@appforge-ci/core 0.2.3 → 0.3.0

package/dist/vpn-egress-presets.js

@@ -0,0 +1,318 @@
+/**
+ * Egress policy settings for a VPN tunnel (migrations/0045): the versioned
+ * preset registry, validation of what an org admin stores, and the server-side
+ * expansion into the concrete `egress` block the helper enforces
+ * (`VpnJobConfig.egress`, vpn-egress.ts).
+ *
+ * Pure and runtime-agnostic: the API Worker, the lease-job Worker, the
+ * dashboard and the CLI all import it, so they apply the same rules and report
+ * the same problems.
+ *
+ * Presets never reach the helper. The control plane expands a tunnel's preset
+ * ids plus its custom hosts into one host list; the helper hashes THAT list
+ * (`vpnEgressPolicyHash`) and echoes the hash, so the evidence names the exact
+ * hosts a build ran under even if a preset's contents change in a later release.
+ */
+import { canonicalVpnEgressPolicy, normalizeEgressHost, validateVpnEgressPolicy, VPN_EGRESS_DEFAULT_PORT, VPN_EGRESS_MAX_PORTS_PER_RULE, } from "./vpn-egress.js";
+/** Version of the preset registry below. Bumped whenever a preset's hosts
+ *  change; recorded nowhere per tunnel (the policy hash is the record). */
+export const VPN_EGRESS_PRESETS_VERSION = 1;
+/** At most this many presets on one tunnel (the registry is smaller; this bounds the stored JSON). */
+export const VPN_EGRESS_MAX_PRESETS = 16;
+/** At most this many custom `egressAllow` entries on one tunnel. With the presets
+ *  the expanded list stays far below the helper's 512-rule limit. */
+export const VPN_EGRESS_MAX_CUSTOM_RULES = 100;
+/**
+ * The registry. Hostnames only, exact or `*.suffix`, port 443 unless a rule says
+ * otherwise (the helper's default). The first four presets come from the hosts
+ * one cold build of a sample Flutter app contacted (Android debug APK and iOS
+ * simulator build, empty Gradle/pub/CocoaPods caches); `npm` and `github` are the
+ * standard hosts of those services and were not part of that measurement.
+ *
+ * These lists are a starting point, not a guarantee that a build works: an
+ * app-specific host (Firebase, Sentry, App Store Connect, Google Play, a private
+ * registry) is not here, and a customer will see refusals until they add it as a
+ * custom entry. For a regulated setup the better answer is an internal mirror
+ * reached through the tunnel, with no presets at all.
+ */
+export const VPN_EGRESS_PRESETS = [
+    {
+        id: "flutter",
+        label: "Flutter",
+        description: "The Flutter and Dart tools: pub packages and the Flutter engine artifacts. A Flutter app for Android also needs the Android / Gradle preset, and one for iOS needs iOS / CocoaPods.",
+        rules: [{ host: "pub.dev" }, { host: "storage.googleapis.com", sharedTenancy: true }],
+    },
+    {
+        id: "android-gradle",
+        label: "Android / Gradle",
+        description: "Google's Maven repository and Android SDK downloads, Maven Central, the Gradle plugin portal and the Gradle distribution (which is downloaded through GitHub release assets).",
+        rules: [
+            { host: "dl.google.com" },
+            { host: "repo.maven.apache.org" },
+            { host: "plugins.gradle.org" },
+            { host: "plugins-artifacts.gradle.org" },
+            { host: "services.gradle.org" },
+            { host: "github.com", sharedTenancy: true },
+            { host: "release-assets.githubusercontent.com", sharedTenancy: true },
+        ],
+    },
+    {
+        id: "ios-cocoapods",
+        label: "iOS / CocoaPods",
+        description: "The CocoaPods CDN and its jsDelivr mirror. Most pods download their source from GitHub, so a project with pods usually needs the GitHub preset too.",
+        rules: [{ host: "cdn.cocoapods.org" }, { host: "cdn.jsdelivr.net", sharedTenancy: true }],
+    },
+    {
+        id: "npm",
+        label: "npm / Yarn",
+        description: "The public npm registry and the Yarn registry alias.",
+        rules: [{ host: "registry.npmjs.org" }, { host: "registry.yarnpkg.com" }],
+    },
+    {
+        id: "github",
+        label: "GitHub (https)",
+        description: "git over https to github.com, source archives and release downloads. GitHub is shared by every tenant, so this also lets a build upload to any repository it holds a token for.",
+        rules: [
+            { host: "github.com", sharedTenancy: true },
+            { host: "codeload.github.com", sharedTenancy: true },
+            { host: "objects.githubusercontent.com", sharedTenancy: true },
+            { host: "raw.githubusercontent.com", sharedTenancy: true },
+            { host: "release-assets.githubusercontent.com", sharedTenancy: true },
+        ],
+    },
+];
+const PRESET_ID = /^[a-z0-9][a-z0-9-]{0,63}$/;
+export function findVpnEgressPreset(id) {
+    return typeof id === "string" ? VPN_EGRESS_PRESETS.find((p) => p.id === id) : undefined;
+}
+/** The ids of the given presets whose hosts include a shared-tenancy host. */
+export function sharedTenancyPresetIds(presetIds) {
+    return presetIds.filter((id) => findVpnEgressPreset(id)?.rules.some((r) => r.sharedTenancy === true));
+}
+/** The compliance modes of a tunnel (`VpnTunnel.complianceMode`). */
+export const VPN_COMPLIANCE_MODES = ["standard", "regulated"];
+/**
+ * Parses one `host` or `host:port` entry as typed in the CLI or dashboard. The
+ * host rules (no IP literal, no bare `*`, ...) are checked by
+ * `validateEgressAllow`; this only splits the port off and refuses what could
+ * not be a single `host[:port]` (a scheme, a path, an IPv6 literal).
+ */
+export function parseEgressAllowEntry(text) {
+    const t = text.trim();
+    const m = /^([^:/\s]+)(?::(\d{1,5}))?$/.exec(t);
+    if (!m)
+        return { error: `"${shorten(t)}" is not host or host:port (no scheme, path or IPv6 literal)` };
+    const host = m[1];
+    if (m[2] === undefined)
+        return { rule: { host } };
+    const port = Number(m[2]);
+    if (!Number.isInteger(port) || port < 1 || port > 65535)
+        return { error: `"${shorten(t)}": the port must be 1-65535` };
+    return { rule: { host, ports: [port] } };
+}
+/** Parses a list of entries, merging repeated hosts (so `a.com:443` and `a.com:8443` become one rule). Returns every error. */
+export function parseEgressAllowEntries(texts) {
+    const rules = [];
+    const errors = [];
+    for (const text of texts) {
+        const parsed = parseEgressAllowEntry(text);
+        if ("error" in parsed)
+            errors.push(parsed.error);
+        else
+            rules.push(parsed.rule);
+    }
+    return { rules, errors };
+}
+function shorten(s) {
+    return s.length > 60 ? `${s.slice(0, 57)}...` : s;
+}
+/**
+ * Every problem with a tunnel's custom egress entries (empty = valid). The host
+ * and port rules are `validateVpnEgressPolicy`'s, so the server, CLI, dashboard,
+ * agent and helper refuse exactly the same hosts; only the size bound and the
+ * field names differ. Problem strings never echo a rejected value.
+ */
+export function validateEgressAllow(allow) {
+    if (!Array.isArray(allow))
+        return ["egressAllow: must be an array"];
+    if (allow.length > VPN_EGRESS_MAX_CUSTOM_RULES) {
+        return [`egressAllow: may contain at most ${VPN_EGRESS_MAX_CUSTOM_RULES} entries`];
+    }
+    return validateVpnEgressPolicy({ allow }).map((p) => p.replace(/^egress\.allow/, "egressAllow"));
+}
+/** Every problem with a tunnel's preset ids (empty = valid). An unknown id is refused, never ignored. */
+export function validateEgressPresets(presets) {
+    if (!Array.isArray(presets))
+        return ["egressPresets: must be an array"];
+    if (presets.length > VPN_EGRESS_MAX_PRESETS) {
+        return [`egressPresets: may contain at most ${VPN_EGRESS_MAX_PRESETS} presets`];
+    }
+    const problems = [];
+    presets.forEach((id, i) => {
+        if (typeof id !== "string" || !PRESET_ID.test(id))
+            problems.push(`egressPresets[${i}]: must be a preset id`);
+        else if (!findVpnEgressPreset(id)) {
+            problems.push(`egressPresets[${i}]: unknown preset (known: ${VPN_EGRESS_PRESETS.map((p) => p.id).join(", ")})`);
+        }
+    });
+    return problems;
+}
+/** Sorted, de-duplicated preset ids: the form that is stored. Call only on validated input. */
+export function normalizeEgressPresets(presets) {
+    return [...new Set(presets)].sort();
+}
+/**
+ * The merged form of a rule list: hosts lowercased, one rule per host with its
+ * ports unioned (default 443 made explicit), sorted by host, ports ascending.
+ * It is also what `canonicalVpnEgressPolicy` serialises, so a stored list in
+ * this form never changes meaning when hashed. Throws on an invalid host: call
+ * `validateEgressAllow` first.
+ */
+export function mergeEgressRules(rules) {
+    const merged = new Map();
+    for (const rule of rules) {
+        const host = normalizeEgressHost(rule.host);
+        if (host === null)
+            throw new Error("invalid egress host");
+        let ports = merged.get(host);
+        if (!ports)
+            merged.set(host, (ports = new Set()));
+        for (const p of rule.ports && rule.ports.length > 0 ? rule.ports : [VPN_EGRESS_DEFAULT_PORT])
+            ports.add(p);
+    }
+    return [...merged.keys()].sort().map((host) => ({ host, ports: [...merged.get(host)].sort((a, b) => a - b) }));
+}
+/** The stored form of custom entries: merged, with the helper's per-rule port limit applied by validation first. */
+export function normalizeEgressAllow(allow) {
+    return mergeEgressRules(allow);
+}
+/** The rules the given (already validated) preset ids contribute, copied. */
+function presetRules(ids) {
+    const rules = [];
+    for (const id of ids) {
+        for (const r of findVpnEgressPreset(id).rules)
+            rules.push({ host: r.host, ...(r.ports ? { ports: [...r.ports] } : {}) });
+    }
+    return rules;
+}
+/**
+ * Every problem with the egress part of a tunnel's settings, in one list.
+ *
+ * Beyond the per-list checks it validates the RESULT: the presets' hosts and the
+ * custom entries merged exactly as `expandVpnEgressPolicy` merges them (ports
+ * unioned per host), because that merged policy is what the helper receives and
+ * what its limits apply to. A preset host plus a custom entry for the same host
+ * can push it past the helper's per-rule port limit even when each list is fine
+ * on its own; catching that here (not at the first lease) is what keeps a saved
+ * setting from failing every build of the org.
+ */
+export function validateEgressSettings(settings) {
+    const problems = [];
+    if (settings.egressPresets !== undefined)
+        problems.push(...validateEgressPresets(settings.egressPresets));
+    if (settings.egressAllow !== undefined)
+        problems.push(...validateEgressAllow(settings.egressAllow));
+    if (problems.length > 0)
+        return problems;
+    const presets = Array.isArray(settings.egressPresets) ? settings.egressPresets : [];
+    const custom = Array.isArray(settings.egressAllow) ? settings.egressAllow : [];
+    const merged = mergeEgressRules([...presetRules(presets), ...custom]);
+    merged.forEach((r) => {
+        if ((r.ports?.length ?? 0) > VPN_EGRESS_MAX_PORTS_PER_RULE) {
+            problems.push(`${r.host} lists more than ${VPN_EGRESS_MAX_PORTS_PER_RULE} ports once its presets and entries are merged`);
+        }
+    });
+    // Whatever else the helper would refuse in the merged policy (e.g. its total rule limit).
+    if (problems.length === 0) {
+        problems.push(...validateVpnEgressPolicy({ allow: merged }).map((p) => `merged egress policy: ${p.replace(/^egress\.allow/, "allow")}`));
+    }
+    return problems;
+}
+/**
+ * The concrete policy for a tunnel: the union of its presets' hosts and its
+ * custom entries, merged and sorted (so the same settings always give the same
+ * bytes, and so the same hash). Throws on an unknown preset, an invalid host or
+ * an oversized result: the lease route treats a throw as "the tunnel
+ * configuration could not be prepared" and fails the build closed rather than
+ * run it with a weaker policy than the customer set.
+ */
+export function expandVpnEgressPolicy(settings) {
+    const problems = validateEgressSettings({ egressPresets: [...settings.egressPresets], egressAllow: [...settings.egressAllow] });
+    if (problems.length > 0)
+        throw new Error(`invalid egress settings: ${problems.join("; ")}`);
+    const rules = [...presetRules(settings.egressPresets), ...settings.egressAllow];
+    const policy = { allow: mergeEgressRules(rules) };
+    // Final guard: whatever was built must be a policy the helper accepts.
+    canonicalVpnEgressPolicy(policy);
+    return policy;
+}
+function parseStoredArray(text, what) {
+    let parsed;
+    try {
+        parsed = typeof text === "string" ? JSON.parse(text) : null;
+    }
+    catch {
+        parsed = null;
+    }
+    if (!Array.isArray(parsed))
+        throw new Error(`${what} is not a JSON array`);
+    return parsed;
+}
+/**
+ * Reads the two JSON columns of a tunnel row for enforcement. Strict, unlike a
+ * display parse: a column that is not a JSON array throws instead of reading as
+ * empty, because an empty allow-list is the MOST restrictive policy but an
+ * empty preset list would silently drop what the customer allowed, and either
+ * way a corrupt row must stop the build rather than guess.
+ */
+export function egressSettingsFromRow(row) {
+    const presets = parseStoredArray(row.egressPresets, "egressPresets");
+    const allow = parseStoredArray(row.egressAllow, "egressAllow");
+    return { egressPresets: presets, egressAllow: allow };
+}
+/** Lenient read for display: unusable entries are dropped. Never use it to enforce. */
+export function egressSettingsForDisplay(row) {
+    const arr = (text) => {
+        try {
+            const v = JSON.parse(text);
+            return Array.isArray(v) ? v : [];
+        }
+        catch {
+            return [];
+        }
+    };
+    const egressPresets = arr(row.egressPresets).filter((v) => typeof v === "string");
+    const egressAllow = arr(row.egressAllow).flatMap((v) => {
+        if (v === null || typeof v !== "object")
+            return [];
+        const { host, ports } = v;
+        if (typeof host !== "string")
+            return [];
+        const okPorts = Array.isArray(ports) ? ports.filter((p) => typeof p === "number") : [];
+        return [{ host, ...(okPorts.length > 0 ? { ports: okPorts } : {}) }];
+    });
+    return { egressPresets, egressAllow };
+}
+/**
+ * The text the dashboard and CLI show for one rule: `host` for the default port,
+ * `host:port` per extra port.
+ */
+export function formatEgressRule(rule) {
+    const ports = rule.ports && rule.ports.length > 0 ? rule.ports : [VPN_EGRESS_DEFAULT_PORT];
+    return ports.map((p) => (p === VPN_EGRESS_DEFAULT_PORT ? rule.host : `${rule.host}:${p}`));
+}
+/**
+ * What strict egress does and does not give, in the words every surface (CLI,
+ * dashboard, docs/vpn.md) uses. It is only the enforcement that exists today:
+ * the helper's proxy refuses unlisted destinations. Nothing here may claim more
+ * until the build sandbox ships.
+ */
+export const VPN_EGRESS_LIMITS = [
+    "Strict egress limits where the helper's proxy connects. It does not stop a process that ignores the proxy settings (xcodebuild, raw sockets, UDP, a tool that opens its own connection): builds still run as the same user on the Mac with direct network access, and a kernel build sandbox that would close that is not available yet.",
+    "It limits destinations, not content. Hosts shared by many tenants (GitHub, Google Cloud Storage, jsDelivr) also let a build upload data to anyone's repository or bucket there, so it is not data-loss prevention.",
+    "The presets are starting points from one sample build. App-specific hosts (Firebase, Sentry, App Store Connect, Google Play, private registries) are not included, so expect refusals until you add them. Where you can, prefer an internal mirror reached through the tunnel and no presets.",
+    "Builds of a strict tunnel run only on Macs that report the egress-policy-v1 capability (an up-to-date agent); until one is available they wait in the queue.",
+];
+/** The extra sentence for `complianceMode = 'regulated'`. */
+export const VPN_REGULATED_NOTE = "Regulated mode additionally requires a Mac that reports kernel-enforced build isolation. No Mac does yet, so builds of a regulated tunnel wait in the queue; it is not a compliance certification.";
+//# sourceMappingURL=vpn-egress-presets.js.map

package/dist/vpn-egress-presets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress-presets.js","sourceRoot":"","sources":["../src/vpn-egress-presets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,6BAA6B,GAC9B,MAAM,iBAAiB,CAAC;AAGzB;2EAC2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC;AAE5C,sGAAsG;AACtG,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAC;AACzC;qEACqE;AACrE,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAiB/C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAA+B;IAC5D;QACE,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,qLAAqL;QACvL,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;KACtF;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,KAAK,EAAE,kBAAkB;QACzB,WAAW,EACT,+KAA+K;QACjL,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,eAAe,EAAE;YACzB,EAAE,IAAI,EAAE,uBAAuB,EAAE;YACjC,EAAE,IAAI,EAAE,oBAAoB,EAAE;YAC9B,EAAE,IAAI,EAAE,8BAA8B,EAAE;YACxC,EAAE,IAAI,EAAE,qBAAqB,EAAE;YAC/B,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE;YAC3C,EAAE,IAAI,EAAE,sCAAsC,EAAE,aAAa,EAAE,IAAI,EAAE;SACtE;KACF;IACD;QACE,EAAE,EAAE,eAAe;QACnB,KAAK,EAAE,iBAAiB;QACxB,WAAW,EACT,qJAAqJ;QACvJ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;KAC1F;IACD;QACE,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,sDAAsD;QACnE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC;KAC1E;IACD;QACE,EAAE,EAAE,QAAQ;QACZ,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,iLAAiL;QACnL,KAAK,EAAE;YACL,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE;YAC3C,EAAE,IAAI,EAAE,qBAAqB,EAAE,aAAa,EAAE,IAAI,EAAE;YACpD,EAAE,IAAI,EAAE,+BAA+B,EAAE,aAAa,EAAE,IAAI,EAAE;YAC9D,EAAE,IAAI,EAAE,2BAA2B,EAAE,aAAa,EAAE,IAAI,EAAE;YAC1D,EAAE,IAAI,EAAE,sCAAsC,EAAE,aAAa,EAAE,IAAI,EAAE;SACtE;KACF;CACF,CAAC;AAEF,MAAM,SAAS,GAAG,2BAA2B,CAAC;AAE9C,MAAM,UAAU,mBAAmB,CAAC,EAAW;IAC7C,OAAO,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,sBAAsB,CAAC,SAA4B;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC;AACxG,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAU,EAAE,WAAW,CAAU,CAAC;AAGvE;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,8DAA8D,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACnB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,6BAA6B,EAAE,CAAC;IACvH,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC3C,CAAC;AAED,+HAA+H;AAC/H,MAAM,UAAU,uBAAuB,CAAC,KAAwB;IAC9D,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,OAAO,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;;YAC5C,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,OAAO,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC/C,OAAO,CAAC,oCAAoC,2BAA2B,UAAU,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,iCAAiC,CAAC,CAAC;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAC5C,OAAO,CAAC,sCAAsC,sBAAsB,UAAU,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,OAAO,CAAC,OAAO,CAAC,CAAC,EAAW,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,wBAAwB,CAAC,CAAC;aACxG,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,sBAAsB,CAAC,OAA0B;IAC/D,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA+B;IAC9D,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClH,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,oBAAoB,CAAC,KAA+B;IAClE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,WAAW,CAAC,GAAsB;IACzC,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,IAAI,mBAAmB,CAAC,EAAE,CAAE,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,QAA4D;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,aAAa,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1G,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACpG,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,aAA0B,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,WAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IACtE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE;QACnB,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,6BAA6B,EAAE,CAAC;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,oBAAoB,6BAA6B,gDAAgD,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC,CAAC,CAAC;IACH,0FAA0F;IAC1F,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3I,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAA2B;IAC/D,MAAM,QAAQ,GAAG,sBAAsB,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAChI,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChF,MAAM,MAAM,GAAoB,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;IACnE,uEAAuE;IACvE,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa,EAAE,IAAY;IACnD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,sBAAsB,CAAC,CAAC;IAC3E,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAmD;IACvF,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAC/D,OAAO,EAAE,aAAa,EAAE,OAAmB,EAAE,WAAW,EAAE,KAAwB,EAAE,CAAC;AACvF,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,wBAAwB,CAAC,GAAmD;IAI1F,MAAM,GAAG,GAAG,CAAC,IAAY,EAAa,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IAC/F,MAAM,WAAW,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAmB,EAAE;QACtE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACnD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAwC,CAAC;QACjE,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;IAC3F,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,0UAA0U;IAC1U,oNAAoN;IACpN,+RAA+R;IAC/R,8JAA8J;CAC/J,CAAC;AAEF,6DAA6D;AAC7D,MAAM,CAAC,MAAM,kBAAkB,GAC7B,oMAAoM,CAAC"}

package/dist/vpn-egress-presets.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-egress-presets.test.d.ts.map

package/dist/vpn-egress-presets.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress-presets.test.d.ts","sourceRoot":"","sources":["../src/vpn-egress-presets.test.ts"],"names":[],"mappings":""}

package/dist/vpn-egress-presets.test.js

@@ -0,0 +1,210 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { createVpnTunnelSchema, updateVpnTunnelSchema, canonicalVpnEgressPolicy, egressSettingsForDisplay, egressSettingsFromRow, expandVpnEgressPolicy, findVpnEgressPreset, formatEgressRule, mergeEgressRules, normalizeEgressHost, normalizeEgressPresets, parseEgressAllowEntries, parseEgressAllowEntry, sharedTenancyPresetIds, validateEgressAllow, validateEgressPresets, validateEgressSettings, validateVpnEgressPolicy, vpnEgressPolicyHash, VPN_EGRESS_MAX_CUSTOM_RULES, VPN_EGRESS_MAX_PRESETS, VPN_EGRESS_MAX_RULES, VPN_EGRESS_PRESETS, } from "./index.js";
+const sha = (s) => createHash("sha256").update(s).digest("hex");
+test("registry: ids are unique and well-formed; every host passes the helper's own host rules; no bare *, no IP literal, no Unicode", () => {
+    assert.ok(VPN_EGRESS_PRESETS.length >= 5);
+    assert.equal(new Set(VPN_EGRESS_PRESETS.map((p) => p.id)).size, VPN_EGRESS_PRESETS.length);
+    for (const p of VPN_EGRESS_PRESETS) {
+        assert.match(p.id, /^[a-z0-9][a-z0-9-]*$/);
+        assert.ok(p.label.length > 0 && p.description.length > 0 && p.rules.length > 0, p.id);
+        for (const r of p.rules) {
+            assert.equal(normalizeEgressHost(r.host), r.host, `${p.id}: ${r.host} must already be in normal form`);
+            assert.notEqual(r.host, "*");
+            assert.doesNotMatch(r.host, /^[0-9.]+$/);
+            for (const port of r.ports ?? [])
+                assert.ok(Number.isInteger(port) && port >= 1 && port <= 65535);
+        }
+        // Each preset is a valid helper policy on its own.
+        assert.deepEqual(validateVpnEgressPolicy({ allow: p.rules.map(({ host, ports }) => ({ host, ...(ports ? { ports: [...ports] } : {}) })) }), [], p.id);
+    }
+});
+test("registry: the hosts the Seatbelt spike observed in a cold Flutter android + ios build are all covered by the presets", () => {
+    const observed = [
+        "dl.google.com",
+        "repo.maven.apache.org",
+        "plugins.gradle.org",
+        "plugins-artifacts.gradle.org",
+        "services.gradle.org",
+        "storage.googleapis.com",
+        "pub.dev",
+        "github.com",
+        "release-assets.githubusercontent.com",
+        "cdn.cocoapods.org",
+        "cdn.jsdelivr.net",
+    ];
+    const policy = expandVpnEgressPolicy({ egressPresets: ["flutter", "android-gradle", "ios-cocoapods"], egressAllow: [] });
+    const hosts = new Set(policy.allow.map((r) => r.host));
+    for (const h of observed)
+        assert.ok(hosts.has(h), `${h} missing`);
+    // ...and the presets add nothing the sample build did not need.
+    assert.deepEqual([...hosts].sort(), [...observed].sort());
+});
+test("registry: shared-tenancy hosts are flagged, so the UI can warn about the exfiltration channel", () => {
+    assert.deepEqual(sharedTenancyPresetIds(["flutter", "npm", "github", "ios-cocoapods", "android-gradle"]).sort(), [
+        "android-gradle",
+        "flutter",
+        "github",
+        "ios-cocoapods",
+    ]);
+    assert.deepEqual(sharedTenancyPresetIds(["npm"]), []);
+    assert.deepEqual(sharedTenancyPresetIds(["no-such-preset"]), []);
+    const github = findVpnEgressPreset("github");
+    assert.ok(github.rules.every((r) => r.sharedTenancy === true));
+});
+test("golden: expanding settings gives these exact canonical bytes and hash (a preset change must be deliberate)", async () => {
+    const policy = expandVpnEgressPolicy({
+        egressPresets: ["npm", "flutter"],
+        egressAllow: [{ host: "Git.Corp.Example.com", ports: [8443] }, { host: "*.corp.example.com" }, { host: "pub.dev", ports: [8080] }],
+    });
+    const canonical = '{"v":1,"allow":[' +
+        '{"host":"*.corp.example.com","ports":[443]},' +
+        '{"host":"git.corp.example.com","ports":[8443]},' +
+        '{"host":"pub.dev","ports":[443,8080]},' +
+        '{"host":"registry.npmjs.org","ports":[443]},' +
+        '{"host":"registry.yarnpkg.com","ports":[443]},' +
+        '{"host":"storage.googleapis.com","ports":[443]}]}';
+    assert.equal(canonicalVpnEgressPolicy(policy), canonical);
+    assert.equal(await vpnEgressPolicyHash(policy), sha(canonical));
+    // The expansion is already in the merged form, so canonicalising it again changes nothing.
+    assert.deepEqual(mergeEgressRules(policy.allow), policy.allow);
+});
+test("golden: the full android + flutter + cocoapods policy is pinned", async () => {
+    const policy = expandVpnEgressPolicy({ egressPresets: ["ios-cocoapods", "android-gradle", "flutter"], egressAllow: [] });
+    const canonical = '{"v":1,"allow":[' +
+        '{"host":"cdn.cocoapods.org","ports":[443]},{"host":"cdn.jsdelivr.net","ports":[443]},{"host":"dl.google.com","ports":[443]},' +
+        '{"host":"github.com","ports":[443]},{"host":"plugins-artifacts.gradle.org","ports":[443]},{"host":"plugins.gradle.org","ports":[443]},' +
+        '{"host":"pub.dev","ports":[443]},{"host":"release-assets.githubusercontent.com","ports":[443]},{"host":"repo.maven.apache.org","ports":[443]},' +
+        '{"host":"services.gradle.org","ports":[443]},{"host":"storage.googleapis.com","ports":[443]}]}';
+    assert.equal(canonicalVpnEgressPolicy(policy), canonical);
+    assert.equal(await vpnEgressPolicyHash(policy), sha(canonical));
+});
+test("expansion is order- and duplicate-insensitive, and no settings at all is the tunnel-only policy", async () => {
+    const a = expandVpnEgressPolicy({ egressPresets: ["npm", "flutter", "npm"], egressAllow: [{ host: "a.example.com" }, { host: "A.example.com", ports: [443] }] });
+    const b = expandVpnEgressPolicy({ egressPresets: ["flutter", "npm"], egressAllow: [{ host: "a.example.com", ports: [443] }] });
+    assert.deepEqual(a, b);
+    assert.deepEqual(expandVpnEgressPolicy({ egressPresets: [], egressAllow: [] }), { allow: [] });
+    assert.equal(canonicalVpnEgressPolicy({ allow: [] }), '{"v":1,"allow":[]}');
+});
+test("expansion refuses what the helper would: an unknown preset, a bad host, an IP literal, a bare *", () => {
+    assert.throws(() => expandVpnEgressPolicy({ egressPresets: ["nope"], egressAllow: [] }), /unknown preset/);
+    for (const host of ["*", "10.0.0.1", "2130706433", "0x7f.1", "localhost", "a.com.", "*.com", "a b.com", "ünï.example.com", "a.example.com:443", "*.*.example.com"]) {
+        assert.throws(() => expandVpnEgressPolicy({ egressPresets: [], egressAllow: [{ host }] }), /invalid egress settings/, host);
+    }
+});
+test("validateEgressAllow: bare *, IP literals, scheme/path/port in the host, trailing dot, Unicode and bad ports are all rejected, and no rejected value is echoed", () => {
+    const bad = ["*", "10.0.0.1", "127.0.0.1", "169.254.169.254", "::1", "2130706433", "0x7f.0.0.1", "https://a.example.com", "a.example.com/x", "a.example.com.", "a.example.com:443", "ünï.example.com", "", "*.example.*"];
+    for (const host of bad) {
+        const problems = validateEgressAllow([{ host }]);
+        assert.ok(problems.length > 0, `${JSON.stringify(host)} must be rejected`);
+        for (const p of problems) {
+            assert.match(p, /^egressAllow\[0\]/);
+            if (host.length > 3)
+                assert.ok(!p.includes(host), `problem echoes the value: ${p}`);
+        }
+    }
+    assert.ok(validateEgressAllow([{ host: "a.example.com", ports: [0] }]).length > 0);
+    assert.ok(validateEgressAllow([{ host: "a.example.com", ports: [65536] }]).length > 0);
+    assert.ok(validateEgressAllow([{ host: "a.example.com", ports: [1.5] }]).length > 0);
+    assert.ok(validateEgressAllow([{ host: "a.example.com", ports: "443" }]).length > 0);
+    assert.ok(validateEgressAllow("a.example.com").length > 0);
+    assert.ok(validateEgressAllow([null]).length > 0);
+    assert.deepEqual(validateEgressAllow([{ host: "a.example.com" }, { host: "*.b.example.com", ports: [443, 8443] }]), []);
+});
+test("size limits: too many custom entries, too many presets, too many ports (also once merged)", () => {
+    const many = Array.from({ length: VPN_EGRESS_MAX_CUSTOM_RULES + 1 }, (_, i) => ({ host: `h${i}.example.com` }));
+    assert.match(validateEgressAllow(many)[0], /at most 100 entries/);
+    assert.deepEqual(validateEgressAllow(many.slice(0, VPN_EGRESS_MAX_CUSTOM_RULES)), []);
+    assert.match(validateEgressPresets(Array.from({ length: VPN_EGRESS_MAX_PRESETS + 1 }, () => "npm"))[0], /at most 16 presets/);
+    const ports17 = Array.from({ length: 17 }, (_, i) => 1000 + i);
+    assert.ok(validateEgressAllow([{ host: "a.example.com", ports: ports17 }]).length > 0);
+    // 16 ports in each of two entries for the same host merge to 17+ distinct ports.
+    const first16 = Array.from({ length: 16 }, (_, i) => 1000 + i);
+    const entries = [
+        { host: "a.example.com", ports: first16 },
+        { host: "A.example.com", ports: [2000] },
+    ];
+    assert.deepEqual(validateEgressAllow(entries), []);
+    assert.match(validateEgressSettings({ egressAllow: entries })[0], /more than 16 ports once its presets and entries are merged/);
+    assert.throws(() => expandVpnEgressPolicy({ egressPresets: [], egressAllow: entries }), /merged/);
+    assert.ok(VPN_EGRESS_MAX_CUSTOM_RULES + VPN_EGRESS_PRESETS.reduce((n, p) => n + p.rules.length, 0) < VPN_EGRESS_MAX_RULES);
+});
+test("validateEgressPresets: unknown, malformed and non-array input is refused", () => {
+    assert.deepEqual(validateEgressPresets(["flutter", "npm"]), []);
+    assert.match(validateEgressPresets(["bogus"])[0], /unknown preset/);
+    assert.match(validateEgressPresets(["Flutter"])[0], /must be a preset id/);
+    assert.match(validateEgressPresets([1])[0], /must be a preset id/);
+    assert.match(validateEgressPresets("flutter")[0], /must be an array/);
+    assert.deepEqual(normalizeEgressPresets(["npm", "flutter", "npm"]), ["flutter", "npm"]);
+});
+test("parseEgressAllowEntry: host, host:port, and what is not an entry", () => {
+    assert.deepEqual(parseEgressAllowEntry("repo.example.com"), { rule: { host: "repo.example.com" } });
+    assert.deepEqual(parseEgressAllowEntry(" repo.example.com:8443 "), { rule: { host: "repo.example.com", ports: [8443] } });
+    assert.deepEqual(parseEgressAllowEntry("*.example.com:443"), { rule: { host: "*.example.com", ports: [443] } });
+    for (const bad of ["", "https://a.example.com", "a.example.com/x", "[::1]:443", "::1", "a.example.com:", "a.example.com:0", "a.example.com:70000", "a.example.com:12ab", "a b"]) {
+        assert.ok("error" in parseEgressAllowEntry(bad), JSON.stringify(bad));
+    }
+    const { rules, errors } = parseEgressAllowEntries(["a.example.com:443", "a.example.com:8443", "https://x"]);
+    assert.equal(rules.length, 2);
+    assert.equal(errors.length, 1);
+    assert.deepEqual(mergeEgressRules(rules), [{ host: "a.example.com", ports: [443, 8443] }]);
+});
+test("a long rejected entry is shortened in its error", () => {
+    const parsed = parseEgressAllowEntry(`https://${"a".repeat(300)}.example.com`);
+    assert.ok("error" in parsed && parsed.error.length < 140);
+});
+test("egressSettingsFromRow is strict: a corrupt column throws instead of reading as empty", () => {
+    assert.deepEqual(egressSettingsFromRow({ egressPresets: '["npm"]', egressAllow: '[{"host":"a.example.com"}]' }), {
+        egressPresets: ["npm"],
+        egressAllow: [{ host: "a.example.com" }],
+    });
+    assert.throws(() => egressSettingsFromRow({ egressPresets: "not json", egressAllow: "[]" }), /egressPresets/);
+    assert.throws(() => egressSettingsFromRow({ egressPresets: "[]", egressAllow: '{"host":"a"}' }), /egressAllow/);
+    assert.throws(() => egressSettingsFromRow({ egressPresets: "[]", egressAllow: null }), /egressAllow/);
+    // A well-formed JSON array of the wrong thing is refused at expansion, never trusted.
+    const s = egressSettingsFromRow({ egressPresets: "[1]", egressAllow: '["x"]' });
+    assert.throws(() => expandVpnEgressPolicy(s), /invalid egress settings/);
+});
+test("egressSettingsForDisplay is lenient and never throws", () => {
+    assert.deepEqual(egressSettingsForDisplay({ egressPresets: "nope", egressAllow: "nope" }), { egressPresets: [], egressAllow: [] });
+    assert.deepEqual(egressSettingsForDisplay({ egressPresets: '["npm",3]', egressAllow: '[{"host":"a.example.com","ports":[443,"x"]},7,{"ports":[1]}]' }), {
+        egressPresets: ["npm"],
+        egressAllow: [{ host: "a.example.com", ports: [443] }],
+    });
+});
+test("formatEgressRule shows the default port as the bare host", () => {
+    assert.deepEqual(formatEgressRule({ host: "a.example.com" }), ["a.example.com"]);
+    assert.deepEqual(formatEgressRule({ host: "a.example.com", ports: [443, 8443] }), ["a.example.com", "a.example.com:8443"]);
+});
+test("a preset host plus a custom entry for it is validated as merged: 443 + 16 custom ports is refused at save time, not at the first lease", () => {
+    const sixteen = Array.from({ length: 16 }, (_, i) => 8001 + i);
+    const settings = { egressPresets: ["github"], egressAllow: [{ host: "github.com", ports: sixteen }] };
+    const problems = validateEgressSettings(settings);
+    assert.equal(problems.length, 1);
+    assert.match(problems[0], /github\.com lists more than 16 ports once its presets and entries are merged/);
+    // The same settings are what expansion (the lease path) refuses, so save and lease now agree.
+    assert.throws(() => expandVpnEgressPolicy(settings), /merged/);
+    // 15 custom ports + the preset's 443 is exactly 16: accepted by both.
+    const fifteen = sixteen.slice(0, 15);
+    assert.deepEqual(validateEgressSettings({ ...settings, egressAllow: [{ host: "github.com", ports: fifteen }] }), []);
+    assert.doesNotThrow(() => expandVpnEgressPolicy({ ...settings, egressAllow: [{ host: "github.com", ports: fifteen }] }));
+    // Restating a preset's own port adds nothing.
+    assert.deepEqual(validateEgressSettings({ egressPresets: ["github"], egressAllow: [{ host: "github.com", ports: [443] }] }), []);
+});
+test("the tunnel schemas themselves reject bare *, IP literals and a bad preset, so a caller using them alone is safe", () => {
+    const base = {
+        name: "HQ",
+        gatewayEndpoint: "vpn.example.com:51820",
+        gatewayPublicKey: "A".repeat(43) + "=",
+        lanCidrs: ["10.20.0.0/16"],
+    };
+    assert.equal(createVpnTunnelSchema.safeParse({ ...base, egressAllow: [{ host: "a.example.com" }], egressPresets: ["npm"] }).success, true);
+    for (const host of ["*", "10.0.0.1"]) {
+        assert.equal(createVpnTunnelSchema.safeParse({ ...base, egressAllow: [{ host }] }).success, false, host);
+        assert.equal(updateVpnTunnelSchema.safeParse({ egressAllow: [{ host }] }).success, false, host);
+    }
+    assert.equal(updateVpnTunnelSchema.safeParse({ egressPresets: ["no-such-preset"] }).success, false);
+    assert.equal(updateVpnTunnelSchema.safeParse({ strictEgress: true }).success, true);
+});
+//# sourceMappingURL=vpn-egress-presets.test.js.map

package/dist/vpn-egress-presets.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-egress-presets.test.js","sourceRoot":"","sources":["../src/vpn-egress-presets.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,EACxB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,YAAY,CAAC;AAEpB,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAExE,IAAI,CAAC,+HAA+H,EAAE,GAAG,EAAE;IACzI,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC3F,KAAK,MAAM,CAAC,IAAI,kBAAkB,EAAE,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC3C,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,iCAAiC,CAAC,CAAC;YACvG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACzC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE;gBAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,CAAC,CAAC;QACpG,CAAC;QACD,mDAAmD;QACnD,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxJ,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sHAAsH,EAAE,GAAG,EAAE;IAChI,MAAM,QAAQ,GAAG;QACf,eAAe;QACf,uBAAuB;QACvB,oBAAoB;QACpB,8BAA8B;QAC9B,qBAAqB;QACrB,wBAAwB;QACxB,SAAS;QACT,YAAY;QACZ,sCAAsC;QACtC,mBAAmB;QACnB,kBAAkB;KACnB,CAAC;IACF,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;IAClE,gEAAgE;IAChE,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+FAA+F,EAAE,GAAG,EAAE;IACzG,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;QAC/G,gBAAgB;QAChB,SAAS;QACT,QAAQ;QACR,eAAe;KAChB,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,gBAAgB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAE,CAAC;IAC9C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4GAA4G,EAAE,KAAK,IAAI,EAAE;IAC5H,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,aAAa,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;QACjC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KACnI,CAAC,CAAC;IACH,MAAM,SAAS,GACb,kBAAkB;QAClB,8CAA8C;QAC9C,iDAAiD;QACjD,wCAAwC;QACxC,8CAA8C;QAC9C,gDAAgD;QAChD,mDAAmD,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;IAChE,2FAA2F;IAC3F,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACzH,MAAM,SAAS,GACb,kBAAkB;QAClB,8HAA8H;QAC9H,wIAAwI;QACxI,gJAAgJ;QAChJ,gGAAgG,CAAC;IACnG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,mBAAmB,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,MAAM,CAAC,GAAG,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjK,MAAM,CAAC,GAAG,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/H,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,oBAAoB,CAAC,CAAC;AAC9E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,GAAG,EAAE;IAC3G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC3G,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACnK,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+JAA+J,EAAE,GAAG,EAAE;IACzK,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,iBAAiB,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,EAAE,EAAE,aAAa,CAAC,CAAC;IAC1N,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC3E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,6BAA6B,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,KAAc,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9F,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,GAAG,EAAE;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,2BAA2B,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;IAChH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,EAAE,qBAAqB,CAAC,CAAC;IACnE,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,oBAAoB,CAAC,CAAC;IAC/H,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvF,iFAAiF;IACjF,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG;QACd,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE;QACzC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE;KACzC,CAAC;IACF,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,4DAA4D,CAAC,CAAC;IACjI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,MAAM,CAAC,EAAE,CAAC,2BAA2B,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,oBAAoB,CAAC,CAAC;AAC7H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,GAAG,EAAE;IACpF,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,gBAAgB,CAAC,CAAC;IACrE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,qBAAqB,CAAC,CAAC;IAC5E,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,EAAE,qBAAqB,CAAC,CAAC;IACpE,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,EAAE,kBAAkB,CAAC,CAAC;IACvE,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kEAAkE,EAAE,GAAG,EAAE;IAC5E,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,kBAAkB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IACpG,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,yBAAyB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1H,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;IAChH,KAAK,MAAM,GAAG,IAAI,CAAC,EAAE,EAAE,uBAAuB,EAAE,iBAAiB,EAAE,WAAW,EAAE,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,KAAK,CAAC,EAAE,CAAC;QAChL,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,uBAAuB,CAAC,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAC,CAAC;IAC5G,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC3D,MAAM,MAAM,GAAG,qBAAqB,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/E,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC;AAC5D,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sFAAsF,EAAE,GAAG,EAAE;IAChG,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,4BAA4B,EAAE,CAAC,EAAE;QAC/G,aAAa,EAAE,CAAC,KAAK,CAAC;QACtB,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;KACzC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;IAC9G,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAChH,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,IAAa,EAAE,CAAC,EAAE,aAAa,CAAC,CAAC;IAC/G,sFAAsF;IACtF,MAAM,CAAC,GAAG,qBAAqB,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;IAChF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;IAChE,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;IACnI,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC,EAAE;QACtJ,aAAa,EAAE,CAAC,KAAK,CAAC;QACtB,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0DAA0D,EAAE,GAAG,EAAE;IACpE,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IACjF,MAAM,CAAC,SAAS,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAC7H,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,wIAAwI,EAAE,GAAG,EAAE;IAClJ,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAG,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAE,EAAE,8EAA8E,CAAC,CAAC;IAC3G,8FAA8F;IAC9F,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,sEAAsE;IACtE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACrH,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACzH,8CAA8C;IAC9C,MAAM,CAAC,SAAS,CAAC,sBAAsB,CAAC,EAAE,aAAa,EAAE,CAAC,QAAQ,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACnI,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iHAAiH,EAAE,GAAG,EAAE;IAC3H,MAAM,IAAI,GAAG;QACX,IAAI,EAAE,IAAI;QACV,eAAe,EAAE,uBAAuB;QACxC,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG;QACtC,QAAQ,EAAE,CAAC,cAAc,CAAC;KAC3B,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3I,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACzG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpG,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AACtF,CAAC,CAAC,CAAC"}