: number;
+    maxWasmStackBytes?: number;
+};

package/dist/generated/ResourceLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/RootFilesystemConfig.d.ts

@@ -0,0 +1,9 @@
+import type { RootFilesystemEntry } from "./RootFilesystemEntry.js";
+import type { RootFilesystemLowerDescriptor } from "./RootFilesystemLowerDescriptor.js";
+import type { RootFilesystemMode } from "./RootFilesystemMode.js";
+export type RootFilesystemConfig = {
+    mode: RootFilesystemMode;
+    disableDefaultBaseLayer: boolean;
+    lowers: Array<RootFilesystemLowerDescriptor>;
+    bootstrapEntries: Array<RootFilesystemEntry>;
+};

package/dist/generated/RootFilesystemConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemEntry.d.ts

@@ -0,0 +1,13 @@
+import type { RootFilesystemEntryEncoding } from "./RootFilesystemEntryEncoding.js";
+import type { RootFilesystemEntryKind } from "./RootFilesystemEntryKind.js";
+export type RootFilesystemEntry = {
+    path: string;
+    kind: RootFilesystemEntryKind;
+    mode?: number;
+    uid?: number;
+    gid?: number;
+    content?: string;
+    encoding?: RootFilesystemEntryEncoding;
+    target?: string;
+    executable: boolean;
+};

package/dist/generated/RootFilesystemEntry.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemEntryEncoding.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemEntryEncoding = "utf8" | "base64";

package/dist/generated/RootFilesystemEntryEncoding.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/RootFilesystemEntryKind.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemEntryKind = "file" | "directory" | "symlink";

package/dist/generated/RootFilesystemEntryKind.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/RootFilesystemLowerDescriptor.d.ts

@@ -0,0 +1,7 @@
+import type { RootFilesystemEntry } from "./RootFilesystemEntry.js";
+export type RootFilesystemLowerDescriptor = {
+    "kind": "snapshot";
+    entries: Array<RootFilesystemEntry>;
+} | {
+    "kind": "bundledBaseFilesystem";
+};

package/dist/generated/RootFilesystemLowerDescriptor.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/RootFilesystemMode.d.ts

@@ -0,0 +1 @@
+export type RootFilesystemMode = "ephemeral" | "read-only";

package/dist/generated/RootFilesystemMode.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/ToolLimitsConfig.d.ts

@@ -0,0 +1,10 @@
+export type ToolLimitsConfig = {
+    defaultToolTimeoutMs?: number;
+    maxToolTimeoutMs?: number;
+    maxRegisteredToolkits?: number;
+    maxRegisteredToolsPerVm?: number;
+    maxToolsPerToolkit?: number;
+    maxToolSchemaBytes?: number;
+    maxToolExamplesPerTool?: number;
+    maxToolExampleInputBytes?: number;
+};

package/dist/generated/ToolLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmDnsConfig.d.ts

@@ -0,0 +1,6 @@
+export type VmDnsConfig = {
+    nameServers: Array<string>;
+    overrides: {
+        [key in string]?: Array<string>;
+    };
+};

package/dist/generated/VmDnsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/VmLimitsConfig.d.ts

@@ -0,0 +1,18 @@
+import type { AcpLimitsConfig } from "./AcpLimitsConfig.js";
+import type { HttpLimitsConfig } from "./HttpLimitsConfig.js";
+import type { JsRuntimeLimitsConfig } from "./JsRuntimeLimitsConfig.js";
+import type { PluginLimitsConfig } from "./PluginLimitsConfig.js";
+import type { PythonLimitsConfig } from "./PythonLimitsConfig.js";
+import type { ResourceLimitsConfig } from "./ResourceLimitsConfig.js";
+import type { ToolLimitsConfig } from "./ToolLimitsConfig.js";
+import type { WasmLimitsConfig } from "./WasmLimitsConfig.js";
+export type VmLimitsConfig = {
+    resources?: ResourceLimitsConfig;
+    http?: HttpLimitsConfig;
+    tools?: ToolLimitsConfig;
+    plugins?: PluginLimitsConfig;
+    acp?: AcpLimitsConfig;
+    jsRuntime?: JsRuntimeLimitsConfig;
+    python?: PythonLimitsConfig;
+    wasm?: WasmLimitsConfig;
+};

package/dist/generated/VmLimitsConfig.js

@@ -0,0 +1 @@
+export {};

package/dist/generated/VmListenPolicyConfig.d.ts

@@ -0,0 +1,5 @@
+export type VmListenPolicyConfig = {
+    portMin?: number;
+    portMax?: number;
+    allowPrivileged?: boolean;
+};

package/dist/generated/VmListenPolicyConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};

package/dist/generated/WasmLimitsConfig.d.ts

@@ -0,0 +1,5 @@
+export type WasmLimitsConfig = {
+    maxModuleFileBytes?: number;
+    capturedOutputLimitBytes?: number;
+    syncReadLimitBytes?: number;
+};

package/dist/generated/WasmLimitsConfig.js

@@ -0,0 +1,2 @@
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+export {};