@zhin.js/agent 0.2.0 → 0.3.0

package/lib/security/owner-approve-always-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"owner-approve-always-store.js","sourceRoot":"","sources":["../../src/security/owner-approve-always-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAe,CAAC;AAIzD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,aAAa,GAAG,CAAU,CAAC;AAEjC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,6BAA6B;IAC7B,4BAA4B;IAC5B,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,0BAA0B;IAC1B,8BAA8B;IAC9B,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,sCAAsC;CACvC,CAAC;AAuBF,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO;IACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe;IACtE,OAAO,GAAG,OAAO,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QAC/C,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAC;QAExD,IAAK,IAAgB,CAAC,OAAO,KAAK,aAAa,IAAK,IAAgB,CAAC,IAAI,IAAI,OAAQ,IAAgB,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxH,MAAM,EAAE,GAAG,IAAe,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrC,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,SAAS;oBAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAK,IAAgB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChF,MAAM,EAAE,GAAG,aAAa,CAAC,IAAe,CAAC,CAAC;YAC1C,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAE,IAAyC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAG,IAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,GAAgB;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAS,CAAwB,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,KAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAI,GAAG,EAAE,OAA+C,EAAE,MAAM,CAAC;IAC7E,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAgB;IACxD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAS,CAAwB,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,KAAM,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAI,GAAG,EAAE,OAA+C,IAAI,EAAE,CAAC;IAC9E,OAAO,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,GAAgB;IACvE,IAAI,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACtB,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAClD,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACpD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/D,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,GAAgB;IAChD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,GAAgB;IACnD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACnC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAE,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,OAAqB;IAClF,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,GAAG,GAAgB;QACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QACnD,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QAC5B,OAAO;QACP,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,CAAC,QAAQ,CAAC;QACjB,QAAQ,EAAE,OAAO;KAClB,CAAC;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAgB,EAAE,QAAgB;IACtF,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,GAAgB,EAAE,KAAc;IAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACjD,MAAM,GAAG,GAAyB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpE,IAAI,KAAK;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;;QAC5B,OAAO,GAAG,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrB,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAgB,EAAE,QAAgB;IACtF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,yBAAyB,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,GAAgB,EAAE,QAAgB;IACzF,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,yBAAyB,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnD,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,GAAgB,EAChB,OAAe;IAEf,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QACH,kCAAkC;QAClC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAyB,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAClI,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrB,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,GAAgB,EAChB,MAAc;IAEd,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IACrB,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,GAAgB,EAAE,WAAmB;IAC9F,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,GAAgB;IACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,cAAc,MAAM,EAAE,EAAE,YAAY,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,GAAgB;IACrE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,EAAE,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAGD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAExD,SAAS,UAAU,CAAC,OAAe,EAAE,KAAa,EAAE,OAAe;IACjE,OAAO,GAAG,OAAO,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAAgB,EAAE,QAAgB;IAC5F,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO;IACnD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE;QACrE,QAAQ,EAAE,yBAAyB;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAgB;IAC5E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO;IACxC,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,GAAgB;IAC1E,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QACnD,IAAI,CAAC;YAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,yBAAyB,CAAC;AACnC,CAAC"}
+{"version":3,"file":"owner-approve-always-store.js","sourceRoot":"","sources":["../../src/security/owner-approve-always-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAe,CAAC;AAIzD,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,aAAa,GAAG,CAAU,CAAC;AAEjC,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iCAAiC,GAAsB;IAClE,6BAA6B;IAC7B,4BAA4B;IAC5B,2BAA2B;IAC3B,0BAA0B;IAC1B,0BAA0B;IAC1B,yBAAyB;IACzB,2BAA2B;IAC3B,8BAA8B;IAC9B,8BAA8B;IAC9B,0BAA0B;IAC1B,8BAA8B;IAC9B,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,sCAAsC;CACvC,CAAC;AAuBF,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO;IACd,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,SAAS,eAAe,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAe;IAC3E,OAAO,GAAG,OAAO,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACpD,IAAI,KAAK,KAAK,oBAAoB,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YAC5D,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;QAClD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAC;QAExD,IAAK,IAAgB,CAAC,OAAO,KAAK,aAAa,IAAK,IAAgB,CAAC,SAAS,IAAI,OAAQ,IAAgB,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClI,MAAM,EAAE,GAAG,IAAe,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,GAAG,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,SAAS;oBAAE,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC;YACzC,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAK,IAAgB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAE,IAAgB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChF,MAAM,EAAE,GAAG,aAAa,CAAC,IAAe,CAAC,CAAC;YAC1C,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,KAAK,CAAC,OAAO,CAAE,IAAyC,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAG,IAAgB,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,UAAU,CAAC,EAAE,CAAC,CAAC;YACf,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,MAAM,CAAC,GAAG,SAAS,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACtC,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IAClD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,WAAoB;IACpE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAwB,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,MAAM,GAAI,QAAQ,EAAE,OAA+C,EAAE,MAAM,CAAC;IAClF,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAc,EAAE,WAAoB;IACjE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAwB,CAAC;IACzE,MAAM,QAAQ,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,cAAc,GAAI,QAAQ,EAAE,OAA+C,IAAI,EAAE,CAAC;IACxF,OAAO,eAAe,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAoB;IAC3E,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,WAAW,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,WAAW,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9F,IAAI,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QACpD,IAAI,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,WAAW,CAAC,CAAC;QACzE,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC7D,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC/D,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE;YAAE,OAAO,SAAS,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,QAAQ,IAAI,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC/D,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;QACjD,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,WAAoB;IACpD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,WAAoB;IACvD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC9E,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAC9C,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,MAAc,EAAE,OAAgB;IAC7E,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnD,IAAI,OAAO,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAoB,EAAE,QAAgB;IAC1F,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,WAAoB,EAAE,KAAc;IAChF,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO;IAC5D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IACtD,MAAM,GAAG,GAAyB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;IACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpE,IAAI,KAAK;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;;QAC5B,OAAO,GAAG,CAAC,UAAU,CAAC;IAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1B,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAoB,EAAE,QAAgB;IAC1F,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,yBAAyB,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACvD,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;IACzC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAc,EAAE,WAAoB,EAAE,QAAgB;IAC7F,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,yBAAyB,EAAE,CAAC;QAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAClD,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACnD,CAAC;IACD,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,MAAc,EACd,WAAoB,EACpB,OAAe;IAEf,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,CAAC;QAEH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAE,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAyB,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;IAC5I,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU;QAAE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAC/B,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1B,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAc,EACd,WAAoB,EACpB,MAAc;IAEd,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IAClD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS,IAAI,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,IAAI,EAAE,CAAC;QACtG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAE,CAAC;IACxD,MAAM,GAAG,GAAG,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACtE,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC;IAC1D,CAAC;IACD,GAAG,CAAC,SAAS,GAAG,IAAI,CAAC;IACrB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC1B,UAAU,CAAC,IAAI,CAAC,CAAC;IACjB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,0BAA0B,CAAC,MAAc,EAAE,WAAoB,EAAE,WAAmB;IAClG,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,WAAoB;IACxE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAC3C,MAAM,KAAK,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,cAAc,MAAM,EAAE,EAAE,YAAY,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,WAAoB;IACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,EAAE,UAAU;QAAE,GAAG,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IACzD,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,cAAsB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,OAAO,iCAAiC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAGD,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAAmB,CAAC;AAExD,SAAS,UAAU,CAAC,OAAe,EAAE,UAAkB,EAAE,OAAe;IACtE,OAAO,GAAG,OAAO,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO,oBAAoB,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,uCAAuC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;QAChD,IAAI,GAAG,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC;YAC1B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,WAAoB,EAAE,QAAgB;IAChG,IAAI,QAAQ,KAAK,yBAAyB;QAAE,OAAO;IACnD,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO;IAC5D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE;QACjG,QAAQ,EAAE,yBAAyB;QACnC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;KACvC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,MAAc,EAAE,WAAoB;IAChF,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO;IAC5D,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO;IAC5B,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,MAAc,EAAE,WAAoB;IAC9E,IAAI,CAAC,WAAW,CAAC,QAAQ,IAAI,CAAC,WAAW,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACrF,MAAM,CAAC,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,yBAAyB,EAAE,CAAC;QACnD,IAAI,CAAC;YAAE,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,yBAAyB,CAAC;AACnC,CAAC"}

package/lib/security/sandbox-docker.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Docker 沙箱 — 真实容器级隔离
+ *
+ * 使用 Docker 容器执行 bash 命令，提供：
+ * - 文件系统隔离（只挂载工作目录）
+ * - 网络隔离（默认无网络）
+ * - 资源限制（内存、CPU）
+ * - 进程隔离（独立 PID 命名空间）
+ *
+ * 降级策略：Docker 不可用时回退到软沙箱。
+ */
+import type { SandboxConfig, SandboxResult } from './sandbox.js';
+/** Docker 沙箱配置 */
+export interface DockerSandboxConfig extends SandboxConfig {
+    /** Docker 镜像（默认 node:20-alpine） */
+    dockerImage?: string;
+    /** 是否启用网络（默认 false） */
+    enableNetwork?: boolean;
+}
+/**
+ * 检测 Docker 是否可用
+ */
+export declare function isDockerAvailable(): boolean;
+/**
+ * 在 Docker 容器中执行命令
+ */
+export declare function executeInDocker(command: string, config?: Partial<DockerSandboxConfig>): Promise<SandboxResult>;
+//# sourceMappingURL=sandbox-docker.d.ts.map

package/lib/security/sandbox-docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-docker.d.ts","sourceRoot":"","sources":["../../src/security/sandbox-docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEjE,kBAAkB;AAClB,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAcD;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AA2BD;;GAEG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM,GACxC,OAAO,CAAC,aAAa,CAAC,CA0HxB"}

package/lib/security/sandbox-docker.js

@@ -0,0 +1,177 @@
+/**
+ * Docker 沙箱 — 真实容器级隔离
+ *
+ * 使用 Docker 容器执行 bash 命令，提供：
+ * - 文件系统隔离（只挂载工作目录）
+ * - 网络隔离（默认无网络）
+ * - 资源限制（内存、CPU）
+ * - 进程隔离（独立 PID 命名空间）
+ *
+ * 降级策略：Docker 不可用时回退到软沙箱。
+ */
+import * as child_process from 'node:child_process';
+const DEFAULT_DOCKER_CONFIG = {
+    enabled: true,
+    timeout: 30000,
+    maxMemoryMB: 512,
+    maxCpuPercent: 50,
+    maxOutputSize: 10 * 1024 * 1024,
+    preserveHome: false,
+    preservePath: true,
+    enableNetwork: false,
+    dockerImage: 'node:20-alpine',
+};
+/**
+ * 检测 Docker 是否可用
+ */
+export function isDockerAvailable() {
+    try {
+        const result = child_process.spawnSync('docker', ['info'], {
+            timeout: 5000,
+            stdio: 'pipe',
+        });
+        return result.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * 确保 Docker 镜像存在（不存在则拉取）
+ */
+function ensureImage(image) {
+    try {
+        // 检查镜像是否存在
+        const check = child_process.spawnSync('docker', ['image', 'inspect', image], {
+            timeout: 5000,
+            stdio: 'pipe',
+        });
+        if (check.status === 0)
+            return { ok: true };
+        // 拉取镜像
+        const pull = child_process.spawnSync('docker', ['pull', image], {
+            timeout: 120000,
+            stdio: 'pipe',
+        });
+        return pull.status === 0
+            ? { ok: true }
+            : { ok: false, error: `拉取镜像 ${image} 失败` };
+    }
+    catch (e) {
+        return { ok: false, error: `Docker 操作失败: ${e}` };
+    }
+}
+/**
+ * 在 Docker 容器中执行命令
+ */
+export async function executeInDocker(command, config = {}) {
+    const merged = { ...DEFAULT_DOCKER_CONFIG, ...config };
+    const startTime = Date.now();
+    // 确保镜像存在
+    const imageCheck = ensureImage(merged.dockerImage);
+    if (!imageCheck.ok) {
+        return {
+            success: false,
+            stdout: '',
+            stderr: imageCheck.error || 'Docker 镜像不可用',
+            exitCode: 1,
+            duration: Date.now() - startTime,
+            timedOut: false,
+            blocked: true,
+            blockReason: imageCheck.error,
+        };
+    }
+    const timeout = merged.timeout || 30000;
+    const maxOutput = merged.maxOutputSize || 10 * 1024 * 1024;
+    const cwd = merged.workingDirectory || process.cwd();
+    // 构建 docker run 参数
+    const dockerArgs = [
+        'run',
+        '--rm', // 执行完自动删除容器
+        '--read-only', // 只读文件系统
+        '--tmpfs', '/tmp:size=64m', // /tmp 可写，限制 64MB
+        '--memory', `${merged.maxMemoryMB}m`,
+        '--cpus', `${(merged.maxCpuPercent || 50) / 100}`,
+        '--pids-limit', '64', // 进程数限制
+        '--security-opt', 'no-new-privileges', // 禁止提权
+        '--cap-drop', 'ALL', // 丢弃所有 capabilities
+        '--workdir', '/workspace',
+        '-v', `${cwd}:/workspace:ro`, // 只读挂载工作目录
+    ];
+    // 网络隔离
+    if (!merged.enableNetwork) {
+        dockerArgs.push('--network', 'none');
+    }
+    // 环境变量清理
+    if (merged.allowedEnvVars) {
+        for (const varName of merged.allowedEnvVars) {
+            const value = process.env[varName];
+            if (value) {
+                dockerArgs.push('-e', `${varName}=${value}`);
+            }
+        }
+    }
+    // 镜像和命令
+    dockerArgs.push(merged.dockerImage, 'sh', '-c', command);
+    return new Promise((resolve) => {
+        let timedOut = false;
+        const child = child_process.spawn('docker', dockerArgs, {
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        const stdoutChunks = [];
+        let stdoutLen = 0;
+        const stderrChunks = [];
+        let stderrLen = 0;
+        child.stdout?.on('data', (data) => {
+            const chunk = data.toString();
+            if (stdoutLen + chunk.length <= maxOutput) {
+                stdoutChunks.push(chunk);
+                stdoutLen += chunk.length;
+            }
+        });
+        child.stderr?.on('data', (data) => {
+            const chunk = data.toString();
+            if (stderrLen + chunk.length <= maxOutput) {
+                stderrChunks.push(chunk);
+                stderrLen += chunk.length;
+            }
+        });
+        const timer = setTimeout(() => {
+            timedOut = true;
+            child.kill('SIGKILL');
+            // 尝试强制删除容器
+            try {
+                child_process.spawnSync('docker', ['kill', `$(docker ps -q --filter "ancestor=${merged.dockerImage}")`], {
+                    timeout: 3000,
+                    stdio: 'pipe',
+                });
+            }
+            catch { /* ignore */ }
+        }, timeout);
+        child.on('close', (exitCode) => {
+            clearTimeout(timer);
+            resolve({
+                success: exitCode === 0 && !timedOut,
+                stdout: stdoutChunks.join('').slice(0, maxOutput),
+                stderr: stderrChunks.join('').slice(0, maxOutput),
+                exitCode,
+                duration: Date.now() - startTime,
+                timedOut,
+                blocked: false,
+            });
+        });
+        child.on('error', (error) => {
+            clearTimeout(timer);
+            resolve({
+                success: false,
+                stdout: stdoutChunks.join(''),
+                stderr: `Docker 执行错误: ${error.message}`,
+                exitCode: 1,
+                duration: Date.now() - startTime,
+                timedOut: false,
+                blocked: false,
+            });
+        });
+    });
+}
+//# sourceMappingURL=sandbox-docker.js.map

package/lib/security/sandbox-docker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-docker.js","sourceRoot":"","sources":["../../src/security/sandbox-docker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAC;AAYpD,MAAM,qBAAqB,GAAwB;IACjD,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,KAAK;IACd,WAAW,EAAE,GAAG;IAChB,aAAa,EAAE,EAAE;IACjB,aAAa,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC/B,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,IAAI;IAClB,aAAa,EAAE,KAAK;IACpB,WAAW,EAAE,gBAAgB;CAC9B,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACzD,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,WAAW;QACX,MAAM,KAAK,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE;YAC3E,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAE5C,OAAO;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAC9D,OAAO,EAAE,MAAM;YACf,KAAK,EAAE,MAAM;SACd,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;YACtB,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE;YACd,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,KAAK,KAAK,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAe,EACf,SAAuC,EAAE;IAEzC,MAAM,MAAM,GAAwB,EAAE,GAAG,qBAAqB,EAAE,GAAG,MAAM,EAAE,CAAC;IAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,SAAS;IACT,MAAM,UAAU,GAAG,WAAW,CAAC,MAAM,CAAC,WAAY,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,cAAc;YAC1C,QAAQ,EAAE,CAAC;YACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YAChC,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,UAAU,CAAC,KAAK;SAC9B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAErD,mBAAmB;IACnB,MAAM,UAAU,GAAa;QAC3B,KAAK;QACL,MAAM,EAA2B,YAAY;QAC7C,aAAa,EAAqB,SAAS;QAC3C,SAAS,EAAE,eAAe,EAAO,kBAAkB;QACnD,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,GAAG;QACpC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,GAAG,GAAG,EAAE;QACjD,cAAc,EAAE,IAAI,EAAa,QAAQ;QACzC,gBAAgB,EAAE,mBAAmB,EAAG,OAAO;QAC/C,YAAY,EAAE,KAAK,EAAc,oBAAoB;QACrD,WAAW,EAAE,YAAY;QACzB,IAAI,EAAE,GAAG,GAAG,gBAAgB,EAAK,WAAW;KAC7C,CAAC;IAEF,OAAO;IACP,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAC1B,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED,SAAS;IACT,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;IACH,CAAC;IAED,QAAQ;IACR,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,WAAY,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAE1D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE;YACtD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,SAAS,GAAG,CAAC,CAAC;QAElB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9B,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC1C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,WAAW;YACX,IAAI,CAAC;gBACH,aAAa,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,qCAAqC,MAAM,CAAC,WAAW,IAAI,CAAC,EAAE;oBACvG,OAAO,EAAE,IAAI;oBACb,KAAK,EAAE,MAAM;iBACd,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,QAAQ,KAAK,CAAC,IAAI,CAAC,QAAQ;gBACpC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;gBACjD,QAAQ;gBACR,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ;gBACR,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,MAAM,EAAE,gBAAgB,KAAK,CAAC,OAAO,EAAE;gBACvC,QAAQ,EAAE,CAAC;gBACX,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAChC,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/lib/security/sandbox.d.ts

@@ -37,6 +37,10 @@ export interface SandboxConfig {
     enableNetwork?: boolean;
     /** 允许的域名（如果启用网络） */
     allowedDomains?: string[];
+    /** 是否使用 Docker 容器隔离（默认 'auto'：检测到 Docker 就用） */
+    useDocker?: 'auto' | 'always' | 'never';
+    /** Docker 镜像（默认 node:20-alpine） */
+    dockerImage?: string;
 }
 export interface SandboxResult {
     /** 是否成功 */
@@ -63,7 +67,10 @@ export interface SandboxResult {
 }
 export declare class Sandbox {
     private config;
+    private _dockerAvailable;
     constructor(config?: Partial<SandboxConfig>);
+    /** 是否应该使用 Docker 沙箱 */
+    private shouldUseDocker;
     /**
      * 在沙箱中执行命令
      */
@@ -72,6 +79,8 @@ export declare class Sandbox {
         env?: Record<string, string>;
         timeout?: number;
     }): Promise<SandboxResult>;
+    /** 软沙箱执行（ulimit 包装 + detached 进程组 + /proc 资源监控） */
+    private executeSoft;
     private executeUnsafe;
     /**
      * 更新配置

package/lib/security/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,MAAM,WAAW,aAAa;IAC5B,aAAa;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AA2CD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AA4ID,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,aAAa,CAAC;YAkIZ,aAAa;IA2E3B;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B;AAMD;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAGnE;AAED,qBAAqB;AACrB,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/security/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AA0EH,MAAM,WAAW,aAAa;IAC5B,aAAa;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,0BAA0B;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iBAAiB;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc;IACd,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,gBAAgB;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,uBAAuB;IACvB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,oBAAoB;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IACxC,mCAAmC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA2CD,MAAM,WAAW,aAAa;IAC5B,WAAW;IACX,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU;IACV,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW;IACX,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc;IACd,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW;IACX,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,aAAa,CAAC,EAAE;QACd,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAsOD,qBAAa,OAAO;IAClB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,gBAAgB,CAAwB;gBAEpC,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM;IAI/C,uBAAuB;IACvB,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QACvC,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,aAAa,CAAC;IAwC1B,mDAAmD;YACrC,WAAW;YAwIX,aAAa;IAmF3B;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,SAAS,IAAI,aAAa;CAG3B;AAMD;;GAEG;AACH,wBAAgB,UAAU,IAAI,OAAO,CAKpC;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAGnE;AAED,qBAAqB;AACrB,wBAAgB,YAAY,IAAI,IAAI,CAEnC;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,aAAa,CAAC,CAEzB"}

package/lib/security/sandbox.js

@@ -13,6 +13,61 @@
 import * as child_process from 'node:child_process';
 import * as os from 'node:os';
 import * as fs from 'node:fs';
+// ── 资源限制包装 ────────────────────────────────────────────────────
+/**
+ * 用 ulimit/timeout/nice 包装命令，强制施加资源限制。
+ * 仅在 POSIX 系统（Linux/macOS）生效。
+ */
+function wrapCommandWithLimits(command, config) {
+    if (process.platform === 'win32')
+        return command;
+    const parts = [];
+    // 内存限制：ulimit -v <KB>（虚拟地址空间）— 仅 Linux 支持
+    if (config.maxMemoryMB && config.maxMemoryMB > 0 && process.platform === 'linux') {
+        const kb = config.maxMemoryMB * 1024;
+        parts.push(`ulimit -v ${kb} 2>/dev/null || true`);
+    }
+    // CPU 时间限制：ulimit -t <seconds> — 仅 Linux 支持
+    if (config.timeout && config.timeout > 0 && process.platform === 'linux') {
+        const cpuSeconds = Math.ceil(config.timeout / 1000) * 2;
+        parts.push(`ulimit -t ${cpuSeconds} 2>/dev/null || true`);
+    }
+    // 最大文件写入大小：ulimit -f <blocks>（10MB = 20480 blocks of 512B）
+    parts.push('ulimit -f 20480 2>/dev/null || true');
+    // 最大进程数：ulimit -u 64
+    parts.push('ulimit -u 64 2>/dev/null || true');
+    if (parts.length === 0)
+        return command;
+    // 用分号连接，ulimit 失败也继续执行
+    const ulimitChain = parts.join(' ; ');
+    return `${ulimitChain} ; exec bash -c ${JSON.stringify(command)}`;
+}
+/**
+ * 从 /proc/<pid>/status 读取子进程资源使用（仅 Linux）
+ */
+function readChildResourceUsage(pid) {
+    try {
+        const status = fs.readFileSync(`/proc/${pid}/status`, 'utf8');
+        const vmRss = status.match(/^VmRSS:\s+(\d+)\s+kB/m);
+        return {
+            memoryKB: vmRss ? parseInt(vmRss[1], 10) : 0,
+        };
+    }
+    catch {
+        return null; // macOS 或进程已退出
+    }
+}
+/** 安全杀死进程组（detached 模式下杀整棵树） */
+function killProcessGroup(child, signal = 'SIGKILL') {
+    try {
+        if (child.pid) {
+            process.kill(-child.pid, signal); // 负 PID = 杀整个进程组
+        }
+    }
+    catch {
+        // 进程已退出
+    }
+}
 const DEFAULT_CONFIG = {
     enabled: true,
     timeout: 30000, // 30 秒
@@ -91,6 +146,81 @@ function cleanEnvironment(config) {
     }
     return cleanEnv;
 }
+// ── 网络命令检测 ────────────────────────────────────────────────────
+/** 网络命令模式（当 enableNetwork: false 时阻断） */
+const NETWORK_COMMAND_PATTERNS = [
+    /\bcurl\s+/,
+    /\bwget\s+/,
+    /\bnc\s+/,
+    /\bnetcat\s+/,
+    /\bssh\s+/,
+    /\bscp\s+/,
+    /\brsync\s+/,
+    /\bping\s+/,
+    /\btraceroute\s+/,
+    /\bnmap\s+/,
+    /\bhttp\s+/,
+    /\bhttps\s+/,
+];
+/** 从命令中提取 URL */
+function extractUrlsFromCommand(command) {
+    const urlPattern = /https?:\/\/[^\s'"`&|;)}\]]+/gi;
+    return (command.match(urlPattern) || []).map(u => u.toLowerCase());
+}
+/**
+ * 检查网络命令访问权限
+ * - enableNetwork: false → 阻断所有网络命令
+ * - enableNetwork: true + allowedDomains → 仅允许指定域名
+ */
+function checkNetworkCommand(command, config) {
+    // 网络未启用时，阻断所有网络命令
+    if (!config.enableNetwork) {
+        for (const pattern of NETWORK_COMMAND_PATTERNS) {
+            if (pattern.test(command)) {
+                const cmd = command.match(pattern)?.[0]?.trim() || 'network command';
+                return {
+                    allowed: false,
+                    reason: `沙箱网络未启用，禁止执行网络命令: ${cmd}（配置 enableNetwork: true 以允许）`,
+                };
+            }
+        }
+        return { allowed: true };
+    }
+    // 网络已启用但有域名白名单时，校验 URL
+    if (config.allowedDomains && config.allowedDomains.length > 0) {
+        const urls = extractUrlsFromCommand(command);
+        if (urls.length === 0) {
+            // 网络命令必须包含可校验的 URL
+            const hasNetworkCommand = NETWORK_COMMAND_PATTERNS.some(pattern => pattern.test(command));
+            if (hasNetworkCommand) {
+                return {
+                    allowed: false,
+                    reason: `启用 allowedDomains 时，网络命令必须包含可校验的 URL（如 http://example.com）`,
+                };
+            }
+            return { allowed: true };
+        }
+        for (const url of urls) {
+            try {
+                const hostname = new URL(url).hostname.toLowerCase();
+                const isAllowed = config.allowedDomains.some(domain => {
+                    const d = domain.toLowerCase().replace(/^\./, '');
+                    return hostname === d || hostname.endsWith('.' + d);
+                });
+                if (!isAllowed) {
+                    return {
+                        allowed: false,
+                        reason: `域名 ${hostname} 不在允许列表中（允许: ${config.allowedDomains.join(', ')}）`,
+                    };
+                }
+            }
+            catch {
+                // URL 解析失败，放行（可能是相对路径或其他格式）
+            }
+        }
+    }
+    return { allowed: true };
+}
 // ── 命令验证 ──────────────────────────────────────────────────────────
 function matchDangerousSandboxCommand(command) {
     const lower = command.toLowerCase();
@@ -165,24 +295,48 @@ function validateCommand(command, config) {
     if (blocked) {
         return { valid: false, reason: blocked };
     }
+    // 网络命令检查
+    const networkCheck = checkNetworkCommand(command, config);
+    if (!networkCheck.allowed) {
+        return { valid: false, reason: networkCheck.reason };
+    }
     return { valid: true };
 }
 // ── 沙箱执行器 ────────────────────────────────────────────────────────
 export class Sandbox {
     config;
+    _dockerAvailable = null; // 缓存检测结果
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
+    /** 是否应该使用 Docker 沙箱 */
+    shouldUseDocker() {
+        const mode = this.config.useDocker || 'auto';
+        if (mode === 'never')
+            return false;
+        if (mode === 'always')
+            return true;
+        // auto 模式：检测 Docker 是否可用
+        if (this._dockerAvailable === null) {
+            try {
+                const { isDockerAvailable } = require('./sandbox-docker.js');
+                this._dockerAvailable = isDockerAvailable();
+            }
+            catch {
+                this._dockerAvailable = false;
+            }
+        }
+        return this._dockerAvailable ?? false;
+    }
     /**
      * 在沙箱中执行命令
      */
     async execute(command, options) {
         if (!this.config.enabled) {
-            // 沙箱未启用，直接执行
             return this.executeUnsafe(command, options);
         }
         const startTime = Date.now();
-        // 验证命令
+        // 验证命令（无论使用哪种沙箱都先验证）
         const validation = validateCommand(command, this.config);
         if (!validation.valid) {
             return {
@@ -196,6 +350,26 @@ export class Sandbox {
                 blockReason: validation.reason,
             };
         }
+        // 优先使用 Docker 容器隔离
+        if (this.shouldUseDocker()) {
+            try {
+                const { executeInDocker } = require('./sandbox-docker.js');
+                return executeInDocker(command, {
+                    ...this.config,
+                    workingDirectory: options?.cwd || this.config.workingDirectory,
+                    timeout: options?.timeout || this.config.timeout,
+                });
+            }
+            catch (e) {
+                // Docker 执行失败，降级到软沙箱
+            }
+        }
+        // 降级：软沙箱（ulimit 包装 + 进程组隔离）
+        return this.executeSoft(command, options);
+    }
+    /** 软沙箱执行（ulimit 包装 + detached 进程组 + /proc 资源监控） */
+    async executeSoft(command, options) {
+        const startTime = Date.now();
         // 清理环境变量
         const cleanEnv = cleanEnvironment(this.config);
         // 合并用户提供的环境变量（但要检查是否在阻止列表中）
@@ -214,21 +388,22 @@ export class Sandbox {
         if (!fs.existsSync(cwd)) {
             fs.mkdirSync(cwd, { recursive: true });
         }
-        // 执行命令
+        // 执行命令（用 ulimit 包装资源限制）
         return new Promise((resolve) => {
             const timeout = options?.timeout || this.config.timeout || 30000;
             let timedOut = false;
             let killed = false;
-            const child = child_process.spawn('bash', ['-c', command], {
+            // 包装命令：ulimit 内存/CPU/文件/进程限制
+            const wrappedCommand = wrapCommandWithLimits(command, {
+                maxMemoryMB: this.config.maxMemoryMB,
+                timeout,
+                maxCpuPercent: this.config.maxCpuPercent,
+            });
+            const child = child_process.spawn('bash', ['-c', wrappedCommand], {
                 cwd,
                 env: cleanEnv,
                 stdio: ['pipe', 'pipe', 'pipe'],
-                timeout,
-                // 资源限制（仅 Linux/macOS）
-                ...(process.platform !== 'win32' && {
-                // 内存限制（通过 ulimit）
-                // 注意：Node.js 没有直接的内存限制 API，需要通过 ulimit 命令
-                }),
+                detached: true, // 新进程组，便于整棵进程树 kill
             });
             const maxOutput = this.config.maxOutputSize || 10 * 1024 * 1024;
             const stdoutChunks = [];
@@ -249,14 +424,32 @@ export class Sandbox {
                     stderrLen += chunk.length;
                 }
             });
-            // 超时处理
+            // 资源监控（每 500ms 采样一次子进程内存）
+            let peakMemoryKB = 0;
+            const resourceTimer = setInterval(() => {
+                if (child.pid) {
+                    const usage = readChildResourceUsage(child.pid);
+                    if (usage && usage.memoryKB > peakMemoryKB) {
+                        peakMemoryKB = usage.memoryKB;
+                    }
+                }
+            }, 500);
+            resourceTimer.unref?.();
+            // 超时处理 — 杀整个进程组
             const timer = setTimeout(() => {
                 timedOut = true;
                 killed = true;
-                child.kill('SIGKILL');
+                killProcessGroup(child, 'SIGKILL');
             }, timeout);
             child.on('close', (exitCode) => {
                 clearTimeout(timer);
+                clearInterval(resourceTimer);
+                // 超时后补一次资源采样
+                if (child.pid && peakMemoryKB === 0) {
+                    const usage = readChildResourceUsage(child.pid);
+                    if (usage)
+                        peakMemoryKB = usage.memoryKB;
+                }
                 const stdout = stdoutChunks.join('').slice(0, maxOutput);
                 const stderr = stderrChunks.join('').slice(0, maxOutput);
                 const duration = Date.now() - startTime;
@@ -270,12 +463,13 @@ export class Sandbox {
                     blocked: false,
                     resourceUsage: {
                         cpuTime: 0,
-                        memoryUsage: 0,
+                        memoryUsage: peakMemoryKB * 1024, // 转为 bytes
                     },
                 });
             });
             child.on('error', (error) => {
                 clearTimeout(timer);
+                clearInterval(resourceTimer);
                 resolve({
                     success: false,
                     stdout: stdoutChunks.join(''),
@@ -293,9 +487,16 @@ export class Sandbox {
         return new Promise((resolve) => {
             const timeout = options?.timeout || 30000;
             let timedOut = false;
+            // 即使在 unsafe 模式也要过滤敏感环境变量
+            const cleanEnv = { ...process.env };
+            if (this.config.blockedEnvVars) {
+                for (const key of this.config.blockedEnvVars) {
+                    delete cleanEnv[key];
+                }
+            }
             const child = child_process.spawn('bash', ['-c', command], {
                 cwd: options?.cwd || process.cwd(),
-                env: { ...process.env, ...options?.env },
+                env: { ...cleanEnv, ...options?.env },
                 stdio: ['pipe', 'pipe', 'pipe'],
                 timeout,
             });