@appforge-ci/core 0.2.3 → 0.3.1

package/dist/ssh-deploy-key.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-deploy-key.test.js","sourceRoot":"","sources":["../src/ssh-deploy-key.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,MAAM,qBAAqB,CAAC;AAC5J,OAAO,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAChI,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;AAE3E,SAAS,OAAO;IACd,0EAA0E;IAC1E,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,IAAI,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;IACzH,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,+FAA+F,CAAC,CAAC;IAC5H,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAC;IAClF,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,4BAA4B,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;IACrE,iEAAiE;IACjE,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3D,yDAAyD;IACzD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;AAC7F,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;IAChG,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,yFAAyF,EAAE,GAAG,EAAE;IACnG,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,iCAAiC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,KAAK,MAAM,OAAO,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,mCAAmC,CAAC,EAAE,CAAC;QAC7E,MAAM,GAAG,GAAG,iCAAiC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,GAAG,GAAG,kBAAkB,CAAC,MAAM,CAAC;QACpC,MAAM,GAAG,GAAG,GAAG,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC;YAClD,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC;YACf,OAAO,GAAG,CAAC;QACb,CAAC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;QACnD,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,cAAc;QAC3D,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,wCAAwC,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;QACzF,6CAA6C;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9E,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,iCAAiC,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,UAAU,CAAC,CAAC;IACjG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qFAAqF,EAAE,GAAG,EAAE;IAC/F,MAAM,IAAI,GAAG,sBAAsB,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,6BAA6B,CAAC,CAAC;IAC/F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACzC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,oDAAoD,CAAC,CAAC;AAC3E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;IACrF,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,CAAC,sCAAsC,CAAC,EAAE,IAAI,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,MAAM,oBAAoB,CAAC,qCAAqC,CAAC,EAAE,IAAI,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,sHAAsH,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE;IAC1J,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7B,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,wDAAwD;QACxD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACpC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,GAAG,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gGAAgG,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,IAAI,EAAE;IACpI,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACnC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QAC/F,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACvD,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,eAAe,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,OAAO,EAAE,CAAC;QAC5I,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/types.d.ts

@@ -1,8 +1,10 @@
+import type { SshHostKeyEntry } from "./vpn-ssh.js";
 /**
  * Shared domain types used by the API, dashboard, CLI, and agent.
  * These mirror (but do not import from) the Prisma schema in packages/db,
  * so packages that never need a DB connection don't need Prisma as a dep.
  */
+import type { VpnHostPolicy } from "./agent-readiness.js";
 export type Platform = "ios" | "android" | "flutter" | "react-native";
 export type BuildStatus = "queued" | "leased" | "running" | "succeeded" | "failed" | "canceled";
 export type AgentStatus = "online" | "offline" | "draining" | "building";
@@ -154,6 +156,53 @@ export interface Build {
      *  index-ordered. Empty when `smokeTest: true` wasn't set, or the
      *  smoke test itself couldn't run (no device/Simulator attached). */
     smokeTestResults: SmokeTestScreenshotResult[];
+    /** Whether this build ran through the org's site-to-site VPN — derived
+     *  from the build's `VpnEvent` rows. Only on `GET /builds/:id` (never on
+     *  list rows, which would be an N+1); optional so an older API or a list
+     *  row simply omits it. */
+    vpn?: BuildVpnStatus;
+}
+export type BuildVpnOutcome = "connected" | "failed" | "not_established" | "unknown";
+/** One line of a build's VPN timeline. `detail` is already secret-free. */
+export interface BuildVpnEvent {
+    type: VpnEventType;
+    detail: string | null;
+    createdAt: string;
+}
+/**
+ * The state of a strict-egress or regulated build's signed attestation (regulated-VPN program, PR-M): where the evidence stands, not the
+ * evidence itself. The document, bundle and printable page are `GET /orgs/:orgId/vpn/attestations/:id` (owner/admin).
+ */
+export interface BuildAttestationStatus {
+    id: string;
+    /** `pending`: expected, the agent has not reported (a degraded one follows 30 minutes after the build is seen finished). */
+    state: "pending" | "complete" | "degraded_server_observed";
+    completeness: "full" | "partial" | "server_observed_only" | null;
+    controlsVerdict: string | null;
+    /** Failing control tests recorded in it. */
+    violations: number;
+    /** A signature covers the document. False: it is registered in the audit chain but nothing authenticates it. */
+    signed: boolean;
+    issuedAt: string | null;
+}
+/** See `Build.vpn` and docs/vpn.md ("Seeing whether a build used the VPN"). */
+export interface BuildVpnStatus {
+    /** The build was actually leased with a tunnel (lock/handshake events exist). */
+    used: boolean;
+    /** The app's opt-in (`App.useVpn`) right now — it may have changed since the build ran. */
+    appOptedIn: boolean;
+    tunnelId: string | null;
+    /** The org's current tunnel name when it is the tunnel this build used. */
+    tunnelName: string | null;
+    tunnelStatus: VpnTunnelStatus | null;
+    outcome: BuildVpnOutcome;
+    /** When the handshake succeeded (`handshake_ok` event), if it did. */
+    handshakeAt?: string;
+    /** Short, secret-free human explanation (failure reason, or why unknown). */
+    detail?: string;
+    events?: BuildVpnEvent[];
+    /** Present only for a strict-egress or regulated build that has an attestation (or is expecting one). */
+    attestation?: BuildAttestationStatus;
 }
 /** Per-screenshot smoke-test state — see `Build.smokeTestResults`. */
 export interface SmokeTestScreenshotResult {
@@ -244,6 +293,33 @@ export interface AgentInfo {
      *  AND `vpnCapable` are 1. Changes via `PATCH .../vpn-approved` or
      *  `appforge-admin agents allow-vpn`. Optional for old APIs. */
     vpnApproved?: number;
+    /** JSON array text of the VPN feature ids the agent reported at its last
+     *  heartbeat (migrations/0043), '[]' for none — parse with
+     *  `parseVpnFeatures`. Self-reported; derived from that one heartbeat.
+     *  Optional for old APIs. */
+    vpnFeatures?: string;
+    /** Build-isolation level the agent reported at its last heartbeat
+     *  ('none' | 'sandbox' | 'sandbox_uid', migrations/0043). Optional for old
+     *  APIs, which reads as 'none'. */
+    enforcementLevel?: "none" | "sandbox" | "sandbox_uid";
+    /** Operator-set taint (migrations/0043): when set, this Mac takes only that
+     *  org's builds. Never self-reported. Changes via `PATCH .../dedicated` or
+     *  `appforge-admin agents dedicate`. Optional for old APIs. */
+    dedicatedOrgId?: string | null;
+    /** Whether the Mac's last heartbeat found a GitHub Actions self-hosted
+     *  runner on the same machine (migrations/0047): 1 yes, 0 no, null never
+     *  reported / unknown. A Mac cannot be dedicated to an org unless this is 0.
+     *  Optional for old APIs. */
+    coHostedRunner?: number | null;
+    /** The display name of `dedicatedOrgId`'s org, resolved server-side for the
+     *  platform-admin fleet listing; null when it is not dedicated or the org no
+     *  longer resolves (show the id then). Optional for old APIs. */
+    dedicatedOrgName?: string | null;
+    /** Which orgs' tunnels this Mac is pinned to (`VpnTunnelHostPin`,
+     *  migrations/0047), with each tunnel's placement policy. Platform-admin
+     *  view only: customers never see machine identities. Empty for an unpinned
+     *  Mac. Optional for old APIs. */
+    vpnPins?: AgentVpnPin[];
     cpuUsagePercent: number;
     memUsagePercent: number;
     diskFreeGb: number;
@@ -260,6 +336,15 @@ export interface AgentInfo {
     activeBuildIds: string;
     lastSeenAt: string;
 }
+/** One tunnel a Mac is pinned to, as the fleet listing shows it. */
+export interface AgentVpnPin {
+    /** The org that owns the tunnel. */
+    orgId: string;
+    /** That org's display name; null when it no longer resolves. */
+    orgName: string | null;
+    /** The tunnel's placement policy ('pinned' or 'dedicated' while pins matter; 'shared' means the pin is currently inert). */
+    hostPolicy: VpnHostPolicy;
+}
 export type AgentCommandType = "DRAIN" | "RESUME" | "REBOOT_HOST" | "RESTART_AGENT" | "RUN_MAINTENANCE_SCRIPT" | "UPDATE_AGENT" | "CANCEL_BUILD";
 export interface AgentCommand {
     id: string;
@@ -482,6 +567,36 @@ export interface VpnTunnel {
      *  admin can turn it on. Optional so a client built before it existed
      *  still type-checks against a newer server. */
     allowPrivateEndpoint?: boolean;
+    /** `standard` (default) or `regulated` (migrations/0045). `regulated` needs
+     *  `strictEgress` and is refused unless the operator has turned the feature
+     *  on; it also requires a Mac that has proven its kernel build sandbox (the
+     *  lease then carries `sandbox`), so with none a regulated tunnel's builds wait. Optional so a client
+     *  built before it existed still type-checks against a newer server. */
+    complianceMode?: "standard" | "regulated";
+    /** Strict egress (migrations/0045): public destinations are reachable only if
+     *  they match `egressPresets` + `egressAllow`. Optional like `complianceMode`. */
+    strictEgress?: boolean;
+    /** Preset ids (`VPN_EGRESS_PRESETS` in vpn-egress-presets.ts), sorted. */
+    egressPresets?: string[];
+    /** Custom allow-list entries, merged and sorted (one per host, explicit ports). */
+    egressAllow?: VpnEgressRule[];
+    /** Where this tunnel's builds may run (migrations/0047): `shared` (any
+     *  approved VPN-capable Mac, the default), `pinned` (only the Macs the
+     *  operator pinned to it) or `dedicated` (pinned, and each Mac dedicated to
+     *  this org with no co-hosted GitHub Actions runner). Read-only for org
+     *  admins: only an AppForge platform admin changes it. Optional so a client
+     *  built before it existed still type-checks against a newer server. */
+    hostPolicy?: VpnHostPolicy;
+    /** How many Macs the operator pinned to this tunnel. Count only: the fleet's
+     *  machine identities are not shown to customers. Optional like `hostPolicy`. */
+    pinnedHostCount?: number;
+    /** Pinned SSH host keys (migrations/0048): known_hosts lines for the customer's git/ssh servers, with
+     *  no trust-on-first-use. Public data. Empty = no ssh through this tunnel. Optional so a client built
+     *  before it existed still type-checks against a newer server. */
+    sshKnownHosts?: string[];
+    /** The same keys with SHA-256 fingerprints computed server-side, for the customer to compare with
+     *  what their server prints (`ssh-keygen -lf <host key>.pub`). */
+    sshHostKeys?: SshHostKeyEntry[];
     /** AppForge's side's public key — what the customer adds to their gateway. */
     publicKey: string;
     keyVersion: number;
@@ -489,6 +604,35 @@ export interface VpnTunnel {
     createdAt: string;
     updatedAt: string;
 }
+/**
+ * One Mac pinned to a tunnel, as the operator sees it
+ * (`GET /orgs/:orgId/vpn-hosts/:tunnelOrgId` on the admin API). `ready` is the
+ * same predicate the scheduler and the wait-timeout sweep apply, so "ready"
+ * here means "a build for this tunnel can be leased to it right now".
+ */
+export interface VpnPinnedHost {
+    agentId: string;
+    name: string;
+    ready: boolean;
+    /** Why it is not ready (empty when ready): short operator-facing phrases. */
+    notReadyReasons: string[];
+    vpnApproved: boolean;
+    dedicatedOrgId: string | null;
+    coHostedRunner: number | null;
+    lastSeenAt: string;
+}
+/** A tunnel's host placement as the operator sees it (platform admins only). */
+export interface VpnHostPlacement {
+    tunnelId: string;
+    orgId: string;
+    tunnelName: string;
+    tunnelStatus: VpnTunnelStatus;
+    hostPolicy: VpnHostPolicy;
+    hosts: VpnPinnedHost[];
+    /** Operator-facing warnings about the current setup, e.g. a non-shared policy
+     *  with no ready host (its builds would fail after the wait timeout). */
+    warnings: string[];
+}
 /** What an org admin pastes into their own gateway. Contains the
  *  preshared key, so it is returned only to org owners/admins. */
 export interface VpnPeerConfig {
@@ -502,6 +646,17 @@ export interface VpnPeerConfig {
     /** The source address AppForge's builds appear from inside the tunnel. */
     localAddress: string;
 }
+/** An app's git deploy key as shown to a client (migrations/0048). Only the PUBLIC key ever leaves the server. */
+export interface AppDeployKeyInfo {
+    /** `ssh-ed25519 <base64> <comment>`: what the customer installs on their git server (read-only is enough). */
+    publicKey: string;
+    /** `SHA256:<base64>` of the public key. */
+    fingerprint: string;
+    /** Starts at 1, +1 on every rotation: a rotated key must be re-installed on the git server. */
+    keyVersion: number;
+    createdAt: string;
+    rotatedAt: string | null;
+}
 export type VpnEventType = "tunnel_created" | "tunnel_updated" | "tunnel_deleted" | "key_rotated" | "lock_acquired" | "lock_released" | "tunnel_up" | "tunnel_down" | "handshake_ok" | "handshake_failed";
 export interface VpnEvent {
     id: string;
@@ -536,11 +691,60 @@ export interface VpnJobConfig {
     lanCidrs: string[];
     dnsServer: string | null;
     allowedDomains: string[];
+    /** The tunnel's display name, for the one human-readable line the agent
+     *  writes into the build log. Optional: an older server omits it. */
+    tunnelName?: string;
     /** Lab mode (`VpnTunnel.allowPrivateEndpoint`): the agent re-checks the
      *  resolved gateway address against the narrower forbidden set (loopback,
      *  link-local, multicast/reserved, 0.0.0.0/8) instead of requiring a public
      *  one. Optional so an older server (field absent => false) and an older
      *  agent (ignores it => stricter, fails closed) both interoperate. */
     allowPrivateEndpoint?: boolean;
+    /** Strict egress policy. PRESENT => the helper enforces it: public
+     *  destinations are reachable only if host and port match `allow` (default
+     *  port 443), RFC1918/CGNAT/ULA outside `lanCidrs` are refused, and every
+     *  address a name resolves to must be public. `{ allow: [] }` is tunnel-only.
+     *  ABSENT => the standard engine (still refuses loopback, link-local, etc.).
+     *  The control plane expands presets into concrete hosts; the helper never
+     *  sees a preset name. A helper that predates this field ignores it and would
+     *  NOT enforce it, so the agent compares the policy hash the helper echoes
+     *  with `vpnEgressPolicyHash` (vpn-egress.ts) and fails the start on a mismatch
+     *  or a missing hash. An agent that predates the field cannot check, so a
+     *  tunnel with strict egress REQUIRES the `egress-policy-v1` agent feature
+     *  (`vpnTunnelRequirements`, agent-readiness.ts): the scheduler leases it only
+     *  to a Mac reporting that feature, and the lease's `requires` makes the agent
+     *  abort a job it cannot honour. Present only for a strict tunnel
+     *  (apps/admin-api lib/vpn-job.ts). */
+    egress?: VpnEgressPolicy;
+    /** Public SSH host keys of the customer's servers: known_hosts lines
+     *  (`host[,host...] <keytype> <base64> [comment]`) or `@cert-authority`
+     *  lines, validated by `sanitizeKnownHosts` (vpn-ssh.ts). Pinned for ssh
+     *  inside a VPN build (`ssh://` git remotes, scp, rsync): no
+     *  trust-on-first-use, so once ssh is wired up for a build (it is when the
+     *  tunnel has host keys or a deploy key) a connection to a host with no
+     *  registered key is refused. Public data. Optional and absent from every lease today: a build
+     *  without it behaves exactly as before (ssh is not wired up at all). The
+     *  control plane must require the `ssh-v1` agent feature for any tunnel that
+     *  sends it, because an agent that predates it would ignore the field. NOT
+     *  part of the helper's job (the agent strips it) nor of the agent's tunnel
+     *  config fingerprint (rotating it must not restart a shared helper). */
+    sshKnownHosts?: string[];
+    /** OpenSSH/PEM private key used as the build's ssh identity (a git deploy
+     *  key). A secret like the WireGuard keys: only in the lease response; the
+     *  agent loads it into a per-build `ssh-agent` over stdin (never to disk),
+     *  destination-constrained to the hosts pinned under a concrete name (the
+     *  build fails if there is none), and tears it down with the
+     *  build. Same optionality and `ssh-v1` requirement as `sshKnownHosts`. */
+    sshDeployKey?: string;
+}
+/** One strict-egress allow-list entry. `host` is an exact ASCII/punycode
+ *  hostname or `*.suffix` (proper subdomains only); `ports` defaults to [443]. */
+export interface VpnEgressRule {
+    host: string;
+    ports?: number[];
+}
+/** The `egress` block of `VpnJobConfig`. See `validateVpnEgressPolicy` (vpn-egress.ts). */
+export interface VpnEgressPolicy {
+    allow: VpnEgressRule[];
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC;AAEtE,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,QAAQ,GACR,UAAU,CAAC;AAEf,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;6BAKyB;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;8BAK0B;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;2EACuE;IACvE,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;2CAMuC;IACvC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAEzD,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB;;6CAEyC;IACzC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;2EAC2E;AAC3E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;sEAGkE;IAClE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;6DAIyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB;;kEAE8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;uEAEuE;AACvE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;;sCAOkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C;;;;6DAIyD;IACzD,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;yEAIqE;IACrE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;CAC/C;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;+DAE2D;IAC3D,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;sDAGkD;IAClD,SAAS,EAAE,OAAO,CAAC;IACnB;;;mBAGe;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;gEAE4D;IAC5D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;4EAGwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;kEAK8D;IAC9D,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;;;;;;;qCAUiC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;sEAEkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;oEAGgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;uEAEmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;kEAG8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,QAAQ,GACR,aAAa,GACb,eAAe,GACf,wBAAwB,GACxB,cAAc,GACd,cAAc,CAAC;AAEnB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;oFACgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;iDAI6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;6DAMyD;IACzD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;0DAKsD;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;gEAEgE;AAChE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;gDAE4C;IAC5C,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;yEAGqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KAC7B,CAAC;IACF,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;+CAG+C;AAC/C,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAKlE,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,EAKlC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAsC,CAAC;AAE9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS;;;;;QArC1C,MAAM;WACH,MAAM;YACL,MAAM;gBACF,MAAM;EA0CnB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEnE;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;gFAC4E;IAC5E,MAAM,EAAE,eAAe,CAAC;IACxB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB;;;oDAGgD;IAChD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;kEACkE;AAClE,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,eAAe,GACf,WAAW,GACX,aAAa,GACb,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB;wEACoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;0EAIsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD;;;;GAIG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,GAAG,cAAc,CAAC;AAEtE,MAAM,MAAM,WAAW,GACnB,QAAQ,GACR,QAAQ,GACR,SAAS,GACT,WAAW,GACX,QAAQ,GACR,UAAU,CAAC;AAEf,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAC;AAEzE,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;6BAKyB;IACzB,eAAe,EAAE,OAAO,CAAC;IACzB;;;;;8BAK0B;IAC1B,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;2EACuE;IACvE,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;2CAMuC;IACvC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAC;CACxC;AAED,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAEzD,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,CAAC;IACzB;;6CAEyC;IACzC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;2EAC2E;AAC3E,MAAM,MAAM,eAAe,GAAG,KAAK,CAAC;AAEpC,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,8DAA8D;IAC9D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;;sEAGkE;IAClE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,EAAE,eAAe,GAAG,IAAI,CAAC;CAC1C;AAED,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEjE,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,oBAAoB,CAAC;IAC7B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAC;CACpC;AAED,MAAM,WAAW,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB;;;;6DAIyD;IACzD,YAAY,EAAE,OAAO,CAAC;IACtB;;kEAE8D;IAC9D,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;uEAEuE;AACvE,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,MAAM,WAAW,KAAK;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,WAAW,CAAC;IACpB;;;;;;;sCAOkC;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C;;;;6DAIyD;IACzD,WAAW,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B;;;;yEAIqE;IACrE,gBAAgB,EAAE,yBAAyB,EAAE,CAAC;IAC9C;;;+BAG2B;IAC3B,GAAG,CAAC,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,QAAQ,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAErF,2EAA2E;AAC3E,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,4HAA4H;IAC5H,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,0BAA0B,CAAC;IAC3D,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,sBAAsB,GAAG,IAAI,CAAC;IACjE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,gHAAgH;IAChH,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,iFAAiF;IACjF,IAAI,EAAE,OAAO,CAAC;IACd,2FAA2F;IAC3F,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,eAAe,GAAG,IAAI,CAAC;IACrC,OAAO,EAAE,eAAe,CAAC;IACzB,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC;IACzB,yGAAyG;IACzG,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED,sEAAsE;AACtE,MAAM,WAAW,yBAAyB;IACxC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB;;+DAE2D;IAC3D,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACjC;;;sDAGkD;IAClD,SAAS,EAAE,OAAO,CAAC;IACnB;;;mBAGe;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CACvC;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB;;gEAE4D;IAC5D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB;;;4EAGwE;IACxE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B;;;;;kEAK8D;IAC9D,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;;;;;;;;;qCAUiC;IACjC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC;;sEAEkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;oEAGgE;IAChE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iCAG6B;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;uCAEmC;IACnC,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,aAAa,CAAC;IACtD;;mEAE+D;IAC/D,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;;iCAG6B;IAC7B,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;qEAEiE;IACjE,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC;;;sCAGkC;IAClC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B;;uEAEmE;IACnE,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;kEAG8D;IAC9D,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oEAAoE;AACpE,MAAM,WAAW,WAAW;IAC1B,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,gEAAgE;IAChE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4HAA4H;IAC5H,UAAU,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,MAAM,gBAAgB,GACxB,OAAO,GACP,QAAQ,GACR,aAAa,GACb,eAAe,GACf,wBAAwB,GACxB,cAAc,GACd,cAAc,CAAC;AAEnB,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,gBAAgB,CAAC;IACvB,yFAAyF;IACzF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;oFACgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;iDAI6C;IAC7C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;6DAMyD;IACzD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,CAAC;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;0DAKsD;IACtD,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED;;gEAEgE;AAChE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;gDAE4C;IAC5C,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;yEAGqE;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC/B,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,IAAI,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,EAAE,CAAA;SAAE,CAAC;KAC7B,CAAC;IACF,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IAC7C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,6EAA6E;IAC7E,GAAG,CAAC,EAAE;QACJ,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,OAAO,CAAC;KACrB,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,aAAa,EAAE,UAAU,GAAG,IAAI,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;uEAGuE;AACvE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AASD,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAC;AAE1F,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,YAAY,CAAC;IACrB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,iBAAiB,MAAM,CAAC;AAErC;;;+CAG+C;AAC/C,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAKlE,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAG7D;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACpB;AAWD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,SAAS,EAKlC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,QAAsC,CAAC;AAE9E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS;;;;;QArC1C,MAAM;WACH,MAAM;YACL,MAAM;gBACF,MAAM;EA0CnB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CAEnE;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAE5E;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb;gFAC4E;IAC5E,MAAM,EAAE,eAAe,CAAC;IACxB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB;;;oDAGgD;IAChD,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;4EAIwE;IACxE,cAAc,CAAC,EAAE,UAAU,GAAG,WAAW,CAAC;IAC1C;sFACkF;IAClF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,0EAA0E;IAC1E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,mFAAmF;IACnF,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;IAC9B;;;;;4EAKwE;IACxE,UAAU,CAAC,EAAE,aAAa,CAAC;IAC3B;qFACiF;IACjF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;sEAEkE;IAClE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;sEACkE;IAClE,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;IAChC,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,eAAe,CAAC;IAC9B,UAAU,EAAE,aAAa,CAAC;IAC1B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB;6EACyE;IACzE,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;kEACkE;AAClE,MAAM,WAAW,aAAa;IAC5B,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,cAAc,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,kHAAkH;AAClH,MAAM,WAAW,gBAAgB;IAC/B,8GAA8G;IAC9G,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,+FAA+F;IAC/F,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GACpB,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,eAAe,GACf,WAAW,GACX,aAAa,GACb,cAAc,GACd,kBAAkB,CAAC;AAEvB,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB;wEACoE;IACpE,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;yEACqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;0EAIsE;IACtE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;;;;2CAcuC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB;;;;;;;;;;;6EAWyE;IACzE,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;+EAK2E;IAC3E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;kFACkF;AAClF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,2FAA2F;AAC3F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,aAAa,EAAE,CAAC;CACxB"}

package/dist/types.js

@@ -1,8 +1,3 @@
-/**
- * Shared domain types used by the API, dashboard, CLI, and agent.
- * These mirror (but do not import from) the Prisma schema in packages/db,
- * so packages that never need a DB connection don't need Prisma as a dep.
- */
 /**
  * Billing runs on tokens, not direct EUR-per-build, specifically so a
  * bigger top-up can be cheaper per token without ever changing what a

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAubH;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;+CAG+C;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAA6B;IACrE,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,cAAc,EAAE,iBAAiB;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAa,CAAC;IAC1D,OAAO,6BAA6B,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC;AACtE,CAAC;AASD,SAAS,kBAAkB,CAAC,IAAe;IACzC,OAAO,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,4GAA4G;AAC5G,SAAS,eAAe,CAAC,IAAe,EAAE,iBAAyB;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,GAAG,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,iCAAiC;IACxG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,8BAA8B;IACnG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,gCAAgC;IACrG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,iCAAiC;CAC1G,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,UAAU,GAAG,GAAG;QAC/B,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,CAAC;QAC5C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC;QAC3D,eAAe,EAAE,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AAClD,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAshBA;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAErC;;;+CAG+C;AAC/C,MAAM,CAAC,MAAM,6BAA6B,GAA6B;IACrE,GAAG,EAAE,iBAAiB;IACtB,OAAO,EAAE,iBAAiB;IAC1B,OAAO,EAAE,iBAAiB;IAC1B,cAAc,EAAE,iBAAiB;CAClC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB;IACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAa,CAAC;IAC1D,OAAO,6BAA6B,CAAC,QAAQ,CAAC,IAAI,iBAAiB,CAAC;AACtE,CAAC;AASD,SAAS,kBAAkB,CAAC,IAAe;IACzC,OAAO,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC;AACvC,CAAC;AAED,4GAA4G;AAC5G,SAAS,eAAe,CAAC,IAAe,EAAE,iBAAyB;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,GAAG,iBAAiB,CAAC,GAAG,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAgB;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,iCAAiC;IACxG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,8BAA8B;IACnG,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,gCAAgC;IACrG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,iCAAiC;CAC1G,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,CAAC;AAE9E,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,OAAO;QACL,GAAG,IAAI;QACP,QAAQ,EAAE,IAAI,CAAC,UAAU,GAAG,GAAG;QAC/B,kBAAkB,EAAE,kBAAkB,CAAC,IAAI,CAAC;QAC5C,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,iBAAiB,CAAC;QAC3D,eAAe,EAAE,eAAe,CAAC,IAAI,EAAE,0BAA0B,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AAClD,CAAC"}

package/dist/vpn-attestation-workerd.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vpn-attestation-workerd.test.d.ts.map

package/dist/vpn-attestation-workerd.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-attestation-workerd.test.d.ts","sourceRoot":"","sources":["../src/vpn-attestation-workerd.test.ts"],"names":[],"mappings":""}

package/dist/vpn-attestation-workerd.test.js

@@ -0,0 +1,184 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { spawn } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { createServer } from "node:net";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { agentVpnEvidenceSchema, analyzeConnectionLog, attestationDocumentSha256, buildAttestationDocument, buildTunnelFacts, expandLeasedPolicy, renderEvidencePage, } from "./vpn-attestation.js";
+import { canonicalJson } from "./attestation.js";
+import { SANDBOX_PROFILE_VERSION } from "./vpn-sandbox.js";
+/**
+ * The attestation document is built and signed in the Workers runtime (apps/admin-api through @appforge/db) and verified
+ * under Node by the offline script, so the bytes the two runtimes produce from the same input must be identical. This runs
+ * the real module in workerd (the production engine, with the compatibility date admin-api deploys with) and compares its
+ * output, byte for byte, with Node's: the log analysis and its digest, the canonical document and its hash, and the printable
+ * page. Same harness as attestation-workerd.test.ts: skips locally when wrangler's workerd/esbuild cannot be loaded, and FAILS
+ * when CI is set.
+ */
+const COMPAT_DATE = "2025-04-01"; // apps/admin-api/wrangler.jsonc
+async function loadTooling() {
+    try {
+        const req = createRequire(import.meta.url);
+        const fromWrangler = createRequire(req.resolve("wrangler/package.json"));
+        const workerdMod = (await import(fromWrangler.resolve("workerd")));
+        const esbuild = (await import(fromWrangler.resolve("esbuild")));
+        const build = esbuild.build ?? esbuild.default?.build;
+        if (!build || typeof workerdMod.default !== "string")
+            return "workerd or esbuild did not expose the expected entry points";
+        return { workerd: workerdMod.default, build };
+    }
+    catch (err) {
+        return `wrangler's workerd/esbuild could not be loaded (${err instanceof Error ? err.message : String(err)})`;
+    }
+}
+function freePort() {
+    return new Promise((resolve, reject) => {
+        const srv = createServer();
+        srv.once("error", reject);
+        srv.listen(0, "127.0.0.1", () => {
+            const { port } = srv.address();
+            srv.close(() => resolve(port));
+        });
+    });
+}
+const WORKER_ENTRY = `
+import { analyzeConnectionLog, buildAttestationDocument, attestationDocumentSha256, renderEvidencePage, summariseConnections, agentVpnEvidenceSchema } from ${JSON.stringify(fileURLToPath(new URL("./vpn-attestation.ts", import.meta.url)))};
+import { canonicalJson } from ${JSON.stringify(fileURLToPath(new URL("./attestation.ts", import.meta.url)))};
+
+export default {
+  async fetch(request) {
+    const input = await request.json();
+    const analysis = await analyzeConnectionLog(input.log, input.buildId);
+    const evidence = agentVpnEvidenceSchema.parse(input.evidence);
+    const built = await buildAttestationDocument({ facts: input.facts, evidence, log: analysis, rawLog: { sha256: input.rawSha256, bytes: input.rawBytes } });
+    const bundle = { format: "appforge-evidence-bundle", version: 1, attestation: { doc: built.doc, signatures: [{ alg: "Ed25519", keyId: "0123456789abcdef", role: "server", signature: "AAAA" }] }, auditChain: { orgId: input.facts.orgId, anchor: null, entries: [], checkpoints: [] }, connectionLog: { encoding: "records", normalization: "appforge-conn-records-v1", records: analysis.records } };
+    return Response.json({
+      records: JSON.stringify(analysis.records),
+      destinations: JSON.stringify(analysis.destinations),
+      logSha256: analysis.logSha256,
+      reasons: analysis.incompleteReasons,
+      doc: canonicalJson(built.doc),
+      docSha256: await attestationDocumentSha256(built.doc),
+      completeness: built.completeness,
+      verdict: built.controlsVerdict,
+      html: await renderEvidencePage(bundle),
+      // Sorting of destinations and results must not depend on the runtime's locale data.
+      sorted: summariseConnections([{ dest: "10.0.0.1:443", route: "t", decision: "allow" }, { dest: "10.0.0.10:443", route: "t", decision: "allow" }, { dest: "z.example:443", route: "t", decision: "allow" }, { dest: "B.example:443", route: "t", decision: "allow" }]).map((d) => d.dest),
+    });
+  },
+};
+`;
+const BUILD = "bld_workerd";
+const conn = (bseq, over = {}) => JSON.stringify({ v: 1, type: "conn", seq: bseq, bseq, ts: "2026-10-02T14:00:00.123Z", buildId: BUILD, auth: "build", proto: "socks5", host: "pub.dev", port: 443, decision: "allow", reason: "allowlist", route: "direct", connected: true, bytesUp: 10 * bseq, bytesDown: 20 * bseq, durationMs: 5, ...over });
+test("the attestation document, its hash, the log analysis and the printable page are byte-identical in workerd and in Node", async (t) => {
+    const tooling = await loadTooling();
+    if (typeof tooling === "string") {
+        if (process.env.CI)
+            assert.fail(tooling);
+        t.skip(tooling);
+        return;
+    }
+    const lines = [conn(1), conn(2, { host: "10.20.0.5", route: "tunnel", reason: "lan" }), conn(3, { host: "z.example" }), conn(4, { host: "B.example", decision: "deny", reason: "not-in-allowlist", route: "none", connected: false, bytesUp: 0, bytesDown: 0 }), conn(5, { host: "2001:db8::1", port: 8443 })];
+    const tally = JSON.stringify({ v: 1, type: "summary", ts: "t", buildId: BUILD, reason: "unregistered", conns: 5, allowed: 4, denied: 1, connected: 4, failed: 0, bytesUp: 10 + 20 + 30 + 0 + 50, bytesDown: 20 + 40 + 60 + 0 + 100, dropped: 0, forcedClosed: 0, stream: true });
+    const log = lines.join("\n") + "\n" + tally + "\n";
+    const policy = await expandLeasedPolicy({ allow: [{ host: "pub.dev" }] });
+    const tunnel = await buildTunnelFacts({ tunnelId: "tun_1", tunnelName: "HQ", keyVersion: 1, gatewayEndpoint: "vpn.acme.example:51820", gatewayPublicKey: "A".repeat(43) + "=", tunnelCidr: "169.254.200.0/30", localAddress: "169.254.200.2", gatewayAddress: "169.254.200.1", lanCidrs: ["10.20.0.0/16"], dnsServer: null, allowedDomains: [], allowPrivateEndpoint: false, egress: { allow: [{ host: "pub.dev" }] } }, "B".repeat(43) + "=");
+    const facts = {
+        orgId: "org_acme", appId: "app_1", buildId: BUILD, workflow: "w <b>", branch: "main", commitSha: null, tunnelId: "tun_1", vpnClass: 2,
+        build: { status: "succeeded", failureKind: null, queuedAt: "2026-10-02T13:59:00Z", startedAt: "2026-10-02T14:00:06Z", finishedAt: "2026-10-02T14:03:42Z" },
+        agent: { id: "agt_1", version: "0.3.1", os: "macOS 15.2" }, lease: { leasedAt: "2026-10-02T14:00:03Z", policy: policy.policy, policyHash: policy.helperHash, tunnel },
+        events: [{ type: "lock_acquired", at: "2026-10-02T14:00:01Z" }, { type: "handshake_ok", at: "2026-10-02T14:00:05Z" }, { type: "lock_released", at: "2026-10-02T14:03:45Z" }],
+        chain: { headSeq: 3, headHash: "00".repeat(32), firstEventSeq: 1 }, issuedAt: "2026-10-02T14:03:50Z", manifests: { vpnRelease: null, agentRelease: null },
+    };
+    const evidence = {
+        v: 1, buildId: BUILD, agent: { version: "0.3.1", os: "macOS 15.2", arch: "arm64" }, outcome: { status: "succeeded" }, helper: { version: "0.3.1", sha256: "11".repeat(32), arch: "arm64" },
+        egress: { mode: "strict", policyHash: policy.helperHash }, tunnel: { configDigest: tunnel.configDigest },
+        sandbox: { profileVersion: SANDBOX_PROFILE_VERSION, templateSha256: "22".repeat(32), renderedSha256: "33".repeat(32), paramsSha256: "44".repeat(32), loopbackDenyPorts: [5900], orgId: "org_acme", selfTest: { verdict: "pass", counts: { pass: 2 }, startedAt: "2026-10-02T14:00:00.000Z", durationMs: 1234.6, results: [{ id: "net-direct-tcp", area: "network", title: "direct TCP", tier: "core", expect: "blocked", status: "pass", detail: "ok" }, { id: "files-config", area: "files", title: "read config", tier: "core", expect: "blocked", status: "pass" }] }, scope: "Seatbelt blocklist." },
+        connectionLog: { uploaded: true, sha256: "55".repeat(32), bytes: log.length, lines: 6, complete: true, incompleteReasons: [], summary: { total: 5, allowed: 4, denied: 1, connected: 4, failed: 0, bytesUp: 90, bytesDown: 220 } },
+    };
+    const rawSha256 = "55".repeat(32);
+    // Node's own result.
+    const analysis = await analyzeConnectionLog(log, BUILD);
+    const parsedEvidence = agentVpnEvidenceSchema.parse(evidence);
+    const built = await buildAttestationDocument({ facts, evidence: parsedEvidence, log: analysis, rawLog: { sha256: rawSha256, bytes: log.length } });
+    const bundle = { format: "appforge-evidence-bundle", version: 1, attestation: { doc: built.doc, signatures: [{ alg: "Ed25519", keyId: "0123456789abcdef", role: "server", signature: "AAAA" }] }, auditChain: { orgId: "org_acme", anchor: null, entries: [], checkpoints: [] }, connectionLog: { encoding: "records", normalization: "appforge-conn-records-v1", records: analysis.records } };
+    const built2 = await tooling.build({
+        stdin: { contents: WORKER_ENTRY, resolveDir: fileURLToPath(new URL(".", import.meta.url)), sourcefile: "worker-entry.js", loader: "js" },
+        bundle: true,
+        format: "esm",
+        platform: "neutral",
+        target: "es2022",
+        write: false,
+        logLevel: "silent",
+        plugins: [
+            {
+                name: "ts-js-specifiers",
+                setup(b) {
+                    const src = fileURLToPath(new URL(".", import.meta.url));
+                    b.onResolve({ filter: /^\.\.?\/.*\.js$/ }, (args) => {
+                        if (!args.resolveDir.startsWith(src.replace(/\/$/, "")))
+                            return undefined;
+                        return { path: fileURLToPath(new URL(args.path.replace(/\.js$/, ".ts"), `file://${args.resolveDir}/`)) };
+                    });
+                },
+            },
+        ],
+    });
+    const dir = mkdtempSync(join(tmpdir(), "appforge-workerd-att-"));
+    let child;
+    try {
+        writeFileSync(join(dir, "worker.mjs"), built2.outputFiles[0].text);
+        const port = await freePort();
+        writeFileSync(join(dir, "config.capnp"), `using Workerd = import "/workerd/workerd.capnp";
+const config :Workerd.Config = (
+  services = [(name = "main", worker = .w)],
+  sockets = [(name = "http", address = "127.0.0.1:${port}", http = (), service = "main")]
+);
+const w :Workerd.Worker = (
+  modules = [(name = "worker", esModule = embed "worker.mjs")],
+  compatibilityDate = "${COMPAT_DATE}",
+);
+`);
+        child = spawn(tooling.workerd, ["serve", "config.capnp"], { cwd: dir, stdio: ["ignore", "pipe", "pipe"] });
+        let outLog = "";
+        child.stdout?.on("data", (d) => (outLog += d.toString()));
+        child.stderr?.on("data", (d) => (outLog += d.toString()));
+        let res;
+        const body = JSON.stringify({ log, buildId: BUILD, facts, evidence, rawSha256, rawBytes: log.length });
+        for (let i = 0; i < 100 && !res; i++) {
+            try {
+                res = await fetch(`http://127.0.0.1:${port}/`, { method: "POST", body });
+            }
+            catch {
+                if (child.exitCode !== null)
+                    assert.fail(`workerd exited early: ${outLog}`);
+                await new Promise((r) => setTimeout(r, 100));
+            }
+        }
+        assert.ok(res, `workerd never answered: ${outLog}`);
+        const text = await res.text();
+        assert.equal(res.status, 200, outLog + text);
+        const out = JSON.parse(text);
+        assert.equal(out.records, JSON.stringify(analysis.records), "the normalised records are identical");
+        assert.equal(out.destinations, JSON.stringify(analysis.destinations));
+        assert.equal(out.logSha256, analysis.logSha256, "the records digest the document commits to is identical");
+        assert.deepEqual(out.reasons, analysis.incompleteReasons);
+        assert.equal(out.doc, canonicalJson(built.doc), "the canonical document (what is signed) is identical");
+        assert.equal(out.docSha256, await attestationDocumentSha256(built.doc));
+        assert.equal(out.completeness, built.completeness);
+        assert.equal(out.verdict, built.controlsVerdict);
+        assert.equal(out.html, await renderEvidencePage(bundle), "the printable page is identical");
+        assert.deepEqual(out.sorted, ["10.0.0.10:443", "10.0.0.1:443", "B.example:443", "z.example:443"], "code-unit order in workerd too");
+        // And the page workerd wrote is what the verifier's own renderer produces from its embedded JSON.
+        const V = (await import(new URL("../../../scripts/appforge-verify.mjs", import.meta.url).href));
+        assert.deepEqual(V.renderCheck(out.html), []);
+    }
+    finally {
+        child?.kill("SIGKILL");
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=vpn-attestation-workerd.test.js.map

package/dist/vpn-attestation-workerd.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vpn-attestation-workerd.test.js","sourceRoot":"","sources":["../src/vpn-attestation-workerd.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,wBAAwB,EACxB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,GAGnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D;;;;;;;GAOG;AAEH,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,gCAAgC;AAMlE,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAyB,CAAC;QAC3F,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAwE,CAAC;QACvI,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;QACtD,IAAI,CAAC,KAAK,IAAI,OAAO,UAAU,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,6DAA6D,CAAC;QAC3H,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,mDAAmD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;IAChH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,EAAsB,CAAC;YACnD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,YAAY,GAAG;8JACyI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;gCAC7M,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;CAwB1G,CAAC;AAEF,MAAM,KAAK,GAAG,aAAa,CAAC;AAC5B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,OAAgC,EAAE,EAAE,EAAE,CAChE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AAElT,IAAI,CAAC,uHAAuH,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxI,MAAM,OAAO,GAAG,MAAM,WAAW,EAAE,CAAC;IACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/S,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjR,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,eAAe,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC;IAC/a,MAAM,KAAK,GAA2B;QACpC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACrI,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,SAAS,EAAE,sBAAsB,EAAE,UAAU,EAAE,sBAAsB,EAAE;QAC1J,KAAK,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE;QACrK,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,EAAE,sBAAsB,EAAE,CAAC;QAC5K,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,sBAAsB,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;KAC1J,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1L,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;QACxG,OAAO,EAAE,EAAE,cAAc,EAAE,uBAAuB,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,iBAAiB,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,qBAAqB,EAAE;QACxkB,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;KACnO,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAElC,qBAAqB;IACrB,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnJ,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EAA+B,CAAC;IAE7Z,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE;QACxI,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,QAAQ;QAChB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE;YACP;gBACE,IAAI,EAAE,kBAAkB;gBACxB,KAAK,CAAC,CAAkJ;oBACtJ,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;oBACzD,CAAC,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;wBAClD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;4BAAE,OAAO,SAAS,CAAC;wBAC1E,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,CAAC;oBAC3G,CAAC,CAAC,CAAC;gBACL,CAAC;aACF;SACF;KACF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC,CAAC;IACjE,IAAI,KAA+B,CAAC;IACpC,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC9B,aAAa,CACX,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EACzB;;;oDAG8C,IAAI;;;;yBAI/B,WAAW;;CAEnC,CACI,CAAC;QACF,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC3G,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAClE,IAAI,GAAyB,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvG,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,oBAAoB,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI;oBAAE,MAAM,CAAC,IAAI,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;gBAC5E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,2BAA2B,MAAM,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAQ,CAAC;QACpC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACpG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,yDAAyD,CAAC,CAAC;QAC3G,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,sDAAsD,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,kBAAkB,CAAC,MAAM,CAAC,EAAE,iCAAiC,CAAC,CAAC;QAC5F,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,CAAC,EAAE,gCAAgC,CAAC,CAAC;QACpI,kGAAkG;QAClG,MAAM,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,GAAG,CAAC,sCAAsC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAQ,CAAC;QACvG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC,CAAC,CAAC"}