{"_id":"nono-ts","name":"nono-ts","dist-tags":{"latest":"0.3.0"},"versions":{"0.3.0":{"name":"nono-ts","version":"0.3.0","description":"Node.js/TypeScript bindings for nono capability-based sandboxing","main":"index.js","types":"index.d.ts","license":"Apache-2.0","author":{"name":"Luke Hinds"},"keywords":["sandbox","security","capability","landlock","seatbelt","napi-rs"],"repository":{"type":"git","url":"git+https://github.com/always-further/nono.git"},"scripts":{"artifacts":"napi artifacts","build":"napi build --platform --release","build:debug":"napi build --platform","examples:list":"node examples/list.js","example:js:01-support-check":"node examples/js/01-support-check.js","example:js:02-build-capabilities":"node examples/js/02-build-capabilities.js","example:js:03-query-policy":"node examples/js/03-query-policy.js","example:js:04-state-roundtrip":"node examples/js/04-state-roundtrip.js","example:js:05-safe-apply-pattern":"node examples/js/05-safe-apply-pattern.js","example:js:all":"npm run example:js:01-support-check && npm run example:js:02-build-capabilities && npm run example:js:03-query-policy && npm run example:js:04-state-roundtrip","example:ts:01-support-check":"node --experimental-strip-types examples/ts/01-support-check.ts","example:ts:02-build-capabilities":"node --experimental-strip-types examples/ts/02-build-capabilities.ts","example:ts:03-query-policy":"node --experimental-strip-types examples/ts/03-query-policy.ts","example:ts:04-state-roundtrip":"node --experimental-strip-types examples/ts/04-state-roundtrip.ts","example:ts:05-safe-apply-pattern":"node --experimental-strip-types examples/ts/05-safe-apply-pattern.ts","example:ts:all":"npm run example:ts:01-support-check && npm run example:ts:02-build-capabilities && npm run example:ts:03-query-policy && npm run example:ts:04-state-roundtrip","example:all":"npm run example:js:all && npm run example:ts:all","prepublishOnly":"napi prepublish -t npm","test":"node test.js","universal":"napi universal","version":"napi version"},"devDependencies":{"@napi-rs/cli":"^3.0.0-alpha.63"},"engines":{"node":">= 18"},"napi":{"binaryName":"nono","targets":["x86_64-apple-darwin","aarch64-apple-darwin","x86_64-unknown-linux-gnu","aarch64-unknown-linux-gnu"]},"dependencies":{"mintlify":"^4.2.345"},"optionalDependencies":{"nono-ts-darwin-x64":"0.3.0","nono-ts-darwin-arm64":"0.3.0","nono-ts-linux-x64-gnu":"0.3.0","nono-ts-linux-arm64-gnu":"0.3.0"},"gitHead":"598f9d8fdecb899a74c88ed4a85438f12089f806","_id":"nono-ts@0.3.0","bugs":{"url":"https://github.com/always-further/nono/issues"},"homepage":"https://github.com/always-further/nono#readme","_nodeVersion":"24.13.0","_npmVersion":"11.6.2","dist":{"integrity":"sha512-KMv05ucezwFbxfIGTlcqElmCAkPS2rHjhsPV0Bg04pfXKNoeR7dcC0opHnoeNADHESwS/BjoPHjUkWf7JbxCkQ==","shasum":"f002f71e8af53da967e550f42709edd35d41d3ca","tarball":"https://registry.npmjs.org/nono-ts/-/nono-ts-0.3.0.tgz","fileCount":6,"unpackedSize":545014,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQC+WBfYTdRIvZV+L205TggTwrr6vwSvd1ugWMYM45UzdAIhAKAlFNT99a8jWdEo33G9cDbY3iVcQnZT1FeBOwv8weO+"}]},"_npmUser":{"name":"lukehinds","email":"lhinds@protonmail.com"},"directories":{},"maintainers":[{"name":"lukehinds","email":"lhinds@protonmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/nono-ts_0.3.0_1771437195386_0.04737639283596673"},"_hasShrinkwrap":false}},"time":{"created":"2026-02-18T17:53:15.252Z","0.3.0":"2026-02-18T17:53:15.610Z","modified":"2026-02-18T17:53:15.850Z"},"maintainers":[{"name":"lukehinds","email":"lhinds@protonmail.com"}],"description":"Node.js/TypeScript bindings for nono capability-based sandboxing","homepage":"https://github.com/always-further/nono#readme","keywords":["sandbox","security","capability","landlock","seatbelt","napi-rs"],"repository":{"type":"git","url":"git+https://github.com/always-further/nono.git"},"author":{"name":"Luke Hinds"},"bugs":{"url":"https://github.com/always-further/nono/issues"},"license":"Apache-2.0","readme":"

\n \"nono-ts\"\n

\n\n

\n Node.js/TypeScript bindings for nono capability-based sandboxing\n

\n\n

\n \"npm\n \"License\"\n

\n\n---\n\nOS-enforced sandboxing for Node.js applications via [Landlock](https://landlock.io/) (Linux) and [Seatbelt](https://developer.apple.com/library/archive/documentation/Darwin/Reference/ManPages/man7/sandbox.7.html) (macOS).\n\n## Installation\n\n```bash\nnpm install nono-ts\n```\n\n## Usage\n\n```typescript\nimport { CapabilitySet, AccessMode, apply, isSupported, supportInfo } from 'nono-ts';\n\n// Check platform support\nif (!isSupported()) {\n console.log('Sandboxing not supported on this platform');\n process.exit(1);\n}\n\n// Build capabilities\nconst caps = new CapabilitySet();\ncaps.allowPath('/tmp', AccessMode.ReadWrite);\ncaps.allowPath('/usr', AccessMode.Read);\ncaps.allowFile('/etc/hosts', AccessMode.Read);\ncaps.blockNetwork();\n\n// Apply sandbox (irreversible)\napply(caps);\n\n// From this point, the process can only access granted resources\n```\n\n## Examples\n\nRunnable examples live in `examples/` with both JavaScript and TypeScript variants:\n\n- `01-support-check`: detect platform support\n- `02-build-capabilities`: build and inspect a `CapabilitySet`\n- `03-query-policy`: dry-run policy decisions with `QueryContext`\n- `04-state-roundtrip`: serialize/restore with `SandboxState`\n- `05-safe-apply-pattern`: guarded `apply()` flow (`NONO_APPLY=1`)\n\n```bash\nnpm run examples:list\nnpm run example:all\n```\n\nSee `examples/README.md` for all commands.\n\n## API\n\n### `CapabilitySet`\n\nBuild a set of capabilities to grant the sandboxed process.\n\n```typescript\nconst caps = new CapabilitySet();\n\n// Directory access\ncaps.allowPath('/data', AccessMode.Read);\ncaps.allowPath('/tmp', AccessMode.ReadWrite);\n\n// Single file access\ncaps.allowFile('/etc/passwd', AccessMode.Read);\n\n// Network\ncaps.blockNetwork();\n\n// Commands\ncaps.allowCommand('git');\ncaps.blockCommand('curl');\n\n// Platform-specific rules (macOS Seatbelt)\ncaps.platformRule('(allow file-read* (subpath \"/opt\"))');\n\n// Utilities\ncaps.deduplicate(); // Remove duplicate capabilities\ncaps.pathCovered('/tmp/foo'); // Check if path is covered\ncaps.fsCapabilities(); // List all filesystem capabilities\ncaps.summary(); // Human-readable summary\n```\n\n### `AccessMode`\n\n```typescript\nenum AccessMode {\n Read,\n Write,\n ReadWrite\n}\n```\n\n### `QueryContext`\n\nQuery whether operations would be permitted without applying the sandbox.\n\n```typescript\nconst caps = new CapabilitySet();\ncaps.allowPath('/tmp', AccessMode.ReadWrite);\ncaps.blockNetwork();\n\nconst query = new QueryContext(caps);\n\nconst result = query.queryPath('/tmp/test.txt', AccessMode.Write);\n// { status: 'allowed', reason: 'granted_path', grantedPath: '/private/tmp', access: 'read+write' }\n\nconst netResult = query.queryNetwork();\n// { status: 'denied', reason: 'network_blocked' }\n```\n\n### `SandboxState`\n\nSerialize and deserialize sandbox state for process inheritance.\n\n```typescript\n// Serialize\nconst state = SandboxState.fromCaps(caps);\nconst json = state.toJson();\n\n// Deserialize\nconst restored = SandboxState.fromJson(json);\nconst restoredCaps = restored.toCaps();\n```\n\n### Functions\n\n```typescript\n// Apply sandbox with capabilities (irreversible)\napply(caps: CapabilitySet): void\n\n// Check if sandboxing is supported\nisSupported(): boolean\n\n// Get detailed support information\nsupportInfo(): SupportInfoResult\n// Returns: { isSupported: boolean, platform: string, details: string }\n```\n\n## Platform Support\n\n| Platform | Backend | Status |\n|----------|---------|--------|\n| Linux 5.13+ | Landlock | Supported |\n| macOS 10.5+ | Seatbelt | Supported |\n| Windows | - | Not supported |\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md","_rev":"1-ed82f5388601bf5b8d5a04e8c0bf91ff"}