@vorionsys/security 1.0.0

package/dist/cognigate/output-integration.d.ts

@@ -0,0 +1,86 @@
+/**
+ * Cognigate Output Integration
+ *
+ * Integrates with OutputValidator from semantic-governance for
+ * output validation with strict/permissive modes and PII handling.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/output-integration
+ */
+import type { OutputBinding, OutputValidationResult } from '../semantic-governance/types.js';
+import type { OutputValidationOptions, OutputValidationMode } from './types.js';
+/**
+ * Output validation result with additional metadata
+ */
+export interface CognigateOutputValidationResult {
+    /** Whether validation passed */
+    valid: boolean;
+    /** Original output */
+    originalOutput: unknown;
+    /** Sanitized output (if sanitizePII is enabled) */
+    sanitizedOutput?: unknown;
+    /** Whether output was modified */
+    modified: boolean;
+    /** Validation details */
+    details: OutputValidationResult;
+    /** PII detection results */
+    piiDetected: boolean;
+    /** Detected PII types */
+    piiTypes: string[];
+    /** Validation mode used */
+    mode: OutputValidationMode;
+    /** Duration in milliseconds */
+    durationMs: number;
+}
+/**
+ * Output integrator for Cognigate execution gateway.
+ *
+ * Features:
+ * - Integrates with semantic-governance OutputValidator
+ * - Supports strict (reject) and permissive (log only) modes
+ * - PII detection and optional sanitization
+ * - Custom prohibited patterns
+ */
+export declare class OutputIntegrator {
+    private readonly validator;
+    private readonly mode;
+    private readonly sanitizePII;
+    constructor(options: OutputValidationOptions, binding?: OutputBinding);
+    /**
+     * Validate and optionally sanitize execution output
+     */
+    validateOutput(output: unknown): CognigateOutputValidationResult;
+    /**
+     * Validate and transform output for return.
+     * In strict mode, throws on validation failure.
+     * In permissive mode, returns original output with logged warning.
+     */
+    processOutput(output: unknown): Promise<{
+        output: unknown;
+        validation: CognigateOutputValidationResult;
+    }>;
+    /**
+     * Check if a pattern description indicates PII
+     */
+    private isPIIPattern;
+    /**
+     * Validate URLs in output against allowed/blocked endpoints
+     */
+    validateUrls(output: unknown): {
+        valid: boolean;
+        invalidUrls: string[];
+    };
+}
+/**
+ * Create an output integrator with default settings
+ */
+export declare function createOutputIntegrator(options: OutputValidationOptions, binding?: OutputBinding): OutputIntegrator;
+/**
+ * Create a strict output integrator that rejects invalid output
+ */
+export declare function createStrictOutputIntegrator(sanitizePII?: boolean, binding?: OutputBinding): OutputIntegrator;
+/**
+ * Create a permissive output integrator that logs but allows invalid output
+ */
+export declare function createPermissiveOutputIntegrator(sanitizePII?: boolean, binding?: OutputBinding): OutputIntegrator;
+//# sourceMappingURL=output-integration.d.ts.map

package/dist/cognigate/output-integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-integration.d.ts","sourceRoot":"","sources":["../../src/cognigate/output-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAGvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAIhF;;GAEG;AACH,MAAM,WAAW,+BAA+B;IAC9C,gCAAgC;IAChC,KAAK,EAAE,OAAO,CAAC;IACf,sBAAsB;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,kCAAkC;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,yBAAyB;IACzB,OAAO,EAAE,sBAAsB,CAAC;IAChC,4BAA4B;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,yBAAyB;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2BAA2B;IAC3B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAuB;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAU;gBAE1B,OAAO,EAAE,uBAAuB,EAAE,OAAO,CAAC,EAAE,aAAa;IAyBrE;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,OAAO,GAAG,+BAA+B;IA6EhE;;;;OAIG;IACG,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC;QAC5C,MAAM,EAAE,OAAO,CAAC;QAChB,UAAU,EAAE,+BAA+B,CAAC;KAC7C,CAAC;IAwBF;;OAEG;IACH,OAAO,CAAC,YAAY;IAkBpB;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,OAAO,GAAG;QAC7B,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,EAAE,CAAC;KACvB;CAmBF;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,CAElB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,GAAE,OAAc,EAC3B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,CAKlB;AAED;;GAEG;AACH,wBAAgB,gCAAgC,CAC9C,WAAW,GAAE,OAAc,EAC3B,OAAO,CAAC,EAAE,aAAa,GACtB,gBAAgB,CAKlB"}

package/dist/cognigate/output-integration.js

@@ -0,0 +1,184 @@
+/**
+ * Cognigate Output Integration
+ *
+ * Integrates with OutputValidator from semantic-governance for
+ * output validation with strict/permissive modes and PII handling.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/output-integration
+ */
+import { createLogger } from '../common/logger.js';
+import { OutputValidator, OutputValidationError, createDefaultOutputValidator, } from '../semantic-governance/output-validator.js';
+const logger = createLogger({ component: 'cognigate-output-integration' });
+/**
+ * Output integrator for Cognigate execution gateway.
+ *
+ * Features:
+ * - Integrates with semantic-governance OutputValidator
+ * - Supports strict (reject) and permissive (log only) modes
+ * - PII detection and optional sanitization
+ * - Custom prohibited patterns
+ */
+export class OutputIntegrator {
+    validator;
+    mode;
+    sanitizePII;
+    constructor(options, binding) {
+        this.mode = options.mode;
+        this.sanitizePII = options.sanitizePII;
+        // Create validator with custom binding or default
+        if (binding) {
+            // Merge custom prohibited patterns if provided
+            const mergedBinding = {
+                ...binding,
+                prohibitedPatterns: [
+                    ...binding.prohibitedPatterns,
+                    ...(options.prohibitedPatterns ?? []),
+                ],
+            };
+            this.validator = new OutputValidator(mergedBinding);
+        }
+        else {
+            this.validator = createDefaultOutputValidator(options.prohibitedPatterns);
+        }
+        logger.debug({ mode: this.mode, sanitizePII: this.sanitizePII }, 'Output integrator initialized');
+    }
+    /**
+     * Validate and optionally sanitize execution output
+     */
+    validateOutput(output) {
+        const startTime = Date.now();
+        // Run validation
+        const validationResult = this.validator.validateOutput(output);
+        // Check for PII
+        const piiTypes = [];
+        if (validationResult.patternScan?.detected) {
+            for (const pattern of validationResult.patternScan.patterns) {
+                // Identify PII-related patterns
+                if (this.isPIIPattern(pattern.description)) {
+                    piiTypes.push(pattern.description);
+                }
+            }
+        }
+        const piiDetected = piiTypes.length > 0;
+        // Handle sanitization if needed
+        let sanitizedOutput = undefined;
+        let modified = false;
+        if (this.sanitizePII && piiDetected) {
+            const sanitizeResult = this.validator.sanitizeOutput(output);
+            sanitizedOutput = sanitizeResult.content;
+            modified = sanitizeResult.modified;
+            if (modified) {
+                logger.info({
+                    redactions: sanitizeResult.redactions.length,
+                    piiTypes,
+                }, 'Output sanitized for PII');
+            }
+        }
+        const durationMs = Date.now() - startTime;
+        // Build result
+        const result = {
+            valid: validationResult.valid,
+            originalOutput: output,
+            sanitizedOutput,
+            modified,
+            details: validationResult,
+            piiDetected,
+            piiTypes,
+            mode: this.mode,
+            durationMs,
+        };
+        // Handle based on mode
+        if (!validationResult.valid) {
+            if (this.mode === 'strict') {
+                logger.warn({ reason: validationResult.reason, durationMs }, 'Output validation failed (strict mode)');
+            }
+            else {
+                // Permissive mode - log but don't reject
+                logger.warn({ reason: validationResult.reason, durationMs }, 'Output validation failed (permissive mode - logged only)');
+                // In permissive mode, we still allow the output
+                result.valid = true;
+            }
+        }
+        else {
+            logger.debug({ durationMs }, 'Output validation passed');
+        }
+        return result;
+    }
+    /**
+     * Validate and transform output for return.
+     * In strict mode, throws on validation failure.
+     * In permissive mode, returns original output with logged warning.
+     */
+    async processOutput(output) {
+        const validation = this.validateOutput(output);
+        if (!validation.valid && this.mode === 'strict') {
+            throw new OutputValidationError(validation.details.reason ?? 'Output validation failed', {
+                piiDetected: validation.piiDetected,
+                piiTypes: validation.piiTypes,
+            });
+        }
+        // Return sanitized output if available and modified, otherwise original
+        const finalOutput = validation.modified && validation.sanitizedOutput !== undefined
+            ? validation.sanitizedOutput
+            : output;
+        return {
+            output: finalOutput,
+            validation,
+        };
+    }
+    /**
+     * Check if a pattern description indicates PII
+     */
+    isPIIPattern(description) {
+        const piiIndicators = [
+            'email',
+            'phone',
+            'ssn',
+            'social security',
+            'credit card',
+            'address',
+            'name',
+            'ip address',
+            'personal',
+            'pii',
+        ];
+        const lowerDesc = description.toLowerCase();
+        return piiIndicators.some((indicator) => lowerDesc.includes(indicator));
+    }
+    /**
+     * Validate URLs in output against allowed/blocked endpoints
+     */
+    validateUrls(output) {
+        const content = typeof output === 'string'
+            ? output
+            : JSON.stringify(output);
+        const invalidUrls = this.validator.validateAllUrls(content);
+        if (invalidUrls.length > 0) {
+            logger.warn({ invalidUrls }, 'Output contains disallowed external URLs');
+        }
+        return {
+            valid: invalidUrls.length === 0,
+            invalidUrls,
+        };
+    }
+}
+/**
+ * Create an output integrator with default settings
+ */
+export function createOutputIntegrator(options, binding) {
+    return new OutputIntegrator(options, binding);
+}
+/**
+ * Create a strict output integrator that rejects invalid output
+ */
+export function createStrictOutputIntegrator(sanitizePII = true, binding) {
+    return new OutputIntegrator({ mode: 'strict', sanitizePII }, binding);
+}
+/**
+ * Create a permissive output integrator that logs but allows invalid output
+ */
+export function createPermissiveOutputIntegrator(sanitizePII = true, binding) {
+    return new OutputIntegrator({ mode: 'permissive', sanitizePII }, binding);
+}
+//# sourceMappingURL=output-integration.js.map

package/dist/cognigate/output-integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-integration.js","sourceRoot":"","sources":["../../src/cognigate/output-integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EACL,eAAe,EACf,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4CAA4C,CAAC;AASpD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,8BAA8B,EAAE,CAAC,CAAC;AA0B3E;;;;;;;;GAQG;AACH,MAAM,OAAO,gBAAgB;IACV,SAAS,CAAkB;IAC3B,IAAI,CAAuB;IAC3B,WAAW,CAAU;IAEtC,YAAY,OAAgC,EAAE,OAAuB;QACnE,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAEvC,kDAAkD;QAClD,IAAI,OAAO,EAAE,CAAC;YACZ,+CAA+C;YAC/C,MAAM,aAAa,GAAkB;gBACnC,GAAG,OAAO;gBACV,kBAAkB,EAAE;oBAClB,GAAG,OAAO,CAAC,kBAAkB;oBAC7B,GAAG,CAAC,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;iBACtC;aACF,CAAC;YACF,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,4BAA4B,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,CAAC,KAAK,CACV,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAClD,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAe;QAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,iBAAiB;QACjB,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE/D,gBAAgB;QAChB,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC;YAC3C,KAAK,MAAM,OAAO,IAAI,gBAAgB,CAAC,WAAW,CAAC,QAAQ,EAAE,CAAC;gBAC5D,gCAAgC;gBAChC,IAAI,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC3C,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAExC,gCAAgC;QAChC,IAAI,eAAe,GAAY,SAAS,CAAC;QACzC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,IAAI,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7D,eAAe,GAAG,cAAc,CAAC,OAAO,CAAC;YACzC,QAAQ,GAAG,cAAc,CAAC,QAAQ,CAAC;YAEnC,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CACT;oBACE,UAAU,EAAE,cAAc,CAAC,UAAU,CAAC,MAAM;oBAC5C,QAAQ;iBACT,EACD,0BAA0B,CAC3B,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QAE1C,eAAe;QACf,MAAM,MAAM,GAAoC;YAC9C,KAAK,EAAE,gBAAgB,CAAC,KAAK;YAC7B,cAAc,EAAE,MAAM;YACtB,eAAe;YACf,QAAQ;YACR,OAAO,EAAE,gBAAgB;YACzB,WAAW;YACX,QAAQ;YACR,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU;SACX,CAAC;QAEF,uBAAuB;QACvB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,EAC/C,wCAAwC,CACzC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,yCAAyC;gBACzC,MAAM,CAAC,IAAI,CACT,EAAE,MAAM,EAAE,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,EAC/C,0DAA0D,CAC3D,CAAC;gBACF,gDAAgD;gBAChD,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC;YACtB,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,EAAE,0BAA0B,CAAC,CAAC;QAC3D,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,MAAe;QAIjC,MAAM,UAAU,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,qBAAqB,CAC7B,UAAU,CAAC,OAAO,CAAC,MAAM,IAAI,0BAA0B,EACvD;gBACE,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,QAAQ,EAAE,UAAU,CAAC,QAAQ;aAC9B,CACF,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS;YACjF,CAAC,CAAC,UAAU,CAAC,eAAe;YAC5B,CAAC,CAAC,MAAM,CAAC;QAEX,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,UAAU;SACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,WAAmB;QACtC,MAAM,aAAa,GAAG;YACpB,OAAO;YACP,OAAO;YACP,KAAK;YACL,iBAAiB;YACjB,aAAa;YACb,SAAS;YACT,MAAM;YACN,YAAY;YACZ,UAAU;YACV,KAAK;SACN,CAAC;QAEF,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,MAAe;QAI1B,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ;YACxC,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAE3B,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,EACf,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,OAAO;YACL,KAAK,EAAE,WAAW,CAAC,MAAM,KAAK,CAAC;YAC/B,WAAW;SACZ,CAAC;IACJ,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAgC,EAChC,OAAuB;IAEvB,OAAO,IAAI,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,cAAuB,IAAI,EAC3B,OAAuB;IAEvB,OAAO,IAAI,gBAAgB,CACzB,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,EAC/B,OAAO,CACR,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAC9C,cAAuB,IAAI,EAC3B,OAAuB;IAEvB,OAAO,IAAI,gBAAgB,CACzB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,EACnC,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/cognigate/resource-interceptors.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Cognigate Resource Interceptors
+ *
+ * Interceptors for network and file system operations that enforce
+ * resource limits and track usage.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/resource-interceptors
+ */
+import * as fs from 'node:fs/promises';
+import type { ID } from '../common/types.js';
+import type { ResourceLimits, ResourceStateProvider } from './types.js';
+/**
+ * Error thrown when a resource limit is exceeded
+ */
+export declare class ResourceLimitExceededError extends Error {
+    readonly limitType: 'network' | 'filesystem';
+    readonly current: number;
+    readonly limit: number;
+    constructor(message: string, limitType: 'network' | 'filesystem', current: number, limit: number);
+}
+/**
+ * Wrapped fetch function type
+ */
+export type WrappedFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+/**
+ * Create a network interceptor that wraps fetch to track and limit requests.
+ *
+ * @param executionId - Unique execution identifier
+ * @param limits - Resource limits to enforce
+ * @param stateProvider - State provider for distributed tracking
+ * @param signal - Abort signal for termination
+ * @returns Wrapped fetch function
+ */
+export declare function createNetworkInterceptor(executionId: ID, limits: ResourceLimits, stateProvider: ResourceStateProvider, signal: AbortSignal): WrappedFetch;
+/**
+ * Wrapped file system functions type
+ */
+export interface WrappedFileSystemFunctions {
+    readFile: typeof fs.readFile;
+    writeFile: typeof fs.writeFile;
+    appendFile: typeof fs.appendFile;
+    unlink: typeof fs.unlink;
+    mkdir: typeof fs.mkdir;
+    rmdir: typeof fs.rmdir;
+    readdir: typeof fs.readdir;
+    stat: typeof fs.stat;
+    access: typeof fs.access;
+    rename: typeof fs.rename;
+    copyFile: typeof fs.copyFile;
+}
+/**
+ * Create file system interceptors that wrap fs functions to track and limit operations.
+ *
+ * @param executionId - Unique execution identifier
+ * @param limits - Resource limits to enforce
+ * @param stateProvider - State provider for distributed tracking
+ * @param signal - Abort signal for termination
+ * @returns Object with wrapped file system functions
+ */
+export declare function createFileSystemInterceptors(executionId: ID, limits: ResourceLimits, stateProvider: ResourceStateProvider, signal: AbortSignal): WrappedFileSystemFunctions;
+/**
+ * Execution context with interceptors for sandboxed execution
+ */
+export interface ExecutionInterceptors {
+    /** Wrapped fetch function */
+    fetch: WrappedFetch;
+    /** Wrapped file system functions */
+    fs: WrappedFileSystemFunctions;
+    /** Abort signal for termination */
+    signal: AbortSignal;
+}
+/**
+ * Create all interceptors for an execution
+ */
+export declare function createExecutionInterceptors(executionId: ID, limits: ResourceLimits, stateProvider: ResourceStateProvider, signal: AbortSignal): ExecutionInterceptors;
+//# sourceMappingURL=resource-interceptors.d.ts.map

package/dist/cognigate/resource-interceptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-interceptors.d.ts","sourceRoot":"","sources":["../../src/cognigate/resource-interceptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAEvC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAIxE;;GAEG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;aAGjC,SAAS,EAAE,SAAS,GAAG,YAAY;aACnC,OAAO,EAAE,MAAM;aACf,KAAK,EAAE,MAAM;gBAH7B,OAAO,EAAE,MAAM,EACC,SAAS,EAAE,SAAS,GAAG,YAAY,EACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM;CAKhC;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,KAAK,EAAE,WAAW,GAAG,GAAG,EACxB,IAAI,CAAC,EAAE,WAAW,KACf,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEvB;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,WAAW,EAAE,EAAE,EACf,MAAM,EAAE,cAAc,EACtB,aAAa,EAAE,qBAAqB,EACpC,MAAM,EAAE,WAAW,GAClB,YAAY,CA8Cd;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;IAC7B,SAAS,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC;IAC/B,UAAU,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC;IACjC,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACzB,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;IACvB,KAAK,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC;IACvB,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC;IAC3B,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC;IACrB,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC;IACzB,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC;CAC9B;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,EAAE,EACf,MAAM,EAAE,cAAc,EACtB,aAAa,EAAE,qBAAqB,EACpC,MAAM,EAAE,WAAW,GAClB,0BAA0B,CAoE5B;AA0BD;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,6BAA6B;IAC7B,KAAK,EAAE,YAAY,CAAC;IACpB,oCAAoC;IACpC,EAAE,EAAE,0BAA0B,CAAC;IAC/B,mCAAmC;IACnC,MAAM,EAAE,WAAW,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,EAAE,EACf,MAAM,EAAE,cAAc,EACtB,aAAa,EAAE,qBAAqB,EACpC,MAAM,EAAE,WAAW,GAClB,qBAAqB,CAMvB"}

package/dist/cognigate/resource-interceptors.js

@@ -0,0 +1,143 @@
+/**
+ * Cognigate Resource Interceptors
+ *
+ * Interceptors for network and file system operations that enforce
+ * resource limits and track usage.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/resource-interceptors
+ */
+import * as fs from 'node:fs/promises';
+import { createLogger } from '../common/logger.js';
+const logger = createLogger({ component: 'cognigate-interceptors' });
+/**
+ * Error thrown when a resource limit is exceeded
+ */
+export class ResourceLimitExceededError extends Error {
+    limitType;
+    current;
+    limit;
+    constructor(message, limitType, current, limit) {
+        super(message);
+        this.limitType = limitType;
+        this.current = current;
+        this.limit = limit;
+        this.name = 'ResourceLimitExceededError';
+    }
+}
+/**
+ * Create a network interceptor that wraps fetch to track and limit requests.
+ *
+ * @param executionId - Unique execution identifier
+ * @param limits - Resource limits to enforce
+ * @param stateProvider - State provider for distributed tracking
+ * @param signal - Abort signal for termination
+ * @returns Wrapped fetch function
+ */
+export function createNetworkInterceptor(executionId, limits, stateProvider, signal) {
+    const maxRequests = limits.maxNetworkRequests ?? Infinity;
+    return async (input, init) => {
+        // Check if already aborted
+        if (signal.aborted) {
+            throw new ResourceLimitExceededError('Execution terminated', 'network', 0, maxRequests);
+        }
+        // Check and increment request count
+        if (maxRequests !== Infinity) {
+            const result = await stateProvider.incrementNetworkRequests(executionId, maxRequests);
+            if (!result.allowed) {
+                logger.warn({ executionId, current: result.current, limit: maxRequests }, 'Network request limit exceeded');
+                throw new ResourceLimitExceededError(`Network request limit exceeded: ${result.current} >= ${maxRequests}`, 'network', result.current, maxRequests);
+            }
+            logger.debug({ executionId, requestCount: result.current, limit: maxRequests }, 'Network request allowed');
+        }
+        // Merge abort signal with any existing signal
+        const combinedInit = {
+            ...init,
+            signal: combineAbortSignals(signal, init?.signal),
+        };
+        // Make the actual fetch request
+        return fetch(input, combinedInit);
+    };
+}
+/**
+ * Create file system interceptors that wrap fs functions to track and limit operations.
+ *
+ * @param executionId - Unique execution identifier
+ * @param limits - Resource limits to enforce
+ * @param stateProvider - State provider for distributed tracking
+ * @param signal - Abort signal for termination
+ * @returns Object with wrapped file system functions
+ */
+export function createFileSystemInterceptors(executionId, limits, stateProvider, signal) {
+    const maxOps = limits.maxFileSystemOps ?? Infinity;
+    /**
+     * Check limit and track operation before execution
+     */
+    async function checkAndTrack() {
+        // Check if already aborted
+        if (signal.aborted) {
+            throw new ResourceLimitExceededError('Execution terminated', 'filesystem', 0, maxOps);
+        }
+        // Check and increment operation count
+        if (maxOps !== Infinity) {
+            const result = await stateProvider.incrementFileSystemOps(executionId, maxOps);
+            if (!result.allowed) {
+                logger.warn({ executionId, current: result.current, limit: maxOps }, 'File system operation limit exceeded');
+                throw new ResourceLimitExceededError(`File system operation limit exceeded: ${result.current} >= ${maxOps}`, 'filesystem', result.current, maxOps);
+            }
+            logger.debug({ executionId, opCount: result.current, limit: maxOps }, 'File system operation allowed');
+        }
+    }
+    /**
+     * Create a wrapped version of an fs function
+     */
+    function wrapFsFunction(fn, operationName) {
+        return (async (...args) => {
+            await checkAndTrack();
+            logger.debug({ executionId, operation: operationName }, 'File system operation');
+            return fn(...args);
+        });
+    }
+    return {
+        readFile: wrapFsFunction(fs.readFile, 'readFile'),
+        writeFile: wrapFsFunction(fs.writeFile, 'writeFile'),
+        appendFile: wrapFsFunction(fs.appendFile, 'appendFile'),
+        unlink: wrapFsFunction(fs.unlink, 'unlink'),
+        mkdir: wrapFsFunction(fs.mkdir, 'mkdir'),
+        rmdir: wrapFsFunction(fs.rmdir, 'rmdir'),
+        readdir: wrapFsFunction(fs.readdir, 'readdir'),
+        stat: wrapFsFunction(fs.stat, 'stat'),
+        access: wrapFsFunction(fs.access, 'access'),
+        rename: wrapFsFunction(fs.rename, 'rename'),
+        copyFile: wrapFsFunction(fs.copyFile, 'copyFile'),
+    };
+}
+/**
+ * Combine multiple abort signals into one.
+ * The combined signal will abort when any of the input signals abort.
+ */
+function combineAbortSignals(...signals) {
+    const controller = new AbortController();
+    const validSignals = signals.filter((s) => s != null);
+    for (const signal of validSignals) {
+        if (signal.aborted) {
+            controller.abort(signal.reason);
+            return controller.signal;
+        }
+        signal.addEventListener('abort', () => {
+            controller.abort(signal.reason);
+        }, { once: true });
+    }
+    return controller.signal;
+}
+/**
+ * Create all interceptors for an execution
+ */
+export function createExecutionInterceptors(executionId, limits, stateProvider, signal) {
+    return {
+        fetch: createNetworkInterceptor(executionId, limits, stateProvider, signal),
+        fs: createFileSystemInterceptors(executionId, limits, stateProvider, signal),
+        signal,
+    };
+}
+//# sourceMappingURL=resource-interceptors.js.map

package/dist/cognigate/resource-interceptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-interceptors.js","sourceRoot":"","sources":["../../src/cognigate/resource-interceptors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAErE;;GAEG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAGjC;IACA;IACA;IAJlB,YACE,OAAe,EACC,SAAmC,EACnC,OAAe,EACf,KAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,cAAS,GAAT,SAAS,CAA0B;QACnC,YAAO,GAAP,OAAO,CAAQ;QACf,UAAK,GAAL,KAAK,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAUD;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CACtC,WAAe,EACf,MAAsB,EACtB,aAAoC,EACpC,MAAmB;IAEnB,MAAM,WAAW,GAAG,MAAM,CAAC,kBAAkB,IAAI,QAAQ,CAAC;IAE1D,OAAO,KAAK,EAAE,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QAC/E,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,SAAS,EACT,CAAC,EACD,WAAW,CACZ,CAAC;QACJ,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,wBAAwB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAEtF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAC5D,gCAAgC,CACjC,CAAC;gBACF,MAAM,IAAI,0BAA0B,CAClC,mCAAmC,MAAM,CAAC,OAAO,OAAO,WAAW,EAAE,EACrE,SAAS,EACT,MAAM,CAAC,OAAO,EACd,WAAW,CACZ,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EACjE,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QAED,8CAA8C;QAC9C,MAAM,YAAY,GAAgB;YAChC,GAAG,IAAI;YACP,MAAM,EAAE,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;SAClD,CAAC;QAEF,gCAAgC;QAChC,OAAO,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC;AAmBD;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAe,EACf,MAAsB,EACtB,aAAoC,EACpC,MAAmB;IAEnB,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,IAAI,QAAQ,CAAC;IAEnD;;OAEG;IACH,KAAK,UAAU,aAAa;QAC1B,2BAA2B;QAC3B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,IAAI,0BAA0B,CAClC,sBAAsB,EACtB,YAAY,EACZ,CAAC,EACD,MAAM,CACP,CAAC;QACJ,CAAC;QAED,sCAAsC;QACtC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,sBAAsB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAE/E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CACT,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EACvD,sCAAsC,CACvC,CAAC;gBACF,MAAM,IAAI,0BAA0B,CAClC,yCAAyC,MAAM,CAAC,OAAO,OAAO,MAAM,EAAE,EACtE,YAAY,EACZ,MAAM,CAAC,OAAO,EACd,MAAM,CACP,CAAC;YACJ,CAAC;YAED,MAAM,CAAC,KAAK,CACV,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EACvD,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,SAAS,cAAc,CACrB,EAAK,EACL,aAAqB;QAErB,OAAO,CAAC,KAAK,EAAE,GAAG,IAAmB,EAAmC,EAAE;YACxE,MAAM,aAAa,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACjF,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACrB,CAAC,CAAM,CAAC;IACV,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAuB;QACvE,SAAS,EAAE,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAwB;QAC3E,UAAU,EAAE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,CAAyB;QAC/E,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAqB;QAC/D,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAoB;QAC3D,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAoB;QAC3D,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAsB;QACnE,IAAI,EAAE,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAmB;QACvD,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAqB;QAC/D,MAAM,EAAE,cAAc,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAqB;QAC/D,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAuB;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAC1B,GAAG,OAA2C;IAE9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;IAExE,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,OAAO,UAAU,CAAC,MAAM,CAAC;QAC3B,CAAC;QAED,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE;YACpC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,CAAC;AAC3B,CAAC;AAcD;;GAEG;AACH,MAAM,UAAU,2BAA2B,CACzC,WAAe,EACf,MAAsB,EACtB,aAAoC,EACpC,MAAmB;IAEnB,OAAO;QACL,KAAK,EAAE,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;QAC3E,EAAE,EAAE,4BAA4B,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC;QAC5E,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/cognigate/resource-state-provider.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Cognigate Redis Resource State Provider
+ *
+ * Implements distributed resource tracking using Redis.
+ * Uses atomic Lua scripts for consistency under concurrent access.
+ *
+ * @packageDocumentation
+ * @module @vorion/cognigate/resource-state-provider
+ */
+import type { Redis } from 'ioredis';
+import type { ID } from '../common/types.js';
+import type { ResourceLimits, ResourceUsage, ResourceStateProvider } from './types.js';
+/**
+ * Dependencies for RedisResourceStateProvider
+ */
+export interface RedisResourceStateProviderDependencies {
+    /** Redis client instance */
+    redis?: Redis;
+}
+/**
+ * Redis-based resource state provider for distributed execution tracking.
+ *
+ * Uses Redis HASH structures for efficient storage and Lua scripts
+ * for atomic operations that prevent race conditions.
+ */
+export declare class RedisResourceStateProvider implements ResourceStateProvider {
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(deps?: RedisResourceStateProviderDependencies);
+    /**
+     * Build the Redis key for an execution
+     */
+    private buildKey;
+    /**
+     * Initialize execution tracking with limits and TTL
+     */
+    initExecution(executionId: ID, limits: ResourceLimits, ttlMs: number): Promise<void>;
+    /**
+     * Record memory usage sample, updating peak if higher
+     */
+    recordMemoryUsage(executionId: ID, memoryMb: number): Promise<void>;
+    /**
+     * Get peak memory usage for an execution
+     */
+    getPeakMemory(executionId: ID): Promise<number>;
+    /**
+     * Atomically increment CPU time and return new total
+     */
+    incrementCpuTime(executionId: ID, deltaMs: number): Promise<number>;
+    /**
+     * Get total CPU time for an execution
+     */
+    getCpuTimeMs(executionId: ID): Promise<number>;
+    /**
+     * Atomically increment network request count and check limit
+     */
+    incrementNetworkRequests(executionId: ID, limit: number): Promise<{
+        allowed: boolean;
+        current: number;
+    }>;
+    /**
+     * Get current network request count
+     */
+    getNetworkRequestCount(executionId: ID): Promise<number>;
+    /**
+     * Atomically increment file system operation count and check limit
+     */
+    incrementFileSystemOps(executionId: ID, limit: number): Promise<{
+        allowed: boolean;
+        current: number;
+    }>;
+    /**
+     * Get current file system operation count
+     */
+    getFileSystemOpCount(executionId: ID): Promise<number>;
+    /**
+     * Check if execution should be terminated based on resource limits
+     */
+    shouldTerminate(executionId: ID, limits: ResourceLimits): Promise<{
+        terminate: boolean;
+        reason?: string;
+        violation?: string;
+    }>;
+    /**
+     * Clean up execution tracking and return final usage metrics
+     */
+    cleanupExecution(executionId: ID): Promise<ResourceUsage>;
+    /**
+     * Get a snapshot of all resource metrics
+     */
+    getResourceSnapshot(executionId: ID): Promise<{
+        memoryPeakMb: number;
+        cpuTimeMs: number;
+        networkRequests: number;
+        fileSystemOps: number;
+        wallTimeMs: number;
+    }>;
+}
+/**
+ * Create a Redis resource state provider instance
+ */
+export declare function createResourceStateProvider(deps?: RedisResourceStateProviderDependencies): ResourceStateProvider;
+//# sourceMappingURL=resource-state-provider.d.ts.map

package/dist/cognigate/resource-state-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-state-provider.d.ts","sourceRoot":"","sources":["../../src/cognigate/resource-state-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAGrC,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAavF;;GAEG;AACH,MAAM,WAAW,sCAAsC;IACrD,4BAA4B;IAC5B,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAyBD;;;;;GAKG;AACH,qBAAa,0BAA2B,YAAW,qBAAqB;IACtE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;gBAEnC,IAAI,GAAE,sCAA2C;IAI7D;;OAEG;IACH,OAAO,CAAC,QAAQ;IAIhB;;OAEG;IACG,aAAa,CAAC,WAAW,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB1F;;OAEG;IACG,iBAAiB,CAAC,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE;;OAEG;IACG,aAAa,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAMrD;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAazE;;OAEG;IACG,YAAY,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAMpD;;OAEG;IACG,wBAAwB,CAC5B,WAAW,EAAE,EAAE,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBjD;;OAEG;IACG,sBAAsB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAM9D;;OAEG;IACG,sBAAsB,CAC1B,WAAW,EAAE,EAAE,EACf,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAgBjD;;OAEG;IACG,oBAAoB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAM5D;;OAEG;IACG,eAAe,CACnB,WAAW,EAAE,EAAE,EACf,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA6CvE;;OAEG;IACG,gBAAgB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAyB/D;;OAEG;IACG,mBAAmB,CAAC,WAAW,EAAE,EAAE,GAAG,OAAO,CAAC;QAClD,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAqBH;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CACzC,IAAI,GAAE,sCAA2C,GAChD,qBAAqB,CAEvB"}