@vorionsys/platform-core 0.1.0

package/dist/cognigate/sandbox/sandbox-service.js

@@ -0,0 +1,472 @@
+/**
+ * Sandbox Service
+ *
+ * Manages isolated execution environments for agent operations.
+ * Enforces trust-tier-based capabilities through network and filesystem policies.
+ *
+ * @packageDocumentation
+ */
+import { randomUUID } from 'crypto';
+import { createLogger } from '../../common/logger.js';
+import { SandboxState, SandboxRuntime, NetworkAccessLevel, FilesystemAccessLevel, TIER_CAPABILITIES, } from './types.js';
+const logger = createLogger({ component: 'sandbox-service' });
+// ============================================================================
+// Sandbox Service
+// ============================================================================
+export class SandboxService {
+    instances = new Map();
+    runtimeAdapter;
+    constructor(runtime = SandboxRuntime.DOCKER) {
+        this.runtimeAdapter = this.createRuntimeAdapter(runtime);
+        logger.info({ runtime }, 'Sandbox service initialized');
+    }
+    // ==========================================================================
+    // Sandbox Lifecycle
+    // ==========================================================================
+    /**
+     * Create a new sandbox for agent execution
+     */
+    async createSandbox(carId, trustTier, context) {
+        const sandboxId = randomUUID();
+        const capabilities = this.getCapabilities(trustTier);
+        const config = {
+            sandboxId,
+            carId,
+            trustTier,
+            runtime: this.selectRuntime(trustTier),
+            capabilities,
+            networkPolicy: this.buildNetworkPolicy(capabilities, context),
+            filesystemPolicy: this.buildFilesystemPolicy(capabilities, context),
+            resourceLimits: this.buildResourceLimits(capabilities),
+            context,
+        };
+        const instance = {
+            id: sandboxId,
+            config,
+            state: SandboxState.CREATING,
+            ports: {},
+            resourceUsage: {
+                memoryBytes: 0,
+                cpuPercent: 0,
+                diskBytes: 0,
+                networkBytesIn: 0,
+                networkBytesOut: 0,
+                openFiles: 0,
+                processCount: 0,
+            },
+            createdAt: new Date(),
+        };
+        this.instances.set(sandboxId, instance);
+        try {
+            // Create the actual sandbox via runtime adapter
+            const runtimeId = await this.runtimeAdapter.create(config);
+            instance.runtimeId = runtimeId;
+            instance.state = SandboxState.READY;
+            logger.info({ sandboxId, carId, trustTier }, 'Sandbox created');
+        }
+        catch (error) {
+            instance.state = SandboxState.FAILED;
+            instance.error = error instanceof Error ? error.message : 'Unknown error';
+            logger.error({ sandboxId, error }, 'Failed to create sandbox');
+            throw error;
+        }
+        return instance;
+    }
+    /**
+     * Execute a command in a sandbox
+     */
+    async execute(sandboxId, command, args = [], stdin) {
+        const instance = this.instances.get(sandboxId);
+        if (!instance) {
+            throw new Error(`Sandbox not found: ${sandboxId}`);
+        }
+        if (instance.state !== SandboxState.READY && instance.state !== SandboxState.RUNNING) {
+            throw new Error(`Sandbox not ready: ${instance.state}`);
+        }
+        const startTime = Date.now();
+        instance.state = SandboxState.RUNNING;
+        instance.startedAt = new Date();
+        const violations = [];
+        try {
+            // Execute via runtime adapter
+            const result = await this.runtimeAdapter.execute(instance.runtimeId, command, args, stdin, instance.config.resourceLimits.executionMs);
+            const durationMs = Date.now() - startTime;
+            // Collect activity logs
+            const networkActivity = await this.runtimeAdapter.getNetworkActivity(instance.runtimeId);
+            const filesystemActivity = await this.runtimeAdapter.getFilesystemActivity(instance.runtimeId);
+            // Check for policy violations
+            violations.push(...this.detectViolations(instance, networkActivity, filesystemActivity));
+            // Update resource usage
+            instance.resourceUsage = await this.runtimeAdapter.getResourceUsage(instance.runtimeId);
+            const attestationData = this.buildAttestationData(result.exitCode === 0, violations);
+            const executionResult = {
+                sandboxId,
+                success: result.exitCode === 0,
+                exitCode: result.exitCode,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                durationMs,
+                resourceUsage: instance.resourceUsage,
+                networkActivity,
+                filesystemActivity,
+                violations,
+                attestationData,
+            };
+            instance.exitCode = result.exitCode;
+            instance.state = SandboxState.STOPPED;
+            instance.stoppedAt = new Date();
+            logger.info({ sandboxId, exitCode: result.exitCode, durationMs, violations: violations.length }, 'Sandbox execution completed');
+            return executionResult;
+        }
+        catch (error) {
+            instance.state = SandboxState.FAILED;
+            instance.error = error instanceof Error ? error.message : 'Unknown error';
+            instance.stoppedAt = new Date();
+            logger.error({ sandboxId, error }, 'Sandbox execution failed');
+            return {
+                sandboxId,
+                success: false,
+                exitCode: -1,
+                stdout: '',
+                stderr: instance.error,
+                durationMs: Date.now() - startTime,
+                resourceUsage: instance.resourceUsage,
+                networkActivity: [],
+                filesystemActivity: [],
+                violations: [{
+                        timestamp: new Date(),
+                        type: 'security',
+                        severity: 'critical',
+                        description: 'Execution failed with error',
+                        details: { error: instance.error },
+                        action: 'terminated',
+                    }],
+                attestationData: this.buildAttestationData(false, violations),
+            };
+        }
+    }
+    /**
+     * Destroy a sandbox and clean up resources
+     */
+    async destroy(sandboxId) {
+        const instance = this.instances.get(sandboxId);
+        if (!instance) {
+            return;
+        }
+        instance.state = SandboxState.STOPPING;
+        try {
+            if (instance.runtimeId) {
+                await this.runtimeAdapter.destroy(instance.runtimeId);
+            }
+            instance.state = SandboxState.DESTROYED;
+            this.instances.delete(sandboxId);
+            logger.info({ sandboxId }, 'Sandbox destroyed');
+        }
+        catch (error) {
+            logger.error({ sandboxId, error }, 'Failed to destroy sandbox');
+            throw error;
+        }
+    }
+    /**
+     * Get sandbox instance by ID
+     */
+    getInstance(sandboxId) {
+        return this.instances.get(sandboxId);
+    }
+    /**
+     * List all active sandboxes
+     */
+    listInstances() {
+        return Array.from(this.instances.values());
+    }
+    // ==========================================================================
+    // Policy Builders
+    // ==========================================================================
+    /**
+     * Get capabilities for a trust tier
+     */
+    getCapabilities(trustTier) {
+        const caps = TIER_CAPABILITIES[trustTier];
+        if (!caps) {
+            throw new Error(`Invalid trust tier: ${trustTier}`);
+        }
+        return { ...caps };
+    }
+    /**
+     * Select runtime based on trust tier
+     */
+    selectRuntime(trustTier) {
+        if (trustTier <= 1) {
+            // Strongest isolation for lowest tiers
+            return SandboxRuntime.GVISOR;
+        }
+        else if (trustTier <= 3) {
+            // Good isolation for mid-low tiers
+            return SandboxRuntime.DOCKER;
+        }
+        else if (trustTier <= 6) {
+            // Standard Docker for trusted tiers
+            return SandboxRuntime.DOCKER;
+        }
+        else {
+            // T7 can run without sandbox (monitored)
+            return SandboxRuntime.NONE;
+        }
+    }
+    /**
+     * Build network policy from capabilities
+     */
+    buildNetworkPolicy(caps, context) {
+        const policy = {
+            accessLevel: caps.networkAccess,
+            allowedEgress: [],
+            blockedEgress: [
+                // Always block metadata services
+                '169.254.169.254',
+                'metadata.google.internal',
+                // Block local network by default (except localhost for internal)
+                ...(caps.networkAccess === NetworkAccessLevel.NONE ? ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16'] : []),
+            ],
+            dnsPolicy: {
+                servers: ['8.8.8.8', '8.8.4.4'],
+                allowedDomains: caps.allowedEgressDomains,
+                internalOnly: caps.networkAccess === NetworkAccessLevel.INTERNAL,
+            },
+            mtlsRequired: caps.networkAccess >= NetworkAccessLevel.EXTERNAL,
+            rateLimits: {
+                requestsPerMinute: this.getRateLimit(caps.networkAccess),
+                egressBytesPerMinute: this.getEgressLimit(caps.networkAccess),
+                maxConnections: this.getConnectionLimit(caps.networkAccess),
+            },
+        };
+        // Build allowed egress rules
+        for (const domain of caps.allowedEgressDomains) {
+            policy.allowedEgress.push({
+                destination: domain,
+                ports: [80, 443],
+                protocol: 'tcp',
+            });
+        }
+        return policy;
+    }
+    /**
+     * Build filesystem policy from capabilities
+     */
+    buildFilesystemPolicy(caps, context) {
+        const sandboxRoot = `/sandbox/${context.tenantId}/${context.requestId}`;
+        const policy = {
+            accessLevel: caps.filesystemAccess,
+            sandboxRoot,
+            mounts: [],
+            overlay: {
+                baseLayer: 'cognigate-base:latest',
+                ephemeral: caps.filesystemAccess === FilesystemAccessLevel.READONLY_SANDBOX,
+                persistWork: caps.filesystemAccess >= FilesystemAccessLevel.WORKSPACE,
+                workDir: `${sandboxRoot}/work`,
+            },
+            secrets: [],
+            quotas: {
+                maxBytes: this.getDiskQuota(caps.filesystemAccess),
+                maxInodes: 100000,
+                warnThreshold: 0.8,
+            },
+        };
+        // Add mounts based on allowed paths
+        for (const path of caps.allowedMountPaths) {
+            if (path === '*')
+                continue; // Full access doesn't need explicit mounts
+            policy.mounts.push({
+                source: `${sandboxRoot}${path}`,
+                target: path,
+                readonly: caps.filesystemAccess === FilesystemAccessLevel.READONLY_SANDBOX,
+                type: 'bind',
+            });
+        }
+        // Add tmpfs for temp directory
+        policy.mounts.push({
+            source: 'tmpfs',
+            target: '/tmp',
+            readonly: false,
+            type: 'tmpfs',
+            options: ['size=100m', 'noexec'],
+        });
+        return policy;
+    }
+    /**
+     * Build resource limits from capabilities
+     */
+    buildResourceLimits(caps) {
+        return {
+            memoryMb: caps.maxMemoryMb === -1 ? 16384 : caps.maxMemoryMb,
+            cpuPercent: caps.maxCpuPercent,
+            executionMs: caps.maxExecutionMs === -1 ? 86400000 : caps.maxExecutionMs,
+            maxPids: caps.canSpawnSubprocesses ? 100 : 10,
+            maxOpenFiles: 1024,
+            oomKillEnabled: true,
+        };
+    }
+    // ==========================================================================
+    // Violation Detection
+    // ==========================================================================
+    /**
+     * Detect policy violations from activity logs
+     */
+    detectViolations(instance, networkActivity, filesystemActivity) {
+        const violations = [];
+        // Check network violations
+        for (const activity of networkActivity) {
+            if (!activity.allowed) {
+                violations.push({
+                    timestamp: activity.timestamp,
+                    type: 'network',
+                    severity: 'medium',
+                    description: `Blocked network access to ${activity.destination}:${activity.port}`,
+                    details: activity,
+                    action: 'blocked',
+                });
+            }
+        }
+        // Check filesystem violations
+        for (const activity of filesystemActivity) {
+            if (!activity.allowed) {
+                violations.push({
+                    timestamp: activity.timestamp,
+                    type: 'filesystem',
+                    severity: activity.operation === 'write' ? 'high' : 'medium',
+                    description: `Blocked filesystem ${activity.operation} on ${activity.path}`,
+                    details: activity,
+                    action: 'blocked',
+                });
+            }
+        }
+        // Check resource violations
+        const limits = instance.config.resourceLimits;
+        const usage = instance.resourceUsage;
+        if (usage.memoryBytes > limits.memoryMb * 1024 * 1024 * 0.95) {
+            violations.push({
+                timestamp: new Date(),
+                type: 'resource',
+                severity: 'high',
+                description: 'Memory usage approaching limit',
+                details: { limit: limits.memoryMb, usedMb: Math.round(usage.memoryBytes / 1024 / 1024) },
+                action: 'logged',
+            });
+        }
+        return violations;
+    }
+    /**
+     * Build attestation data from execution results
+     */
+    buildAttestationData(success, violations) {
+        const maxSeverity = violations.reduce((max, v) => {
+            const order = ['low', 'medium', 'high', 'critical'];
+            return order.indexOf(v.severity) > order.indexOf(max) ? v.severity : max;
+        }, 'none');
+        return {
+            executionSuccess: success,
+            resourceCompliance: !violations.some(v => v.type === 'resource'),
+            networkCompliance: !violations.some(v => v.type === 'network'),
+            filesystemCompliance: !violations.some(v => v.type === 'filesystem'),
+            violationCount: violations.length,
+            violationSeverity: violations.length === 0 ? 'none' : maxSeverity,
+        };
+    }
+    // ==========================================================================
+    // Helpers
+    // ==========================================================================
+    createRuntimeAdapter(runtime) {
+        // In production, this would return Docker/gVisor/Firecracker adapters
+        return new MockRuntimeAdapter();
+    }
+    getRateLimit(level) {
+        const limits = {
+            [NetworkAccessLevel.NONE]: 0,
+            [NetworkAccessLevel.INTERNAL]: 100,
+            [NetworkAccessLevel.EXTERNAL]: 1000,
+            [NetworkAccessLevel.CROSS_AGENT]: 5000,
+            [NetworkAccessLevel.FULL]: -1,
+        };
+        return limits[level];
+    }
+    getEgressLimit(level) {
+        const limits = {
+            [NetworkAccessLevel.NONE]: 0,
+            [NetworkAccessLevel.INTERNAL]: 10 * 1024 * 1024, // 10MB
+            [NetworkAccessLevel.EXTERNAL]: 100 * 1024 * 1024, // 100MB
+            [NetworkAccessLevel.CROSS_AGENT]: 500 * 1024 * 1024, // 500MB
+            [NetworkAccessLevel.FULL]: -1,
+        };
+        return limits[level];
+    }
+    getConnectionLimit(level) {
+        const limits = {
+            [NetworkAccessLevel.NONE]: 0,
+            [NetworkAccessLevel.INTERNAL]: 10,
+            [NetworkAccessLevel.EXTERNAL]: 50,
+            [NetworkAccessLevel.CROSS_AGENT]: 100,
+            [NetworkAccessLevel.FULL]: -1,
+        };
+        return limits[level];
+    }
+    getDiskQuota(level) {
+        const quotas = {
+            [FilesystemAccessLevel.READONLY_SANDBOX]: 0,
+            [FilesystemAccessLevel.WORKSPACE]: 100 * 1024 * 1024, // 100MB
+            [FilesystemAccessLevel.EXTENDED]: 1024 * 1024 * 1024, // 1GB
+            [FilesystemAccessLevel.FULL]: -1,
+        };
+        return quotas[level];
+    }
+}
+/**
+ * Mock runtime adapter for development/testing
+ */
+class MockRuntimeAdapter {
+    async create(config) {
+        return `mock-${config.sandboxId}`;
+    }
+    async execute(runtimeId, command, args, stdin, timeoutMs) {
+        return {
+            exitCode: 0,
+            stdout: `Mock execution of ${command} ${args.join(' ')}`,
+            stderr: '',
+        };
+    }
+    async destroy(runtimeId) {
+        // No-op
+    }
+    async getResourceUsage(runtimeId) {
+        return {
+            memoryBytes: 50 * 1024 * 1024,
+            cpuPercent: 5,
+            diskBytes: 10 * 1024 * 1024,
+            networkBytesIn: 1024,
+            networkBytesOut: 2048,
+            openFiles: 10,
+            processCount: 1,
+        };
+    }
+    async getNetworkActivity(runtimeId) {
+        return [];
+    }
+    async getFilesystemActivity(runtimeId) {
+        return [];
+    }
+}
+// ============================================================================
+// Factory Functions
+// ============================================================================
+let instance = null;
+export function createSandboxService(runtime) {
+    if (!instance) {
+        instance = new SandboxService(runtime);
+    }
+    return instance;
+}
+export function getSandboxService() {
+    if (!instance) {
+        throw new Error('SandboxService not initialized');
+    }
+    return instance;
+}
+//# sourceMappingURL=sandbox-service.js.map

package/dist/cognigate/sandbox/sandbox-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-service.js","sourceRoot":"","sources":["../../../src/cognigate/sandbox/sandbox-service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAWL,YAAY,EACZ,cAAc,EACd,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AAEpB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAE9D,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,OAAO,cAAc;IACjB,SAAS,GAAiC,IAAI,GAAG,EAAE,CAAC;IACpD,cAAc,CAAiB;IAEvC,YAAY,UAA0B,cAAc,CAAC,MAAM;QACzD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,6BAA6B,CAAC,CAAC;IAC1D,CAAC;IAED,6EAA6E;IAC7E,oBAAoB;IACpB,6EAA6E;IAE7E;;OAEG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB,EACjB,OAAyB;QAEzB,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAErD,MAAM,MAAM,GAAkB;YAC5B,SAAS;YACT,KAAK;YACL,SAAS;YACT,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC;YACtC,YAAY;YACZ,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,YAAY,EAAE,OAAO,CAAC;YAC7D,gBAAgB,EAAE,IAAI,CAAC,qBAAqB,CAAC,YAAY,EAAE,OAAO,CAAC;YACnE,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC;YACtD,OAAO;SACR,CAAC;QAEF,MAAM,QAAQ,GAAoB;YAChC,EAAE,EAAE,SAAS;YACb,MAAM;YACN,KAAK,EAAE,YAAY,CAAC,QAAQ;YAC5B,KAAK,EAAE,EAAE;YACT,aAAa,EAAE;gBACb,WAAW,EAAE,CAAC;gBACd,UAAU,EAAE,CAAC;gBACb,SAAS,EAAE,CAAC;gBACZ,cAAc,EAAE,CAAC;gBACjB,eAAe,EAAE,CAAC;gBAClB,SAAS,EAAE,CAAC;gBACZ,YAAY,EAAE,CAAC;aAChB;YACD,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC;QAEF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAExC,IAAI,CAAC;YACH,gDAAgD;YAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC3D,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;YAC/B,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC;YAEpC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,iBAAiB,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC;YACrC,QAAQ,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAC/D,MAAM,KAAK,CAAC;QACd,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,OAAiB,EAAE,EACnB,KAAc;QAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,EAAE,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC;QACtC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,IAAI,CAAC;YACH,8BAA8B;YAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAC9C,QAAQ,CAAC,SAAU,EACnB,OAAO,EACP,IAAI,EACJ,KAAK,EACL,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,WAAW,CAC3C,CAAC;YAEF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAE1C,wBAAwB;YACxB,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,kBAAkB,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,qBAAqB,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;YAEhG,8BAA8B;YAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;YAEzF,wBAAwB;YACxB,QAAQ,CAAC,aAAa,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;YAEzF,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,UAAU,CAAC,CAAC;YAErF,MAAM,eAAe,GAA2B;gBAC9C,SAAS;gBACT,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,UAAU;gBACV,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,eAAe;gBACf,kBAAkB;gBAClB,UAAU;gBACV,eAAe;aAChB,CAAC;YAEF,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;YACpC,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC;YACtC,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAEhC,MAAM,CAAC,IAAI,CACT,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,EACnF,6BAA6B,CAC9B,CAAC;YAEF,OAAO,eAAe,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC;YACrC,QAAQ,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;YAC1E,QAAQ,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC;YAEhC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;YAE/D,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,QAAQ,EAAE,CAAC,CAAC;gBACZ,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,QAAQ,CAAC,KAAK;gBACtB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,eAAe,EAAE,EAAE;gBACnB,kBAAkB,EAAE,EAAE;gBACtB,UAAU,EAAE,CAAC;wBACX,SAAS,EAAE,IAAI,IAAI,EAAE;wBACrB,IAAI,EAAE,UAAU;wBAChB,QAAQ,EAAE,UAAU;wBACpB,WAAW,EAAE,6BAA6B;wBAC1C,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE;wBAClC,MAAM,EAAE,YAAY;qBACrB,CAAC;gBACF,eAAe,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,UAAU,CAAC;aAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,QAAQ,CAAC;QAEvC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACxD,CAAC;YACD,QAAQ,CAAC,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAEjC,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,2BAA2B,CAAC,CAAC;YAChE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,SAAiB;QAC3B,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,aAAa;QACX,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,6EAA6E;IAC7E,kBAAkB;IAClB,6EAA6E;IAE7E;;OAEG;IACK,eAAe,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACrB,CAAC;IAED;;OAEG;IACK,aAAa,CAAC,SAAiB;QACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,uCAAuC;YACvC,OAAO,cAAc,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC1B,mCAAmC;YACnC,OAAO,cAAc,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC1B,oCAAoC;YACpC,OAAO,cAAc,CAAC,MAAM,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,yCAAyC;YACzC,OAAO,cAAc,CAAC,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,kBAAkB,CAAC,IAAsB,EAAE,OAAyB;QAC1E,MAAM,MAAM,GAAkB;YAC5B,WAAW,EAAE,IAAI,CAAC,aAAa;YAC/B,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE;gBACb,iCAAiC;gBACjC,iBAAiB;gBACjB,0BAA0B;gBAC1B,iEAAiE;gBACjE,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7G;YACD,SAAS,EAAE;gBACT,OAAO,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC;gBAC/B,cAAc,EAAE,IAAI,CAAC,oBAAoB;gBACzC,YAAY,EAAE,IAAI,CAAC,aAAa,KAAK,kBAAkB,CAAC,QAAQ;aACjE;YACD,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,kBAAkB,CAAC,QAAQ;YAC/D,UAAU,EAAE;gBACV,iBAAiB,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC;gBACxD,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC;gBAC7D,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC;aAC5D;SACF,CAAC;QAEF,6BAA6B;QAC7B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;gBACxB,WAAW,EAAE,MAAM;gBACnB,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,CAAC;gBAChB,QAAQ,EAAE,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,qBAAqB,CAAC,IAAsB,EAAE,OAAyB;QAC7E,MAAM,WAAW,GAAG,YAAY,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAExE,MAAM,MAAM,GAAqB;YAC/B,WAAW,EAAE,IAAI,CAAC,gBAAgB;YAClC,WAAW;YACX,MAAM,EAAE,EAAE;YACV,OAAO,EAAE;gBACP,SAAS,EAAE,uBAAuB;gBAClC,SAAS,EAAE,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,gBAAgB;gBAC3E,WAAW,EAAE,IAAI,CAAC,gBAAgB,IAAI,qBAAqB,CAAC,SAAS;gBACrE,OAAO,EAAE,GAAG,WAAW,OAAO;aAC/B;YACD,OAAO,EAAE,EAAE;YACX,MAAM,EAAE;gBACN,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBAClD,SAAS,EAAE,MAAM;gBACjB,aAAa,EAAE,GAAG;aACnB;SACF,CAAC;QAEF,oCAAoC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1C,IAAI,IAAI,KAAK,GAAG;gBAAE,SAAS,CAAC,2CAA2C;YAEvE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;gBACjB,MAAM,EAAE,GAAG,WAAW,GAAG,IAAI,EAAE;gBAC/B,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,IAAI,CAAC,gBAAgB,KAAK,qBAAqB,CAAC,gBAAgB;gBAC1E,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;QACL,CAAC;QAED,+BAA+B;QAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;YACjB,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;OAEG;IACK,mBAAmB,CAAC,IAAsB;QAChD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW;YAC5D,UAAU,EAAE,IAAI,CAAC,aAAa;YAC9B,WAAW,EAAE,IAAI,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc;YACxE,OAAO,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC7C,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,sBAAsB;IACtB,6EAA6E;IAE7E;;OAEG;IACK,gBAAgB,CACtB,QAAyB,EACzB,eAAsB,EACtB,kBAAyB;QAEzB,MAAM,UAAU,GAAsB,EAAE,CAAC;QAEzC,2BAA2B;QAC3B,KAAK,MAAM,QAAQ,IAAI,eAAe,EAAE,CAAC;YACvC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,UAAU,CAAC,IAAI,CAAC;oBACd,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,QAAQ;oBAClB,WAAW,EAAE,6BAA6B,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,EAAE;oBACjF,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,8BAA8B;QAC9B,KAAK,MAAM,QAAQ,IAAI,kBAAkB,EAAE,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,UAAU,CAAC,IAAI,CAAC;oBACd,SAAS,EAAE,QAAQ,CAAC,SAAS;oBAC7B,IAAI,EAAE,YAAY;oBAClB,QAAQ,EAAE,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;oBAC5D,WAAW,EAAE,sBAAsB,QAAQ,CAAC,SAAS,OAAO,QAAQ,CAAC,IAAI,EAAE;oBAC3E,OAAO,EAAE,QAAQ;oBACjB,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;QAC9C,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC;QAErC,IAAI,KAAK,CAAC,WAAW,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;YAC7D,UAAU,CAAC,IAAI,CAAC;gBACd,SAAS,EAAE,IAAI,IAAI,EAAE;gBACrB,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,MAAM;gBAChB,WAAW,EAAE,gCAAgC;gBAC7C,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,GAAG,IAAI,GAAG,IAAI,CAAC,EAAE;gBACxF,MAAM,EAAE,QAAQ;aACjB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,OAAgB,EAAE,UAA6B;QAC1E,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3E,CAAC,EAAE,MAAyD,CAAC,CAAC;QAE9D,OAAO;YACL,gBAAgB,EAAE,OAAO;YACzB,kBAAkB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;YAChE,iBAAiB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC;YAC9D,oBAAoB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;YACpE,cAAc,EAAE,UAAU,CAAC,MAAM;YACjC,iBAAiB,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW;SAClE,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,UAAU;IACV,6EAA6E;IAErE,oBAAoB,CAAC,OAAuB;QAClD,sEAAsE;QACtE,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAClC,CAAC;IAEO,YAAY,CAAC,KAAyB;QAC5C,MAAM,MAAM,GAAuC;YACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG;YAClC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,IAAI;YACnC,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,IAAI;YACtC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9B,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,cAAc,CAAC,KAAyB;QAC9C,MAAM,MAAM,GAAuC;YACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,OAAO;YACxD,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC1D,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC7D,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9B,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,kBAAkB,CAAC,KAAyB;QAClD,MAAM,MAAM,GAAuC;YACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE;YACjC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE;YACjC,CAAC,kBAAkB,CAAC,WAAW,CAAC,EAAE,GAAG;YACrC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SAC9B,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAEO,YAAY,CAAC,KAA4B;QAC/C,MAAM,MAAM,GAA0C;YACpD,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC3C,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;YAC9D,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM;YAC5D,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACjC,CAAC;QACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;CACF;AAqBD;;GAEG;AACH,MAAM,kBAAkB;IACtB,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,OAAO,QAAQ,MAAM,CAAC,SAAS,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,OAAO,CACX,SAAiB,EACjB,OAAe,EACf,IAAc,EACd,KAAyB,EACzB,SAAiB;QAEjB,OAAO;YACL,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,qBAAqB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;YACxD,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,QAAQ;IACV,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,SAAiB;QACtC,OAAO;YACL,WAAW,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC7B,UAAU,EAAE,CAAC;YACb,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,cAAc,EAAE,IAAI;YACpB,eAAe,EAAE,IAAI;YACrB,SAAS,EAAE,EAAE;YACb,YAAY,EAAE,CAAC;SAChB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,SAAiB;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,SAAiB;QAC3C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E,IAAI,QAAQ,GAA0B,IAAI,CAAC;AAE3C,MAAM,UAAU,oBAAoB,CAAC,OAAwB;IAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}