agent-nuvira 1.14.0

package/dist/sandbox/manager.js

@@ -0,0 +1,470 @@
+/**
+ * SandboxManager — Docker-based sandbox isolation for code execution.
+ *
+ * Provides:
+ * - Container lifecycle management (create, exec, destroy)
+ * - Resource limits (CPU, memory, disk, PIDs, network)
+ * - Volume/project mounting
+ * - Command execution with timeout enforcement
+ * - Non-root user execution
+ *
+ * Usage:
+ * ```ts
+ * const manager = new SandboxManager();
+ *
+ * // Check if Docker is available
+ * const available = await manager.isDockerAvailable();
+ *
+ * // Create a sandbox
+ * const containerId = await manager.createContainer('node:20-slim', {
+ *   memoryLimit: '512m',
+ *   cpuLimit: 1,
+ *   networkAccess: false,
+ * });
+ *
+ * // Copy project, run commands
+ * await manager.copyProjectToContainer(containerId, '/path/to/project');
+ * const result = await manager.runCommand(containerId, 'npm test');
+ *
+ * // Always clean up
+ * await manager.destroyContainer(containerId);
+ * ```
+ */
+import { execSync, spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { mkdtempSync, readdirSync } from 'node:fs';
+import { logger } from '../utils/logger.js';
+import { DEFAULT_RESOURCE_LIMITS, getSandboxConfig, } from './types.js';
+// ─── Constants ──────────────────────────────────────────────────────────────
+/** Maximum number of managed containers to track */
+const MAX_CONTAINERS = 20;
+/** Temporary directory for building context before copying to container */
+const BUFF_TMP_PREFIX = 'buff-docker-';
+// ─── SandboxManager ─────────────────────────────────────────────────────────
+export class SandboxManager {
+    config;
+    /** Managed containers tracked by this manager instance */
+    containers = new Map();
+    /** Whether Docker availability has been checked */
+    dockerChecked = false;
+    /** Cached result of Docker availability check */
+    dockerAvailable = false;
+    /** Cached error message from Docker check */
+    dockerError = '';
+    constructor(config = getSandboxConfig()) {
+        this.config = config;
+    }
+    // ─── Docker Availability ──────────────────────────────────────────────────
+    /**
+     * Check if Docker is installed and the daemon is running.
+     * Caches the result so repeated calls are instant.
+     */
+    async isDockerAvailable() {
+        if (this.dockerChecked)
+            return this.dockerAvailable;
+        try {
+            const result = await this.execHostCommand('docker info --format "{{.ServerVersion}}"');
+            this.dockerAvailable = result.exitCode === 0 && result.stdout.trim().length > 0;
+            this.dockerError = result.stderr;
+        }
+        catch (err) {
+            this.dockerAvailable = false;
+            this.dockerError = err instanceof Error ? err.message : String(err);
+        }
+        this.dockerChecked = true;
+        return this.dockerAvailable;
+    }
+    /**
+     * Get the error message from the last Docker availability check.
+     */
+    getDockerError() {
+        return this.dockerError;
+    }
+    /**
+     * Force re-check Docker availability on the next call.
+     */
+    resetDockerCheck() {
+        this.dockerChecked = false;
+    }
+    // ─── Container Lifecycle ─────────────────────────────────────────────────
+    /**
+     * Create a Docker sandbox container with the given image and resource limits.
+     *
+     * @param image - Docker image to use (e.g., 'node:20-slim')
+     * @param limits - Resource limit overrides
+     * @param workDir - Working directory inside the container
+     * @returns The container ID
+     */
+    async createContainer(image, limits, workDir) {
+        if (!(await this.isDockerAvailable())) {
+            throw new Error('Docker is not available. ' + (this.dockerError || 'Is Docker installed and running?'));
+        }
+        // Enforce max container limit
+        if (this.containers.size >= MAX_CONTAINERS) {
+            // Clean up stale containers (created > 30 min ago)
+            await this.cleanupStaleContainers();
+            if (this.containers.size >= MAX_CONTAINERS) {
+                throw new Error(`Maximum of ${MAX_CONTAINERS} sandbox containers reached. ` +
+                    'Please destroy unused containers with destroyContainer().');
+            }
+        }
+        const resolvedImage = image || this.config.image.image;
+        const resolvedLimits = { ...DEFAULT_RESOURCE_LIMITS, ...limits };
+        const resolvedWorkDir = workDir || this.config.workDir;
+        // Generate unique container name
+        const name = 'buff-sandbox-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6);
+        // Build docker run arguments
+        const args = [
+            'run',
+            '--detach', // Run in background
+            '--name', name, // Assign a name for easy reference
+            '--workdir', resolvedWorkDir, // Set working directory
+            '--init', // Use tini as init for proper signal handling
+            '--stop-timeout', String(Math.floor(this.config.stopTimeoutMs / 1000)),
+        ];
+        // Resource limits
+        args.push('--memory', resolvedLimits.memoryLimit);
+        args.push('--memory-swap', resolvedLimits.memoryLimit); // No swap
+        args.push('--cpus', String(resolvedLimits.cpuLimit));
+        args.push('--pids-limit', String(resolvedLimits.pidsLimit));
+        // Disk / storage limit (via size quota if available)
+        try {
+            args.push('--storage-opt', `size=${resolvedLimits.diskLimit}`);
+        }
+        catch {
+            // storage-opt may not be supported on all Docker configurations
+        }
+        // Network access
+        if (!resolvedLimits.networkAccess) {
+            args.push('--network', 'none');
+        }
+        // Security: read-only root filesystem, drop capabilities, non-root user
+        args.push('--read-only'); // Read-only root filesystem
+        args.push('--cap-drop', 'ALL'); // Drop all Linux capabilities
+        args.push('--security-opt', 'no-new-privileges:true'); // No privilege escalation
+        args.push('--user', this.config.containerUser);
+        // Create a writable tmp directory for the workspace
+        args.push('--tmpfs', '/tmp:noexec,nosuid,size=64m');
+        // Mount a temp directory for workspace (rw since / is read-only)
+        const hostTmpDir = mkdtempSync(join(tmpdir(), BUFF_TMP_PREFIX));
+        args.push('--mount', `type=bind,source=${hostTmpDir},target=${resolvedWorkDir}`);
+        args.push('--env', `BUFF_WORKSPACE=${resolvedWorkDir}`);
+        // The image
+        args.push(resolvedImage);
+        // Keep the container alive
+        args.push('tail', '-f', '/dev/null');
+        // Run the container
+        const runResult = await this.execHostCommand(`docker ${args.join(' ')}`, 120_000);
+        if (runResult.exitCode !== 0) {
+            throw new Error(`Failed to create sandbox container: ${runResult.stderr || runResult.stdout}`);
+        }
+        const containerId = runResult.stdout.trim();
+        const managed = {
+            containerId,
+            name,
+            createdAt: Date.now(),
+            status: 'created',
+            limits: resolvedLimits,
+            image: resolvedImage,
+        };
+        this.containers.set(containerId, managed);
+        logger.debug(`Created sandbox container: ${name} (${containerId.slice(0, 12)}...)`);
+        return containerId;
+    }
+    /**
+     * Copy project files (or a specific directory) into the sandbox container.
+     *
+     * Uses `docker cp` to copy files into the container's working directory.
+     *
+     * @param containerId - Container ID
+     * @param sourceDir - Source directory on the host
+     * @param targetDir - Target directory inside container (defaults to workDir)
+     */
+    async copyProjectToContainer(containerId, sourceDir, targetDir) {
+        const container = this.ensureContainer(containerId);
+        const resolvedTarget = targetDir || this.config.workDir;
+        if (!existsSync(sourceDir)) {
+            throw new Error(`Source directory does not exist: ${sourceDir}`);
+        }
+        // Use docker cp to copy the project
+        // We need to ensure the target directory exists first
+        await this.execInContainer(containerId, `mkdir -p "${resolvedTarget}"`);
+        // Copy each top-level entry (excluding node_modules, .git, etc.)
+        const entries = readdirSync(sourceDir);
+        // Use tar for efficient copying (docker cp supports piping via tar)
+        const excluded = new Set(['node_modules', '.git', 'dist', '.next', 'coverage', '.cache', '__pycache__']);
+        const visibleEntries = entries.filter((e) => !e.startsWith('.') && !excluded.has(e));
+        if (visibleEntries.length === 0) {
+            // Just cop an empty directory structure
+            return;
+        }
+        // Use a tar pipe for efficient bulk copy
+        const tarArgs = visibleEntries.map((e) => `"${join(sourceDir, e)}"`).join(' ');
+        const copyCmd = `tar cf - ${tarArgs} | docker exec -i "${containerId}" tar xf - -C "${resolvedTarget}"`;
+        const result = await this.execHostCommand(copyCmd, 120_000);
+        if (result.exitCode !== 0) {
+            // Fall back to individual copies
+            for (const entry of visibleEntries) {
+                try {
+                    await this.execHostCommand(`docker cp "${join(sourceDir, entry)}" "${containerId}:${resolvedTarget}/"`, 60_000);
+                }
+                catch {
+                    // Skip files that fail to copy
+                    logger.debug(`Failed to copy ${entry} to sandbox`);
+                }
+            }
+        }
+        logger.debug(`Copied ${visibleEntries.length} entries to sandbox container: ${container.name}`);
+    }
+    /**
+     * Execute a command inside the sandbox container with timeout enforcement.
+     *
+     * @param containerId - Container ID
+     * @param command - Command to execute (as a string, passed to /bin/sh -c)
+     * @param timeoutMs - Timeout in milliseconds (default: config timeout)
+     * @returns Execution result with stdout, stderr, exit code
+     */
+    async runCommand(containerId, command, timeoutMs) {
+        const container = this.ensureContainer(containerId);
+        const resolvedTimeout = timeoutMs || this.config.limits.timeoutMs;
+        // Escape the command for safe shell execution
+        const escapedCommand = command.replace(/"/g, '\\"').replace(/`/g, '\\`').replace(/\$/g, '\\$');
+        const shell = this.config.image.shell || '/bin/bash';
+        const execCmd = `docker exec -i "${container.containerId}" ${shell} -c "${escapedCommand}"`;
+        const startTime = Date.now();
+        let timedOut = false;
+        // Use a timeout wrapper
+        const timeoutCmd = `timeout ${Math.floor(resolvedTimeout / 1000)} ${execCmd}`;
+        try {
+            const result = await this.execHostCommand(timeoutCmd, resolvedTimeout + 10_000);
+            if (result.exitCode === 124) {
+                // Exit code 124 means 'timeout' command killed the process
+                timedOut = true;
+            }
+            return {
+                success: result.exitCode === 0,
+                stdout: result.stdout,
+                stderr: result.stderr,
+                exitCode: timedOut ? 124 : result.exitCode,
+                durationMs: Date.now() - startTime,
+                timedOut,
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                stdout: '',
+                stderr: '',
+                exitCode: -1,
+                durationMs: Date.now() - startTime,
+                timedOut,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+    /**
+     * Run a command and stream its stdout output (for long-running commands).
+     * Calls onChunk for each line of stdout.
+     */
+    async runCommandWithOutput(containerId, command, onChunk, timeoutMs) {
+        const container = this.ensureContainer(containerId);
+        const resolvedTimeout = timeoutMs || this.config.limits.timeoutMs;
+        return new Promise((resolvePromise) => {
+            const startTime = Date.now();
+            const escapedCommand = command.replace(/"/g, '\\"').replace(/`/g, '\\`');
+            const shell = this.config.image.shell || '/bin/bash';
+            const fullCommand = `docker exec -i "${container.containerId}" ${shell} -c "${escapedCommand}"`;
+            const childProcess = spawn(fullCommand, [], {
+                shell: true,
+                stdio: ['pipe', 'pipe', 'pipe'],
+                timeout: resolvedTimeout,
+            });
+            let stdout = '';
+            let stderr = '';
+            let timedOut = false;
+            const timer = setTimeout(() => {
+                timedOut = true;
+                childProcess.kill('SIGTERM');
+                // Give it a moment to exit, then SIGKILL
+                setTimeout(() => {
+                    try {
+                        childProcess.kill('SIGKILL');
+                    }
+                    catch { /* already dead */ }
+                }, 2000);
+            }, resolvedTimeout);
+            childProcess.stdout?.on('data', (data) => {
+                const chunk = data.toString();
+                stdout += chunk;
+                onChunk?.(chunk);
+            });
+            childProcess.stderr?.on('data', (data) => {
+                stderr += data.toString();
+            });
+            childProcess.on('close', (exitCode) => {
+                clearTimeout(timer);
+                const duration = Date.now() - startTime;
+                resolvePromise({
+                    success: exitCode === 0,
+                    stdout,
+                    stderr,
+                    exitCode: timedOut ? 124 : (exitCode ?? -1),
+                    durationMs: duration,
+                    timedOut,
+                });
+            });
+            childProcess.on('error', (err) => {
+                clearTimeout(timer);
+                resolvePromise({
+                    success: false,
+                    stdout,
+                    stderr: stderr || err.message,
+                    exitCode: -1,
+                    durationMs: Date.now() - startTime,
+                    timedOut: false,
+                    error: err.message,
+                });
+            });
+        });
+    }
+    /**
+     * Get the status of a managed container.
+     */
+    async getContainerStatus(containerId) {
+        const container = this.ensureContainer(containerId);
+        try {
+            const result = await this.execHostCommand(`docker inspect --format "{{.State.Status}}" "${containerId}"`);
+            if (result.exitCode === 0) {
+                const status = result.stdout.trim();
+                container.status = status;
+                return status;
+            }
+        }
+        catch {
+            // Container might not exist
+        }
+        container.status = 'removed';
+        return 'removed';
+    }
+    /**
+     * Stop and remove a sandbox container.
+     */
+    async destroyContainer(containerId) {
+        const container = this.ensureContainer(containerId);
+        try {
+            // Stop the container gracefully first
+            await this.execHostCommand(`docker stop --time ${Math.floor(this.config.stopTimeoutMs / 1000)} "${containerId}" 2>/dev/null`, 30_000);
+        }
+        catch {
+            // Ignore stop errors
+        }
+        try {
+            // Remove the container
+            await this.execHostCommand(`docker rm -f "${containerId}" 2>/dev/null`, 30_000);
+        }
+        catch {
+            // Ignore removal errors
+        }
+        container.status = 'removed';
+        this.containers.delete(containerId);
+        logger.debug(`Destroyed sandbox container: ${container.name}`);
+    }
+    /**
+     * Destroy all managed containers.
+     */
+    async destroyAll() {
+        const ids = [...this.containers.keys()];
+        await Promise.all(ids.map((id) => this.destroyContainer(id).catch(() => { })));
+        this.containers.clear();
+    }
+    /**
+     * Get information about all managed containers.
+     */
+    getManagedContainers() {
+        return [...this.containers.values()];
+    }
+    // ─── Private Helpers ─────────────────────────────────────────────────────
+    /**
+     * Ensure a container ID is tracked and still exists.
+     */
+    ensureContainer(containerId) {
+        const container = this.containers.get(containerId);
+        if (!container) {
+            throw new Error(`Container not managed by this SandboxManager: ${containerId.slice(0, 12)}...`);
+        }
+        return container;
+    }
+    /**
+     * Run a command on the host machine (not inside a container).
+     * Used for docker CLI operations.
+     */
+    async execHostCommand(command, timeoutMs = 60_000) {
+        return new Promise((resolve) => {
+            try {
+                const output = execSync(command, {
+                    timeout: timeoutMs,
+                    stdio: 'pipe',
+                    encoding: 'utf-8',
+                    shell: '/bin/sh',
+                    maxBuffer: 10 * 1024 * 1024, // 10 MB
+                });
+                resolve({
+                    exitCode: 0,
+                    stdout: output.trim(),
+                    stderr: '',
+                });
+            }
+            catch (err) {
+                const error = err;
+                resolve({
+                    exitCode: error.status ?? 1,
+                    stdout: (typeof error.stdout === 'string' ? error.stdout : String(error.stdout || '')).trim(),
+                    stderr: (typeof error.stderr === 'string' ? error.stderr : String(error.stderr || '')).trim(),
+                });
+            }
+        });
+    }
+    /**
+     * Execute a command inside a container using docker exec.
+     * Used internally for setup operations like mkdir.
+     */
+    async execInContainer(containerId, command) {
+        const escaped = command.replace(/"/g, '\\"');
+        return this.execHostCommand(`docker exec "${containerId}" /bin/sh -c "${escaped}"`, 30_000);
+    }
+    /**
+     * Remove containers that have been managed for more than 30 minutes.
+     */
+    async cleanupStaleContainers() {
+        const staleTime = Date.now() - 30 * 60 * 1000;
+        const stale = [...this.containers.entries()].filter(([_, c]) => c.createdAt < staleTime);
+        for (const [id] of stale) {
+            try {
+                await this.destroyContainer(id);
+            }
+            catch {
+                // Best-effort cleanup
+            }
+        }
+    }
+}
+// ─── Singleton / Convenience API ────────────────────────────────────────────
+let defaultManager = null;
+/**
+ * Get or create the default SandboxManager singleton.
+ */
+export function getSandboxManager() {
+    if (!defaultManager) {
+        defaultManager = new SandboxManager();
+    }
+    return defaultManager;
+}
+/**
+ * Reset the default SandboxManager singleton (useful for testing).
+ */
+export function resetSandboxManager() {
+    defaultManager = null;
+}
+//# sourceMappingURL=manager.js.map

package/dist/sandbox/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/sandbox/manager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQ5C,OAAO,EACL,uBAAuB,EAEvB,gBAAgB,GACjB,MAAM,YAAY,CAAC;AAGpB,+EAA+E;AAE/E,oDAAoD;AACpD,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,2EAA2E;AAC3E,MAAM,eAAe,GAAG,cAAc,CAAC;AAEvC,+EAA+E;AAE/E,MAAM,OAAO,cAAc;IAUL;IATpB,0DAA0D;IAClD,UAAU,GAAkC,IAAI,GAAG,EAAE,CAAC;IAC9D,mDAAmD;IAC3C,aAAa,GAAG,KAAK,CAAC;IAC9B,iDAAiD;IACzC,eAAe,GAAG,KAAK,CAAC;IAChC,6CAA6C;IACrC,WAAW,GAAG,EAAE,CAAC;IAEzB,YAAoB,SAAwB,gBAAgB,EAAE;QAA1C,WAAM,GAAN,MAAM,CAAoC;IAAG,CAAC;IAElE,6EAA6E;IAE7E;;;OAGG;IACH,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,eAAe,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,2CAA2C,CAAC,CAAC;YACvF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;YAChF,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC,WAAW,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,4EAA4E;IAE5E;;;;;;;OAOG;IACH,KAAK,CAAC,eAAe,CACnB,KAAc,EACd,MAAgC,EAChC,OAAgB;QAEhB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,2BAA2B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,kCAAkC,CAAC,CACvF,CAAC;QACJ,CAAC;QAED,8BAA8B;QAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YAC3C,mDAAmD;YACnD,MAAM,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,cAAc,cAAc,+BAA+B;oBAC3D,2DAA2D,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,aAAa,GAAG,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;QACvD,MAAM,cAAc,GAAG,EAAE,GAAG,uBAAuB,EAAE,GAAG,MAAM,EAAE,CAAC;QACjE,MAAM,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAEvD,iCAAiC;QACjC,MAAM,IAAI,GAAG,eAAe,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtG,6BAA6B;QAC7B,MAAM,IAAI,GAAa;YACrB,KAAK;YACL,UAAU,EAAwB,oBAAoB;YACtD,QAAQ,EAAE,IAAI,EAAoB,mCAAmC;YACrE,WAAW,EAAE,eAAe,EAAM,wBAAwB;YAC1D,QAAQ,EAA0B,8CAA8C;YAChF,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;SACvE,CAAC;QAEF,kBAAkB;QAClB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,WAAY,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,cAAc,CAAC,WAAY,CAAC,CAAC,CAAC,UAAU;QACnE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,qDAAqD;QACrD,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,cAAc,CAAC,SAAS,EAAE,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAED,wEAAwE;QACxE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAmB,4BAA4B;QACxE,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAa,8BAA8B;QAC1E,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,CAAC,CAAC,CAAC,0BAA0B;QACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE/C,oDAAoD;QACpD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,6BAA6B,CAAC,CAAC;QAEpD,iEAAiE;QACjE,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,UAAU,WAAW,eAAe,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,eAAe,EAAE,CAAC,CAAC;QAExD,YAAY;QACZ,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAEzB,2BAA2B;QAC3B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAErC,oBAAoB;QACpB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAClF,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAC9E,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAqB;YAChC,WAAW;YACX,IAAI;YACJ,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,cAAc;YACtB,KAAK,EAAE,aAAa;SACrB,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,8BAA8B,IAAI,KAAK,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAEpF,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,sBAAsB,CAC1B,WAAmB,EACnB,SAAiB,EACjB,SAAkB;QAElB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAExD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,EAAE,CAAC,CAAC;QACnE,CAAC;QAED,oCAAoC;QACpC,sDAAsD;QACtD,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,aAAa,cAAc,GAAG,CAAC,CAAC;QAExE,iEAAiE;QACjE,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;QAEvC,oEAAoE;QACpE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QACzG,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAE7F,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,wCAAwC;YACxC,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,YAAY,OAAO,sBAAsB,WAAW,kBAAkB,cAAc,GAAG,CAAC;QAExG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,iCAAiC;YACjC,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,eAAe,CACxB,cAAc,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,WAAW,IAAI,cAAc,IAAI,EAC3E,MAAM,CACP,CAAC;gBACJ,CAAC;gBAAC,MAAM,CAAC;oBACP,+BAA+B;oBAC/B,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,aAAa,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,UAAU,cAAc,CAAC,MAAM,kCAAkC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAClG,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,UAAU,CACd,WAAmB,EACnB,OAAe,EACf,SAAkB;QAElB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAElE,8CAA8C;QAC9C,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAE/F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;QACrD,MAAM,OAAO,GAAG,mBAAmB,SAAS,CAAC,WAAW,KAAK,KAAK,QAAQ,cAAc,GAAG,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,wBAAwB;QACxB,MAAM,UAAU,GAAG,WAAW,IAAI,CAAC,KAAK,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,eAAe,GAAG,MAAM,CAAC,CAAC;YAEhF,IAAI,MAAM,CAAC,QAAQ,KAAK,GAAG,EAAE,CAAC;gBAC5B,2DAA2D;gBAC3D,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,MAAM,CAAC,QAAQ,KAAK,CAAC;gBAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ;gBAC1C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;aACT,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,EAAE;gBACV,QAAQ,EAAE,CAAC,CAAC;gBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,QAAQ;gBACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,oBAAoB,CACxB,WAAmB,EACnB,OAAe,EACf,OAAiC,EACjC,SAAkB;QAElB,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,eAAe,GAAG,SAAS,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAElE,OAAO,IAAI,OAAO,CAAoB,CAAC,cAAc,EAAE,EAAE;YACvD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC;YACrD,MAAM,WAAW,GAAG,mBAAmB,SAAS,CAAC,WAAW,KAAK,KAAK,QAAQ,cAAc,GAAG,CAAC;YAEhG,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE;gBAC1C,KAAK,EAAE,IAAI;gBACX,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;gBAC/B,OAAO,EAAE,eAAe;aACzB,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;YAErB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,QAAQ,GAAG,IAAI,CAAC;gBAChB,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC7B,yCAAyC;gBACzC,UAAU,CAAC,GAAG,EAAE;oBACd,IAAI,CAAC;wBAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBACpE,CAAC,EAAE,IAAI,CAAC,CAAC;YACX,CAAC,EAAE,eAAe,CAAC,CAAC;YAEpB,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC;gBAChB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAY,EAAE,EAAE;gBAC/C,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAuB,EAAE,EAAE;gBACnD,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;gBACxC,cAAc,CAAC;oBACb,OAAO,EAAE,QAAQ,KAAK,CAAC;oBACvB,MAAM;oBACN,MAAM;oBACN,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;oBAC3C,UAAU,EAAE,QAAQ;oBACpB,QAAQ;iBACT,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YAEH,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE;gBACtC,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,cAAc,CAAC;oBACb,OAAO,EAAE,KAAK;oBACd,MAAM;oBACN,MAAM,EAAE,MAAM,IAAI,GAAG,CAAC,OAAO;oBAC7B,QAAQ,EAAE,CAAC,CAAC;oBACZ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;oBAClC,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,GAAG,CAAC,OAAO;iBACnB,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,WAAmB;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CACvC,gDAAgD,WAAW,GAAG,CAC/D,CAAC;YACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAqB,CAAC;gBACvD,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC1B,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,4BAA4B;QAC9B,CAAC;QAED,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;QAC7B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAEpD,IAAI,CAAC;YACH,sCAAsC;YACtC,MAAM,IAAI,CAAC,eAAe,CACxB,sBAAsB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,KAAK,WAAW,eAAe,EACjG,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,qBAAqB;QACvB,CAAC;QAED,IAAI,CAAC;YACH,uBAAuB;YACvB,MAAM,IAAI,CAAC,eAAe,CACxB,iBAAiB,WAAW,eAAe,EAC3C,MAAM,CACP,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;QAED,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,gCAAgC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,oBAAoB;QAClB,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,4EAA4E;IAE5E;;OAEG;IACK,eAAe,CAAC,WAAmB;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,iDAAiD,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,OAAe,EACf,SAAS,GAAG,MAAM;QAElB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE;oBAC/B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,MAAM;oBACb,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,SAAS;oBAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ;iBACtC,CAAC,CAAC;gBAEH,OAAO,CAAC;oBACN,QAAQ,EAAE,CAAC;oBACX,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;oBACrB,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,KAAK,GAAG,GAKb,CAAC;gBAEF,OAAO,CAAC;oBACN,QAAQ,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;oBAC3B,MAAM,EAAE,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;oBAC7F,MAAM,EAAE,CAAC,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;iBAC9F,CAAC,CAAC;YACL,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,eAAe,CAC3B,WAAmB,EACnB,OAAe;QAEf,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,eAAe,CACzB,gBAAgB,WAAW,iBAAiB,OAAO,GAAG,EACtD,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,sBAAsB;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAC9C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CACjD,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,SAAS,CACpC,CAAC;QAEF,KAAK,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAE/E,IAAI,cAAc,GAA0B,IAAI,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IACxC,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,cAAc,GAAG,IAAI,CAAC;AACxB,CAAC"}

package/dist/sandbox/types.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Sandbox types — Configuration types for Docker-based sandbox isolation.
+ *
+ * The sandbox system provides process-level isolation for running generated
+ * code and tests inside Docker containers with configurable resource limits.
+ *
+ * Basic usage:
+ * ```ts
+ * const manager = new SandboxManager({ memoryLimit: '512m', cpuLimit: 1 });
+ * const id = await manager.createContainer();
+ * await manager.copyProject(id, '/path/to/project');
+ * const result = await manager.runCommand(id, 'npm test');
+ * await manager.destroyContainer(id);
+ * ```
+ */
+/** Resource limit constraints for a sandbox container */
+export interface ResourceLimits {
+    /** Max memory (e.g., '512m', '2g'). Default: '1g' */
+    memoryLimit?: string;
+    /** Max CPU cores (e.g., 0.5, 1, 2). Default: 1 */
+    cpuLimit?: number;
+    /** Max disk space (e.g., '1g', '10g'). Default: '2g' */
+    diskLimit?: string;
+    /** Max PIDs inside container. Default: 100 */
+    pidsLimit?: number;
+    /** Whether to enable network access. Default: false */
+    networkAccess?: boolean;
+    /** Max duration in ms before container is killed. Default: 600000 (10 min) */
+    timeoutMs?: number;
+}
+/** A pre-defined or custom Docker image for sandbox containers */
+export interface SandboxImage {
+    /** Image name (e.g., 'node:20-slim') */
+    image: string;
+    /** Human-readable label (e.g., 'Node.js 20') */
+    label: string;
+    /** Package manager / runtime details */
+    runtimes: string[];
+    /** Install command prefix (e.g., 'npm install') */
+    installCommand?: string;
+    /** Test command prefix (e.g., 'npm test') */
+    testCommand?: string;
+    /** Shell to use inside container */
+    shell?: string;
+}
+/** Complete sandbox configuration */
+export interface SandboxConfig {
+    /** Whether Docker sandbox is enabled */
+    enabled: boolean;
+    /** Resource limits */
+    limits: Required<ResourceLimits>;
+    /** Image to use for sandbox containers */
+    image: SandboxImage;
+    /** Container working directory */
+    workDir: string;
+    /** Non-root user to run as */
+    containerUser: string;
+    /** Timeout for stopping a container gracefully (ms) */
+    stopTimeoutMs: number;
+}
+/** Lifecycle state of a managed container */
+export type ContainerStatus = 'created' | 'running' | 'stopped' | 'removed';
+/** Track a managed sandbox container */
+export interface ManagedContainer {
+    /** Container ID (Docker container hash) */
+    containerId: string;
+    /** Human-readable name (e.g., 'buff-sandbox-abc123') */
+    name: string;
+    /** Creation timestamp */
+    createdAt: number;
+    /** Current status */
+    status: ContainerStatus;
+    /** Resource limits applied */
+    limits: ResourceLimits;
+    /** Image used */
+    image: string;
+}
+/** Result of executing a command inside a sandbox container */
+export interface SandboxExecResult {
+    /** Whether the command exited with code 0 */
+    success: boolean;
+    /** Standard output */
+    stdout: string;
+    /** Standard error */
+    stderr: string;
+    /** Exit code */
+    exitCode: number;
+    /** Execution duration in ms */
+    durationMs: number;
+    /** Whether the container was killed due to timeout */
+    timedOut: boolean;
+    /** Error message if execution failed entirely */
+    error?: string;
+}
+export declare const DEFAULT_RESOURCE_LIMITS: Required<ResourceLimits>;
+export declare const DEFAULT_SANDBOX_CONFIG: SandboxConfig;
+/**
+ * Get the current sandbox configuration.
+ * Reads from ~/.buff/sandbox-config.json (if exists), falls back to defaults.
+ */
+export declare function getSandboxConfig(): SandboxConfig;
+/**
+ * Update the sandbox configuration and persist to disk.
+ */
+/**
+ * Reset the sandbox config cache. Useful for testing.
+ */
+export declare function resetSandboxConfigCache(): void;
+/**
+ * Update the sandbox configuration and persist to disk.
+ */
+export declare function setSandboxConfig(config: Partial<SandboxConfig>): SandboxConfig;
+//# sourceMappingURL=types.d.ts.map

package/dist/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAID,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,wCAAwC;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,wCAAwC;IACxC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mDAAmD;IACnD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,MAAM,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjC,0CAA0C;IAC1C,KAAK,EAAE,YAAY,CAAC;IACpB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,aAAa,EAAE,MAAM,CAAC;CACvB;AAID,6CAA6C;AAC7C,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE5E,wCAAwC;AACxC,MAAM,WAAW,gBAAgB;IAC/B,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,yBAAyB;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,qBAAqB;IACrB,MAAM,EAAE,eAAe,CAAC;IACxB,8BAA8B;IAC9B,MAAM,EAAE,cAAc,CAAC;IACvB,iBAAiB;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAID,+DAA+D;AAC/D,MAAM,WAAW,iBAAiB;IAChC,6CAA6C;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,sBAAsB;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,sDAAsD;IACtD,QAAQ,EAAE,OAAO,CAAC;IAClB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID,eAAO,MAAM,uBAAuB,EAAE,QAAQ,CAAC,cAAc,CAO5D,CAAC;AAEF,eAAO,MAAM,sBAAsB,EAAE,aAcpC,CAAC;AAQF;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,aAAa,CAwBhD;AAED;;GAEG;AACH;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,IAAI,CAE9C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAqB9E"}