kingwl
7b8c3a9b40
ctx.sandbox (dsh-sandbox): confine(argv, policy) returns the argv to spawn instead — wrapped so the process and its children run confined — plus the enforcement completeness and the backend denial/runner-failure dialects; no usable backend throws the fail-closed SANDBOX_UNAVAILABLE. Policy rides per call. dsh-sandbox-local selects by platform and caches the verdict: multi-candidate chains probe FUNCTIONALLY in preference order (Linux: bwrap → the registry-installed node-addon-landlock-run launcher), a sole candidate is selected unprobed (darwin: sandbox-exec/Seatbelt) and fails closed at execution via runnerFailureSignatures; win32 is a reserved empty chain. Profile parity is honest per backend (documented temp-area and ABI differences; enforcement full|partial is a structured result fact). CI: the sandbox-e2e matrix proves real-kernel confinement per rung (bwrap, Landlock per architecture through the registry-installed launcher, Seatbelt), failing on a silent all-skip; the packed-install rehearsal installs the launcher family from the registry and asserts the binary executable apart from kernel enforcement.
29 lines
1.1 KiB
TypeScript
29 lines
1.1 KiB
TypeScript
import { defineConfig } from 'tsdown'
|
|
|
|
/**
|
|
* JS bundling for all workspace packages (vendor and the packages hierarchy).
|
|
* TypeScript source is compiled first by `tsc -b tsconfig.build.json`; tsdown
|
|
* reads only the emitted JS under lib/types and writes lib/index.* runtime
|
|
* bundles. Declarations are NOT produced here, hence `dts: false`.
|
|
*
|
|
* Per-package shape overrides live in `<package>/tsdown.config.ts`
|
|
* (schemastery: dual ESM+CJS; logger-console: extra browser entry).
|
|
*/
|
|
export default defineConfig({
|
|
// Explicit globs: `workspace: true` would also discover examples (any
|
|
// package.json), but only vendor and the packages hierarchy are pnpm
|
|
// workspaces. The Landlock launcher platform packages ship a prebuilt
|
|
// native binary and no JavaScript — nothing to bundle.
|
|
workspace: ['vendor/*', 'packages/*/*'],
|
|
entry: ['lib/types/index.js'],
|
|
outDir: 'lib',
|
|
format: ['esm'],
|
|
platform: 'node',
|
|
target: 'es2024',
|
|
// All packages set "type": "module"; fixedExtension false keeps ESM output
|
|
// at .js (not .mjs), matching the package.json main/exports fields.
|
|
fixedExtension: false,
|
|
dts: false,
|
|
clean: false,
|
|
})
|