@vorionsys/platform-core 0.1.0

package/dist/cognigate/sandbox/filesystem-policy.js

@@ -0,0 +1,426 @@
+/**
+ * Filesystem Policy Enforcer
+ *
+ * Implements filesystem isolation policies for sandboxed agent execution.
+ * Supports overlay filesystems, mount namespaces, and access control.
+ *
+ * @packageDocumentation
+ */
+import { createLogger } from '../../common/logger.js';
+import { FilesystemAccessLevel, } from './types.js';
+const logger = createLogger({ component: 'filesystem-policy' });
+// ============================================================================
+// Filesystem Policy Enforcer
+// ============================================================================
+export class FilesystemPolicyEnforcer {
+    mounts = new Map();
+    activityLogs = new Map();
+    constructor() {
+        logger.info('Filesystem policy enforcer initialized');
+    }
+    // ==========================================================================
+    // Mount Management
+    // ==========================================================================
+    /**
+     * Initialize filesystem isolation for a sandbox
+     */
+    async initializeFilesystem(sandboxId, policy) {
+        // Create overlay filesystem structure
+        const overlay = {
+            lowerDir: policy.overlay.baseLayer,
+            upperDir: `${policy.sandboxRoot}/upper`,
+            workDir: `${policy.sandboxRoot}/work`,
+            mergedDir: `${policy.sandboxRoot}/merged`,
+        };
+        // Build access control rules based on policy
+        const accessControl = this.buildAccessControl(policy);
+        // Process mount configurations
+        const mounts = [];
+        for (const mountConfig of policy.mounts) {
+            const activeMount = {
+                source: mountConfig.source,
+                target: mountConfig.target,
+                readonly: mountConfig.readonly,
+                type: mountConfig.type,
+                mounted: false,
+            };
+            // In production, this would:
+            // - Create mount namespace
+            // - Mount overlay filesystem
+            // - Bind mount additional paths
+            // - Set up quota enforcement
+            activeMount.mounted = true;
+            mounts.push(activeMount);
+        }
+        const state = {
+            sandboxId,
+            policy,
+            overlay,
+            mounts,
+            quotaUsed: 0,
+            inodesUsed: 0,
+            accessControl,
+        };
+        this.mounts.set(sandboxId, state);
+        this.activityLogs.set(sandboxId, []);
+        logger.info({ sandboxId, mountCount: mounts.length, accessLevel: policy.accessLevel }, 'Filesystem initialized');
+        return state;
+    }
+    /**
+     * Cleanup filesystem mounts for a sandbox
+     */
+    async cleanupFilesystem(sandboxId) {
+        const state = this.mounts.get(sandboxId);
+        if (!state)
+            return;
+        // In production, unmount all mounts and clean up
+        // umount -l $mergedDir
+        // rm -rf $sandboxRoot
+        this.mounts.delete(sandboxId);
+        this.activityLogs.delete(sandboxId);
+        logger.info({ sandboxId }, 'Filesystem cleaned up');
+    }
+    // ==========================================================================
+    // Access Control
+    // ==========================================================================
+    /**
+     * Build access control rules from policy
+     */
+    buildAccessControl(policy) {
+        const rules = [];
+        // Default deny all
+        rules.push({
+            path: '/**',
+            operations: ['read', 'write', 'execute', 'delete'],
+            effect: 'deny',
+            priority: 0,
+        });
+        switch (policy.accessLevel) {
+            case FilesystemAccessLevel.READONLY_SANDBOX:
+                // Only read from base layer
+                rules.push({
+                    path: '/**',
+                    operations: ['read', 'execute'],
+                    effect: 'allow',
+                    priority: 10,
+                });
+                // Allow writes to /tmp only
+                rules.push({
+                    path: '/tmp/**',
+                    operations: ['read', 'write', 'delete'],
+                    effect: 'allow',
+                    priority: 20,
+                });
+                break;
+            case FilesystemAccessLevel.WORKSPACE:
+                // Read anywhere, write to workspace
+                rules.push({
+                    path: '/**',
+                    operations: ['read', 'execute'],
+                    effect: 'allow',
+                    priority: 10,
+                });
+                rules.push({
+                    path: '/workspace/**',
+                    operations: ['read', 'write', 'delete'],
+                    effect: 'allow',
+                    priority: 20,
+                });
+                rules.push({
+                    path: '/tmp/**',
+                    operations: ['read', 'write', 'delete'],
+                    effect: 'allow',
+                    priority: 20,
+                });
+                break;
+            case FilesystemAccessLevel.EXTENDED:
+                // Read anywhere, write to allowed paths
+                rules.push({
+                    path: '/**',
+                    operations: ['read', 'execute'],
+                    effect: 'allow',
+                    priority: 10,
+                });
+                for (const mount of policy.mounts) {
+                    if (!mount.readonly) {
+                        rules.push({
+                            path: `${mount.target}/**`,
+                            operations: ['read', 'write', 'delete'],
+                            effect: 'allow',
+                            priority: 20,
+                        });
+                    }
+                }
+                break;
+            case FilesystemAccessLevel.FULL:
+                // Full access (still audited)
+                rules.push({
+                    path: '/**',
+                    operations: ['read', 'write', 'execute', 'delete'],
+                    effect: 'allow',
+                    priority: 100,
+                });
+                break;
+        }
+        // Always deny access to sensitive paths
+        const sensitivePaths = [
+            '/etc/shadow',
+            '/etc/passwd',
+            '/etc/sudoers',
+            '/root/**',
+            '/proc/*/mem',
+            '/dev/mem',
+            '/dev/kmem',
+            '/sys/**',
+        ];
+        for (const path of sensitivePaths) {
+            rules.push({
+                path,
+                operations: ['read', 'write', 'execute', 'delete'],
+                effect: 'deny',
+                priority: 1000, // High priority = always applied
+            });
+        }
+        // Sort by priority descending
+        rules.sort((a, b) => b.priority - a.priority);
+        return rules;
+    }
+    /**
+     * Check if an operation is allowed
+     */
+    checkAccess(sandboxId, path, operation) {
+        const state = this.mounts.get(sandboxId);
+        if (!state) {
+            return { allowed: false, reason: 'Sandbox not found' };
+        }
+        // Normalize path
+        const normalizedPath = this.normalizePath(path);
+        // Check against access control rules
+        for (const rule of state.accessControl) {
+            if (this.pathMatches(normalizedPath, rule.path)) {
+                if (rule.operations.includes(operation)) {
+                    if (rule.effect === 'allow') {
+                        return { allowed: true };
+                    }
+                    else {
+                        return {
+                            allowed: false,
+                            reason: `Access denied by policy: ${rule.path}`,
+                        };
+                    }
+                }
+            }
+        }
+        // Default deny if no rule matched
+        return { allowed: false, reason: 'No matching access rule' };
+    }
+    /**
+     * Normalize a filesystem path
+     */
+    normalizePath(path) {
+        // Remove duplicate slashes, resolve . and ..
+        const parts = path.split('/').filter((p) => p && p !== '.');
+        const normalized = [];
+        for (const part of parts) {
+            if (part === '..') {
+                normalized.pop();
+            }
+            else {
+                normalized.push(part);
+            }
+        }
+        return '/' + normalized.join('/');
+    }
+    /**
+     * Check if path matches a pattern
+     */
+    pathMatches(path, pattern) {
+        // Simple glob matching
+        if (pattern === '/**')
+            return true;
+        const patternParts = pattern.split('/');
+        const pathParts = path.split('/');
+        for (let i = 0; i < patternParts.length; i++) {
+            const patternPart = patternParts[i];
+            const pathPart = pathParts[i];
+            if (patternPart === '**') {
+                // ** matches any remaining path
+                return true;
+            }
+            if (patternPart === '*') {
+                // * matches any single segment
+                if (!pathPart)
+                    return false;
+                continue;
+            }
+            if (patternPart !== pathPart) {
+                return false;
+            }
+        }
+        return patternParts.length === pathParts.length;
+    }
+    // ==========================================================================
+    // Quota Management
+    // ==========================================================================
+    /**
+     * Check and update quota usage
+     */
+    checkQuota(sandboxId, bytesToWrite) {
+        const state = this.mounts.get(sandboxId);
+        if (!state) {
+            return { allowed: false, reason: 'Sandbox not found' };
+        }
+        const quota = state.policy.quotas;
+        // Check if unlimited
+        if (quota.maxBytes === -1) {
+            return { allowed: true };
+        }
+        // Check bytes quota
+        if (state.quotaUsed + bytesToWrite > quota.maxBytes) {
+            return { allowed: false, reason: 'Disk quota exceeded' };
+        }
+        // Check warning threshold
+        const usagePercent = (state.quotaUsed + bytesToWrite) / quota.maxBytes;
+        if (usagePercent > quota.warnThreshold) {
+            logger.warn({ sandboxId, usagePercent, quotaUsed: state.quotaUsed }, 'Disk quota warning threshold reached');
+        }
+        return { allowed: true };
+    }
+    /**
+     * Update quota usage after write
+     */
+    updateQuota(sandboxId, bytesWritten, inodesUsed = 0) {
+        const state = this.mounts.get(sandboxId);
+        if (!state)
+            return;
+        state.quotaUsed += bytesWritten;
+        state.inodesUsed += inodesUsed;
+    }
+    /**
+     * Get current quota usage
+     */
+    getQuotaUsage(sandboxId) {
+        const state = this.mounts.get(sandboxId);
+        if (!state)
+            return null;
+        const quota = state.policy.quotas;
+        return {
+            bytesUsed: state.quotaUsed,
+            bytesLimit: quota.maxBytes,
+            inodesUsed: state.inodesUsed,
+            inodesLimit: quota.maxInodes,
+            percentUsed: quota.maxBytes > 0 ? state.quotaUsed / quota.maxBytes : 0,
+        };
+    }
+    // ==========================================================================
+    // Activity Logging
+    // ==========================================================================
+    /**
+     * Log filesystem activity
+     */
+    logActivity(sandboxId, operation, path, allowed, bytes, blockedReason) {
+        const logs = this.activityLogs.get(sandboxId) || [];
+        logs.push({
+            timestamp: new Date(),
+            operation,
+            path,
+            bytes,
+            allowed,
+            blockedReason,
+        });
+        // Keep only last 1000 entries
+        if (logs.length > 1000) {
+            logs.splice(0, logs.length - 1000);
+        }
+        this.activityLogs.set(sandboxId, logs);
+        if (!allowed) {
+            logger.warn({ sandboxId, operation, path, blockedReason }, 'Filesystem access blocked');
+        }
+    }
+    /**
+     * Get activity logs for a sandbox
+     */
+    getActivityLogs(sandboxId) {
+        return this.activityLogs.get(sandboxId) || [];
+    }
+    // ==========================================================================
+    // Secrets Handling
+    // ==========================================================================
+    /**
+     * Mount secrets for a sandbox
+     */
+    async mountSecrets(sandboxId) {
+        const state = this.mounts.get(sandboxId);
+        if (!state)
+            return;
+        // Only mount secrets if tier allows
+        if (!this.canAccessSecrets(state.policy.accessLevel)) {
+            logger.debug({ sandboxId }, 'Secrets access not allowed for this tier');
+            return;
+        }
+        for (const secret of state.policy.secrets) {
+            switch (secret.type) {
+                case 'env':
+                    // Would set environment variable in container
+                    logger.debug({ sandboxId, name: secret.name, type: 'env' }, 'Secret mounted as env');
+                    break;
+                case 'file':
+                    // Would mount secret as file (tmpfs, memory-only)
+                    logger.debug({ sandboxId, name: secret.name, path: secret.filePath }, 'Secret mounted as file');
+                    break;
+                case 'memory':
+                    // Would make available via memory-mapped file
+                    logger.debug({ sandboxId, name: secret.name }, 'Secret available in memory');
+                    break;
+            }
+        }
+    }
+    /**
+     * Check if tier can access secrets
+     */
+    canAccessSecrets(level) {
+        return level !== FilesystemAccessLevel.READONLY_SANDBOX;
+    }
+    // ==========================================================================
+    // Statistics
+    // ==========================================================================
+    /**
+     * Get filesystem statistics for a sandbox
+     */
+    getStats(sandboxId) {
+        const state = this.mounts.get(sandboxId);
+        const logs = this.activityLogs.get(sandboxId);
+        if (!state || !logs)
+            return null;
+        const totalReads = logs.filter((l) => l.operation === 'read').length;
+        const totalWrites = logs.filter((l) => l.operation === 'write' || l.operation === 'create').length;
+        const totalBytesWritten = logs
+            .filter((l) => l.operation === 'write' && l.bytes)
+            .reduce((sum, l) => sum + (l.bytes || 0), 0);
+        const blockedOperations = logs.filter((l) => !l.allowed).length;
+        return {
+            totalReads,
+            totalWrites,
+            totalBytesWritten,
+            blockedOperations,
+            mountCount: state.mounts.length,
+        };
+    }
+}
+// ============================================================================
+// Factory Functions
+// ============================================================================
+let instance = null;
+export function createFilesystemPolicyEnforcer() {
+    if (!instance) {
+        instance = new FilesystemPolicyEnforcer();
+    }
+    return instance;
+}
+export function getFilesystemPolicyEnforcer() {
+    if (!instance) {
+        throw new Error('FilesystemPolicyEnforcer not initialized');
+    }
+    return instance;
+}
+//# sourceMappingURL=filesystem-policy.js.map

package/dist/cognigate/sandbox/filesystem-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem-policy.js","sourceRoot":"","sources":["../../../src/cognigate/sandbox/filesystem-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAIL,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAgEhE,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,OAAO,wBAAwB;IAC3B,MAAM,GAA4B,IAAI,GAAG,EAAE,CAAC;IAC5C,YAAY,GAAyC,IAAI,GAAG,EAAE,CAAC;IAEvE;QACE,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;IACxD,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACH,KAAK,CAAC,oBAAoB,CACxB,SAAiB,EACjB,MAAwB;QAExB,sCAAsC;QACtC,MAAM,OAAO,GAAiB;YAC5B,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS;YAClC,QAAQ,EAAE,GAAG,MAAM,CAAC,WAAW,QAAQ;YACvC,OAAO,EAAE,GAAG,MAAM,CAAC,WAAW,OAAO;YACrC,SAAS,EAAE,GAAG,MAAM,CAAC,WAAW,SAAS;SAC1C,CAAC;QAEF,6CAA6C;QAC7C,MAAM,aAAa,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAEtD,+BAA+B;QAC/B,MAAM,MAAM,GAAkB,EAAE,CAAC;QACjC,KAAK,MAAM,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxC,MAAM,WAAW,GAAgB;gBAC/B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,MAAM,EAAE,WAAW,CAAC,MAAM;gBAC1B,QAAQ,EAAE,WAAW,CAAC,QAAQ;gBAC9B,IAAI,EAAE,WAAW,CAAC,IAAI;gBACtB,OAAO,EAAE,KAAK;aACf,CAAC;YAEF,6BAA6B;YAC7B,2BAA2B;YAC3B,6BAA6B;YAC7B,gCAAgC;YAChC,6BAA6B;YAE7B,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,KAAK,GAAe;YACxB,SAAS;YACT,MAAM;YACN,OAAO;YACP,MAAM;YACN,SAAS,EAAE,CAAC;YACZ,UAAU,EAAE,CAAC;YACb,aAAa;SACd,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAErC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EACzE,wBAAwB,CACzB,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,iBAAiB,CAAC,SAAiB;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,iDAAiD;QACjD,uBAAuB;QACvB,sBAAsB;QAEtB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEpC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACtD,CAAC;IAED,6EAA6E;IAC7E,iBAAiB;IACjB,6EAA6E;IAE7E;;OAEG;IACK,kBAAkB,CAAC,MAAwB;QACjD,MAAM,KAAK,GAAyB,EAAE,CAAC;QAEvC,mBAAmB;QACnB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;YAClD,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,CAAC;SACZ,CAAC,CAAC;QAEH,QAAQ,MAAM,CAAC,WAAW,EAAE,CAAC;YAC3B,KAAK,qBAAqB,CAAC,gBAAgB;gBACzC,4BAA4B;gBAC5B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBAC/B,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,4BAA4B;gBAC5B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;oBACvC,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,MAAM;YAER,KAAK,qBAAqB,CAAC,SAAS;gBAClC,oCAAoC;gBACpC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBAC/B,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,eAAe;oBACrB,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;oBACvC,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;oBACvC,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,MAAM;YAER,KAAK,qBAAqB,CAAC,QAAQ;gBACjC,wCAAwC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;oBAC/B,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,EAAE;iBACb,CAAC,CAAC;gBACH,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;wBACpB,KAAK,CAAC,IAAI,CAAC;4BACT,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,KAAK;4BAC1B,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC;4BACvC,MAAM,EAAE,OAAO;4BACf,QAAQ,EAAE,EAAE;yBACb,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,MAAM;YAER,KAAK,qBAAqB,CAAC,IAAI;gBAC7B,8BAA8B;gBAC9B,KAAK,CAAC,IAAI,CAAC;oBACT,IAAI,EAAE,KAAK;oBACX,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;oBAClD,MAAM,EAAE,OAAO;oBACf,QAAQ,EAAE,GAAG;iBACd,CAAC,CAAC;gBACH,MAAM;QACV,CAAC;QAED,wCAAwC;QACxC,MAAM,cAAc,GAAG;YACrB,aAAa;YACb,aAAa;YACb,cAAc;YACd,UAAU;YACV,aAAa;YACb,UAAU;YACV,WAAW;YACX,SAAS;SACV,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI;gBACJ,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC;gBAClD,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,IAAI,EAAE,iCAAiC;aAClD,CAAC,CAAC;QACL,CAAC;QAED,8BAA8B;QAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACH,WAAW,CACT,SAAiB,EACjB,IAAY,EACZ,SAAkD;QAElD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzD,CAAC;QAED,iBAAiB;QACjB,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAEhD,qCAAqC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACxC,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAC5B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;oBAC3B,CAAC;yBAAM,CAAC;wBACN,OAAO;4BACL,OAAO,EAAE,KAAK;4BACd,MAAM,EAAE,4BAA4B,IAAI,CAAC,IAAI,EAAE;yBAChD,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC/D,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,IAAY;QAChC,6CAA6C;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;QAC5D,MAAM,UAAU,GAAa,EAAE,CAAC;QAEhC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,UAAU,CAAC,GAAG,EAAE,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,OAAO,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,IAAY,EAAE,OAAe;QAC/C,uBAAuB;QACvB,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAEnC,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;YAE9B,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;gBACzB,gCAAgC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,WAAW,KAAK,GAAG,EAAE,CAAC;gBACxB,+BAA+B;gBAC/B,IAAI,CAAC,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC5B,SAAS;YACX,CAAC;YAED,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC;IAClD,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACH,UAAU,CACR,SAAiB,EACjB,YAAoB;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACzD,CAAC;QAED,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAElC,qBAAqB;QACrB,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,oBAAoB;QACpB,IAAI,KAAK,CAAC,SAAS,GAAG,YAAY,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;YACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QAC3D,CAAC;QAED,0BAA0B;QAC1B,MAAM,YAAY,GAAG,CAAC,KAAK,CAAC,SAAS,GAAG,YAAY,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QACvE,IAAI,YAAY,GAAG,KAAK,CAAC,aAAa,EAAE,CAAC;YACvC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EACvD,sCAAsC,CACvC,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB,EAAE,YAAoB,EAAE,aAAqB,CAAC;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,KAAK,CAAC,SAAS,IAAI,YAAY,CAAC;QAChC,KAAK,CAAC,UAAU,IAAI,UAAU,CAAC;IACjC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAO7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;QAElC,OAAO;YACL,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,UAAU,EAAE,KAAK,CAAC,QAAQ;YAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,SAAS;YAC5B,WAAW,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACH,WAAW,CACT,SAAiB,EACjB,SAA2D,EAC3D,IAAY,EACZ,OAAgB,EAChB,KAAc,EACd,aAAsB;QAEtB,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAEpD,IAAI,CAAC,IAAI,CAAC;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,SAAS;YACT,IAAI;YACJ,KAAK;YACL,OAAO;YACP,aAAa;SACd,CAAC,CAAC;QAEH,8BAA8B;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAEvC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,2BAA2B,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,6EAA6E;IAC7E,mBAAmB;IACnB,6EAA6E;IAE7E;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,oCAAoC;QACpC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAAE,0CAA0C,CAAC,CAAC;YACxE,OAAO;QACT,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC1C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,KAAK;oBACR,8CAA8C;oBAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;oBACrF,MAAM;gBAER,KAAK,MAAM;oBACT,kDAAkD;oBAClD,MAAM,CAAC,KAAK,CACV,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,EACvD,wBAAwB,CACzB,CAAC;oBACF,MAAM;gBAER,KAAK,QAAQ;oBACX,8CAA8C;oBAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,4BAA4B,CAAC,CAAC;oBAC7E,MAAM;YACV,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,KAA4B;QACnD,OAAO,KAAK,KAAK,qBAAqB,CAAC,gBAAgB,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,aAAa;IACb,6EAA6E;IAE7E;;OAEG;IACH,QAAQ,CAAC,SAAiB;QAOxB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAEjC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;QACrE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAC7B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,SAAS,KAAK,QAAQ,CAC3D,CAAC,MAAM,CAAC;QACT,MAAM,iBAAiB,GAAG,IAAI;aAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,CAAC;aACjD,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAEhE,OAAO;YACL,UAAU;YACV,WAAW;YACX,iBAAiB;YACjB,iBAAiB;YACjB,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;SAChC,CAAC;IACJ,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,IAAI,QAAQ,GAAoC,IAAI,CAAC;AAErD,MAAM,UAAU,8BAA8B;IAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,wBAAwB,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,2BAA2B;IACzC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cognigate/sandbox/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Cognigate Sandbox Module
+ *
+ * Provides tier-based execution isolation for agents including:
+ * - Sandbox lifecycle management
+ * - Network policy enforcement
+ * - Filesystem isolation
+ * - Capability brokering
+ *
+ * @packageDocumentation
+ */
+export { NetworkAccessLevel, FilesystemAccessLevel, SandboxRuntime, SandboxState, type TierCapabilities, TIER_CAPABILITIES, type SandboxConfig, type NetworkPolicy, type FilesystemPolicy, type ResourceLimits, type ExecutionContext, type EgressRule, type DnsPolicy, type NetworkRateLimits, type MountConfig, type OverlayConfig, type SecretMount, type DiskQuotas, type SandboxInstance, type ResourceUsage, type SandboxExecutionResult, type NetworkActivityLog, type FilesystemActivityLog, type PolicyViolation, type SandboxAttestationData, } from './types.js';
+export { SandboxService, createSandboxService, getSandboxService, } from './sandbox-service.js';
+export { NetworkPolicyEnforcer, createNetworkPolicyEnforcer, getNetworkPolicyEnforcer, type NetworkNamespaceConfig, type IptablesRule, type ConnectionEntry, } from './network-policy.js';
+export { FilesystemPolicyEnforcer, createFilesystemPolicyEnforcer, getFilesystemPolicyEnforcer, type OverlayMount, type AccessControlEntry, type MountState, type ActiveMount, } from './filesystem-policy.js';
+export { CapabilityBroker, createCapabilityBroker, getCapabilityBroker, type CapabilityRequest, type CapabilityType, type CapabilityDetails, type CapabilityDecision, type CapabilityConditions, type GrantedCapability, } from './capability-broker.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/cognigate/sandbox/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cognigate/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAEL,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,YAAY,EAGZ,KAAK,gBAAgB,EACrB,iBAAiB,EAGjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EAGrB,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,UAAU,EAGf,KAAK,eAAe,EACpB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAG3B,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,sBAAsB,GAC5B,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,eAAe,GACrB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,2BAA2B,EAC3B,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,WAAW,GACjB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC"}

package/dist/cognigate/sandbox/index.js

@@ -0,0 +1,24 @@
+/**
+ * Cognigate Sandbox Module
+ *
+ * Provides tier-based execution isolation for agents including:
+ * - Sandbox lifecycle management
+ * - Network policy enforcement
+ * - Filesystem isolation
+ * - Capability brokering
+ *
+ * @packageDocumentation
+ */
+// Types
+export { 
+// Enums
+NetworkAccessLevel, FilesystemAccessLevel, SandboxRuntime, SandboxState, TIER_CAPABILITIES, } from './types.js';
+// Sandbox Service
+export { SandboxService, createSandboxService, getSandboxService, } from './sandbox-service.js';
+// Network Policy
+export { NetworkPolicyEnforcer, createNetworkPolicyEnforcer, getNetworkPolicyEnforcer, } from './network-policy.js';
+// Filesystem Policy
+export { FilesystemPolicyEnforcer, createFilesystemPolicyEnforcer, getFilesystemPolicyEnforcer, } from './filesystem-policy.js';
+// Capability Broker
+export { CapabilityBroker, createCapabilityBroker, getCapabilityBroker, } from './capability-broker.js';
+//# sourceMappingURL=index.js.map

package/dist/cognigate/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/cognigate/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,QAAQ;AACR,OAAO;AACL,QAAQ;AACR,kBAAkB,EAClB,qBAAqB,EACrB,cAAc,EACd,YAAY,EAIZ,iBAAiB,GA4BlB,MAAM,YAAY,CAAC;AAEpB,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAE9B,iBAAiB;AACjB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,wBAAwB,GAIzB,MAAM,qBAAqB,CAAC;AAE7B,oBAAoB;AACpB,OAAO,EACL,wBAAwB,EACxB,8BAA8B,EAC9B,2BAA2B,GAK5B,MAAM,wBAAwB,CAAC;AAEhC,oBAAoB;AACpB,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GAOpB,MAAM,wBAAwB,CAAC"}

package/dist/cognigate/sandbox/network-policy.d.ts

@@ -0,0 +1,126 @@
+/**
+ * Network Policy Enforcer
+ *
+ * Implements network isolation policies for sandboxed agent execution.
+ * Supports iptables rules, network namespaces, and DNS filtering.
+ *
+ * @packageDocumentation
+ */
+import { type NetworkPolicy, type NetworkActivityLog } from './types.js';
+/**
+ * Network namespace configuration
+ */
+export interface NetworkNamespaceConfig {
+    /** Namespace name */
+    name: string;
+    /** Virtual ethernet pair */
+    vethPair: {
+        host: string;
+        container: string;
+    };
+    /** IP address for container side */
+    containerIp: string;
+    /** Gateway IP */
+    gatewayIp: string;
+    /** Subnet CIDR */
+    subnet: string;
+}
+/**
+ * iptables rule definition
+ */
+export interface IptablesRule {
+    chain: 'INPUT' | 'OUTPUT' | 'FORWARD';
+    action: 'ACCEPT' | 'DROP' | 'REJECT' | 'LOG';
+    protocol?: 'tcp' | 'udp' | 'icmp' | 'all';
+    source?: string;
+    destination?: string;
+    port?: number | string;
+    comment?: string;
+}
+/**
+ * Connection tracking entry
+ */
+export interface ConnectionEntry {
+    id: string;
+    sandboxId: string;
+    sourceIp: string;
+    destIp: string;
+    destPort: number;
+    protocol: string;
+    state: 'NEW' | 'ESTABLISHED' | 'RELATED' | 'CLOSED';
+    bytesIn: number;
+    bytesOut: number;
+    startedAt: Date;
+    lastActivityAt: Date;
+}
+export declare class NetworkPolicyEnforcer {
+    private namespaces;
+    private connections;
+    private activityLogs;
+    private ipCounter;
+    constructor();
+    /**
+     * Create a network namespace for a sandbox
+     */
+    createNamespace(sandboxId: string, policy: NetworkPolicy): Promise<NetworkNamespaceConfig>;
+    /**
+     * Destroy a network namespace
+     */
+    destroyNamespace(sandboxId: string): Promise<void>;
+    /**
+     * Apply network policy to a sandbox
+     */
+    applyPolicy(sandboxId: string, policy: NetworkPolicy): Promise<void>;
+    /**
+     * Convert egress rule to iptables rules
+     */
+    private egressRuleToIptables;
+    /**
+     * Track a new connection attempt
+     */
+    trackConnection(sandboxId: string, destIp: string, destPort: number, protocol: string, allowed: boolean): void;
+    /**
+     * Update connection state and bytes
+     */
+    updateConnection(sandboxId: string, connectionId: string, bytesIn: number, bytesOut: number): void;
+    /**
+     * Close a connection
+     */
+    closeConnection(sandboxId: string, connectionId: string): void;
+    /**
+     * Log network activity
+     */
+    private logActivity;
+    /**
+     * Get activity logs for a sandbox
+     */
+    getActivityLogs(sandboxId: string): NetworkActivityLog[];
+    /**
+     * Get active connections for a sandbox
+     */
+    getConnections(sandboxId: string): ConnectionEntry[];
+    /**
+     * Check if connection is within rate limits
+     */
+    checkRateLimit(sandboxId: string, requestsPerMinute: number, egressBytesPerMinute: number, maxConnections: number): {
+        allowed: boolean;
+        reason?: string;
+    };
+    /**
+     * Check if DNS query is allowed
+     */
+    isDnsQueryAllowed(sandboxId: string, domain: string, policy: NetworkPolicy): boolean;
+    /**
+     * Get network statistics for a sandbox
+     */
+    getStats(sandboxId: string): {
+        totalBytesIn: number;
+        totalBytesOut: number;
+        connectionCount: number;
+        blockedCount: number;
+        activeConnections: number;
+    };
+}
+export declare function createNetworkPolicyEnforcer(): NetworkPolicyEnforcer;
+export declare function getNetworkPolicyEnforcer(): NetworkPolicyEnforcer;
+//# sourceMappingURL=network-policy.d.ts.map

package/dist/cognigate/sandbox/network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../../../src/cognigate/sandbox/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EACL,KAAK,aAAa,EAElB,KAAK,kBAAkB,EAExB,MAAM,YAAY,CAAC;AAQpB;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IAEb,4BAA4B;IAC5B,QAAQ,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IAEF,oCAAoC;IACpC,WAAW,EAAE,MAAM,CAAC;IAEpB,iBAAiB;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,kBAAkB;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;IAC7C,QAAQ,CAAC,EAAE,KAAK,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,KAAK,GAAG,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,EAAE,IAAI,CAAC;CACtB;AAMD,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAAkD;IACpE,OAAO,CAAC,WAAW,CAA6C;IAChE,OAAO,CAAC,YAAY,CAAgD;IACpE,OAAO,CAAC,SAAS,CAAa;;IAU9B;;OAEG;IACG,eAAe,CACnB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,sBAAsB,CAAC;IAwClC;;OAEG;IACG,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkBxD;;OAEG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IA+E1E;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAgC5B;;OAEG;IACH,eAAe,CACb,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,OAAO,GACf,IAAI;IAmCP;;OAEG;IACH,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,GACf,IAAI;IAaP;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI;IAc9D;;OAEG;IACH,OAAO,CAAC,WAAW;IAYnB;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,EAAE;IAIxD;;OAEG;IACH,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,EAAE;IAQpD;;OAEG;IACH,cAAc,CACZ,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,oBAAoB,EAAE,MAAM,EAC5B,cAAc,EAAE,MAAM,GACrB;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAoCxC;;OAEG;IACH,iBAAiB,CACf,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,aAAa,GACpB,OAAO;IAuDV;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG;QAC3B,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,eAAe,EAAE,MAAM,CAAC;QACxB,YAAY,EAAE,MAAM,CAAC;QACrB,iBAAiB,EAAE,MAAM,CAAC;KAC3B;CAmBF;AAQD,wBAAgB,2BAA2B,IAAI,qBAAqB,CAKnE;AAED,wBAAgB,wBAAwB,IAAI,qBAAqB,CAKhE"}