ffp-sql-sandbox 0.1.0

package/INTEGRATION.md

@@ -0,0 +1,37 @@
+# Integrating ffp-sql-sandbox with ChuTingzj/ai-bi
+
+This repository does **not** wire the library into [ChuTingzj/ai-bi](https://github.com/ChuTingzj/ai-bi). Keep that as a follow-up PR in ai-bi after this package is a real dependency, tests are green, and there are no P0s.
+
+## Adapter shape
+
+Keep NestJS, `CryptoService`, and `DataSource` inside ai-bi. Do not leak those types into this library.
+
+Suggested adapter (ai-bi `SandboxService`):
+
+1. Decrypt `dataSource.password` with the existing `CryptoService`.
+2. Call `validateSql` / `executeSql` from `ffp-sql-sandbox`.
+3. Map `{ ok: true, data }` → the current `SandboxResult` / `QueryResult` shape (`success` / `columns`+`rows`).
+4. Map `{ ok: false, code, error }` → `{ success: false, error }`.
+
+## Host rewrite stays in ai-bi
+
+`resolveSandboxDbHost` is **not** a public export of this package (on purpose).
+
+ai-bi may keep its private loopback → `host.docker.internal` helper for its own tests and Docker-on-Linux setups. If the adapter rewrites the host *before* calling `executeSql`, put the rewritten name on `hostAllowlist` as well.
+
+Alternatively, pass the original host (`localhost`, `db.internal`, …) in `connection.host`, allowlist **that** name, and let this library apply a private rewrite after the allowlist check. Either way, user-controlled hosts must not bypass `hostAllowlist`.
+
+## What not to copy from the old sandbox
+
+| Old ai-bi behavior | v1 library |
+| --- | --- |
+| `DB_PASS` / password in container `Env` | Forbidden. Password goes to tmpfs `/run/secrets/db_password`. |
+| `Cmd: [sql]` | SQL on stdin JSON. |
+| Floating `SANDBOX_IMAGE=ai-bi-sandbox:latest` | Default image digest-pinned; custom `image` is untrusted. |
+| Configurable validator prefixes/patterns | Not exposed. `validateSql(sql)` only. |
+| Wait for container + `logs()` then parse/truncate | Streaming attach; `maxRows` / `maxBytes` applied as data arrives. |
+| Regex as the security proof | Documented as fail-fast only. Proof is RO role + limits + allowlist. |
+
+## Image
+
+Build `sandbox/Dockerfile` from this repo (or pull the published digest) and configure ai-bi to use `DEFAULT_SANDBOX_IMAGE` or an explicit digest-pinned ref. Do not default to `:latest`.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 FFP-Tech-Lab (From First Principle)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,144 @@
+# ffp-sql-sandbox
+
+Read-only SQL sandbox primitives for Node.js: fail-fast `validateSql` plus one-shot Docker `executeSql` with hard resource, row, byte, timeout, and host-allowlist limits.
+
+This is the v1 library extracted from the sandbox ideas in [ChuTingzj/ai-bi](https://github.com/ChuTingzj/ai-bi) (`validateSql` + dockerode one-shot container) and redesigned around a stricter security model. It is **not** wired into ai-bi in this repository — see [INTEGRATION.md](./INTEGRATION.md).
+
+## Install
+
+```bash
+pnpm add ffp-sql-sandbox
+```
+
+Docker is a **hard dependency** of `executeSql`. If the engine cannot be pinged, the call fails with `DOCKER_UNAVAILABLE` rather than falling back to in-process SQL.
+
+Build the runner image from `sandbox/Dockerfile` (digest-pinned `FROM`) and either publish it at the default ref below or pass `image` (untrusted override).
+
+```bash
+docker build -t ghcr.io/ffp-tech-lab/ffp-sql-sandbox-runner:v1 ./sandbox
+```
+
+## Public API
+
+```ts
+import {
+  validateSql,
+  executeSql,
+  DEFAULT_SANDBOX_LIMITS,
+  DEFAULT_SANDBOX_IMAGE,
+} from 'ffp-sql-sandbox'
+
+validateSql(sql: string): { ok: true } | { ok: false; code: string; reason: string }
+
+executeSql(input: {
+  sql: string
+  connection: {
+    type: 'postgres' | 'mysql'
+    host: string
+    port: number
+    user: string
+    password: string  // never placed in container Env
+    database: string
+  }
+  hostAllowlist: string[]  // required
+  limits?: Partial<SandboxLimits>
+  image?: string  // untrusted override; default image is digest-pinned
+}): Promise<
+  | { ok: true; data: { columns: string[]; rows: unknown[][]; truncated?: boolean } }
+  | { ok: false; code: string; error: string }
+>
+```
+
+`validateSql` is fail-fast only. There are no `allowPrefixes` / `forbidPatterns` options.
+
+`resolveSandboxDbHost` is **not** exported. Loopback rewrite for container DNS, if needed, stays private (and, for ai-bi, in the adapter — see INTEGRATION.md).
+
+## Non-goals
+
+- Natural language → SQL, query guidance, schema sync, or an AST parser as a required v1 component
+- A multi-tenant auth / connection-pool product
+- Claiming absolute network isolation (the runner uses Docker `bridge` so it can reach the allowlisted database)
+- Exporting `resolveSandboxDbHost` as public API
+- Making `validateSql` a proof of safety (it is a cheap reject, not a guarantee)
+
+## Threat model
+
+Proof that a query cannot mutate data or exfiltrate unbounded results does **not** come from regex. v1 proof is the combination of:
+
+| Guard | What it actually does |
+| --- | --- |
+| 1. Read-only DB role | **Caller must connect as a read-only role** (and/or a `READ ONLY` transaction). The library also sets `statement_timeout` and *prefers* a read-only session (`SET SESSION CHARACTERISTICS AS TRANSACTION READ ONLY` on Postgres, `SET SESSION TRANSACTION READ ONLY` on MySQL) when the dialect allows it. If that `SET` is ignored or the role can override it, the database role is still the real write barrier. |
+| 2. Container limits + dual timeout | Memory, nano-CPUs, PID cap, dropped capabilities. **Dual timeout**: the runner sets DB `statement_timeout` / `MAX_EXECUTION_TIME` to `timeoutMs`, and the host kills the container after `timeoutMs + 2000ms` if it is still running. |
+| 3. Streaming `maxRows` / `maxBytes` | The runner applies limits **as rows arrive** and stops/cancels instead of buffering the full result. The host consumer is a backstop on the live Docker attach stream. **Demux-then-truncate of a completed log buffer is not the limits implementation.** |
+| 4. `connection.host` allowlist | SSRF defense. `hostAllowlist` is required. Hosts not on the list are rejected **before** any container is created. No arbitrary hosts, no glob, no CIDR in v1 — exact match after trim + case-insensitive compare. |
+
+Passwords are written to a **tmpfs** file at `/run/secrets/db_password` inside the container (mode/uid for the `node` user). They are **never** placed in container `Env` (no `DB_PASS`, `PGPASSWORD`, or `MYSQL_PWD`). SQL is sent on stdin JSON, not `Cmd`, so `docker inspect` does not show the password.
+
+### Default image vs custom image
+
+| Image | Trust |
+| --- | --- |
+| `DEFAULT_SANDBOX_IMAGE` (`…@sha256:…`) | Digest-pinned default. Treat as the supported runner. |
+| `image` override | **Untrusted.** Allowed so callers can build locally, but a custom image can ignore streaming caps, log secrets, or exfiltrate. Pin and review your own image if you override. |
+
+The Dockerfile `FROM` line is also digest-pinned (`node:22-bookworm-slim@sha256:83f487e0a63425e5b4d146fb5e5be574bcbe1b7b843d3ebafdd95eaf7767a7e5`).
+
+Until GHCR publish, `DEFAULT_SANDBOX_IMAGE` is a **content digest** of the v1 runner files, not a registry-pullable image. `executeSql` without `image` will return `IMAGE_UNAVAILABLE` if that digest is not present locally. Build `sandbox/Dockerfile` and pass `image` (untrusted override), or `docker load` / retag the digest-pinned image. After the first registry push, replace the constant with `docker buildx imagetools inspect` output.
+
+## Default limits
+
+| Limit | Default | Role |
+| --- | --- | --- |
+| `timeoutMs` | `10000` | DB `statement_timeout` / `MAX_EXECUTION_TIME`, plus container kill at `timeoutMs + 2000` |
+| `memoryMb` | `128` | Container memory (and memory-swap) cap |
+| `nanoCpus` | `500000000` (0.5 CPU) | Container CFS quota |
+| `maxRows` | `1000` | Streaming row cap; result may set `truncated: true` |
+| `maxBytes` | `1000000` | Streaming serialized-row / stdout byte cap; result may set `truncated: true` |
+
+## `hostAllowlist` contract
+
+- Required on every `executeSql` call.
+- Empty list → `HOST_NOT_ALLOWED` (deny all).
+- Compared against the **caller-supplied** `connection.host` (trimmed, case-insensitive). The library may rewrite loopback (`localhost`, `127.0.0.1`, `::1`, `0.0.0.0`) to `host.docker.internal` *after* the allowlist check so the container can reach a DB on the Docker host. That rewrite is private and not a public API.
+- Put the host you actually pass in on the list (e.g. `db.internal` or `localhost`). Do not accept user-controlled hosts without your own allowlist.
+
+## `validateSql` is fail-fast only (known bypasses)
+
+`validateSql` is a cheap prefix + keyword + multi-statement reject. **Do not treat a `{ ok: true }` as authorization to run SQL outside this sandbox.** Known classes:
+
+| Class | Example | Notes |
+| --- | --- | --- |
+| Writes that still look like `SELECT` | `SELECT … INTO …`, `SELECT pg_file_write(...)` | Prefix allowlist does not model Postgres side effects. **Read-only role** is the guard. |
+| False positives | `SELECT * FROM t WHERE action = 'UPDATE'` | Keyword scan is not an AST. Fail-fast, not completeness. |
+| Comment / encoding tricks | Leading `--` comments, Unicode homoglyphs | Rejected or missed; not a parser. |
+| Expensive reads | `SELECT * FROM huge_table` | Allowed by regex; stopped by timeout + `maxRows`/`maxBytes` + role. |
+| Multi-statement via protocol | Driver-level stacked queries if the runner used a naive exec | Runner sends a single query text; DB role + `READ ONLY` still apply. |
+| Network | `dblink`, `http` FDW, `LOAD_FILE` | Allowlist is on `connection.host`, not on SQL-level network functions. Use a locked-down role. |
+
+## Error codes
+
+| Code | Where |
+| --- | --- |
+| `NOT_READ_ONLY_PREFIX` | `validateSql` / `executeSql` |
+| `FORBIDDEN_KEYWORD` | `validateSql` / `executeSql` |
+| `MULTI_STATEMENT` | `validateSql` / `executeSql` |
+| `HOST_NOT_ALLOWED` | `executeSql` |
+| `DOCKER_UNAVAILABLE` | `executeSql` |
+| `TIMEOUT` | `executeSql` |
+| `INVALID_LIMITS` | `executeSql` |
+| `IMAGE_UNPINNED` | `executeSql` (default image missing digest) |
+| `IMAGE_UNAVAILABLE` | `executeSql` (image missing locally / not pullable; default digest is unpublished until GHCR) |
+| `UNSUPPORTED_DIALECT` | `executeSql` |
+| `EXECUTION_FAILED` | `executeSql` |
+
+## Scripts
+
+```bash
+pnpm test       # node:test via tsx
+pnpm typecheck
+pnpm build
+```
+
+## License
+
+MIT. The GitHub repository may stay private until the org publishes it; that does not change the source license.

package/dist/docker-executor.d.ts

@@ -0,0 +1,6 @@
+import { type DockerLike, type DockerRunRequest } from './docker-types.js';
+import type { ExecuteSqlResult } from './types.js';
+export type { DockerLike, DockerRunRequest } from './docker-types.js';
+export declare function createDefaultDocker(): DockerLike;
+export declare function runInSandbox(docker: DockerLike, request: DockerRunRequest): Promise<ExecuteSqlResult>;
+//# sourceMappingURL=docker-executor.d.ts.map

package/dist/docker-executor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-executor.d.ts","sourceRoot":"","sources":["../src/docker-executor.ts"],"names":[],"mappings":"AAGA,OAAO,EAEL,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAKtE,wBAAgB,mBAAmB,IAAI,UAAU,CAEhD;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,gBAAgB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CA0K3B"}

package/dist/docker-executor.js

@@ -0,0 +1,192 @@
+import Docker from 'dockerode';
+import { createPasswordTar } from './password-tar.js';
+import { consumeNdjsonResult } from './stream-consumer.js';
+import { demuxStdout, } from './docker-types.js';
+const CONTAINER_KILL_GRACE_MS = 2_000;
+const SECRET_MOUNT = '/run/secrets';
+export function createDefaultDocker() {
+    return new Docker();
+}
+export async function runInSandbox(docker, request) {
+    let container = null;
+    let timedOut = false;
+    let killedForLimit = false;
+    let attachStream = null;
+    const containerTimeoutMs = request.timeoutMs + CONTAINER_KILL_GRACE_MS;
+    let killTimer;
+    try {
+        container = await docker.createContainer({
+            Image: request.image,
+            AttachStdin: true,
+            AttachStdout: true,
+            AttachStderr: true,
+            OpenStdin: true,
+            StdinOnce: true,
+            Tty: false,
+            Env: request.env,
+            HostConfig: {
+                Memory: request.memoryBytes,
+                MemorySwap: request.memoryBytes,
+                NanoCpus: request.nanoCpus,
+                NetworkMode: 'bridge',
+                ExtraHosts: ['host.docker.internal:host-gateway'],
+                AutoRemove: false,
+                CapDrop: ['ALL'],
+                SecurityOpt: ['no-new-privileges:true'],
+                PidsLimit: 256,
+                Tmpfs: {
+                    [SECRET_MOUNT]: 'rw,noexec,nosuid,size=1m,mode=0700,uid=1000,gid=1000',
+                },
+            },
+            Labels: {
+                'ffp.sql-sandbox': 'v1',
+            },
+        });
+        await container.start();
+        killTimer = setTimeout(() => {
+            timedOut = true;
+            void container?.kill().catch(() => undefined);
+            destroyStream(attachStream);
+        }, containerTimeoutMs);
+        await container.putArchive(createPasswordTar(request.password), {
+            path: SECRET_MOUNT,
+        });
+        attachStream = await container.attach({
+            stream: true,
+            stdin: true,
+            stdout: true,
+            stderr: true,
+            hijack: true,
+        });
+        const writable = attachStream;
+        if (typeof writable.write === 'function') {
+            writable.write(request.stdinJson);
+            if (typeof writable.end === 'function') {
+                writable.end();
+            }
+        }
+        const stdout = demuxStdout(attachStream);
+        const consumed = consumeNdjsonResult(stdout, {
+            maxRows: request.maxRows,
+            maxBytes: request.maxBytes,
+            abort: () => {
+                killedForLimit = true;
+                destroyStream(attachStream);
+                void container?.kill().catch(() => undefined);
+            },
+        });
+        const wait = container.wait();
+        let hangTimer;
+        const hang = new Promise((_, reject) => {
+            hangTimer = setTimeout(() => {
+                timedOut = true;
+                reject(Object.assign(new Error('timeout'), { code: 'TIMEOUT' }));
+            }, containerTimeoutMs + 50);
+        });
+        let result;
+        try {
+            result = await Promise.race([
+                Promise.all([consumed, wait]).then(([data, status]) => ({
+                    data,
+                    status,
+                })),
+                hang,
+            ]);
+        }
+        finally {
+            if (hangTimer !== undefined) {
+                clearTimeout(hangTimer);
+            }
+        }
+        if (timedOut) {
+            return {
+                ok: false,
+                code: 'TIMEOUT',
+                error: `SQL execution timed out after ${request.timeoutMs}ms (container kill + statement_timeout)`,
+            };
+        }
+        if (result.data.error) {
+            return { ok: false, code: 'EXECUTION_FAILED', error: result.data.error };
+        }
+        if (result.status.StatusCode !== 0 && !result.data.truncated && !killedForLimit) {
+            return {
+                ok: false,
+                code: 'EXECUTION_FAILED',
+                error: result.data.error ?? 'Sandbox runner exited with a non-zero status',
+            };
+        }
+        const data = {
+            columns: result.data.columns,
+            rows: result.data.rows,
+        };
+        if (result.data.truncated) {
+            data.truncated = true;
+        }
+        return { ok: true, data };
+    }
+    catch (err) {
+        if (timedOut) {
+            return {
+                ok: false,
+                code: 'TIMEOUT',
+                error: `SQL execution timed out after ${request.timeoutMs}ms (container kill + statement_timeout)`,
+            };
+        }
+        if (isImageUnavailableError(err)) {
+            return {
+                ok: false,
+                code: 'IMAGE_UNAVAILABLE',
+                error: imageUnavailableMessage(request),
+            };
+        }
+        return {
+            ok: false,
+            code: 'EXECUTION_FAILED',
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+    finally {
+        if (killTimer !== undefined) {
+            clearTimeout(killTimer);
+        }
+        destroyStream(attachStream);
+        if (container) {
+            try {
+                await container.kill();
+            }
+            catch {
+                // already exited
+            }
+            try {
+                await container.remove({ force: true });
+            }
+            catch {
+                // already removed
+            }
+        }
+    }
+}
+function destroyStream(stream) {
+    if (!stream) {
+        return;
+    }
+    if ('destroy' in stream && typeof stream.destroy === 'function') {
+        stream.destroy();
+    }
+}
+function isImageUnavailableError(err) {
+    const status = typeof err === 'object' && err !== null && 'statusCode' in err
+        ? Number(err.statusCode)
+        : undefined;
+    const msg = err instanceof Error ? err.message : String(err);
+    return (status === 404 ||
+        /no such image/i.test(msg) ||
+        /\(HTTP code 404\).*image/i.test(msg));
+}
+function imageUnavailableMessage(request) {
+    if (request.usingDefaultImage) {
+        return `Default sandbox image is not pullable (${request.image}). Until GHCR publish, build sandbox/Dockerfile locally and pass image: '<tag-or-id>' (untrusted override), or docker load/tag the digest-pinned image.`;
+    }
+    return `Sandbox image not found: ${request.image}. Build or pull it before calling executeSql.`;
+}
+//# sourceMappingURL=docker-executor.js.map

package/dist/docker-executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-executor.js","sourceRoot":"","sources":["../src/docker-executor.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EACL,WAAW,GAGZ,MAAM,mBAAmB,CAAC;AAK3B,MAAM,uBAAuB,GAAG,KAAK,CAAC;AACtC,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC,MAAM,UAAU,mBAAmB;IACjC,OAAO,IAAI,MAAM,EAA2B,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAkB,EAClB,OAAyB;IAEzB,IAAI,SAAS,GACX,IAAI,CAAC;IACP,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,YAAY,GACd,IAAI,CAAC;IAEP,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,GAAG,uBAAuB,CAAC;IACvE,IAAI,SAAoD,CAAC;IAEzD,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;YACvC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,WAAW;gBAC3B,UAAU,EAAE,OAAO,CAAC,WAAW;gBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,WAAW,EAAE,QAAQ;gBACrB,UAAU,EAAE,CAAC,mCAAmC,CAAC;gBACjD,UAAU,EAAE,KAAK;gBACjB,OAAO,EAAE,CAAC,KAAK,CAAC;gBAChB,WAAW,EAAE,CAAC,wBAAwB,CAAC;gBACvC,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE;oBACL,CAAC,YAAY,CAAC,EAAE,sDAAsD;iBACvE;aACF;YACD,MAAM,EAAE;gBACN,iBAAiB,EAAE,IAAI;aACxB;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACvB,MAAM,SAAS,CAAC,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE;YAC9D,IAAI,EAAE,YAAY;SACnB,CAAC,CAAC;QAEH,YAAY,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAqC,CAAC;QACvD,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACzC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAClC,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;gBACvC,QAAQ,CAAC,GAAG,EAAE,CAAC;YACjB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,WAAW,CAAC,YAA8C,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,GAAG,EAAE;gBACV,cAAc,GAAG,IAAI,CAAC;gBACtB,aAAa,CAAC,YAAY,CAAC,CAAC;gBAC5B,KAAK,SAAS,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChD,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,SAAoD,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC5C,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC1B,QAAQ,GAAG,IAAI,CAAC;gBAChB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACnE,CAAC,EAAE,kBAAkB,GAAG,EAAE,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QAEH,IAAI,MAGH,CAAC;QACF,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBACtD,IAAI;oBACJ,MAAM;iBACP,CAAC,CAAC;gBACH,IAAI;aACL,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,iCAAiC,OAAO,CAAC,SAAS,yCAAyC;aACnG,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3E,CAAC;QAED,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,EAAE,CAAC;YAChF,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,kBAAkB;gBACxB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,8CAA8C;aAC3E,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAkE;YAC1E,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,iCAAiC,OAAO,CAAC,SAAS,yCAAyC;aACnG,CAAC;QACJ,CAAC;QACD,IAAI,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAC;YACjC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,uBAAuB,CAAC,OAAO,CAAC;aACxC,CAAC;QACJ,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;QACD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC5B,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;YACzB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,MAA6D;IAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,IAAI,SAAS,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChE,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,GAAY;IAC3C,MAAM,MAAM,GACV,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,YAAY,IAAI,GAAG;QAC5D,CAAC,CAAC,MAAM,CAAE,GAA+B,CAAC,UAAU,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CACL,MAAM,KAAK,GAAG;QACd,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAyB;IACxD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,0CAA0C,OAAO,CAAC,KAAK,yJAAyJ,CAAC;IAC1N,CAAC;IACD,OAAO,4BAA4B,OAAO,CAAC,KAAK,+CAA+C,CAAC;AAClG,CAAC"}

package/dist/docker-types.d.ts

@@ -0,0 +1,37 @@
+import { PassThrough, type Readable } from 'node:stream';
+export type ContainerLike = {
+    start: () => Promise<unknown>;
+    putArchive: (tar: Buffer | NodeJS.ReadableStream, opts: {
+        path: string;
+    }) => Promise<unknown>;
+    attach: (opts: unknown) => Promise<NodeJS.ReadWriteStream | Readable>;
+    wait: () => Promise<{
+        StatusCode: number;
+    }>;
+    kill: () => Promise<unknown>;
+    remove: (opts?: unknown) => Promise<unknown>;
+};
+export type DockerLike = {
+    ping: () => Promise<unknown>;
+    createContainer: (opts: Record<string, unknown>) => Promise<ContainerLike>;
+};
+export type DockerRunRequest = {
+    image: string;
+    usingDefaultImage: boolean;
+    env: string[];
+    password: string;
+    stdinJson: string;
+    memoryBytes: number;
+    nanoCpus: number;
+    timeoutMs: number;
+    maxRows: number;
+    maxBytes: number;
+};
+/**
+ * Incrementally demux Docker's 8-byte multiplexed attach stream.
+ * Tty:false attach is always multiplexed — buffer until a full 8-byte header.
+ * Type-1 (stdout) and type-2 (stderr) payloads are forwarded to the NDJSON
+ * consumer so runner `{type:"error"}` events are not dropped.
+ */
+export declare function demuxStdout(stream: AsyncIterable<Buffer | string>): PassThrough;
+//# sourceMappingURL=docker-types.d.ts.map

package/dist/docker-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-types.d.ts","sourceRoot":"","sources":["../src/docker-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,KAAK,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,CACV,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,cAAc,EACnC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,KACnB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,eAAe,GAAG,QAAQ,CAAC,CAAC;IACtE,IAAI,EAAE,MAAM,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC5C,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC;CAC5E,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,OAAO,CAAC;IAC3B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,WAAW,CAsB/E"}

package/dist/docker-types.js

@@ -0,0 +1,50 @@
+import { PassThrough } from 'node:stream';
+/**
+ * Incrementally demux Docker's 8-byte multiplexed attach stream.
+ * Tty:false attach is always multiplexed — buffer until a full 8-byte header.
+ * Type-1 (stdout) and type-2 (stderr) payloads are forwarded to the NDJSON
+ * consumer so runner `{type:"error"}` events are not dropped.
+ */
+export function demuxStdout(stream) {
+    const stdout = new PassThrough();
+    let carry = Buffer.alloc(0);
+    void (async () => {
+        try {
+            for await (const chunk of stream) {
+                const incoming = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                const joined = Buffer.concat([carry, incoming]);
+                const extracted = extractMuxed(joined);
+                carry = Buffer.from(extracted.rest);
+                if (extracted.stdout.length > 0) {
+                    stdout.write(extracted.stdout);
+                }
+            }
+            stdout.end();
+        }
+        catch (err) {
+            stdout.destroy(err instanceof Error ? err : new Error(String(err)));
+        }
+    })();
+    return stdout;
+}
+function extractMuxed(buffer) {
+    const stdoutChunks = [];
+    let offset = 0;
+    while (offset + 8 <= buffer.length) {
+        const size = buffer.readUInt32BE(offset + 4);
+        if (offset + 8 + size > buffer.length) {
+            break;
+        }
+        const streamType = buffer[offset];
+        const payload = buffer.subarray(offset + 8, offset + 8 + size);
+        if (streamType === 1 || streamType === 2) {
+            stdoutChunks.push(payload);
+        }
+        offset += 8 + size;
+    }
+    return {
+        stdout: Buffer.concat(stdoutChunks),
+        rest: buffer.subarray(offset),
+    };
+}
+//# sourceMappingURL=docker-types.js.map

package/dist/docker-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-types.js","sourceRoot":"","sources":["../src/docker-types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAiB,MAAM,aAAa,CAAC;AAgCzD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAsC;IAChE,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE5B,KAAK,CAAC,KAAK,IAAI,EAAE;QACf,IAAI,CAAC;YACH,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACjC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChD,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpC,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAChC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IAEL,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;YACtC,MAAM;QACR,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAC/D,IAAI,UAAU,KAAK,CAAC,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACzC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;QACnC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC"}

package/dist/execute-sql.d.ts

@@ -0,0 +1,9 @@
+import type { DockerLike } from './docker-types.js';
+import type { ExecuteSqlInput, ExecuteSqlResult } from './types.js';
+export type { ExecuteSqlInput, ExecuteSqlResult } from './types.js';
+export type { DockerLike } from './docker-types.js';
+export type ExecuteSqlDeps = {
+    docker?: DockerLike;
+};
+export declare function executeSql(input: ExecuteSqlInput, deps?: ExecuteSqlDeps): Promise<ExecuteSqlResult>;
+//# sourceMappingURL=execute-sql.d.ts.map

package/dist/execute-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-sql.d.ts","sourceRoot":"","sources":["../src/execute-sql.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EACV,eAAe,EACf,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB,CAAC;AAEF,wBAAsB,UAAU,CAC9B,KAAK,EAAE,eAAe,EACtB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,gBAAgB,CAAC,CAwE3B"}

package/dist/execute-sql.js

@@ -0,0 +1,89 @@
+import { validateSql } from './validate-sql.js';
+import { hostIsAllowlisted } from './host-allowlist.js';
+import { mergeLimits } from './limits.js';
+import { DEFAULT_SANDBOX_IMAGE, isDigestPinnedImage } from './image.js';
+import { rewriteLoopbackHost } from './rewrite-host.js';
+import { createDefaultDocker, runInSandbox, } from './docker-executor.js';
+export async function executeSql(input, deps = {}) {
+    const validation = validateSql(input.sql);
+    if (!validation.ok) {
+        return {
+            ok: false,
+            code: validation.code,
+            error: validation.reason,
+        };
+    }
+    if (!hostIsAllowlisted(input.connection.host, input.hostAllowlist)) {
+        return {
+            ok: false,
+            code: 'HOST_NOT_ALLOWED',
+            error: `connection.host ${JSON.stringify(input.connection.host)} is not on hostAllowlist`,
+        };
+    }
+    const dialect = parseDialect(input.connection.type);
+    if (!dialect.ok) {
+        return dialect;
+    }
+    const merged = mergeLimits(input.limits);
+    if (!merged.ok) {
+        return { ok: false, code: 'INVALID_LIMITS', error: merged.error };
+    }
+    const image = input.image ?? DEFAULT_SANDBOX_IMAGE;
+    if (input.image === undefined && !isDigestPinnedImage(image)) {
+        return {
+            ok: false,
+            code: 'IMAGE_UNPINNED',
+            error: 'Default sandbox image must be pinned by sha256 digest',
+        };
+    }
+    const docker = deps.docker ?? createDefaultDocker();
+    try {
+        await docker.ping();
+    }
+    catch (err) {
+        return {
+            ok: false,
+            code: 'DOCKER_UNAVAILABLE',
+            error: `Docker is required to execute SQL. Could not ping the Docker engine: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    const dbHost = rewriteLoopbackHost(input.connection.host);
+    const env = [
+        `DB_TYPE=${dialect.type}`,
+        `DB_HOST=${dbHost}`,
+        `DB_PORT=${input.connection.port}`,
+        `DB_USER=${input.connection.user}`,
+        `DB_NAME=${input.connection.database}`,
+        `QUERY_TIMEOUT=${merged.limits.timeoutMs}`,
+        `MAX_ROWS=${merged.limits.maxRows}`,
+        `MAX_BYTES=${merged.limits.maxBytes}`,
+    ];
+    return runInSandbox(docker, {
+        image,
+        usingDefaultImage: input.image === undefined,
+        env,
+        password: input.connection.password,
+        stdinJson: JSON.stringify({ sql: input.sql }) + '\n',
+        memoryBytes: merged.limits.memoryMb * 1024 * 1024,
+        nanoCpus: merged.limits.nanoCpus,
+        timeoutMs: merged.limits.timeoutMs,
+        maxRows: merged.limits.maxRows,
+        maxBytes: merged.limits.maxBytes,
+    });
+}
+function parseDialect(type) {
+    switch (type) {
+        case 'postgres':
+        case 'mysql':
+            return { ok: true, type };
+        default: {
+            const unexpected = type;
+            return {
+                ok: false,
+                code: 'UNSUPPORTED_DIALECT',
+                error: `Unsupported dialect: ${String(unexpected)}`,
+            };
+        }
+    }
+}
+//# sourceMappingURL=execute-sql.js.map

package/dist/execute-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execute-sql.js","sourceRoot":"","sources":["../src/execute-sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EACL,mBAAmB,EACnB,YAAY,GACb,MAAM,sBAAsB,CAAC;AAe9B,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAAsB,EACtB,OAAuB,EAAE;IAEzB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,KAAK,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,KAAK,EAAE,mBAAmB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,0BAA0B;SAC1F,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,qBAAqB,CAAC;IACnD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,uDAAuD;SAC/D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,wEAAwE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SAClI,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG;QACV,WAAW,OAAO,CAAC,IAAI,EAAE;QACzB,WAAW,MAAM,EAAE;QACnB,WAAW,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;QAClC,WAAW,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE;QAClC,WAAW,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE;QACtC,iBAAiB,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE;QAC1C,YAAY,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QACnC,aAAa,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE;KACtC,CAAC;IAEF,OAAO,YAAY,CAAC,MAAM,EAAE;QAC1B,KAAK;QACL,iBAAiB,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS;QAC5C,GAAG;QACH,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,QAAQ;QACnC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI;QACpD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI;QACjD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;QAChC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;QAClC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO;QAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;KACjC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CACnB,IAAgB;IAEhB,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,wBAAwB,MAAM,CAAC,UAAU,CAAC,EAAE;aACpD,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/host-allowlist.d.ts

@@ -0,0 +1,2 @@
+export declare function hostIsAllowlisted(host: string, hostAllowlist: string[]): boolean;
+//# sourceMappingURL=host-allowlist.d.ts.map

package/dist/host-allowlist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-allowlist.d.ts","sourceRoot":"","sources":["../src/host-allowlist.ts"],"names":[],"mappings":"AAAA,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,EAAE,GACtB,OAAO,CAST"}

package/dist/host-allowlist.js

@@ -0,0 +1,9 @@
+export function hostIsAllowlisted(host, hostAllowlist) {
+    const normalized = host.trim().toLowerCase();
+    if (normalized.length === 0) {
+        return false;
+    }
+    const allowed = new Set(hostAllowlist.map((entry) => entry.trim().toLowerCase()).filter(Boolean));
+    return allowed.has(normalized);
+}
+//# sourceMappingURL=host-allowlist.js.map

package/dist/host-allowlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-allowlist.js","sourceRoot":"","sources":["../src/host-allowlist.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,iBAAiB,CAC/B,IAAY,EACZ,aAAuB;IAEvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACzE,CAAC;IACF,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACjC,CAAC"}