buildhive-agent 1.0.0-beta.1

package/dist/security/secretManager.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Secret Manager
+ *
+ * Provides encrypted secret storage at rest using AES-256-GCM.
+ * Encryption key is derived from machine-specific data + optional passphrase
+ * via PBKDF2. Secrets are stored in ~/.buildhive/secrets.enc as a single
+ * encrypted blob containing a JSON envelope.
+ *
+ * Uses ONLY Node.js built-in modules (crypto, fs, path, os).
+ */
+import type { AgentConfig } from '../config/types.js';
+export declare class SecretManager {
+    private readonly configDir;
+    private readonly secretsPath;
+    private derivedKey;
+    private envelope;
+    constructor(configDir?: string);
+    /**
+     * Initialize the secret manager. If a secrets file already exists it is
+     * unlocked (decrypted). Otherwise a new empty vault is created.
+     *
+     * @param passphrase Optional passphrase. When omitted a machine-derived
+     *                   key is used (less secure but zero-friction for dev).
+     */
+    initialize(passphrase?: string): Promise<void>;
+    /**
+     * Store a secret value under the given key.
+     */
+    setSecret(key: string, value: string): Promise<void>;
+    /**
+     * Retrieve a secret value. Returns null if the key does not exist.
+     */
+    getSecret(key: string): Promise<string | null>;
+    /**
+     * Delete a secret. Returns true if the key existed.
+     */
+    deleteSecret(key: string): Promise<boolean>;
+    /**
+     * List all stored secret keys (values are never exposed).
+     */
+    listSecrets(): Promise<string[]>;
+    /**
+     * Check whether a secrets file already exists on disk.
+     */
+    isInitialized(): Promise<boolean>;
+    /**
+     * Rotate the encryption key by re-encrypting all secrets with a new
+     * passphrase. The old passphrase is required to unlock first.
+     */
+    rotateKey(oldPassphrase: string, newPassphrase: string): Promise<void>;
+    private ensureUnlocked;
+    /**
+     * Derive an encryption key from a passphrase (or machine-id fallback)
+     * using PBKDF2. When `existingSalt` is provided, it is reused (unlock
+     * path); otherwise a new random salt is generated (create / rotate path).
+     */
+    private deriveKey;
+    /**
+     * Returns a machine-specific string used as fallback key material when
+     * no passphrase is provided.
+     */
+    private getMachineMaterial;
+    /**
+     * Encrypt plaintext using AES-256-GCM.
+     */
+    private encrypt;
+    /**
+     * Decrypt ciphertext using AES-256-GCM.
+     */
+    private decrypt;
+    /**
+     * Serialize the current envelope to the encrypted file.
+     */
+    private flush;
+    /**
+     * Parse the binary secrets file into its component parts.
+     */
+    private parseFile;
+}
+/**
+ * Resolve any `secret:` prefixed values in an AgentConfig by looking them
+ * up in the SecretManager. Plain values are returned as-is for backward
+ * compatibility.
+ *
+ * Resolved fields:
+ *   - config.apiKey
+ *   - config.storageConfig.s3.accessKeyId
+ *   - config.storageConfig.s3.secretAccessKey
+ */
+export declare function resolveSecrets(config: AgentConfig, passphrase?: string): Promise<AgentConfig>;
+/**
+ * Store a secret (for CLI use).
+ */
+export declare function secretSet(key: string, value: string, passphrase?: string): Promise<void>;
+/**
+ * Retrieve a secret (for CLI use).
+ */
+export declare function secretGet(key: string, passphrase?: string): Promise<string | null>;
+/**
+ * List all secret keys (for CLI use).
+ */
+export declare function secretList(passphrase?: string): Promise<string[]>;
+/**
+ * Delete a secret (for CLI use).
+ */
+export declare function secretDelete(key: string, passphrase?: string): Promise<boolean>;
+//# sourceMappingURL=secretManager.d.ts.map

package/dist/security/secretManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.d.ts","sourceRoot":"","sources":["../../src/security/secretManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6CtD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,UAAU,CAAuB;IACzC,OAAO,CAAC,QAAQ,CAAgC;gBAEpC,SAAS,CAAC,EAAE,MAAM;IAS9B;;;;;;OAMG;IACG,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBpD;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1D;;OAEG;IACG,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAKpD;;OAEG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAWjD;;OAEG;IACG,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;IAKtC;;OAEG;IACG,aAAa,IAAI,OAAO,CAAC,OAAO,CAAC;IASvC;;;OAGG;IACG,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB5E,OAAO,CAAC,cAAc;IAMtB;;;;OAIG;IACH,OAAO,CAAC,SAAS;IAqBjB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAQ1B;;OAEG;IACH,OAAO,CAAC,OAAO;IAaf;;OAEG;IACH,OAAO,CAAC,OAAO;IAaf;;OAEG;YACW,KAAK;IAqBnB;;OAEG;IACH,OAAO,CAAC,SAAS;CAqClB;AAMD;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,WAAW,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CA2DtB;AAMD;;GAEG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED;;GAEG;AACH,wBAAsB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAIvE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAIlB"}

package/dist/security/secretManager.js

@@ -0,0 +1,361 @@
+/**
+ * Secret Manager
+ *
+ * Provides encrypted secret storage at rest using AES-256-GCM.
+ * Encryption key is derived from machine-specific data + optional passphrase
+ * via PBKDF2. Secrets are stored in ~/.buildhive/secrets.enc as a single
+ * encrypted blob containing a JSON envelope.
+ *
+ * Uses ONLY Node.js built-in modules (crypto, fs, path, os).
+ */
+import * as crypto from 'crypto';
+import { promises as fs } from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16; // 128 bits for GCM
+const AUTH_TAG_LENGTH = 16; // 128 bits
+const SALT_LENGTH = 32;
+const PBKDF2_ITERATIONS = 600_000; // OWASP recommendation
+const PBKDF2_DIGEST = 'sha512';
+const SECRETS_FILE_NAME = 'secrets.enc';
+const SECRETS_FILE_MODE = 0o600; // Owner read/write only
+const SECRET_REF_PREFIX = 'secret:';
+const ENVELOPE_VERSION = 1;
+/**
+ * Binary file layout (all lengths in bytes):
+ *   [4]  magic bytes "BHSM"
+ *   [1]  format version
+ *   [32] PBKDF2 salt
+ *   [16] AES-GCM IV
+ *   [16] AES-GCM auth tag
+ *   [*]  ciphertext (rest of file)
+ */
+const MAGIC = Buffer.from('BHSM');
+const FORMAT_VERSION = 1;
+const HEADER_SIZE = MAGIC.length + 1 + SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH;
+// ---------------------------------------------------------------------------
+// SecretManager
+// ---------------------------------------------------------------------------
+export class SecretManager {
+    configDir;
+    secretsPath;
+    derivedKey = null;
+    envelope = null;
+    constructor(configDir) {
+        this.configDir = configDir ?? path.join(os.homedir(), '.buildhive');
+        this.secretsPath = path.join(this.configDir, SECRETS_FILE_NAME);
+    }
+    // -----------------------------------------------------------------------
+    // Public API
+    // -----------------------------------------------------------------------
+    /**
+     * Initialize the secret manager. If a secrets file already exists it is
+     * unlocked (decrypted). Otherwise a new empty vault is created.
+     *
+     * @param passphrase Optional passphrase. When omitted a machine-derived
+     *                   key is used (less secure but zero-friction for dev).
+     */
+    async initialize(passphrase) {
+        const exists = await this.isInitialized();
+        if (exists) {
+            // Unlock existing vault
+            const raw = await fs.readFile(this.secretsPath);
+            const { salt, iv, authTag, ciphertext } = this.parseFile(raw);
+            this.derivedKey = await this.deriveKey(passphrase, salt);
+            const plaintext = this.decrypt(ciphertext, iv, authTag);
+            this.envelope = JSON.parse(plaintext);
+        }
+        else {
+            // Create new empty vault
+            await fs.mkdir(this.configDir, { recursive: true });
+            this.derivedKey = await this.deriveKey(passphrase);
+            this.envelope = {
+                secrets: {},
+                version: ENVELOPE_VERSION,
+                updatedAt: new Date().toISOString(),
+            };
+            await this.flush();
+        }
+    }
+    /**
+     * Store a secret value under the given key.
+     */
+    async setSecret(key, value) {
+        this.ensureUnlocked();
+        this.envelope.secrets[key] = value;
+        this.envelope.updatedAt = new Date().toISOString();
+        await this.flush();
+    }
+    /**
+     * Retrieve a secret value. Returns null if the key does not exist.
+     */
+    async getSecret(key) {
+        this.ensureUnlocked();
+        return this.envelope.secrets[key] ?? null;
+    }
+    /**
+     * Delete a secret. Returns true if the key existed.
+     */
+    async deleteSecret(key) {
+        this.ensureUnlocked();
+        if (!(key in this.envelope.secrets)) {
+            return false;
+        }
+        delete this.envelope.secrets[key];
+        this.envelope.updatedAt = new Date().toISOString();
+        await this.flush();
+        return true;
+    }
+    /**
+     * List all stored secret keys (values are never exposed).
+     */
+    async listSecrets() {
+        this.ensureUnlocked();
+        return Object.keys(this.envelope.secrets);
+    }
+    /**
+     * Check whether a secrets file already exists on disk.
+     */
+    async isInitialized() {
+        try {
+            await fs.access(this.secretsPath);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Rotate the encryption key by re-encrypting all secrets with a new
+     * passphrase. The old passphrase is required to unlock first.
+     */
+    async rotateKey(oldPassphrase, newPassphrase) {
+        // Unlock with old key
+        const raw = await fs.readFile(this.secretsPath);
+        const { salt, iv, authTag, ciphertext } = this.parseFile(raw);
+        const oldKey = await this.deriveKey(oldPassphrase, salt);
+        const plaintext = this.decrypt(ciphertext, iv, authTag, oldKey);
+        this.envelope = JSON.parse(plaintext);
+        // Re-encrypt with new key
+        this.derivedKey = await this.deriveKey(newPassphrase);
+        this.envelope.updatedAt = new Date().toISOString();
+        await this.flush();
+    }
+    // -----------------------------------------------------------------------
+    // Internals
+    // -----------------------------------------------------------------------
+    ensureUnlocked() {
+        if (!this.derivedKey || !this.envelope) {
+            throw new Error('SecretManager is not initialized. Call initialize() first.');
+        }
+    }
+    /**
+     * Derive an encryption key from a passphrase (or machine-id fallback)
+     * using PBKDF2. When `existingSalt` is provided, it is reused (unlock
+     * path); otherwise a new random salt is generated (create / rotate path).
+     */
+    deriveKey(passphrase, existingSalt) {
+        const material = passphrase ?? this.getMachineMaterial();
+        const salt = existingSalt ?? crypto.randomBytes(SALT_LENGTH);
+        return new Promise((resolve, reject) => {
+            crypto.pbkdf2(material, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST, (err, key) => {
+                if (err)
+                    return reject(err);
+                // Attach salt for later storage
+                key.__salt = salt;
+                resolve(key);
+            });
+        });
+    }
+    /**
+     * Returns a machine-specific string used as fallback key material when
+     * no passphrase is provided.
+     */
+    getMachineMaterial() {
+        const hostname = os.hostname();
+        const homedir = os.homedir();
+        const platform = os.platform();
+        const arch = os.arch();
+        return `buildhive:${hostname}:${homedir}:${platform}:${arch}`;
+    }
+    /**
+     * Encrypt plaintext using AES-256-GCM.
+     */
+    encrypt(plaintext) {
+        const iv = crypto.randomBytes(IV_LENGTH);
+        const cipher = crypto.createCipheriv(ALGORITHM, this.derivedKey, iv);
+        const encrypted = Buffer.concat([
+            cipher.update(plaintext, 'utf8'),
+            cipher.final(),
+        ]);
+        const authTag = cipher.getAuthTag();
+        return { iv, authTag, ciphertext: encrypted };
+    }
+    /**
+     * Decrypt ciphertext using AES-256-GCM.
+     */
+    decrypt(ciphertext, iv, authTag, key) {
+        const useKey = key ?? this.derivedKey;
+        const decipher = crypto.createDecipheriv(ALGORITHM, useKey, iv);
+        decipher.setAuthTag(authTag);
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return decrypted.toString('utf8');
+    }
+    /**
+     * Serialize the current envelope to the encrypted file.
+     */
+    async flush() {
+        const json = JSON.stringify(this.envelope);
+        const { iv, authTag, ciphertext } = this.encrypt(json);
+        const salt = this.derivedKey.__salt;
+        // Build binary file: MAGIC | VERSION | SALT | IV | AUTH_TAG | CIPHERTEXT
+        const header = Buffer.alloc(MAGIC.length + 1 + SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+        let offset = 0;
+        MAGIC.copy(header, offset);
+        offset += MAGIC.length;
+        header.writeUInt8(FORMAT_VERSION, offset);
+        offset += 1;
+        salt.copy(header, offset);
+        offset += SALT_LENGTH;
+        iv.copy(header, offset);
+        offset += IV_LENGTH;
+        authTag.copy(header, offset);
+        const file = Buffer.concat([header, ciphertext]);
+        await fs.mkdir(this.configDir, { recursive: true });
+        await fs.writeFile(this.secretsPath, file, { mode: SECRETS_FILE_MODE });
+    }
+    /**
+     * Parse the binary secrets file into its component parts.
+     */
+    parseFile(raw) {
+        if (raw.length < HEADER_SIZE) {
+            throw new Error('Secrets file is corrupted: too small');
+        }
+        let offset = 0;
+        const magic = raw.subarray(offset, offset + MAGIC.length);
+        offset += MAGIC.length;
+        if (!magic.equals(MAGIC)) {
+            throw new Error('Secrets file is corrupted: invalid magic bytes');
+        }
+        const version = raw.readUInt8(offset);
+        offset += 1;
+        if (version !== FORMAT_VERSION) {
+            throw new Error(`Unsupported secrets file version: ${version}`);
+        }
+        const salt = raw.subarray(offset, offset + SALT_LENGTH);
+        offset += SALT_LENGTH;
+        const iv = raw.subarray(offset, offset + IV_LENGTH);
+        offset += IV_LENGTH;
+        const authTag = raw.subarray(offset, offset + AUTH_TAG_LENGTH);
+        offset += AUTH_TAG_LENGTH;
+        const ciphertext = raw.subarray(offset);
+        return { salt, iv, authTag, ciphertext };
+    }
+}
+// ---------------------------------------------------------------------------
+// Config integration helper
+// ---------------------------------------------------------------------------
+/**
+ * Resolve any `secret:` prefixed values in an AgentConfig by looking them
+ * up in the SecretManager. Plain values are returned as-is for backward
+ * compatibility.
+ *
+ * Resolved fields:
+ *   - config.apiKey
+ *   - config.storageConfig.s3.accessKeyId
+ *   - config.storageConfig.s3.secretAccessKey
+ */
+export async function resolveSecrets(config, passphrase) {
+    // Check whether any field actually needs resolution
+    const fieldsToResolve = [];
+    if (config.apiKey?.startsWith(SECRET_REF_PREFIX)) {
+        fieldsToResolve.push('apiKey');
+    }
+    if (config.storageConfig?.s3?.accessKeyId?.startsWith(SECRET_REF_PREFIX)) {
+        fieldsToResolve.push('s3.accessKeyId');
+    }
+    if (config.storageConfig?.s3?.secretAccessKey?.startsWith(SECRET_REF_PREFIX)) {
+        fieldsToResolve.push('s3.secretAccessKey');
+    }
+    if (fieldsToResolve.length === 0) {
+        return config;
+    }
+    const sm = new SecretManager();
+    await sm.initialize(passphrase);
+    // Build a shallow copy so we never mutate the original config
+    const resolved = { ...config };
+    if (config.apiKey?.startsWith(SECRET_REF_PREFIX)) {
+        const key = config.apiKey.slice(SECRET_REF_PREFIX.length);
+        const value = await sm.getSecret(key);
+        if (value === null) {
+            throw new Error(`Secret reference "${key}" not found in SecretManager`);
+        }
+        resolved.apiKey = value;
+    }
+    if (config.storageConfig?.s3) {
+        const s3 = { ...config.storageConfig.s3 };
+        const storage = { ...config.storageConfig, s3 };
+        if (s3.accessKeyId?.startsWith(SECRET_REF_PREFIX)) {
+            const key = s3.accessKeyId.slice(SECRET_REF_PREFIX.length);
+            const value = await sm.getSecret(key);
+            if (value === null) {
+                throw new Error(`Secret reference "${key}" not found in SecretManager`);
+            }
+            s3.accessKeyId = value;
+        }
+        if (s3.secretAccessKey?.startsWith(SECRET_REF_PREFIX)) {
+            const key = s3.secretAccessKey.slice(SECRET_REF_PREFIX.length);
+            const value = await sm.getSecret(key);
+            if (value === null) {
+                throw new Error(`Secret reference "${key}" not found in SecretManager`);
+            }
+            s3.secretAccessKey = value;
+        }
+        resolved.storageConfig = storage;
+    }
+    return resolved;
+}
+// ---------------------------------------------------------------------------
+// CLI helper functions
+// ---------------------------------------------------------------------------
+/**
+ * Store a secret (for CLI use).
+ */
+export async function secretSet(key, value, passphrase) {
+    const sm = new SecretManager();
+    await sm.initialize(passphrase);
+    await sm.setSecret(key, value);
+}
+/**
+ * Retrieve a secret (for CLI use).
+ */
+export async function secretGet(key, passphrase) {
+    const sm = new SecretManager();
+    await sm.initialize(passphrase);
+    return sm.getSecret(key);
+}
+/**
+ * List all secret keys (for CLI use).
+ */
+export async function secretList(passphrase) {
+    const sm = new SecretManager();
+    await sm.initialize(passphrase);
+    return sm.listSecrets();
+}
+/**
+ * Delete a secret (for CLI use).
+ */
+export async function secretDelete(key, passphrase) {
+    const sm = new SecretManager();
+    await sm.initialize(passphrase);
+    return sm.deleteSecret(key);
+}
+//# sourceMappingURL=secretManager.js.map

package/dist/security/secretManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretManager.js","sourceRoot":"","sources":["../../src/security/secretManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AACjC,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAGzB,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,UAAU,GAAG,EAAE,CAAC,CAAC,WAAW;AAClC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,mBAAmB;AACzC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,WAAW;AACvC,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,iBAAiB,GAAG,OAAO,CAAC,CAAC,uBAAuB;AAC1D,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,wBAAwB;AACzD,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAY3B;;;;;;;;GAQG;AACH,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClC,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC;AAEjF,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,MAAM,OAAO,aAAa;IACP,SAAS,CAAS;IAClB,WAAW,CAAS;IAC7B,UAAU,GAAkB,IAAI,CAAC;IACjC,QAAQ,GAA2B,IAAI,CAAC;IAEhD,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;IAClE,CAAC;IAED,0EAA0E;IAC1E,aAAa;IACb,0EAA0E;IAE1E;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,UAAmB;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE1C,IAAI,MAAM,EAAE,CAAC;YACX,wBAAwB;YACxB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC9D,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAoB,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,yBAAyB;YACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,GAAG;gBACd,OAAO,EAAE,EAAE;gBACX,OAAO,EAAE,gBAAgB;gBACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;YACF,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACpC,IAAI,CAAC,QAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,QAAS,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACpD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAS,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS,CAAC,aAAqB,EAAE,aAAqB;QAC1D,sBAAsB;QACtB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAChD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAoB,CAAC;QAEzD,0BAA0B;QAC1B,IAAI,CAAC,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,0EAA0E;IAC1E,YAAY;IACZ,0EAA0E;IAElE,cAAc;QACpB,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,SAAS,CAAC,UAAmB,EAAE,YAAqB;QAC1D,MAAM,QAAQ,GAAG,UAAU,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,YAAY,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAE7D,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,CAAC,MAAM,CACX,QAAQ,EACR,IAAI,EACJ,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;gBACX,IAAI,GAAG;oBAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,gCAAgC;gBAC/B,GAAW,CAAC,MAAM,GAAG,IAAI,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,kBAAkB;QACxB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACvB,OAAO,aAAa,QAAQ,IAAI,OAAO,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;IAChE,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,SAAiB;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAW,EAAE,EAAE,CAAC,CAAC;QAEtE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC;YAChC,MAAM,CAAC,KAAK,EAAE;SACf,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChD,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,UAAkB,EAAE,EAAU,EAAE,OAAe,EAAE,GAAY;QAC3E,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,UAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,KAAK;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,IAAI,GAAY,IAAI,CAAC,UAAkB,CAAC,MAAM,CAAC;QAErD,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,GAAG,SAAS,GAAG,eAAe,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACnD,MAAM,CAAC,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,WAAW,CAAC;QACjD,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAAC,MAAM,IAAI,SAAS,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE7B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QAEjD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACK,SAAS,CAAC,GAAW;QAM3B,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,OAAO,KAAK,cAAc,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAAC,CAAC;QACxD,MAAM,IAAI,WAAW,CAAC;QAEtB,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC;QAEpB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC;QAC/D,MAAM,IAAI,eAAe,CAAC;QAE1B,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAExC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;CACF;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAmB,EACnB,UAAmB;IAEnB,oDAAoD;IACpD,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACjD,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACzE,eAAe,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7E,eAAe,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IAC7C,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAEhC,8DAA8D;IAC9D,MAAM,QAAQ,GAAgB,EAAE,GAAG,MAAM,EAAE,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACjD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,8BAA8B,CAAC,CAAC;QAC1E,CAAC;QACD,QAAQ,CAAC,MAAM,GAAG,KAAK,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC;QAEhD,IAAI,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YAClD,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YACD,EAAE,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,CAAC;QAED,IAAI,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YACD,EAAE,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,CAAC;QAED,QAAQ,CAAC,aAAa,GAAG,OAAO,CAAC;IACnC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,KAAa,EACb,UAAmB;IAEnB,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW,EACX,UAAmB;IAEnB,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAmB;IAClD,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC;AAC1B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAW,EACX,UAAmB;IAEnB,MAAM,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC;IAC/B,MAAM,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;IAChC,OAAO,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/security.d.ts

@@ -0,0 +1,134 @@
+/**
+ * Security Manager - Enhanced Docker security configuration and validation
+ *
+ * Provides comprehensive security measures for container execution including
+ * resource limits, network isolation, filesystem security, and monitoring.
+ *
+ * Requirements: 4.1, 4.2, 4.3, 4.4, 4.5
+ */
+export interface SecurityConfig {
+    maxMemoryMB: number;
+    maxCpuCores: number;
+    maxDiskSpaceMB: number;
+    maxProcesses: number;
+    maxFileDescriptors: number;
+    networkMode: 'none' | 'bridge';
+    allowedOutboundPorts: number[];
+    blockPrivateNetworks: boolean;
+    readOnlyRoot: boolean;
+    allowedWritePaths: string[];
+    tempDirSizeMB: number;
+    dropAllCapabilities: boolean;
+    allowedCapabilities: string[];
+    noNewPrivileges: boolean;
+    seccompProfile?: string;
+    apparmorProfile?: string;
+    maxExecutionTimeSeconds: number;
+    killTimeoutSeconds: number;
+    enableResourceMonitoring: boolean;
+    enableSecurityAuditing: boolean;
+    logSecurityEvents: boolean;
+}
+export interface SecurityViolation {
+    type: 'resource' | 'network' | 'filesystem' | 'capability' | 'execution';
+    severity: 'low' | 'medium' | 'high' | 'critical';
+    message: string;
+    containerId: string;
+    timestamp: Date;
+    details?: any;
+}
+export interface ResourceUsage {
+    memoryUsageMB: number;
+    cpuUsagePercent: number;
+    diskUsageMB: number;
+    processCount: number;
+    networkBytesIn: number;
+    networkBytesOut: number;
+}
+export declare class SecurityManager {
+    private config;
+    private violations;
+    private resourceMonitors;
+    constructor(config: SecurityConfig);
+    /**
+     * Generate secure Docker arguments for container creation
+     */
+    generateSecureDockerArgs(containerId: string): string[];
+    /**
+     * Validate container configuration against security policies
+     */
+    validateContainerConfig(config: any): Promise<SecurityViolation[]>;
+    /**
+     * Start resource monitoring for a container
+     */
+    startResourceMonitoring(containerId: string): Promise<void>;
+    /**
+     * Stop resource monitoring for a container
+     */
+    stopResourceMonitoring(containerId: string): void;
+    /**
+     * Get current resource usage for a container
+     */
+    getResourceUsage(containerId: string): Promise<ResourceUsage>;
+    /**
+     * Check if resource usage exceeds limits
+     */
+    private checkResourceLimits;
+    /**
+     * Handle execution timeout
+     */
+    private handleExecutionTimeout;
+    /**
+     * Create secure temporary directory for container
+     */
+    createSecureTempDir(containerId: string): Promise<string>;
+    /**
+     * Clean up secure temporary directory
+     */
+    cleanupSecureTempDir(tempDir: string): Promise<void>;
+    /**
+     * Validate Docker image security
+     */
+    validateImageSecurity(image: string): Promise<SecurityViolation[]>;
+    /**
+     * Get security violations
+     */
+    getViolations(): SecurityViolation[];
+    /**
+     * Clear security violations
+     */
+    clearViolations(): void;
+    /**
+     * Record a security violation
+     */
+    private recordViolation;
+    /**
+     * Check if a volume mount is unsafe
+     */
+    private isUnsafeMount;
+    /**
+     * Check if image is from trusted registry
+     */
+    private isTrustedImage;
+    /**
+     * Parse memory limit string to MB
+     */
+    private parseMemoryLimit;
+    /**
+     * Parse resource stats output
+     */
+    private parseResourceStats;
+    /**
+     * Parse memory usage string
+     */
+    private parseMemoryUsage;
+    /**
+     * Execute a system command
+     */
+    private executeCommand;
+    /**
+     * Cleanup all monitoring
+     */
+    cleanup(): void;
+}
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,MAAM,WAAW,cAAc;IAE7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAG3B,WAAW,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,oBAAoB,EAAE,OAAO,CAAC;IAG9B,YAAY,EAAE,OAAO,CAAC;IACtB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IAGtB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,eAAe,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IAGzB,uBAAuB,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,MAAM,CAAC;IAG3B,wBAAwB,EAAE,OAAO,CAAC;IAClC,sBAAsB,EAAE,OAAO,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,UAAU,GAAG,SAAS,GAAG,YAAY,GAAG,YAAY,GAAG,WAAW,CAAC;IACzE,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,CAAC,EAAE,GAAG,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,gBAAgB,CAAqC;gBAEjD,MAAM,EAAE,cAAc;IAKlC;;OAEG;IACH,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE;IA6DvD;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAkExE;;OAEG;IACG,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBjE;;OAEG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI;IASjD;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAkBnE;;OAEG;YACW,mBAAmB;IA6CjC;;OAEG;YACW,sBAAsB;IAqBpC;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkB/D;;OAEG;IACG,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS1D;;OAEG;IACG,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IA0CxE;;OAEG;IACH,aAAa,IAAI,iBAAiB,EAAE;IAIpC;;OAEG;IACH,eAAe,IAAI,IAAI;IAIvB;;OAEG;IACH,OAAO,CAAC,eAAe;IAiBvB;;OAEG;IACH,OAAO,CAAC,aAAa;IAuBrB;;OAEG;IACH,OAAO,CAAC,cAAc;IAiBtB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAexB;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAgB1B;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAgBxB;;OAEG;YACW,cAAc;IAoB5B;;OAEG;IACH,OAAO,IAAI,IAAI;CAOhB"}