@ninelives/agent-governance-sdk 5.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +363 -0
- package/dist/audit.d.ts +26 -0
- package/dist/audit.d.ts.map +1 -0
- package/dist/audit.js +107 -0
- package/dist/audit.js.map +1 -0
- package/dist/cascade-containment.d.ts +84 -0
- package/dist/cascade-containment.d.ts.map +1 -0
- package/dist/cascade-containment.js +387 -0
- package/dist/cascade-containment.js.map +1 -0
- package/dist/client.d.ts +34 -0
- package/dist/client.d.ts.map +1 -0
- package/dist/client.js +112 -0
- package/dist/client.js.map +1 -0
- package/dist/context-poisoning.d.ts +58 -0
- package/dist/context-poisoning.d.ts.map +1 -0
- package/dist/context-poisoning.js +410 -0
- package/dist/context-poisoning.js.map +1 -0
- package/dist/credential-vault.d.ts +213 -0
- package/dist/credential-vault.d.ts.map +1 -0
- package/dist/credential-vault.js +567 -0
- package/dist/credential-vault.js.map +1 -0
- package/dist/discovery.d.ts +80 -0
- package/dist/discovery.d.ts.map +1 -0
- package/dist/discovery.js +404 -0
- package/dist/discovery.js.map +1 -0
- package/dist/encryption/channel.d.ts +29 -0
- package/dist/encryption/channel.d.ts.map +1 -0
- package/dist/encryption/channel.js +78 -0
- package/dist/encryption/channel.js.map +1 -0
- package/dist/encryption/index.d.ts +9 -0
- package/dist/encryption/index.d.ts.map +1 -0
- package/dist/encryption/index.js +23 -0
- package/dist/encryption/index.js.map +1 -0
- package/dist/encryption/mesh-client.d.ts +281 -0
- package/dist/encryption/mesh-client.d.ts.map +1 -0
- package/dist/encryption/mesh-client.js +1110 -0
- package/dist/encryption/mesh-client.js.map +1 -0
- package/dist/encryption/ratchet.d.ts +38 -0
- package/dist/encryption/ratchet.d.ts.map +1 -0
- package/dist/encryption/ratchet.js +223 -0
- package/dist/encryption/ratchet.js.map +1 -0
- package/dist/encryption/registry-client.d.ts +136 -0
- package/dist/encryption/registry-client.d.ts.map +1 -0
- package/dist/encryption/registry-client.js +369 -0
- package/dist/encryption/registry-client.js.map +1 -0
- package/dist/encryption/x3dh.d.ts +80 -0
- package/dist/encryption/x3dh.d.ts.map +1 -0
- package/dist/encryption/x3dh.js +238 -0
- package/dist/encryption/x3dh.js.map +1 -0
- package/dist/framework-adapter.d.ts +63 -0
- package/dist/framework-adapter.d.ts.map +1 -0
- package/dist/framework-adapter.js +253 -0
- package/dist/framework-adapter.js.map +1 -0
- package/dist/identity.d.ts +124 -0
- package/dist/identity.d.ts.map +1 -0
- package/dist/identity.js +446 -0
- package/dist/identity.js.map +1 -0
- package/dist/index.d.ts +39 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +95 -0
- package/dist/index.js.map +1 -0
- package/dist/kill-switch.d.ts +22 -0
- package/dist/kill-switch.d.ts.map +1 -0
- package/dist/kill-switch.js +60 -0
- package/dist/kill-switch.js.map +1 -0
- package/dist/lifecycle.d.ts +50 -0
- package/dist/lifecycle.d.ts.map +1 -0
- package/dist/lifecycle.js +113 -0
- package/dist/lifecycle.js.map +1 -0
- package/dist/mcp.d.ts +41 -0
- package/dist/mcp.d.ts.map +1 -0
- package/dist/mcp.js +233 -0
- package/dist/mcp.js.map +1 -0
- package/dist/metrics.d.ts +123 -0
- package/dist/metrics.d.ts.map +1 -0
- package/dist/metrics.js +289 -0
- package/dist/metrics.js.map +1 -0
- package/dist/oci-manifest.d.ts +49 -0
- package/dist/oci-manifest.d.ts.map +1 -0
- package/dist/oci-manifest.js +182 -0
- package/dist/oci-manifest.js.map +1 -0
- package/dist/policy-backends/cedar.d.ts +15 -0
- package/dist/policy-backends/cedar.d.ts.map +1 -0
- package/dist/policy-backends/cedar.js +88 -0
- package/dist/policy-backends/cedar.js.map +1 -0
- package/dist/policy-backends/opa.d.ts +17 -0
- package/dist/policy-backends/opa.d.ts.map +1 -0
- package/dist/policy-backends/opa.js +74 -0
- package/dist/policy-backends/opa.js.map +1 -0
- package/dist/policy.d.ts +77 -0
- package/dist/policy.d.ts.map +1 -0
- package/dist/policy.js +760 -0
- package/dist/policy.js.map +1 -0
- package/dist/prompt-defense.d.ts +37 -0
- package/dist/prompt-defense.d.ts.map +1 -0
- package/dist/prompt-defense.js +229 -0
- package/dist/prompt-defense.js.map +1 -0
- package/dist/protocol-facets.d.ts +87 -0
- package/dist/protocol-facets.d.ts.map +1 -0
- package/dist/protocol-facets.js +728 -0
- package/dist/protocol-facets.js.map +1 -0
- package/dist/rings.d.ts +17 -0
- package/dist/rings.d.ts.map +1 -0
- package/dist/rings.js +61 -0
- package/dist/rings.js.map +1 -0
- package/dist/sandbox.d.ts +61 -0
- package/dist/sandbox.d.ts.map +1 -0
- package/dist/sandbox.js +199 -0
- package/dist/sandbox.js.map +1 -0
- package/dist/surface-parity.d.ts +45 -0
- package/dist/surface-parity.d.ts.map +1 -0
- package/dist/surface-parity.js +216 -0
- package/dist/surface-parity.js.map +1 -0
- package/dist/trust.d.ts +28 -0
- package/dist/trust.d.ts.map +1 -0
- package/dist/trust.js +209 -0
- package/dist/trust.js.map +1 -0
- package/dist/types.d.ts +422 -0
- package/dist/types.d.ts.map +1 -0
- package/dist/types.js +29 -0
- package/dist/types.js.map +1 -0
- package/dist/verify.d.ts +135 -0
- package/dist/verify.d.ts.map +1 -0
- package/dist/verify.js +356 -0
- package/dist/verify.js.map +1 -0
- package/package.json +66 -0
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"protocol-facets.js","sourceRoot":"","sources":["../src/protocol-facets.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;;;;;;;;;;;;;;;;;;GAqBG;;;AA2fH,4CAUC;AAsJD,4CAwEC;AAkBD,sDAKC;AAtvBD;;;;;;;GAOG;AACH,MAAa,aAAa;IACP,UAAU,GAAsD,EAAE,CAAC;IAEpF,oEAAoE;IACpE,QAAQ,CAAC,UAAkB,EAAE,SAAyB;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAgC;QACtC,KAAK,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC;gBACH,gEAAgE;gBAChE,yDAAyD;gBACzD,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,CAAC;gBACrC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;oBACzC,2DAA2D;oBAC3D,6DAA6D;oBAC7D,+CAA+C;oBAC/C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;gBACvC,CAAC;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,iDAAiD;gBACjD,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CACV,oCAAoC,GAAG,YACrC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,0DAA0D;IAC1D,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,kDAAkD;IAClD,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7B,CAAC;CACF;AAlDD,sCAkDC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,eAAe,GAAwB,IAAI,GAAG,CAAC;IACnD,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,OAAO;IACP,MAAM;IACN,SAAS;IACT,SAAS;IACT,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AASH,MAAM,gBAAgB,GAAc,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AACxF,MAAM,kBAAkB,GAAc;IACpC,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,SAAS,EAAE,EAAE;CACd,CAAC;AAEF;;;;;;;;GAQG;AACH,SAAS,eAAe,CAAC,QAAgB;IACvC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAE9C,yEAAyE;IACzE,4EAA4E;IAC5E,oEAAoE;IACpE,0BAA0B;IAC1B,MAAM,UAAU,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IAExC,iDAAiD;IACjD,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACjD,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAE/C,6EAA6E;IAC7E,4EAA4E;IAC5E,+CAA+C;IAC/C,IAAI,IAAY,CAAC;IACjB,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;QAC3B,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAE/C,OAAO;QACL,IAAI;QACJ,MAAM;QACN,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAyB,EAAE,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,6CAA6C;gBAC7C,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,GAAG,EAAqB,CAAC;YAC9B,GAAG,IAAI,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,GAAG,GAAG,EAAE,CAAC;YACT,SAAS;QACX,CAAC;QACD,GAAG,IAAI,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAyB,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBACjB,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBAC3B,CAAC,EAAE,CAAC;gBACN,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAC3C,KAAK,GAAG,EAAqB,CAAC;YAC9B,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,EAAE,CAAC;YACR,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAC/B,KAAK,GAAG,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,KAAK,IAAI,EAAE,CAAC;YACZ,SAAS;QACX,CAAC;QACD,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;gBAC/B,gCAAgC;gBAChC,IAAI,CAAC,YAAY,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;oBACnC,YAAY,GAAG,IAAI,CAAC;gBACtB,CAAC;qBAAM,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC9B,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,KAAa,EAAE,IAAY,EAAE,MAAgB;IAC/D,IAAI,CAAC,GAA4B,IAAI,CAAC;IACtC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACV,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,QAAQ;YACX,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1D,MAAM;QACR,KAAK,QAAQ;YACX,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,wBAAwB,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC;gBAAE,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,CAAC,GAAG,KAAK,CAAC,KAAK,CACb,IAAI,MAAM,CACR,MAAM,IAAI,qHAAqH,KAAK,EAAE,EACtI,GAAG,CACJ,CACF,CAAC;YACF,MAAM;QACR,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ;YACX,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,0BAA0B,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACpE,MAAM;QACR;YACE,mDAAmD;YACnD,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;YACxD,MAAM;IACV,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,KAAK,GAAyB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,KAAK,EAAE,CAAC;YACV,GAAG,IAAI,CAAC,CAAC;YACT,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;gBAChB,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;oBACzB,wBAAwB;oBACxB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;oBAClB,CAAC,IAAI,CAAC,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,KAAK,GAAG,CAAoB,CAAC;YAC7B,GAAG,IAAI,CAAC,CAAC;YACT,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;gBAAE,CAAC,EAAE,CAAC;YACjE,GAAG,IAAI,GAAG,CAAC;YACX,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YACpC,CAAC,IAAI,CAAC,CAAC;YACP,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;gBAAE,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;gBAAE,CAAC,IAAI,CAAC,CAAC;YAC/B,GAAG,IAAI,GAAG,CAAC;YACX,SAAS;QACX,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,GAAG,0DAA0D,CAAC;AAC9E,MAAM,KAAK,GAAG,IAAI,UAAU,SAAS,UAAU,KAAK,CAAC;AAErD,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,qCAAqC;IACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,cAAc,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAEzD,iFAAiF;IACjF,IACE,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,UAAU;QACnB,IAAI,KAAK,OAAO;QAChB,IAAI,KAAK,QAAQ;QACjB,IAAI,KAAK,QAAQ,EACjB,CAAC;QACD,gEAAgE;QAChE,QAAQ,CAAC,IAAI,CACX,IAAI,MAAM,CACR,MAAM,IAAI,qHAAqH,KAAK,EAAE,EACtI,IAAI,CACL,CACF,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,YAAY,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1C,mDAAmD;QACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,0BAA0B,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAChB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC;IACjD,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,MAAM;IACN,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,KAAa;IACrC,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,EAAE,GAAG,kCAAkC,CAAC;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,yEAAyE;IACzE,uEAAuE;IACvE,oDAAoD;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAyB,EAAE,CAAC;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,KAAK,GAAG,GAAG,CAAC;gBACZ,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,KAAK,GAAG,GAAG,CAAC;gBACZ,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,KAAK,GAAG,GAAG,CAAC;gBACZ,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;iBAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACtB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAChB,GAAG,GAAG,EAAE,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,EAAE,CAAC;YACV,IACE,CAAC,KAAK,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC;gBAC7B,CAAC,KAAK,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC;gBAC7B,CAAC,KAAK,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,EAC7B,CAAC;gBACD,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,IAAI,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IACE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC5C,CAAC;QACD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACtD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,MAA+B;IAC9D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;IACzB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjD,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IACnC,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E,MAAM,oBAAoB,GAAqC;IAC7D,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,KAAK;CACZ,CAAC;AAEF,MAAM,yBAAyB,GAAqC;IAClE,GAAG,EAAE,MAAM;IACX,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,kBAAkB;IAC1B,GAAG,EAAE,QAAQ;IACb,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;CACb,CAAC;AAQF,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,iBAAiB,GAA8B;IACnD,gCAAgC;IAChC;QACE,EAAE,EAAE,wDAAwD;QAC5D,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,gEAAgE;QACpE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,OAAO,EAAE,IAAI;KACd;IACD,kCAAkC;IAClC;QACE,EAAE,EAAE,iEAAiE;QACrE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;QACzC,OAAO,EAAE,IAAI;KACd;IACD;QACE,EAAE,EAAE,yEAAyE;QAC7E,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;QACzC,OAAO,EAAE,IAAI;KACd;IACD,yBAAyB;IACzB,EAAE,EAAE,EAAE,mCAAmC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;IAChF,EAAE,EAAE,EAAE,2CAA2C,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;IACxF,yEAAyE;IACzE;QACE,EAAE,EAAE,yEAAyE;QAC7E,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QACxD,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,iFAAiF;QACrF,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QACxD,OAAO,EAAE,KAAK;KACf;IACD,2CAA2C;IAC3C;QACE,EAAE,EAAE,mEAAmE;QACvE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QACxD,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,2EAA2E;QAC/E,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QACxD,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,0DAA0D;QAC9D,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;QACzC,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,kEAAkE;QACtE,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC;QACzC,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,iDAAiD;QACrD,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,yDAAyD;QAC7D,MAAM,EAAE,CAAC,WAAW,EAAE,UAAU,CAAC;QACjC,OAAO,EAAE,KAAK;KACf;IACD,6EAA6E;IAC7E;QACE,EAAE,EAAE,8CAA8C;QAClD,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QAC3C,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,sDAAsD;QAC1D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QAC3C,OAAO,EAAE,KAAK;KACf;IACD,4BAA4B;IAC5B;QACE,EAAE,EAAE,oDAAoD;QACxD,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QAC3C,OAAO,EAAE,KAAK;KACf;IACD;QACE,EAAE,EAAE,4DAA4D;QAChE,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,CAAC;QAC3C,OAAO,EAAE,KAAK;KACf;IACD,EAAE,EAAE,EAAE,qCAAqC,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAC3F;QACE,EAAE,EAAE,6CAA6C;QACjD,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,OAAO,EAAE,KAAK;KACf;IACD,EAAE,EAAE,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;IAC1E,EAAE,EAAE,EAAE,oCAAoC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE;CACnF,CAAC;AAUF,MAAM,gBAAgB,GAAc;IAClC,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,EAAE;IACb,IAAI,EAAE,EAAE;IACR,WAAW,EAAE,EAAE;CAChB,CAAC;AAEF;;;GAGG;AACH,SAAgB,gBAAgB,CAAC,MAA+B;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,OAAO,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3D,MAAM,MAAM,GAAc,EAAE,GAAG,gBAAgB,EAAE,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC;IAE5B,0EAA0E;IAC1E,mEAAmE;IACnE,qDAAqD;IACrD,IAAI,QAAQ,GAAG,OAAO,CAAC;IACvB,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;QACd,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QACjC,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,IAAI,IAAI,CAAC;QAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAElD,IAAI,OAAO,GAA+E,EAAE,CAAC;IAC7F,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,KAAK,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,QAAQ,GAAoC,EAAE,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;gBACtB,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC;YACnB,cAAc,GAAG,OAAO,CAAC;YACzB,MAAM;QACR,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;IAC3C,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IACjC,MAAM,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAE/C,kDAAkD;IAClD,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAS;YACrB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC3B,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;oBAC9C,YAAY,GAAG,IAAI,CAAC;oBACpB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,gEAAgE;IAChE,gCAAgC;IAChC,MAAM,iBAAiB,GAAG,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,CAAC;IACjF,MAAM,OAAO,GAAG,CAAC,cAAc,IAAI,YAAY,CAAC,IAAI,iBAAiB,CAAC;IACtE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;IACxB,CAAC;SAAM,IAAI,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,CAAC;QACzE,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACU,QAAA,eAAe,GAAG,IAAI,aAAa,EAAE,CAAC;AACnD,uBAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAClD,uBAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AAElD;;;;;GAKG;AACH,SAAgB,qBAAqB,CACnC,OAAgC,EAChC,WAA0B,uBAAe;IAEzC,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}
|
package/dist/rings.d.ts
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
import { ExecutionControlConfig, ExecutionRing, RingViolation } from './types';
|
|
2
|
+
export declare class RingBreachError extends Error {
|
|
3
|
+
readonly violation: RingViolation;
|
|
4
|
+
constructor(violation: RingViolation);
|
|
5
|
+
}
|
|
6
|
+
export declare class RingEnforcer {
|
|
7
|
+
private readonly agentRing;
|
|
8
|
+
private readonly defaultRing;
|
|
9
|
+
private readonly actionRings;
|
|
10
|
+
constructor(config?: ExecutionControlConfig);
|
|
11
|
+
getAgentRing(): ExecutionRing;
|
|
12
|
+
getRequiredRing(action: string): ExecutionRing;
|
|
13
|
+
canExecute(action: string): boolean;
|
|
14
|
+
enforce(action: string): void;
|
|
15
|
+
private matches;
|
|
16
|
+
}
|
|
17
|
+
//# sourceMappingURL=rings.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"rings.d.ts","sourceRoot":"","sources":["../src/rings.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE/E,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC;gBAEtB,SAAS,EAAE,aAAa;CAKrC;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgB;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAgC;gBAEhD,MAAM,GAAE,sBAA2B;IAM/C,YAAY,IAAI,aAAa;IAI7B,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa;IAU9C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAInC,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAa7B,OAAO,CAAC,OAAO;CAWhB"}
|
package/dist/rings.js
ADDED
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
// Copyright (c) Microsoft Corporation.
|
|
3
|
+
// Licensed under the MIT License.
|
|
4
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
5
|
+
exports.RingEnforcer = exports.RingBreachError = void 0;
|
|
6
|
+
const types_1 = require("./types");
|
|
7
|
+
class RingBreachError extends Error {
|
|
8
|
+
violation;
|
|
9
|
+
constructor(violation) {
|
|
10
|
+
super(violation.message);
|
|
11
|
+
this.name = 'RingBreachError';
|
|
12
|
+
this.violation = violation;
|
|
13
|
+
}
|
|
14
|
+
}
|
|
15
|
+
exports.RingBreachError = RingBreachError;
|
|
16
|
+
class RingEnforcer {
|
|
17
|
+
agentRing;
|
|
18
|
+
defaultRing;
|
|
19
|
+
actionRings;
|
|
20
|
+
constructor(config = {}) {
|
|
21
|
+
this.agentRing = config.agentRing ?? types_1.ExecutionRing.Ring3;
|
|
22
|
+
this.defaultRing = config.defaultRing ?? types_1.ExecutionRing.Ring3;
|
|
23
|
+
this.actionRings = config.actionRings ?? {};
|
|
24
|
+
}
|
|
25
|
+
getAgentRing() {
|
|
26
|
+
return this.agentRing;
|
|
27
|
+
}
|
|
28
|
+
getRequiredRing(action) {
|
|
29
|
+
for (const [pattern, ring] of Object.entries(this.actionRings)) {
|
|
30
|
+
if (this.matches(pattern, action)) {
|
|
31
|
+
return ring;
|
|
32
|
+
}
|
|
33
|
+
}
|
|
34
|
+
return this.defaultRing;
|
|
35
|
+
}
|
|
36
|
+
canExecute(action) {
|
|
37
|
+
return this.agentRing <= this.getRequiredRing(action);
|
|
38
|
+
}
|
|
39
|
+
enforce(action) {
|
|
40
|
+
if (this.canExecute(action)) {
|
|
41
|
+
return;
|
|
42
|
+
}
|
|
43
|
+
throw new RingBreachError({
|
|
44
|
+
action,
|
|
45
|
+
agentRing: this.agentRing,
|
|
46
|
+
requiredRing: this.getRequiredRing(action),
|
|
47
|
+
message: `Execution ring breach for action "${action}": agent ring ${this.agentRing} exceeds required ring ${this.getRequiredRing(action)}`,
|
|
48
|
+
});
|
|
49
|
+
}
|
|
50
|
+
matches(pattern, action) {
|
|
51
|
+
if (pattern === '*') {
|
|
52
|
+
return true;
|
|
53
|
+
}
|
|
54
|
+
if (pattern.endsWith('*')) {
|
|
55
|
+
return action.startsWith(pattern.slice(0, -1));
|
|
56
|
+
}
|
|
57
|
+
return pattern === action;
|
|
58
|
+
}
|
|
59
|
+
}
|
|
60
|
+
exports.RingEnforcer = RingEnforcer;
|
|
61
|
+
//# sourceMappingURL=rings.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"rings.js","sourceRoot":"","sources":["../src/rings.ts"],"names":[],"mappings":";AAAA,uCAAuC;AACvC,kCAAkC;;;AAElC,mCAA+E;AAE/E,MAAa,eAAgB,SAAQ,KAAK;IAC/B,SAAS,CAAgB;IAElC,YAAY,SAAwB;QAClC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AARD,0CAQC;AAED,MAAa,YAAY;IACN,SAAS,CAAgB;IACzB,WAAW,CAAgB;IAC3B,WAAW,CAAgC;IAE5D,YAAY,SAAiC,EAAE;QAC7C,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,qBAAa,CAAC,KAAK,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,qBAAa,CAAC,KAAK,CAAC;QAC7D,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9C,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,eAAe,CAAC,MAAc;QAC5B,KAAK,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/D,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;gBAClC,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,MAAM,IAAI,eAAe,CAAC;YACxB,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC1C,OAAO,EAAE,qCAAqC,MAAM,iBAAiB,IAAI,CAAC,SAAS,0BAA0B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE;SAC5I,CAAC,CAAC;IACL,CAAC;IAEO,OAAO,CAAC,OAAe,EAAE,MAAc;QAC7C,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,CAAC;QAED,OAAO,OAAO,KAAK,MAAM,CAAC;IAC5B,CAAC;CACF;AArDD,oCAqDC"}
|
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
export declare enum SessionStatus {
|
|
2
|
+
Provisioning = "provisioning",
|
|
3
|
+
Ready = "ready",
|
|
4
|
+
Executing = "executing",
|
|
5
|
+
Destroying = "destroying",
|
|
6
|
+
Destroyed = "destroyed",
|
|
7
|
+
Failed = "failed"
|
|
8
|
+
}
|
|
9
|
+
export declare enum ExecutionStatus {
|
|
10
|
+
Pending = "pending",
|
|
11
|
+
Running = "running",
|
|
12
|
+
Completed = "completed",
|
|
13
|
+
Cancelled = "cancelled",
|
|
14
|
+
Failed = "failed"
|
|
15
|
+
}
|
|
16
|
+
export interface SandboxConfig {
|
|
17
|
+
timeoutSeconds: number;
|
|
18
|
+
memoryMb: number;
|
|
19
|
+
cpuLimit: number;
|
|
20
|
+
networkEnabled: boolean;
|
|
21
|
+
readOnlyFs: boolean;
|
|
22
|
+
envVars: Record<string, string>;
|
|
23
|
+
}
|
|
24
|
+
export interface SandboxResult {
|
|
25
|
+
success: boolean;
|
|
26
|
+
exitCode: number;
|
|
27
|
+
stdout: string;
|
|
28
|
+
stderr: string;
|
|
29
|
+
durationSeconds: number;
|
|
30
|
+
killed: boolean;
|
|
31
|
+
killReason: string;
|
|
32
|
+
}
|
|
33
|
+
export interface SessionHandle {
|
|
34
|
+
agentId: string;
|
|
35
|
+
sessionId: string;
|
|
36
|
+
status: SessionStatus;
|
|
37
|
+
}
|
|
38
|
+
export interface ExecutionHandle {
|
|
39
|
+
executionId: string;
|
|
40
|
+
agentId: string;
|
|
41
|
+
sessionId: string;
|
|
42
|
+
status: ExecutionStatus;
|
|
43
|
+
result?: SandboxResult;
|
|
44
|
+
}
|
|
45
|
+
export declare function defaultSandboxConfig(): SandboxConfig;
|
|
46
|
+
export interface SandboxProvider {
|
|
47
|
+
createSession(agentId: string, config?: SandboxConfig): Promise<SessionHandle>;
|
|
48
|
+
executeCode(agentId: string, sessionId: string, code: string): Promise<ExecutionHandle>;
|
|
49
|
+
destroySession(agentId: string, sessionId: string): Promise<void>;
|
|
50
|
+
isAvailable(): Promise<boolean>;
|
|
51
|
+
}
|
|
52
|
+
export declare class DockerSandboxProvider implements SandboxProvider {
|
|
53
|
+
private readonly image;
|
|
54
|
+
private readonly containers;
|
|
55
|
+
constructor(image?: string);
|
|
56
|
+
isAvailable(): Promise<boolean>;
|
|
57
|
+
createSession(agentId: string, config?: SandboxConfig): Promise<SessionHandle>;
|
|
58
|
+
executeCode(agentId: string, sessionId: string, code: string): Promise<ExecutionHandle>;
|
|
59
|
+
destroySession(agentId: string, sessionId: string): Promise<void>;
|
|
60
|
+
}
|
|
61
|
+
//# sourceMappingURL=sandbox.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AASA,oBAAY,aAAa;IACvB,YAAY,iBAAiB;IAC7B,KAAK,UAAU;IACf,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAED,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,SAAS,cAAc;IACvB,MAAM,WAAW;CAClB;AAMD,MAAM,WAAW,aAAa;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,OAAO,CAAC;IACxB,UAAU,EAAE,OAAO,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,aAAa,CAAC;CACvB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAMD,wBAAgB,oBAAoB,IAAI,aAAa,CASpD;AAMD,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AA2CD,qBAAa,qBAAsB,YAAW,eAAe;IAC3D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA6B;gBAE5C,KAAK,GAAE,MAA2B;IAIxC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAS/B,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAAC,aAAa,CAAC;IAqDnB,WAAW,CACf,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,eAAe,CAAC;IAuDrB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiBxE"}
|
package/dist/sandbox.js
ADDED
|
@@ -0,0 +1,199 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
// Copyright (c) Microsoft Corporation. Licensed under the MIT License.
|
|
3
|
+
Object.defineProperty(exports, "__esModule", { value: true });
|
|
4
|
+
exports.DockerSandboxProvider = exports.ExecutionStatus = exports.SessionStatus = void 0;
|
|
5
|
+
exports.defaultSandboxConfig = defaultSandboxConfig;
|
|
6
|
+
const child_process_1 = require("child_process");
|
|
7
|
+
const crypto_1 = require("crypto");
|
|
8
|
+
// ---------------------------------------------------------------------------
|
|
9
|
+
// Enums
|
|
10
|
+
// ---------------------------------------------------------------------------
|
|
11
|
+
var SessionStatus;
|
|
12
|
+
(function (SessionStatus) {
|
|
13
|
+
SessionStatus["Provisioning"] = "provisioning";
|
|
14
|
+
SessionStatus["Ready"] = "ready";
|
|
15
|
+
SessionStatus["Executing"] = "executing";
|
|
16
|
+
SessionStatus["Destroying"] = "destroying";
|
|
17
|
+
SessionStatus["Destroyed"] = "destroyed";
|
|
18
|
+
SessionStatus["Failed"] = "failed";
|
|
19
|
+
})(SessionStatus || (exports.SessionStatus = SessionStatus = {}));
|
|
20
|
+
var ExecutionStatus;
|
|
21
|
+
(function (ExecutionStatus) {
|
|
22
|
+
ExecutionStatus["Pending"] = "pending";
|
|
23
|
+
ExecutionStatus["Running"] = "running";
|
|
24
|
+
ExecutionStatus["Completed"] = "completed";
|
|
25
|
+
ExecutionStatus["Cancelled"] = "cancelled";
|
|
26
|
+
ExecutionStatus["Failed"] = "failed";
|
|
27
|
+
})(ExecutionStatus || (exports.ExecutionStatus = ExecutionStatus = {}));
|
|
28
|
+
// ---------------------------------------------------------------------------
|
|
29
|
+
// Default config factory
|
|
30
|
+
// ---------------------------------------------------------------------------
|
|
31
|
+
function defaultSandboxConfig() {
|
|
32
|
+
return {
|
|
33
|
+
timeoutSeconds: 60,
|
|
34
|
+
memoryMb: 512,
|
|
35
|
+
cpuLimit: 1.0,
|
|
36
|
+
networkEnabled: false,
|
|
37
|
+
readOnlyFs: true,
|
|
38
|
+
envVars: {},
|
|
39
|
+
};
|
|
40
|
+
}
|
|
41
|
+
// ---------------------------------------------------------------------------
|
|
42
|
+
// Environment variables blocked from sandbox containers
|
|
43
|
+
// ---------------------------------------------------------------------------
|
|
44
|
+
const BLOCKED_ENV_VARS = new Set([
|
|
45
|
+
'LD_PRELOAD',
|
|
46
|
+
'LD_LIBRARY_PATH',
|
|
47
|
+
'LD_AUDIT',
|
|
48
|
+
'LD_DEBUG',
|
|
49
|
+
'LD_PROFILE',
|
|
50
|
+
'LD_SHOW_AUXV',
|
|
51
|
+
'LD_DYNAMIC_WEAK',
|
|
52
|
+
'PYTHONSTARTUP',
|
|
53
|
+
'PYTHONPATH',
|
|
54
|
+
]);
|
|
55
|
+
function sanitizeEnvVars(envVars) {
|
|
56
|
+
const clean = {};
|
|
57
|
+
for (const [k, v] of Object.entries(envVars)) {
|
|
58
|
+
if (!BLOCKED_ENV_VARS.has(k.toUpperCase())) {
|
|
59
|
+
clean[k] = v;
|
|
60
|
+
}
|
|
61
|
+
}
|
|
62
|
+
return clean;
|
|
63
|
+
}
|
|
64
|
+
// Docker resource-name pattern: [a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}
|
|
65
|
+
const DOCKER_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/;
|
|
66
|
+
function validateResourceName(value, label) {
|
|
67
|
+
if (!DOCKER_NAME_RE.test(value)) {
|
|
68
|
+
throw new Error(`Invalid ${label} '${value}': must match [a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}`);
|
|
69
|
+
}
|
|
70
|
+
}
|
|
71
|
+
// ---------------------------------------------------------------------------
|
|
72
|
+
// DockerSandboxProvider
|
|
73
|
+
// ---------------------------------------------------------------------------
|
|
74
|
+
class DockerSandboxProvider {
|
|
75
|
+
image;
|
|
76
|
+
containers = new Map(); // sessionId -> containerId
|
|
77
|
+
constructor(image = 'python:3.11-slim') {
|
|
78
|
+
this.image = image;
|
|
79
|
+
}
|
|
80
|
+
async isAvailable() {
|
|
81
|
+
try {
|
|
82
|
+
(0, child_process_1.execSync)('docker info', { stdio: 'pipe', timeout: 10_000 });
|
|
83
|
+
return true;
|
|
84
|
+
}
|
|
85
|
+
catch {
|
|
86
|
+
return false;
|
|
87
|
+
}
|
|
88
|
+
}
|
|
89
|
+
async createSession(agentId, config) {
|
|
90
|
+
validateResourceName(agentId, 'agentId');
|
|
91
|
+
const cfg = config ?? defaultSandboxConfig();
|
|
92
|
+
const sessionId = (0, crypto_1.randomUUID)();
|
|
93
|
+
const containerName = `agt-${agentId}-${sessionId.slice(0, 8)}`;
|
|
94
|
+
const args = [
|
|
95
|
+
'run', '-d',
|
|
96
|
+
'--name', containerName,
|
|
97
|
+
'--cap-drop=ALL',
|
|
98
|
+
'--security-opt=no-new-privileges',
|
|
99
|
+
`--memory=${cfg.memoryMb}m`,
|
|
100
|
+
`--cpus=${cfg.cpuLimit}`,
|
|
101
|
+
'--pids-limit=256',
|
|
102
|
+
];
|
|
103
|
+
if (cfg.readOnlyFs) {
|
|
104
|
+
args.push('--read-only');
|
|
105
|
+
}
|
|
106
|
+
if (!cfg.networkEnabled) {
|
|
107
|
+
args.push('--network=none');
|
|
108
|
+
}
|
|
109
|
+
const safeEnv = sanitizeEnvVars(cfg.envVars);
|
|
110
|
+
for (const [k, v] of Object.entries(safeEnv)) {
|
|
111
|
+
args.push('-e', `${k}=${v}`);
|
|
112
|
+
}
|
|
113
|
+
args.push(this.image, 'tail', '-f', '/dev/null');
|
|
114
|
+
try {
|
|
115
|
+
const containerId = (0, child_process_1.execFileSync)('docker', args, {
|
|
116
|
+
stdio: 'pipe',
|
|
117
|
+
timeout: 30_000,
|
|
118
|
+
})
|
|
119
|
+
.toString()
|
|
120
|
+
.trim();
|
|
121
|
+
this.containers.set(sessionId, containerId);
|
|
122
|
+
return {
|
|
123
|
+
agentId,
|
|
124
|
+
sessionId,
|
|
125
|
+
status: SessionStatus.Ready,
|
|
126
|
+
};
|
|
127
|
+
}
|
|
128
|
+
catch (err) {
|
|
129
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
130
|
+
throw new Error(`Failed to create sandbox session: ${message}`);
|
|
131
|
+
}
|
|
132
|
+
}
|
|
133
|
+
async executeCode(agentId, sessionId, code) {
|
|
134
|
+
validateResourceName(agentId, 'agentId');
|
|
135
|
+
const containerId = this.containers.get(sessionId);
|
|
136
|
+
if (!containerId) {
|
|
137
|
+
throw new Error(`No active session '${sessionId}' for agent '${agentId}'`);
|
|
138
|
+
}
|
|
139
|
+
const executionId = (0, crypto_1.randomUUID)();
|
|
140
|
+
const startTime = Date.now();
|
|
141
|
+
return new Promise((resolve) => {
|
|
142
|
+
const encoded = Buffer.from(code).toString('base64');
|
|
143
|
+
const execArgs = [
|
|
144
|
+
'exec', containerId, 'python3', '-c',
|
|
145
|
+
`import base64; exec(base64.b64decode('${encoded}').decode())`,
|
|
146
|
+
];
|
|
147
|
+
(0, child_process_1.execFile)('docker', execArgs, { timeout: 60_000 }, (error, stdout, stderr) => {
|
|
148
|
+
const durationSeconds = (Date.now() - startTime) / 1000.0;
|
|
149
|
+
// Node's ExecException.code can be: a numeric exit code (child exited
|
|
150
|
+
// non-zero), `null` (child killed by a signal — `error.signal` is set
|
|
151
|
+
// instead), or a string like 'ENOENT' (the spawn itself failed). The
|
|
152
|
+
// previous `error.code as number ?? 1` cast handled the `null` case
|
|
153
|
+
// by accident — `null ?? 1` is `1` — but on the spawn-failure path it
|
|
154
|
+
// let the string ('ENOENT') flow through as a `number`-typed exit
|
|
155
|
+
// code, and downstream consumers treating `exitCode` as numeric saw
|
|
156
|
+
// a string. Narrow explicitly: only accept a numeric code; otherwise
|
|
157
|
+
// synthesise 1 for any error (signal kill, spawn failure, etc.).
|
|
158
|
+
const exitCode = error
|
|
159
|
+
? typeof error.code === 'number' ? error.code : 1
|
|
160
|
+
: 0;
|
|
161
|
+
const killed = error !== null && 'killed' in error && error.killed;
|
|
162
|
+
const result = {
|
|
163
|
+
success: exitCode === 0,
|
|
164
|
+
exitCode,
|
|
165
|
+
stdout: stdout ?? '',
|
|
166
|
+
stderr: stderr ?? '',
|
|
167
|
+
durationSeconds,
|
|
168
|
+
killed,
|
|
169
|
+
killReason: killed ? 'timeout' : '',
|
|
170
|
+
};
|
|
171
|
+
resolve({
|
|
172
|
+
executionId,
|
|
173
|
+
agentId,
|
|
174
|
+
sessionId,
|
|
175
|
+
status: exitCode === 0 ? ExecutionStatus.Completed : ExecutionStatus.Failed,
|
|
176
|
+
result,
|
|
177
|
+
});
|
|
178
|
+
});
|
|
179
|
+
});
|
|
180
|
+
}
|
|
181
|
+
async destroySession(agentId, sessionId) {
|
|
182
|
+
validateResourceName(agentId, 'agentId');
|
|
183
|
+
const containerId = this.containers.get(sessionId);
|
|
184
|
+
if (!containerId) {
|
|
185
|
+
return; // already destroyed or never existed
|
|
186
|
+
}
|
|
187
|
+
try {
|
|
188
|
+
(0, child_process_1.execFileSync)('docker', ['rm', '-f', containerId], {
|
|
189
|
+
stdio: 'pipe',
|
|
190
|
+
timeout: 15_000,
|
|
191
|
+
});
|
|
192
|
+
}
|
|
193
|
+
finally {
|
|
194
|
+
this.containers.delete(sessionId);
|
|
195
|
+
}
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
exports.DockerSandboxProvider = DockerSandboxProvider;
|
|
199
|
+
//# sourceMappingURL=sandbox.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":";AAAA,uEAAuE;;;AAmEvE,oDASC;AA1ED,iDAAuE;AACvE,mCAAoC;AAEpC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAE9E,IAAY,aAOX;AAPD,WAAY,aAAa;IACvB,8CAA6B,CAAA;IAC7B,gCAAe,CAAA;IACf,wCAAuB,CAAA;IACvB,0CAAyB,CAAA;IACzB,wCAAuB,CAAA;IACvB,kCAAiB,CAAA;AACnB,CAAC,EAPW,aAAa,6BAAb,aAAa,QAOxB;AAED,IAAY,eAMX;AAND,WAAY,eAAe;IACzB,sCAAmB,CAAA;IACnB,sCAAmB,CAAA;IACnB,0CAAuB,CAAA;IACvB,0CAAuB,CAAA;IACvB,oCAAiB,CAAA;AACnB,CAAC,EANW,eAAe,+BAAf,eAAe,QAM1B;AAuCD,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,SAAgB,oBAAoB;IAClC,OAAO;QACL,cAAc,EAAE,EAAE;QAClB,QAAQ,EAAE,GAAG;QACb,QAAQ,EAAE,GAAG;QACb,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,EAAE;KACZ,CAAC;AACJ,CAAC;AAaD,8EAA8E;AAC9E,wDAAwD;AACxD,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,YAAY;IACZ,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,YAAY;IACZ,cAAc;IACd,iBAAiB;IACjB,eAAe;IACf,YAAY;CACb,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,OAA+B;IACtD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,MAAM,cAAc,GAAG,oCAAoC,CAAC;AAE5D,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,KAAK,KAAK,gDAAgD,CAC3E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E,MAAa,qBAAqB;IACf,KAAK,CAAS;IACd,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,2BAA2B;IAEpF,YAAY,QAAgB,kBAAkB;QAC5C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,IAAA,wBAAQ,EAAC,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,OAAe,EACf,MAAsB;QAEtB,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzC,MAAM,GAAG,GAAG,MAAM,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,IAAA,mBAAU,GAAE,CAAC;QAC/B,MAAM,aAAa,GAAG,OAAO,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAEhE,MAAM,IAAI,GAAa;YACrB,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,aAAa;YACvB,gBAAgB;YAChB,kCAAkC;YAClC,YAAY,GAAG,CAAC,QAAQ,GAAG;YAC3B,UAAU,GAAG,CAAC,QAAQ,EAAE;YACxB,kBAAkB;SACnB,CAAC;QAEF,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAA,4BAAY,EAAC,QAAQ,EAAE,IAAI,EAAE;gBAC/C,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;aAChB,CAAC;iBACC,QAAQ,EAAE;iBACV,IAAI,EAAE,CAAC;YAEV,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAE5C,OAAO;gBACL,OAAO;gBACP,SAAS;gBACT,MAAM,EAAE,aAAa,CAAC,KAAK;aAC5B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,qCAAqC,OAAO,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CACf,OAAe,EACf,SAAiB,EACjB,IAAY;QAEZ,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,gBAAgB,OAAO,GAAG,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,WAAW,GAAG,IAAA,mBAAU,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,EAAE;YAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG;gBACf,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI;gBACpC,yCAAyC,OAAO,cAAc;aAC/D,CAAC;YAEF,IAAA,wBAAQ,EAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;gBAC1E,MAAM,eAAe,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,MAAM,CAAC;gBAC1D,sEAAsE;gBACtE,sEAAsE;gBACtE,qEAAqE;gBACrE,oEAAoE;gBACpE,sEAAsE;gBACtE,kEAAkE;gBAClE,oEAAoE;gBACpE,qEAAqE;gBACrE,iEAAiE;gBACjE,MAAM,QAAQ,GAAG,KAAK;oBACpB,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBACjD,CAAC,CAAC,CAAC,CAAC;gBACN,MAAM,MAAM,GAAG,KAAK,KAAK,IAAI,IAAI,QAAQ,IAAI,KAAK,IAAK,KAA6B,CAAC,MAAM,CAAC;gBAE5F,MAAM,MAAM,GAAkB;oBAC5B,OAAO,EAAE,QAAQ,KAAK,CAAC;oBACvB,QAAQ;oBACR,MAAM,EAAE,MAAM,IAAI,EAAE;oBACpB,MAAM,EAAE,MAAM,IAAI,EAAE;oBACpB,eAAe;oBACf,MAAM;oBACN,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;iBACpC,CAAC;gBAEF,OAAO,CAAC;oBACN,WAAW;oBACX,OAAO;oBACP,SAAS;oBACT,MAAM,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM;oBAC3E,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe,EAAE,SAAiB;QACrD,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEzC,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,qCAAqC;QAC/C,CAAC;QAED,IAAI,CAAC;YACH,IAAA,4BAAY,EAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;gBAChD,KAAK,EAAE,MAAM;gBACb,OAAO,EAAE,MAAM;aAChB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF;AArJD,sDAqJC"}
|
|
@@ -0,0 +1,45 @@
|
|
|
1
|
+
import type { GovernanceSurface, Policy, PolicyRule, SurfaceParityReport } from './types';
|
|
2
|
+
/**
|
|
3
|
+
* Detects governance parity gaps between enforcement surfaces (CLI, IDE, API).
|
|
4
|
+
*
|
|
5
|
+
* When organizations deploy governance policies, rules may be enforced
|
|
6
|
+
* differently depending on the surface. This checker identifies rules
|
|
7
|
+
* that only apply to some surfaces, highlighting enforcement gaps.
|
|
8
|
+
*/
|
|
9
|
+
export declare class SurfaceParityChecker {
|
|
10
|
+
/**
|
|
11
|
+
* Analyze a set of policies for surface parity gaps.
|
|
12
|
+
*/
|
|
13
|
+
analyzePolicies(policies: Policy[]): SurfaceParityReport;
|
|
14
|
+
/**
|
|
15
|
+
* Detect which surfaces a rule targets.
|
|
16
|
+
* Returns empty array for universal rules (no surface restriction).
|
|
17
|
+
*/
|
|
18
|
+
detectSurfaces(rule: PolicyRule): GovernanceSurface[];
|
|
19
|
+
/**
|
|
20
|
+
* Find gaps by grouping surface-specific rules by their normalized semantics
|
|
21
|
+
* and checking which surfaces are missing counterparts.
|
|
22
|
+
*/
|
|
23
|
+
private findGaps;
|
|
24
|
+
/**
|
|
25
|
+
* Generate a normalized key for a rule based on its semantics
|
|
26
|
+
* (action + non-surface conditions), so we can group rules that
|
|
27
|
+
* do the same thing on different surfaces.
|
|
28
|
+
*/
|
|
29
|
+
private normalizeRuleKey;
|
|
30
|
+
/**
|
|
31
|
+
* Remove surface-related parts from a condition to get the
|
|
32
|
+
* "semantic core" of a rule for comparison purposes.
|
|
33
|
+
*/
|
|
34
|
+
private stripSurfaceFromCondition;
|
|
35
|
+
private classifySeverity;
|
|
36
|
+
private generateRecommendation;
|
|
37
|
+
private computeCoverage;
|
|
38
|
+
/**
|
|
39
|
+
* Compute a 0-100 parity score.
|
|
40
|
+
* 100 = perfect parity (all rules are universal or all surfaces equally covered).
|
|
41
|
+
* Deductions for each gap, weighted by severity.
|
|
42
|
+
*/
|
|
43
|
+
private computeParityScore;
|
|
44
|
+
}
|
|
45
|
+
//# sourceMappingURL=surface-parity.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"surface-parity.d.ts","sourceRoot":"","sources":["../src/surface-parity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,iBAAiB,EACjB,MAAM,EAEN,UAAU,EAEV,mBAAmB,EAEpB,MAAM,SAAS,CAAC;AAgBjB;;;;;;GAMG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,mBAAmB;IAoCxD;;;OAGG;IACH,cAAc,CAAC,IAAI,EAAE,UAAU,GAAG,iBAAiB,EAAE;IAqCrD;;;OAGG;IACH,OAAO,CAAC,QAAQ;IAiDhB;;;;OAIG;IACH,OAAO,CAAC,gBAAgB;IAMxB;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAwBjC,OAAO,CAAC,gBAAgB;IAMxB,OAAO,CAAC,sBAAsB;IAsB9B,OAAO,CAAC,eAAe;IAgBvB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;CAc3B"}
|