@vorionsys/platform-core 0.1.0

package/dist/cognigate/sandbox/capability-broker.js

@@ -0,0 +1,461 @@
+/**
+ * Capability Broker
+ *
+ * Mediates capability requests between agents and sandbox enforcement.
+ * Translates trust tier into concrete capabilities and handles runtime
+ * capability elevation requests.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { NetworkAccessLevel, FilesystemAccessLevel, TIER_CAPABILITIES, } from './types.js';
+const logger = createLogger({ component: 'capability-broker' });
+// ============================================================================
+// Capability Broker
+// ============================================================================
+export class CapabilityBroker {
+    grantedCapabilities = new Map();
+    pendingRequests = new Map();
+    constructor() {
+        logger.info('Capability broker initialized');
+    }
+    // ==========================================================================
+    // Capability Resolution
+    // ==========================================================================
+    /**
+     * Get capabilities for a trust tier
+     */
+    getCapabilitiesForTier(trustTier) {
+        const caps = TIER_CAPABILITIES[trustTier];
+        if (!caps) {
+            throw new Error(`Invalid trust tier: ${trustTier}`);
+        }
+        return { ...caps };
+    }
+    /**
+     * Check if a tier has a specific capability
+     */
+    hasCapability(trustTier, capability) {
+        const caps = this.getCapabilitiesForTier(trustTier);
+        switch (capability) {
+            case 'network_egress':
+                return caps.networkAccess !== NetworkAccessLevel.NONE;
+            case 'filesystem_write':
+                return caps.filesystemAccess !== FilesystemAccessLevel.READONLY_SANDBOX;
+            case 'spawn_subprocess':
+                return caps.canSpawnSubprocesses;
+            case 'secret_access':
+                return caps.canAccessSecrets;
+            case 'agent_communication':
+                return caps.canCommunicateWithAgents;
+            case 'extended_runtime':
+            case 'elevated_resources':
+                return trustTier >= 4; // T4+ can request elevated resources
+            default:
+                return false;
+        }
+    }
+    // ==========================================================================
+    // Capability Requests
+    // ==========================================================================
+    /**
+     * Request a capability at runtime
+     */
+    async requestCapability(sandboxId, config, request) {
+        const fullRequest = {
+            ...request,
+            requestId: `cap-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+            requestedAt: new Date(),
+        };
+        // Track the request
+        const pending = this.pendingRequests.get(sandboxId) || [];
+        pending.push(fullRequest);
+        this.pendingRequests.set(sandboxId, pending);
+        // Evaluate the request
+        const decision = this.evaluateRequest(config, fullRequest);
+        // Remove from pending
+        const updatedPending = this.pendingRequests.get(sandboxId) || [];
+        this.pendingRequests.set(sandboxId, updatedPending.filter((r) => r.requestId !== fullRequest.requestId));
+        // Track granted capabilities
+        if (decision.granted) {
+            this.trackGrantedCapability(sandboxId, fullRequest, decision);
+        }
+        logger.info({
+            sandboxId,
+            requestId: fullRequest.requestId,
+            type: request.type,
+            granted: decision.granted,
+            reason: decision.reason,
+        }, 'Capability request processed');
+        return decision;
+    }
+    /**
+     * Evaluate a capability request
+     */
+    evaluateRequest(config, request) {
+        const caps = config.capabilities;
+        const tier = config.trustTier;
+        // Check if capability is available at this tier
+        if (!this.hasCapability(tier, request.type)) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: `Capability '${request.type}' not available at trust tier ${tier}`,
+            };
+        }
+        // Evaluate specific capability
+        switch (request.type) {
+            case 'network_egress':
+                return this.evaluateNetworkEgress(config, request);
+            case 'filesystem_write':
+                return this.evaluateFilesystemWrite(config, request);
+            case 'spawn_subprocess':
+                return this.evaluateSubprocessSpawn(config, request);
+            case 'secret_access':
+                return this.evaluateSecretAccess(config, request);
+            case 'agent_communication':
+                return this.evaluateAgentCommunication(config, request);
+            case 'extended_runtime':
+            case 'elevated_resources':
+                return this.evaluateResourceElevation(config, request);
+            default:
+                return {
+                    requestId: request.requestId,
+                    granted: false,
+                    reason: `Unknown capability type: ${request.type}`,
+                };
+        }
+    }
+    /**
+     * Evaluate network egress request
+     */
+    evaluateNetworkEgress(config, request) {
+        const { egressDomain, egressPort } = request.details;
+        const caps = config.capabilities;
+        // Check if domain is in allowed list
+        const isAllowed = caps.allowedEgressDomains.some((pattern) => {
+            if (pattern === '*')
+                return true;
+            if (pattern.startsWith('*.')) {
+                return egressDomain?.endsWith(pattern.slice(1));
+            }
+            return egressDomain === pattern;
+        });
+        if (!isAllowed) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: `Domain '${egressDomain}' not in allowed egress list`,
+            };
+        }
+        // Check rate limits
+        const conditions = {
+            maxDurationMs: 60000, // 1 minute
+            maxBytes: this.getEgressBytesLimit(config.trustTier),
+            rateLimit: this.getRateLimit(config.trustTier),
+            auditLevel: config.trustTier <= 3 ? 'full' : 'summary',
+        };
+        return {
+            requestId: request.requestId,
+            granted: true,
+            reason: 'Egress allowed per policy',
+            conditions,
+            expiresAt: new Date(Date.now() + 60000),
+        };
+    }
+    /**
+     * Evaluate filesystem write request
+     */
+    evaluateFilesystemWrite(config, request) {
+        const { writePath } = request.details;
+        const caps = config.capabilities;
+        // Check if path is in allowed list
+        const isAllowed = caps.allowedMountPaths.some((pattern) => {
+            if (pattern === '*')
+                return true;
+            return writePath?.startsWith(pattern);
+        });
+        if (!isAllowed) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: `Path '${writePath}' not in allowed write paths`,
+            };
+        }
+        return {
+            requestId: request.requestId,
+            granted: true,
+            reason: 'Write allowed per policy',
+            conditions: {
+                maxBytes: this.getDiskQuota(config.trustTier),
+                auditLevel: 'detailed',
+            },
+        };
+    }
+    /**
+     * Evaluate subprocess spawn request
+     */
+    evaluateSubprocessSpawn(config, request) {
+        if (!config.capabilities.canSpawnSubprocesses) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: 'Subprocess spawning not allowed at this tier',
+            };
+        }
+        return {
+            requestId: request.requestId,
+            granted: true,
+            reason: 'Subprocess allowed per policy',
+            conditions: {
+                auditLevel: 'full',
+            },
+        };
+    }
+    /**
+     * Evaluate secret access request
+     */
+    evaluateSecretAccess(config, request) {
+        if (!config.capabilities.canAccessSecrets) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: 'Secret access not allowed at this tier',
+            };
+        }
+        // T3-T4: require approval for sensitive secrets
+        const conditions = {
+            auditLevel: 'full',
+            requiresApproval: config.trustTier < 5,
+        };
+        return {
+            requestId: request.requestId,
+            granted: !conditions.requiresApproval, // Auto-grant for T5+
+            reason: conditions.requiresApproval
+                ? 'Secret access requires human approval'
+                : 'Secret access granted',
+            conditions,
+        };
+    }
+    /**
+     * Evaluate agent communication request
+     */
+    evaluateAgentCommunication(config, request) {
+        if (!config.capabilities.canCommunicateWithAgents) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: 'Agent communication not allowed at this tier',
+            };
+        }
+        return {
+            requestId: request.requestId,
+            granted: true,
+            reason: 'Agent communication allowed per policy',
+            conditions: {
+                auditLevel: 'detailed',
+                maxBytes: 10 * 1024 * 1024, // 10MB message limit
+            },
+        };
+    }
+    /**
+     * Evaluate resource elevation request
+     */
+    evaluateResourceElevation(config, request) {
+        const { additionalMemoryMb, additionalCpuPercent, additionalTimeMs } = request.details;
+        const caps = config.capabilities;
+        // Calculate requested totals
+        const requestedMemory = (additionalMemoryMb || 0) + caps.maxMemoryMb;
+        const requestedCpu = (additionalCpuPercent || 0) + caps.maxCpuPercent;
+        const requestedTime = (additionalTimeMs || 0) + caps.maxExecutionMs;
+        // Check against hard limits (2x tier limits max)
+        const maxAllowedMemory = caps.maxMemoryMb === -1 ? -1 : caps.maxMemoryMb * 2;
+        const maxAllowedTime = caps.maxExecutionMs === -1 ? -1 : caps.maxExecutionMs * 2;
+        if (maxAllowedMemory !== -1 && requestedMemory > maxAllowedMemory) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: `Requested memory ${requestedMemory}MB exceeds maximum ${maxAllowedMemory}MB`,
+            };
+        }
+        if (requestedCpu > 100) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: 'CPU cannot exceed 100%',
+            };
+        }
+        if (maxAllowedTime !== -1 && requestedTime > maxAllowedTime) {
+            return {
+                requestId: request.requestId,
+                granted: false,
+                reason: `Requested time ${requestedTime}ms exceeds maximum ${maxAllowedTime}ms`,
+            };
+        }
+        return {
+            requestId: request.requestId,
+            granted: true,
+            reason: 'Resource elevation granted',
+            conditions: {
+                maxDurationMs: additionalTimeMs,
+                auditLevel: 'full',
+            },
+        };
+    }
+    // ==========================================================================
+    // Capability Tracking
+    // ==========================================================================
+    /**
+     * Track a granted capability
+     */
+    trackGrantedCapability(sandboxId, request, decision) {
+        const granted = this.grantedCapabilities.get(sandboxId) || [];
+        granted.push({
+            requestId: request.requestId,
+            type: request.type,
+            details: request.details,
+            conditions: decision.conditions,
+            grantedAt: new Date(),
+            expiresAt: decision.expiresAt,
+            usageCount: 0,
+            bytesUsed: 0,
+        });
+        this.grantedCapabilities.set(sandboxId, granted);
+    }
+    /**
+     * Record capability usage
+     */
+    recordUsage(sandboxId, requestId, bytes = 0) {
+        const granted = this.grantedCapabilities.get(sandboxId) || [];
+        const cap = granted.find((g) => g.requestId === requestId);
+        if (cap) {
+            cap.usageCount++;
+            cap.bytesUsed += bytes;
+        }
+    }
+    /**
+     * Check if a granted capability is still valid
+     */
+    isCapabilityValid(sandboxId, requestId) {
+        const granted = this.grantedCapabilities.get(sandboxId) || [];
+        const cap = granted.find((g) => g.requestId === requestId);
+        if (!cap)
+            return false;
+        // Check expiration
+        if (cap.expiresAt && cap.expiresAt < new Date()) {
+            return false;
+        }
+        // Check byte limits
+        if (cap.conditions.maxBytes && cap.bytesUsed >= cap.conditions.maxBytes) {
+            return false;
+        }
+        // Check rate limits
+        if (cap.conditions.rateLimit && cap.usageCount >= cap.conditions.rateLimit) {
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Revoke a granted capability
+     */
+    revokeCapability(sandboxId, requestId, reason) {
+        const granted = this.grantedCapabilities.get(sandboxId) || [];
+        this.grantedCapabilities.set(sandboxId, granted.filter((g) => g.requestId !== requestId));
+        logger.info({ sandboxId, requestId, reason }, 'Capability revoked');
+    }
+    /**
+     * Revoke all capabilities for a sandbox
+     */
+    revokeAllCapabilities(sandboxId) {
+        this.grantedCapabilities.delete(sandboxId);
+        this.pendingRequests.delete(sandboxId);
+        logger.info({ sandboxId }, 'All capabilities revoked');
+    }
+    /**
+     * Get all granted capabilities for a sandbox
+     */
+    getGrantedCapabilities(sandboxId) {
+        return this.grantedCapabilities.get(sandboxId) || [];
+    }
+    // ==========================================================================
+    // Violation Handling
+    // ==========================================================================
+    /**
+     * Handle a policy violation
+     */
+    handleViolation(sandboxId, violation) {
+        // Determine action based on severity
+        switch (violation.severity) {
+            case 'low':
+                return { action: 'warn', reason: 'Low severity violation logged' };
+            case 'medium':
+                // Revoke related capability
+                return { action: 'revoke', reason: 'Medium severity violation - capability revoked' };
+            case 'high':
+            case 'critical':
+                // Terminate sandbox
+                return { action: 'terminate', reason: 'High/critical violation - sandbox terminated' };
+            default:
+                return { action: 'warn', reason: 'Unknown severity' };
+        }
+    }
+    // ==========================================================================
+    // Helpers
+    // ==========================================================================
+    getEgressBytesLimit(tier) {
+        const limits = {
+            0: 0,
+            1: 0,
+            2: 10 * 1024 * 1024, // 10MB
+            3: 50 * 1024 * 1024, // 50MB
+            4: 100 * 1024 * 1024, // 100MB
+            5: 500 * 1024 * 1024, // 500MB
+            6: 1024 * 1024 * 1024, // 1GB
+            7: -1, // Unlimited
+        };
+        return limits[tier] || 0;
+    }
+    getRateLimit(tier) {
+        const limits = {
+            0: 0,
+            1: 0,
+            2: 100,
+            3: 500,
+            4: 1000,
+            5: 5000,
+            6: 10000,
+            7: -1,
+        };
+        return limits[tier] || 0;
+    }
+    getDiskQuota(tier) {
+        const quotas = {
+            0: 0,
+            1: 0,
+            2: 100 * 1024 * 1024, // 100MB
+            3: 500 * 1024 * 1024, // 500MB
+            4: 1024 * 1024 * 1024, // 1GB
+            5: 5 * 1024 * 1024 * 1024, // 5GB
+            6: 10 * 1024 * 1024 * 1024, // 10GB
+            7: -1, // Unlimited
+        };
+        return quotas[tier] || 0;
+    }
+}
+// ============================================================================
+// Factory Functions
+// ============================================================================
+let instance = null;
+export function createCapabilityBroker() {
+    if (!instance) {
+        instance = new CapabilityBroker();
+    }
+    return instance;
+}
+export function getCapabilityBroker() {
+    if (!instance) {
+        throw new Error('CapabilityBroker not initialized');
+    }
+    return instance;
+}
+//# sourceMappingURL=capability-broker.js.map

package/dist/cognigate/sandbox/capability-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-broker.js","sourceRoot":"","sources":["../../../src/cognigate/sandbox/capability-broker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAIL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAgHhE,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,MAAM,OAAO,gBAAgB;IACnB,mBAAmB,GAAqC,IAAI,GAAG,EAAE,CAAC;IAClE,eAAe,GAAqC,IAAI,GAAG,EAAE,CAAC;IAEtE;QACE,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IAED,6EAA6E;IAC7E,wBAAwB;IACxB,6EAA6E;IAE7E;;OAEG;IACH,sBAAsB,CAAC,SAAiB;QACtC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB,EAAE,UAA0B;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;QAEpD,QAAQ,UAAU,EAAE,CAAC;YACnB,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,aAAa,KAAK,kBAAkB,CAAC,IAAI,CAAC;YAExD,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,gBAAgB,CAAC;YAE1E,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,oBAAoB,CAAC;YAEnC,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,gBAAgB,CAAC;YAE/B,KAAK,qBAAqB;gBACxB,OAAO,IAAI,CAAC,wBAAwB,CAAC;YAEvC,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,OAAO,SAAS,IAAI,CAAC,CAAC,CAAC,qCAAqC;YAE9D;gBACE,OAAO,KAAK,CAAC;QACjB,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAE7E;;OAEG;IACH,KAAK,CAAC,iBAAiB,CACrB,SAAiB,EACjB,MAAqB,EACrB,OAA6D;QAE7D,MAAM,WAAW,GAAsB;YACrC,GAAG,OAAO;YACV,SAAS,EAAE,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YACxE,WAAW,EAAE,IAAI,IAAI,EAAE;SACxB,CAAC;QAEF,oBAAoB;QACpB,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE7C,uBAAuB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAE3D,sBAAsB;QACtB,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,CAAC,eAAe,CAAC,GAAG,CACtB,SAAS,EACT,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,WAAW,CAAC,SAAS,CAAC,CACpE,CAAC;QAEF,6BAA6B;QAC7B,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,IAAI,CAAC,sBAAsB,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,CAAC,IAAI,CACT;YACE,SAAS;YACT,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;SACxB,EACD,8BAA8B,CAC/B,CAAC;QAEF,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,MAAqB,EACrB,OAA0B;QAE1B,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC;QAE9B,gDAAgD;QAChD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5C,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,eAAe,OAAO,CAAC,IAAI,iCAAiC,IAAI,EAAE;aAC3E,CAAC;QACJ,CAAC;QAED,+BAA+B;QAC/B,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,gBAAgB;gBACnB,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAErD,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEvD,KAAK,kBAAkB;gBACrB,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEvD,KAAK,eAAe;gBAClB,OAAO,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEpD,KAAK,qBAAqB;gBACxB,OAAO,IAAI,CAAC,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAE1D,KAAK,kBAAkB,CAAC;YACxB,KAAK,oBAAoB;gBACvB,OAAO,IAAI,CAAC,yBAAyB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAEzD;gBACE,OAAO;oBACL,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,KAAK;oBACd,MAAM,EAAE,4BAA4B,OAAO,CAAC,IAAI,EAAE;iBACnD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;OAEG;IACK,qBAAqB,CAC3B,MAAqB,EACrB,OAA0B;QAE1B,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QAEjC,qCAAqC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAC3D,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7B,OAAO,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,YAAY,KAAK,OAAO,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,WAAW,YAAY,8BAA8B;aAC9D,CAAC;QACJ,CAAC;QAED,oBAAoB;QACpB,MAAM,UAAU,GAAyB;YACvC,aAAa,EAAE,KAAK,EAAE,WAAW;YACjC,QAAQ,EAAE,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC;YACpD,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,UAAU,EAAE,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SACvD,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,2BAA2B;YACnC,UAAU;YACV,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;SACxC,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAqB,EACrB,OAA0B;QAE1B,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QAEjC,mCAAmC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YACxD,IAAI,OAAO,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC;YACjC,OAAO,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,SAAS,SAAS,8BAA8B;aACzD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,0BAA0B;YAClC,UAAU,EAAE;gBACV,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC;gBAC7C,UAAU,EAAE,UAAU;aACvB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAqB,EACrB,OAA0B;QAE1B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,oBAAoB,EAAE,CAAC;YAC9C,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,+BAA+B;YACvC,UAAU,EAAE;gBACV,UAAU,EAAE,MAAM;aACnB;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,oBAAoB,CAC1B,MAAqB,EACrB,OAA0B;QAE1B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,gBAAgB,EAAE,CAAC;YAC1C,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wCAAwC;aACjD,CAAC;QACJ,CAAC;QAED,gDAAgD;QAChD,MAAM,UAAU,GAAyB;YACvC,UAAU,EAAE,MAAM;YAClB,gBAAgB,EAAE,MAAM,CAAC,SAAS,GAAG,CAAC;SACvC,CAAC;QAEF,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,CAAC,UAAU,CAAC,gBAAgB,EAAE,qBAAqB;YAC5D,MAAM,EAAE,UAAU,CAAC,gBAAgB;gBACjC,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,uBAAuB;YAC3B,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,0BAA0B,CAChC,MAAqB,EACrB,OAA0B;QAE1B,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,wBAAwB,EAAE,CAAC;YAClD,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,8CAA8C;aACvD,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,wCAAwC;YAChD,UAAU,EAAE;gBACV,UAAU,EAAE,UAAU;gBACtB,QAAQ,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,qBAAqB;aAClD;SACF,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,yBAAyB,CAC/B,MAAqB,EACrB,OAA0B;QAE1B,MAAM,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;QACvF,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC;QAEjC,6BAA6B;QAC7B,MAAM,eAAe,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;QACrE,MAAM,YAAY,GAAG,CAAC,oBAAoB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC;QACtE,MAAM,aAAa,GAAG,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC;QAEpE,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,CAAC;QAC7E,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,GAAG,CAAC,CAAC;QAEjF,IAAI,gBAAgB,KAAK,CAAC,CAAC,IAAI,eAAe,GAAG,gBAAgB,EAAE,CAAC;YAClE,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,oBAAoB,eAAe,sBAAsB,gBAAgB,IAAI;aACtF,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,GAAG,EAAE,CAAC;YACvB,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,wBAAwB;aACjC,CAAC;QACJ,CAAC;QAED,IAAI,cAAc,KAAK,CAAC,CAAC,IAAI,aAAa,GAAG,cAAc,EAAE,CAAC;YAC5D,OAAO;gBACL,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,kBAAkB,aAAa,sBAAsB,cAAc,IAAI;aAChF,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,4BAA4B;YACpC,UAAU,EAAE;gBACV,aAAa,EAAE,gBAAgB;gBAC/B,UAAU,EAAE,MAAM;aACnB;SACF,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAE7E;;OAEG;IACK,sBAAsB,CAC5B,SAAiB,EACjB,OAA0B,EAC1B,QAA4B;QAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAE9D,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU,EAAE,QAAQ,CAAC,UAAW;YAChC,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QAEH,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB,EAAE,SAAiB,EAAE,QAAgB,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAE3D,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,UAAU,EAAE,CAAC;YACjB,GAAG,CAAC,SAAS,IAAI,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAiB,EAAE,SAAiB;QACpD,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QAE3D,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAEvB,mBAAmB;QACnB,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,oBAAoB;QACpB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,SAAiB,EAAE,SAAiB,EAAE,MAAc;QACnE,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAC1B,SAAS,EACT,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CACjD,CAAC;QAEF,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC;IACtE,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,SAAiB;QACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,0BAA0B,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACH,sBAAsB,CAAC,SAAiB;QACtC,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IACvD,CAAC;IAED,6EAA6E;IAC7E,qBAAqB;IACrB,6EAA6E;IAE7E;;OAEG;IACH,eAAe,CACb,SAAiB,EACjB,SAA0B;QAE1B,qCAAqC;QACrC,QAAQ,SAAS,CAAC,QAAQ,EAAE,CAAC;YAC3B,KAAK,KAAK;gBACR,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAAC;YAErE,KAAK,QAAQ;gBACX,4BAA4B;gBAC5B,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;YAExF,KAAK,MAAM,CAAC;YACZ,KAAK,UAAU;gBACb,oBAAoB;gBACpB,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;YAEzF;gBACE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAErE,mBAAmB,CAAC,IAAY;QACtC,MAAM,MAAM,GAA2B;YACrC,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;YAC5B,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;YAC5B,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC9B,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC9B,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;YAC7B,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY;SACpB,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,MAAM,MAAM,GAA2B;YACrC,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,GAAG;YACN,CAAC,EAAE,GAAG;YACN,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,KAAK;YACR,CAAC,EAAE,CAAC,CAAC;SACN,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,IAAY;QAC/B,MAAM,MAAM,GAA2B;YACrC,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC9B,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC9B,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;YAC7B,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;YACjC,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;YACnC,CAAC,EAAE,CAAC,CAAC,EAAE,YAAY;SACpB,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,IAAI,QAAQ,GAA4B,IAAI,CAAC;AAE7C,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACpC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cognigate/sandbox/filesystem-policy.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Filesystem Policy Enforcer
+ *
+ * Implements filesystem isolation policies for sandboxed agent execution.
+ * Supports overlay filesystems, mount namespaces, and access control.
+ *
+ * @packageDocumentation
+ */
+import { type FilesystemPolicy, type FilesystemActivityLog } from './types.js';
+/**
+ * Overlay filesystem configuration
+ */
+export interface OverlayMount {
+    /** Lower layer (read-only base) */
+    lowerDir: string;
+    /** Upper layer (writes go here) */
+    upperDir: string;
+    /** Work directory for overlay operations */
+    workDir: string;
+    /** Final merged mount point */
+    mergedDir: string;
+}
+/**
+ * Access control entry
+ */
+export interface AccessControlEntry {
+    /** Path pattern (glob-style) */
+    path: string;
+    /** Allowed operations */
+    operations: ('read' | 'write' | 'execute' | 'delete')[];
+    /** Allow or deny */
+    effect: 'allow' | 'deny';
+    /** Priority (higher = processed first) */
+    priority: number;
+}
+/**
+ * Filesystem mount state
+ */
+export interface MountState {
+    sandboxId: string;
+    policy: FilesystemPolicy;
+    overlay: OverlayMount;
+    mounts: ActiveMount[];
+    quotaUsed: number;
+    inodesUsed: number;
+    accessControl: AccessControlEntry[];
+}
+/**
+ * Active mount information
+ */
+export interface ActiveMount {
+    source: string;
+    target: string;
+    readonly: boolean;
+    type: string;
+    mounted: boolean;
+}
+export declare class FilesystemPolicyEnforcer {
+    private mounts;
+    private activityLogs;
+    constructor();
+    /**
+     * Initialize filesystem isolation for a sandbox
+     */
+    initializeFilesystem(sandboxId: string, policy: FilesystemPolicy): Promise<MountState>;
+    /**
+     * Cleanup filesystem mounts for a sandbox
+     */
+    cleanupFilesystem(sandboxId: string): Promise<void>;
+    /**
+     * Build access control rules from policy
+     */
+    private buildAccessControl;
+    /**
+     * Check if an operation is allowed
+     */
+    checkAccess(sandboxId: string, path: string, operation: 'read' | 'write' | 'execute' | 'delete'): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Normalize a filesystem path
+     */
+    private normalizePath;
+    /**
+     * Check if path matches a pattern
+     */
+    private pathMatches;
+    /**
+     * Check and update quota usage
+     */
+    checkQuota(sandboxId: string, bytesToWrite: number): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Update quota usage after write
+     */
+    updateQuota(sandboxId: string, bytesWritten: number, inodesUsed?: number): void;
+    /**
+     * Get current quota usage
+     */
+    getQuotaUsage(sandboxId: string): {
+        bytesUsed: number;
+        bytesLimit: number;
+        inodesUsed: number;
+        inodesLimit: number;
+        percentUsed: number;
+    } | null;
+    /**
+     * Log filesystem activity
+     */
+    logActivity(sandboxId: string, operation: 'read' | 'write' | 'delete' | 'create' | 'chmod', path: string, allowed: boolean, bytes?: number, blockedReason?: string): void;
+    /**
+     * Get activity logs for a sandbox
+     */
+    getActivityLogs(sandboxId: string): FilesystemActivityLog[];
+    /**
+     * Mount secrets for a sandbox
+     */
+    mountSecrets(sandboxId: string): Promise<void>;
+    /**
+     * Check if tier can access secrets
+     */
+    private canAccessSecrets;
+    /**
+     * Get filesystem statistics for a sandbox
+     */
+    getStats(sandboxId: string): {
+        totalReads: number;
+        totalWrites: number;
+        totalBytesWritten: number;
+        blockedOperations: number;
+        mountCount: number;
+    } | null;
+}
+export declare function createFilesystemPolicyEnforcer(): FilesystemPolicyEnforcer;
+export declare function getFilesystemPolicyEnforcer(): FilesystemPolicyEnforcer;
+//# sourceMappingURL=filesystem-policy.d.ts.map

package/dist/cognigate/sandbox/filesystem-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-policy.d.ts","sourceRoot":"","sources":["../../../src/cognigate/sandbox/filesystem-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,qBAAqB,EAE3B,MAAM,YAAY,CAAC;AAQpB;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IAEjB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,CAAC;IAEjB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAEhB,+BAA+B;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,UAAU,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,CAAC,EAAE,CAAC;IAExD,oBAAoB;IACpB,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;IAEzB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,YAAY,CAAC;IACtB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,kBAAkB,EAAE,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;CAClB;AAMD,qBAAa,wBAAwB;IACnC,OAAO,CAAC,MAAM,CAAsC;IACpD,OAAO,CAAC,YAAY,CAAmD;;IAUvE;;OAEG;IACG,oBAAoB,CACxB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,UAAU,CAAC;IAsDtB;;OAEG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBzD;;OAEG;IACH,OAAO,CAAC,kBAAkB;IA6G1B;;OAEG;IACH,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GACjD;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IA6BxC;;OAEG;IACH,OAAO,CAAC,aAAa;IAgBrB;;OAEG;IACH,OAAO,CAAC,WAAW;IAkCnB;;OAEG;IACH,UAAU,CACR,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IA8BxC;;OAEG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,GAAE,MAAU,GAAG,IAAI;IAQlF;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG;QAChC,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,IAAI;IAmBR;;OAEG;IACH,WAAW,CACT,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,EAC3D,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,OAAO,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,IAAI;IAwBP;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,qBAAqB,EAAE;IAQ3D;;OAEG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAiCpD;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAQxB;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG;QAC3B,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,IAAI;CAuBT;AAQD,wBAAgB,8BAA8B,IAAI,wBAAwB,CAKzE;AAED,wBAAgB,2BAA2B,IAAI,wBAAwB,CAKtE"}