@dcyfr/ai 2.1.3 → 3.0.1

package/dist/ai/src/plugins/reviews/types.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Plugin Review & Rating Types
+ *
+ * Type definitions for the plugin marketplace community rating and review system.
+ *
+ * @module plugins/reviews/types
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+/** Star rating value (1-5) */
+export type StarRating = 1 | 2 | 3 | 4 | 5;
+/** Review moderation status */
+export type ReviewStatus = 'pending' | 'approved' | 'flagged' | 'removed';
+/** A single plugin community review */
+export interface PluginReview {
+    /** Unique review identifier (UUID) */
+    id: string;
+    /** Plugin identifier this review is for */
+    pluginId: string;
+    /** Author user identifier */
+    userId: string;
+    /** Display name (may be anonymized) */
+    displayName: string;
+    /** Star rating 1–5 */
+    rating: StarRating;
+    /** Review text content (optional) */
+    comment?: string;
+    /** Moderation status */
+    status: ReviewStatus;
+    /** When this review was created (ISO-8601) */
+    createdAt: string;
+    /** When this review was last updated (ISO-8601) */
+    updatedAt: string;
+    /** Number of helpful votes */
+    helpfulVotes: number;
+    /** Number of flag/report votes */
+    flagCount: number;
+}
+/** Input for submitting a new review */
+export interface CreateReviewInput {
+    pluginId: string;
+    userId: string;
+    displayName: string;
+    rating: StarRating;
+    comment?: string;
+}
+/** Input for flagging a review */
+export interface FlagReviewInput {
+    reviewId: string;
+    reason: 'spam' | 'inappropriate' | 'fake' | 'other';
+    reportedBy: string;
+}
+/** Distribution of star ratings */
+export interface RatingDistribution {
+    1: number;
+    2: number;
+    3: number;
+    4: number;
+    5: number;
+}
+/** Aggregated rating statistics for a plugin */
+export interface PluginRatingStats {
+    /** Plugin identifier */
+    pluginId: string;
+    /** Average rating (0 if no reviews) */
+    averageRating: number;
+    /** Total number of approved reviews */
+    totalReviews: number;
+    /** Distribution of ratings */
+    distribution: RatingDistribution;
+    /** Community score (0–100) derived from average rating */
+    communityScore: number;
+}
+/** Paginated list of reviews */
+export interface ReviewPage {
+    reviews: PluginReview[];
+    total: number;
+    page: number;
+    pageSize: number;
+    hasMore: boolean;
+}
+/** Options for querying reviews */
+export interface ReviewQueryOptions {
+    page?: number;
+    pageSize?: number;
+    status?: ReviewStatus;
+    sortBy?: 'createdAt' | 'rating' | 'helpfulVotes';
+    sortOrder?: 'asc' | 'desc';
+}
+/**
+ * Drizzle-compatible column definitions for the plugin_reviews table.
+ *
+ * Column layout:
+ *   id          TEXT PRIMARY KEY     — UUID
+ *   plugin_id   TEXT NOT NULL        — FK → plugins.id
+ *   user_id     TEXT NOT NULL        — FK → users.id / session
+ *   display_name TEXT NOT NULL       — anonymizable display name
+ *   rating      INTEGER NOT NULL     — 1–5
+ *   comment     TEXT                 — optional review body
+ *   status      TEXT NOT NULL        — pending | approved | flagged | removed
+ *   helpful_votes INTEGER DEFAULT 0
+ *   flag_count  INTEGER DEFAULT 0
+ *   created_at  TEXT NOT NULL        — ISO-8601
+ *   updated_at  TEXT NOT NULL        — ISO-8601
+ *
+ * Indexes:
+ *   idx_reviews_plugin_id  ON plugin_reviews(plugin_id)
+ *   idx_reviews_user_id    ON plugin_reviews(user_id)
+ *   idx_reviews_status     ON plugin_reviews(status)
+ */
+export declare const PLUGIN_REVIEWS_SCHEMA_SQL = "\nCREATE TABLE IF NOT EXISTS plugin_reviews (\n  id            TEXT PRIMARY KEY,\n  plugin_id     TEXT NOT NULL,\n  user_id       TEXT NOT NULL,\n  display_name  TEXT NOT NULL,\n  rating        INTEGER NOT NULL CHECK (rating BETWEEN 1 AND 5),\n  comment       TEXT,\n  status        TEXT NOT NULL DEFAULT 'pending'\n                  CHECK (status IN ('pending', 'approved', 'flagged', 'removed')),\n  helpful_votes INTEGER NOT NULL DEFAULT 0,\n  flag_count    INTEGER NOT NULL DEFAULT 0,\n  created_at    TEXT NOT NULL,\n  updated_at    TEXT NOT NULL\n);\n\nCREATE INDEX IF NOT EXISTS idx_reviews_plugin_id ON plugin_reviews(plugin_id);\nCREATE INDEX IF NOT EXISTS idx_reviews_user_id   ON plugin_reviews(user_id);\nCREATE INDEX IF NOT EXISTS idx_reviews_status    ON plugin_reviews(status);\n";
+//# sourceMappingURL=types.d.ts.map

package/dist/ai/src/plugins/reviews/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reviews/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH,8BAA8B;AAC9B,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAE3C,+BAA+B;AAC/B,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE1E,uCAAuC;AACvC,MAAM,WAAW,YAAY;IAC3B,sCAAsC;IACtC,EAAE,EAAE,MAAM,CAAC;IAEX,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IAEjB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAC;IAEf,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAC;IAEpB,sBAAsB;IACtB,MAAM,EAAE,UAAU,CAAC;IAEnB,qCAAqC;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,wBAAwB;IACxB,MAAM,EAAE,YAAY,CAAC;IAErB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,CAAC;IAElB,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;IAElB,8BAA8B;IAC9B,YAAY,EAAE,MAAM,CAAC;IAErB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wCAAwC;AACxC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,kCAAkC;AAClC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,MAAM,GAAG,OAAO,CAAC;IACpD,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;IACV,CAAC,EAAE,MAAM,CAAC;CACX;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IAEjB,uCAAuC;IACvC,aAAa,EAAE,MAAM,CAAC;IAEtB,uCAAuC;IACvC,YAAY,EAAE,MAAM,CAAC;IAErB,8BAA8B;IAC9B,YAAY,EAAE,kBAAkB,CAAC;IAEjC,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,gCAAgC;AAChC,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC;IACjD,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC5B;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,yBAAyB,+xBAmBrC,CAAC"}

package/dist/ai/src/plugins/reviews/types.js

@@ -0,0 +1,55 @@
+/**
+ * Plugin Review & Rating Types
+ *
+ * Type definitions for the plugin marketplace community rating and review system.
+ *
+ * @module plugins/reviews/types
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+// ---------------------------------------------------------------------------
+// Schema definitions (for reference / Drizzle migration)
+// ---------------------------------------------------------------------------
+/**
+ * Drizzle-compatible column definitions for the plugin_reviews table.
+ *
+ * Column layout:
+ *   id          TEXT PRIMARY KEY     — UUID
+ *   plugin_id   TEXT NOT NULL        — FK → plugins.id
+ *   user_id     TEXT NOT NULL        — FK → users.id / session
+ *   display_name TEXT NOT NULL       — anonymizable display name
+ *   rating      INTEGER NOT NULL     — 1–5
+ *   comment     TEXT                 — optional review body
+ *   status      TEXT NOT NULL        — pending | approved | flagged | removed
+ *   helpful_votes INTEGER DEFAULT 0
+ *   flag_count  INTEGER DEFAULT 0
+ *   created_at  TEXT NOT NULL        — ISO-8601
+ *   updated_at  TEXT NOT NULL        — ISO-8601
+ *
+ * Indexes:
+ *   idx_reviews_plugin_id  ON plugin_reviews(plugin_id)
+ *   idx_reviews_user_id    ON plugin_reviews(user_id)
+ *   idx_reviews_status     ON plugin_reviews(status)
+ */
+export const PLUGIN_REVIEWS_SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS plugin_reviews (
+  id            TEXT PRIMARY KEY,
+  plugin_id     TEXT NOT NULL,
+  user_id       TEXT NOT NULL,
+  display_name  TEXT NOT NULL,
+  rating        INTEGER NOT NULL CHECK (rating BETWEEN 1 AND 5),
+  comment       TEXT,
+  status        TEXT NOT NULL DEFAULT 'pending'
+                  CHECK (status IN ('pending', 'approved', 'flagged', 'removed')),
+  helpful_votes INTEGER NOT NULL DEFAULT 0,
+  flag_count    INTEGER NOT NULL DEFAULT 0,
+  created_at    TEXT NOT NULL,
+  updated_at    TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_reviews_plugin_id ON plugin_reviews(plugin_id);
+CREATE INDEX IF NOT EXISTS idx_reviews_user_id   ON plugin_reviews(user_id);
+CREATE INDEX IF NOT EXISTS idx_reviews_status    ON plugin_reviews(status);
+`;
+//# sourceMappingURL=types.js.map

package/dist/ai/src/plugins/reviews/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/reviews/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiHH,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;CAmBxC,CAAC"}

package/dist/ai/src/plugins/runtime/docker-plugin-runner.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Docker Plugin Runner
+ *
+ * Executes plugins inside isolated Docker containers with configurable
+ * resource limits, network restrictions, read-only filesystems, and
+ * Linux capability dropping.
+ *
+ * Specification: Plugin Runtime Isolation Specification (plugin-runtime-isolation)
+ *
+ * @module plugins/runtime/docker-plugin-runner
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import type { SandboxConfig, SandboxResult, DockerProbeResult, GVisorProbeResult } from './types.js';
+/**
+ * Parse a human-readable duration string to milliseconds.
+ * Supports: "30s", "5m", "1h", "500ms"
+ */
+export declare function parseDurationMs(value: string): number;
+/**
+ * Normalize a memory string to Docker's short format ("k", "m", "g").
+ * Accepts "512MB", "512M", "512mb", "1GB", "1g", "1024k".
+ */
+export declare function normalizeMemory(value: string): string;
+/**
+ * Runs plugins in isolated Docker containers.
+ *
+ * @example
+ * ```ts
+ * const runner = new DockerPluginRunner();
+ * const result = await runner.run({
+ *   image: 'dcyfr-plugin-sandbox:latest',
+ *   command: ['node', 'dist/index.js'],
+ *   resourceLimits: { maxMemory: '256MB', maxExecutionTime: '2m' },
+ * });
+ * console.log(result.stdout);
+ * ```
+ */
+export declare class DockerPluginRunner {
+    private readonly containerPrefix;
+    constructor(containerPrefix?: string);
+    /**
+     * Execute a plugin inside a sandboxed Docker container.
+     * Returns after the container exits or is killed due to timeout.
+     */
+    run(config: SandboxConfig): Promise<SandboxResult>;
+    /**
+     * Force-remove a container by name (idempotent — ignores "no such container").
+     */
+    cleanup(containerName: string): Promise<void>;
+    /**
+     * Probe whether Docker is installed and the daemon is running.
+     */
+    isDockerAvailable(): Promise<DockerProbeResult>;
+    /**
+     * Probe whether the gVisor runtime (runsc) is registered with Docker.
+     */
+    isGVisorAvailable(): Promise<GVisorProbeResult>;
+    private generateContainerName;
+    private resolveResourceLimits;
+    /**
+     * Build the complete `docker run` argument array.
+     * Does NOT include the `docker` binary itself.
+     */
+    private buildRunArgs;
+    /**
+     * Spawn `docker run [args]`, enforce time limit, return stdout/stderr/exit code.
+     */
+    private spawnWithTimeout;
+    /**
+     * Gracefully stop then forcefully remove a running container.
+     * First sends SIGTERM (via `docker stop --time=10`), then ensures removal.
+     */
+    private stopContainer;
+}
+//# sourceMappingURL=docker-plugin-runner.d.ts.map

package/dist/ai/src/plugins/runtime/docker-plugin-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-plugin-runner.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/runtime/docker-plugin-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EACV,aAAa,EAEb,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAWpB;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAcrD;AAID;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrD;AA8CD;;;;;;;;;;;;;GAaG;AACH,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,eAAe,SAAiB;IAQ5C;;;OAGG;IACG,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAgBxD;;OAEG;IACG,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQnD;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAUrD;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAcrD,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,qBAAqB;IAM7B;;;OAGG;IACH,OAAO,CAAC,YAAY;IAoCpB;;OAEG;YACW,gBAAgB;IAiC9B;;;OAGG;YACW,aAAa;CAa5B"}

package/dist/ai/src/plugins/runtime/docker-plugin-runner.js

@@ -0,0 +1,248 @@
+/**
+ * Docker Plugin Runner
+ *
+ * Executes plugins inside isolated Docker containers with configurable
+ * resource limits, network restrictions, read-only filesystems, and
+ * Linux capability dropping.
+ *
+ * Specification: Plugin Runtime Isolation Specification (plugin-runtime-isolation)
+ *
+ * @module plugins/runtime/docker-plugin-runner
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import { spawn, execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { randomUUID } from 'node:crypto';
+import { DEFAULT_RESOURCE_LIMITS } from './types.js';
+const execFileAsync = promisify(execFile);
+// ---------------------------------------------------------------------------
+// Duration / memory parsing helpers
+// ---------------------------------------------------------------------------
+const DURATION_REGEX = /^(\d+(?:\.\d+)?)(ms|s|m|h)$/i;
+/**
+ * Parse a human-readable duration string to milliseconds.
+ * Supports: "30s", "5m", "1h", "500ms"
+ */
+export function parseDurationMs(value) {
+    const match = DURATION_REGEX.exec(value.trim());
+    if (!match) {
+        throw new Error(`Invalid duration: "${value}". Expected format: "5m", "30s", "1h", "500ms"`);
+    }
+    const amount = Number.parseFloat(match[1] ?? '0');
+    const unit = (match[2] ?? 's').toLowerCase();
+    switch (unit) {
+        case 'ms': return Math.ceil(amount);
+        case 's': return Math.ceil(amount * 1_000);
+        case 'm': return Math.ceil(amount * 60_000);
+        case 'h': return Math.ceil(amount * 3_600_000);
+        default: return Math.ceil(amount * 1_000);
+    }
+}
+const MEMORY_REGEX = /^(\d+(?:\.\d+)?)\s*(kb?|mb?|gb?|tb?)/i;
+/**
+ * Normalize a memory string to Docker's short format ("k", "m", "g").
+ * Accepts "512MB", "512M", "512mb", "1GB", "1g", "1024k".
+ */
+export function normalizeMemory(value) {
+    const match = MEMORY_REGEX.exec(value.trim());
+    if (!match) {
+        throw new Error(`Invalid memory value: "${value}". Expected format: "512MB", "1GB"`);
+    }
+    const amount = match[1] ?? '512';
+    const unit = (match[2] ?? 'm')[0].toLowerCase();
+    return `${amount}${unit}`;
+}
+// ---------------------------------------------------------------------------
+// Argument builder helpers
+// ---------------------------------------------------------------------------
+function applyResourceFlags(args, limits) {
+    args.push(`--memory=${normalizeMemory(limits.maxMemory)}`, `--cpus=${limits.maxCpu}`);
+}
+function applyNetworkFlags(args, networkPermitted) {
+    if (!networkPermitted) {
+        args.push('--network=none');
+    }
+}
+function applyFilesystemFlags(args, config, tmpfsSize) {
+    if (!config.writePermitted) {
+        args.push('--read-only');
+    }
+    // Always provide a writable /tmp via tmpfs
+    args.push(`--tmpfs=/tmp:rw,noexec,nosuid,size=${normalizeMemory(tmpfsSize)}`);
+    // Explicit writable bind-mounts (only useful when writePermitted=true)
+    if (config.writePermitted && config.writableMounts) {
+        for (const mount of config.writableMounts) {
+            args.push('-v', mount);
+        }
+    }
+}
+function applyEnvFlags(args, env) {
+    if (!env)
+        return;
+    for (const [key, value] of Object.entries(env)) {
+        args.push('-e', `${key}=${value}`);
+    }
+}
+// ---------------------------------------------------------------------------
+// Main class
+// ---------------------------------------------------------------------------
+/**
+ * Runs plugins in isolated Docker containers.
+ *
+ * @example
+ * ```ts
+ * const runner = new DockerPluginRunner();
+ * const result = await runner.run({
+ *   image: 'dcyfr-plugin-sandbox:latest',
+ *   command: ['node', 'dist/index.js'],
+ *   resourceLimits: { maxMemory: '256MB', maxExecutionTime: '2m' },
+ * });
+ * console.log(result.stdout);
+ * ```
+ */
+export class DockerPluginRunner {
+    containerPrefix;
+    constructor(containerPrefix = 'dcyfr-plugin') {
+        this.containerPrefix = containerPrefix;
+    }
+    // --------------------------------------------------------------------------
+    // Public API
+    // --------------------------------------------------------------------------
+    /**
+     * Execute a plugin inside a sandboxed Docker container.
+     * Returns after the container exits or is killed due to timeout.
+     */
+    async run(config) {
+        const containerName = this.generateContainerName();
+        const limits = this.resolveResourceLimits(config.resourceLimits);
+        const limitMs = parseDurationMs(limits.maxExecutionTime);
+        const runArgs = this.buildRunArgs(containerName, config, limits);
+        const startTime = Date.now();
+        const result = await this.spawnWithTimeout(runArgs, containerName, limitMs);
+        return {
+            ...result,
+            containerName,
+            executionTimeMs: Date.now() - startTime,
+        };
+    }
+    /**
+     * Force-remove a container by name (idempotent — ignores "no such container").
+     */
+    async cleanup(containerName) {
+        try {
+            await execFileAsync('docker', ['rm', '-f', containerName]);
+        }
+        catch {
+            // Container already removed or never existed — not an error
+        }
+    }
+    /**
+     * Probe whether Docker is installed and the daemon is running.
+     */
+    async isDockerAvailable() {
+        try {
+            const { stdout } = await execFileAsync('docker', ['version', '--format', '{{.Server.Version}}']);
+            return { available: true, version: stdout.trim() };
+        }
+        catch (error_) {
+            const msg = error_ instanceof Error ? error_.message : String(error_);
+            return { available: false, error: msg };
+        }
+    }
+    /**
+     * Probe whether the gVisor runtime (runsc) is registered with Docker.
+     */
+    async isGVisorAvailable() {
+        try {
+            await execFileAsync('docker', ['run', '--rm', '--runtime=runsc', 'hello-world']);
+            return { available: true };
+        }
+        catch (error_) {
+            const msg = error_ instanceof Error ? error_.message : String(error_);
+            return { available: false, error: msg };
+        }
+    }
+    // --------------------------------------------------------------------------
+    // Private helpers
+    // --------------------------------------------------------------------------
+    generateContainerName() {
+        return `${this.containerPrefix}-${randomUUID().slice(0, 8)}`;
+    }
+    resolveResourceLimits(partial) {
+        return { ...DEFAULT_RESOURCE_LIMITS, ...partial };
+    }
+    /**
+     * Build the complete `docker run` argument array.
+     * Does NOT include the `docker` binary itself.
+     */
+    buildRunArgs(containerName, config, limits) {
+        const args = ['run', '--rm', '--name', containerName];
+        // Resource limits
+        applyResourceFlags(args, limits);
+        // Network
+        applyNetworkFlags(args, config.networkPermitted ?? false);
+        // Filesystem isolation
+        applyFilesystemFlags(args, config, limits.maxDiskSpace);
+        // Security hardening
+        args.push('--cap-drop=ALL', '--security-opt=no-new-privileges', '--user=65534:65534');
+        // gVisor runtime (best-effort — falls through to standard if unavailable)
+        if (config.useGVisor) {
+            args.push('--runtime=runsc');
+        }
+        // Working directory
+        args.push('-w', config.workDir ?? '/plugin');
+        // Environment variables
+        applyEnvFlags(args, config.env);
+        // Image + command
+        args.push(config.image, ...config.command);
+        return args;
+    }
+    /**
+     * Spawn `docker run [args]`, enforce time limit, return stdout/stderr/exit code.
+     */
+    async spawnWithTimeout(args, containerName, limitMs) {
+        const proc = spawn('docker', args, { stdio: 'pipe' });
+        const stdoutChunks = [];
+        const stderrChunks = [];
+        let timedOut = false;
+        proc.stdout?.on('data', (chunk) => stdoutChunks.push(chunk));
+        proc.stderr?.on('data', (chunk) => stderrChunks.push(chunk));
+        const timer = setTimeout(() => {
+            timedOut = true;
+            void this.stopContainer(containerName);
+        }, limitMs);
+        const exitCode = await new Promise((resolve) => {
+            proc.on('close', (code) => resolve(code));
+            proc.on('error', () => resolve(null));
+        });
+        clearTimeout(timer);
+        return {
+            exitCode,
+            stdout: Buffer.concat(stdoutChunks).toString('utf8'),
+            stderr: Buffer.concat(stderrChunks).toString('utf8'),
+            timedOut,
+        };
+    }
+    /**
+     * Gracefully stop then forcefully remove a running container.
+     * First sends SIGTERM (via `docker stop --time=10`), then ensures removal.
+     */
+    async stopContainer(containerName) {
+        try {
+            // 10-second grace period before Docker sends SIGKILL
+            await execFileAsync('docker', ['stop', '--time', '10', containerName]);
+        }
+        catch {
+            // Container may have already exited — attempt force kill
+            try {
+                await execFileAsync('docker', ['kill', containerName]);
+            }
+            catch {
+                // Already gone — ignore
+            }
+        }
+    }
+}
+//# sourceMappingURL=docker-plugin-runner.js.map

package/dist/ai/src/plugins/runtime/docker-plugin-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-plugin-runner.js","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/runtime/docker-plugin-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,gDAAgD,CAAC,CAAC;IAC/F,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,KAAK,GAAG,CAAC,CAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;QAC5C,KAAK,GAAG,CAAC,CAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;QAC7C,KAAK,GAAG,CAAC,CAAE,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;QAChD,OAAO,CAAC,CAAG,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAE7D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,0BAA0B,KAAK,oCAAoC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACjC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAChD,OAAO,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,8EAA8E;AAC9E,2BAA2B;AAC3B,8EAA8E;AAE9E,SAAS,kBAAkB,CAAC,IAAc,EAAE,MAA6B;IACvE,IAAI,CAAC,IAAI,CAAC,YAAY,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAc,EAAE,gBAAyB;IAClE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,IAAc,EACd,MAAqB,EACrB,SAAiB;IAEjB,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3B,CAAC;IACD,2CAA2C;IAC3C,IAAI,CAAC,IAAI,CAAC,sCAAsC,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAE9E,uEAAuE;IACvE,IAAI,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QACnD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAc,EAAE,GAA4B;IACjE,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,kBAAkB;IACZ,eAAe,CAAS;IAEzC,YAAY,eAAe,GAAG,cAAc;QAC1C,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACzC,CAAC;IAED,6EAA6E;IAC7E,aAAa;IACb,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,GAAG,CAAC,MAAqB;QAC7B,MAAM,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QAE5E,OAAO;YACL,GAAG,MAAM;YACT,aAAa;YACb,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;YACjG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACrD,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;YACjF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACtE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAErE,qBAAqB;QAC3B,OAAO,GAAG,IAAI,CAAC,eAAe,IAAI,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC/D,CAAC;IAEO,qBAAqB,CAC3B,OAAwC;QAExC,OAAO,EAAE,GAAG,uBAAuB,EAAE,GAAG,OAAO,EAAE,CAAC;IACpD,CAAC;IAED;;;OAGG;IACK,YAAY,CAClB,aAAqB,EACrB,MAAqB,EACrB,MAA6B;QAE7B,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAEhE,kBAAkB;QAClB,kBAAkB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAEjC,UAAU;QACV,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC,CAAC;QAE1D,uBAAuB;QACvB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAExD,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,kCAAkC,EAAE,oBAAoB,CAAC,CAAC;QAEtF,0EAA0E;QAC1E,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC/B,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;QAE7C,wBAAwB;QACxB,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAEhC,kBAAkB;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;QAE3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAc,EACd,aAAqB,EACrB,OAAe;QAEf,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACtD,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,MAAM,YAAY,GAAa,EAAE,CAAC;QAClC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAErE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC;QACzC,CAAC,EAAE,OAAO,CAAC,CAAC;QAEZ,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YAC5D,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,YAAY,CAAC,KAAK,CAAC,CAAC;QAEpB,OAAO;YACL,QAAQ;YACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACpD,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,aAAa,CAAC,aAAqB;QAC/C,IAAI,CAAC;YACH,qDAAqD;YACrD,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,yDAAyD;YACzD,IAAI,CAAC;gBACH,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/ai/src/plugins/runtime/gvisor-plugin-runner.d.ts

@@ -0,0 +1,99 @@
+/**
+ * gVisor Plugin Runner
+ *
+ * Extends DockerPluginRunner with gVisor (runsc) runtime support.
+ * Enforces TLP-based runtime selection:
+ *   - TLP:CLEAR / TLP:GREEN → standard Docker (no gVisor required)
+ *   - TLP:AMBER            → gVisor preferred; gracefully falls back to Docker
+ *   - TLP:RED              → gVisor required; throws if unavailable
+ *
+ * gVisor (runsc) provides an additional kernel isolation layer on top of
+ * Docker by intercepting all guest system calls via a user-space kernel.
+ * This significantly reduces the attack surface for privilege escalation
+ * exploits in high-sensitivity (AMBER/RED) plugin workloads.
+ *
+ * Specification: Plugin Marketplace Security — Phase 15 (gVisor Integration)
+ *
+ * @see https://gvisor.dev/docs/
+ * @module plugins/runtime/gvisor-plugin-runner
+ * @version 1.0.0
+ * @date 2026-02-28
+ * @license MIT
+ */
+import { DockerPluginRunner } from './docker-plugin-runner.js';
+import type { SandboxConfig, SandboxResult, GVisorProbeResult } from './types.js';
+import type { TLPLevel } from '../../types/delegation-contracts.js';
+/**
+ * Thrown when a TLP:RED plugin cannot be executed because the gVisor
+ * runtime (runsc) is not available on the host machine.
+ *
+ * TLP:RED plugins are blocked unconditionally if gVisor is absent —
+ * unlike TLP:AMBER which falls back to standard Docker with a warning.
+ */
+export declare class GVisorRequiredError extends Error {
+    readonly code = "GVISOR_REQUIRED";
+    constructor(message: string);
+}
+/** Extended result that records which container runtime was actually used. */
+export interface GVisorSandboxResult extends SandboxResult {
+    /** Indicates whether gVisor or standard Docker executed the plugin. */
+    runtimeUsed: 'gvisor' | 'docker';
+    /** The TLP level that drove runtime selection. */
+    tlpLevel: TLPLevel;
+}
+/**
+ * Plugin runner with gVisor (runsc) isolation support and TLP enforcement.
+ *
+ * Inherits all standard Docker sandbox behaviour from DockerPluginRunner and
+ * adds:
+ * 1. Lightweight PATH-based gVisor detection (no Docker daemon required).
+ * 2. `runWithTlp()` — TLP-aware `run()` wrapper that automatically selects
+ *    `--runtime=runsc` for AMBER/RED plugins and enforces blocking for RED
+ *    when gVisor is absent.
+ *
+ * @example
+ * ```ts
+ * const runner = new GVisorPluginRunner();
+ * const result = await runner.runWithTlp(
+ *   { image: 'dcyfr-plugin-sandbox:latest', command: ['node', 'dist/index.js'] },
+ *   'TLP:AMBER',
+ * );
+ * console.log(result.runtimeUsed); // 'gvisor' | 'docker'
+ * console.log(result.tlpLevel);    // 'TLP:AMBER'
+ * ```
+ */
+export declare class GVisorPluginRunner extends DockerPluginRunner {
+    /**
+     * Probe whether the gVisor `runsc` binary is present on this machine.
+     *
+     * Uses a two-stage lightweight check — no Docker daemon required:
+     * 1. `which runsc`     — succeeds on most Linux/macOS installations.
+     * 2. `runsc --version` — fallback for non-standard PATH configurations.
+     *
+     * This is faster than DockerPluginRunner.isGVisorAvailable() which spins
+     * up a full container and pulls `hello-world`. Use this method for all
+     * availability checks before scheduling plugin workloads.
+     */
+    isGVisorAvailable(): Promise<GVisorProbeResult>;
+    /**
+     * Execute a plugin with TLP-level-aware runtime selection.
+     *
+     * Runtime selection table:
+     *
+     * | TLP Level   | gVisor Available | Behaviour                                  |
+     * |-------------|------------------|--------------------------------------------|
+     * | CLEAR/GREEN | any              | Standard Docker (--runtime flag omitted)   |
+     * | AMBER       | yes              | gVisor (--runtime=runsc)                   |
+     * | AMBER       | no               | Docker fallback; warning prepended to stderr |
+     * | RED         | yes              | gVisor (--runtime=runsc)                   |
+     * | RED         | no               | Throws GVisorRequiredError — BLOCKED       |
+     *
+     * @param config   Standard SandboxConfig. The `useGVisor` field is managed
+     *                 automatically and should be omitted by callers.
+     * @param tlpLevel Plugin data classification. Defaults to 'TLP:CLEAR'.
+     * @returns SandboxResult enriched with `runtimeUsed` and `tlpLevel`.
+     * @throws {GVisorRequiredError} When tlpLevel is 'TLP:RED' and gVisor is unavailable.
+     */
+    runWithTlp(config: SandboxConfig, tlpLevel?: TLPLevel): Promise<GVisorSandboxResult>;
+}
+//# sourceMappingURL=gvisor-plugin-runner.d.ts.map

package/dist/ai/src/plugins/runtime/gvisor-plugin-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gvisor-plugin-runner.d.ts","sourceRoot":"","sources":["../../../../../packages/ai/src/plugins/runtime/gvisor-plugin-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAClF,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qCAAqC,CAAC;AAQpE;;;;;;GAMG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,IAAI,qBAAqB;gBAEtB,OAAO,EAAE,MAAM;CAM5B;AAMD,8EAA8E;AAC9E,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,uEAAuE;IACvE,WAAW,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACjC,kDAAkD;IAClD,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAMD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,kBAAmB,SAAQ,kBAAkB;IAKxD;;;;;;;;;;OAUG;IACY,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAsB9D;;;;;;;;;;;;;;;;;;OAkBG;IACG,UAAU,CACd,MAAM,EAAE,aAAa,EACrB,QAAQ,GAAE,QAAsB,GAC/B,OAAO,CAAC,mBAAmB,CAAC;CAyChC"}