@hasna/uptime 0.1.22 → 0.1.24

package/dist/cli/index.js

@@ -2813,8 +2813,9 @@ async function runMonitorCheck(monitor, options = {}) {
   }
   if (monitor.kind === "browser_page")
     return runBrowserPageCheck(monitor, { fetch: options.fetch, runner: options.browserPage });
-  if (monitor.kind === "tcp")
-    return runTcpCheck(monitor);
+  if (monitor.kind === "tcp") {
+    return options.hostedTargetPolicy ? runHostedTcpCheck(monitor, { resolveHost: options.resolveHost }) : runTcpCheck(monitor);
+  }
   return { status: "down", latencyMs: null, error: `unsupported monitor kind: ${monitor.kind ?? "unknown"}` };
 }
 async function runHttpCheck(monitor, fetchImpl = fetch) {
@@ -2926,9 +2927,30 @@ async function runHostedHttpCheck(monitor, options = {}) {
 async function runTcpCheck(monitor) {
   if (!monitor.host || !monitor.port)
     return { status: "down", latencyMs: null, error: "missing host or port" };
+  return runTcpSocket(monitor.host, monitor.port, monitor.timeoutMs);
+}
+async function runHostedTcpCheck(monitor, options = {}) {
+  if (!monitor.host || !monitor.port)
+    return { status: "down", latencyMs: null, error: "missing host or port" };
+  const resolver = options.resolveHost ?? resolveHostedHost;
+  try {
+    const addresses = normalizeResolvedAddresses(await resolver(normalizeHostedHost(monitor.host)));
+    assertHostedResolvedAddressesAllowed(monitor.host, addresses, "TCP resolved address");
+    const address = addresses[0];
+    return runTcpSocket(address.address, monitor.port, monitor.timeoutMs, address.family);
+  } catch (error) {
+    return {
+      status: "down",
+      latencyMs: null,
+      statusCode: null,
+      error: error instanceof Error ? error.message : String(error)
+    };
+  }
+}
+async function runTcpSocket(host, port, timeoutMs, family) {
   const started = performance.now();
   return new Promise((resolve) => {
-    const socket = net2.createConnection({ host: monitor.host, port: monitor.port, timeout: monitor.timeoutMs });
+    const socket = net2.createConnection({ host, port, timeout: timeoutMs, family });
     let settled = false;
     const finish = (result) => {
       if (settled)
@@ -3344,7 +3366,7 @@ function previewRecord(store, source, record, defaults, options) {
     };
   }
   const monitorOptions = options.workspaceId ? { workspaceId: options.workspaceId } : undefined;
-  const rawProvenance = store.getProvenance(candidate.source, candidate.sourceId);
+  const rawProvenance = store.getProvenance(candidate.source, candidate.sourceId, monitorOptions);
   const provenanceMonitor = rawProvenance ? store.getMonitor(rawProvenance.monitorId, monitorOptions) : null;
   const provenance = provenanceMonitor ? rawProvenance : null;
   const monitor = provenanceMonitor ?? store.getMonitor(candidate.name, monitorOptions);
@@ -3816,7 +3838,7 @@ var REQUIRED_TABLES = [
 ];
 var PROBE_TABLES = new Set(["probe_identities", "probe_check_jobs", "probe_submissions"]);
 var REPORT_AUDIT_TABLES = new Set(["report_schedules", "report_runs", "audit_events"]);
-var CURRENT_SCHEMA_VERSION = "4";
+var CURRENT_SCHEMA_VERSION = "5";
 
 class StaleCheckResultError extends Error {
   constructor(message) {
@@ -3929,15 +3951,17 @@ class UptimeStore {
     `);
     this.db.run(`
       CREATE TABLE IF NOT EXISTS monitor_provenance (
+        workspace_id TEXT NOT NULL DEFAULT 'local',
         monitor_id TEXT NOT NULL REFERENCES monitors(id) ON DELETE CASCADE,
         source TEXT NOT NULL,
         source_id TEXT NOT NULL,
         source_label TEXT,
         imported_at TEXT NOT NULL,
         snapshot_json TEXT NOT NULL,
-        PRIMARY KEY (source, source_id)
+        PRIMARY KEY (workspace_id, source, source_id)
       )
     `);
+    this.ensureMonitorProvenanceWorkspaceScoped();
     this.db.run(`
       CREATE TABLE IF NOT EXISTS import_batches (
         id TEXT PRIMARY KEY,
@@ -4029,6 +4053,7 @@ class UptimeStore {
     this.db.run(`
       CREATE TABLE IF NOT EXISTS audit_events (
         id TEXT PRIMARY KEY,
+        workspace_id TEXT,
         action TEXT NOT NULL,
         resource_type TEXT,
         resource_id TEXT,
@@ -4038,6 +4063,7 @@ class UptimeStore {
         created_at TEXT NOT NULL
       )
     `);
+    this.ensureColumn("audit_events", "workspace_id", "TEXT");
     this.db.run(`
       CREATE TABLE IF NOT EXISTS schema_migrations (
         key TEXT PRIMARY KEY,
@@ -4051,6 +4077,7 @@ class UptimeStore {
     this.db.run("CREATE INDEX IF NOT EXISTS idx_incidents_monitor_status ON incidents(monitor_id, status)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_check_leases_until ON check_leases(leased_until)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_monitor_provenance_monitor ON monitor_provenance(monitor_id)");
+    this.db.run("CREATE INDEX IF NOT EXISTS idx_monitor_provenance_workspace_source ON monitor_provenance(workspace_id, source, source_id)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_probe_jobs_status_due ON probe_check_jobs(status, due_at)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_probe_jobs_probe_status ON probe_check_jobs(claimed_by_probe_id, status)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_probe_submissions_probe_time ON probe_submissions(probe_id, submitted_at DESC)");
@@ -4059,6 +4086,7 @@ class UptimeStore {
     this.db.run("CREATE INDEX IF NOT EXISTS idx_report_schedules_due ON report_schedules(enabled, next_run_at)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_report_runs_schedule_time ON report_runs(schedule_id, started_at DESC)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_audit_events_resource_time ON audit_events(resource_type, resource_id, created_at DESC)");
+    this.db.run("CREATE INDEX IF NOT EXISTS idx_audit_events_workspace_time ON audit_events(workspace_id, created_at DESC)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_audit_events_time ON audit_events(created_at DESC)");
   }
   backup(destinationPath) {
@@ -4108,6 +4136,9 @@ class UptimeStore {
     const normalized = normalizeCreateMonitor(input, options.allowBrowserPage === true);
     if (this.mode === "hosted")
       assertHostedTargetAllowed(normalized);
+    if (this.mode === "hosted" && normalized.kind === "browser_page" && normalized.enabled !== false) {
+      throw new Error("hosted browser_page monitors must remain disabled until browser evidence workers are configured");
+    }
     const now = new Date().toISOString();
     const workspaceId = normalizeWorkspaceId(options.workspaceId ?? input.workspaceId ?? "local");
     const monitor = {
@@ -4172,6 +4203,9 @@ class UptimeStore {
     const next = normalizeUpdateMonitor(current, input, updatedAt, options.allowBrowserPage === true);
     if (this.mode === "hosted")
       assertHostedTargetAllowed(next);
+    if (this.mode === "hosted" && next.kind === "browser_page" && next.enabled) {
+      throw new Error("hosted browser_page monitors must remain disabled until browser evidence workers are configured");
+    }
     this.db.query(`UPDATE monitors SET
           name = ?, kind = ?, url = ?, host = ?, port = ?, method = ?,
           expected_status = ?, interval_seconds = ?, timeout_ms = ?,
@@ -4468,8 +4502,10 @@ class UptimeStore {
     const action = normalizeAuditText(input.action, "Audit action", 160);
     const createdAt = input.createdAt ?? new Date().toISOString();
     assertIsoTimestamp(createdAt, "Audit event createdAt");
+    const workspaceId = input.workspaceId == null ? null : normalizeWorkspaceId(input.workspaceId);
     const event = {
       id: newId("aud"),
+      workspaceId,
       action,
       resourceType: normalizeNullableAuditText(input.resourceType, "Audit resourceType", 80),
       resourceId: normalizeNullableAuditText(input.resourceId, "Audit resourceId", 160),
@@ -4479,13 +4515,17 @@ class UptimeStore {
       createdAt
     };
     this.db.query(`INSERT INTO audit_events (
-          id, action, resource_type, resource_id, message, metadata_json, actor, created_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`).run(event.id, event.action, event.resourceType, event.resourceId, event.message, JSON.stringify(event.metadata), event.actor, event.createdAt);
+          id, workspace_id, action, resource_type, resource_id, message, metadata_json, actor, created_at
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(event.id, event.workspaceId, event.action, event.resourceType, event.resourceId, event.message, JSON.stringify(event.metadata), event.actor, event.createdAt);
     return event;
   }
   listAuditEvents(options = {}) {
     const clauses = [];
     const args = [];
+    if (options.workspaceId) {
+      clauses.push("workspace_id = ?");
+      args.push(normalizeWorkspaceId(options.workspaceId));
+    }
     if (options.resourceType) {
       clauses.push("resource_type = ?");
       args.push(options.resourceType);
@@ -4577,21 +4617,24 @@ class UptimeStore {
     const rows = this.db.query(`SELECT check_results.* FROM check_results JOIN monitors ON monitors.id = check_results.monitor_id ${where} ORDER BY checked_at DESC LIMIT ?`).all(...args);
     return rows.map(checkResultFromRow);
   }
-  getProvenance(source, sourceId) {
-    const row = this.db.query("SELECT * FROM monitor_provenance WHERE source = ? AND source_id = ?").get(source, sourceId);
+  getProvenance(source, sourceId, options = {}) {
+    const workspaceId = options.workspaceId ? normalizeWorkspaceId(options.workspaceId) : undefined;
+    const row = workspaceId ? this.db.query("SELECT * FROM monitor_provenance WHERE workspace_id = ? AND source = ? AND source_id = ?").get(workspaceId, source, sourceId) : this.db.query("SELECT * FROM monitor_provenance WHERE source = ? AND source_id = ? ORDER BY imported_at DESC LIMIT 1").get(source, sourceId);
     return row ? provenanceFromRow(row) : null;
   }
   upsertMonitorProvenance(input) {
     const importedAt = new Date().toISOString();
+    const monitor = this.getMonitor(input.monitorId);
+    const workspaceId = normalizeWorkspaceId(input.workspaceId ?? monitor?.workspaceId ?? "local");
     this.db.query(`INSERT INTO monitor_provenance (
-          monitor_id, source, source_id, source_label, imported_at, snapshot_json
-        ) VALUES (?, ?, ?, ?, ?, ?)
-        ON CONFLICT(source, source_id) DO UPDATE SET
+          workspace_id, monitor_id, source, source_id, source_label, imported_at, snapshot_json
+        ) VALUES (?, ?, ?, ?, ?, ?, ?)
+        ON CONFLICT(workspace_id, source, source_id) DO UPDATE SET
           monitor_id = excluded.monitor_id,
           source_label = excluded.source_label,
           imported_at = excluded.imported_at,
-          snapshot_json = excluded.snapshot_json`).run(input.monitorId, input.source, input.sourceId, input.sourceLabel ?? null, importedAt, JSON.stringify(input.snapshot));
-    return this.getProvenance(input.source, input.sourceId);
+          snapshot_json = excluded.snapshot_json`).run(workspaceId, input.monitorId, input.source, input.sourceId, input.sourceLabel ?? null, importedAt, JSON.stringify(input.snapshot));
+    return this.getProvenance(input.source, input.sourceId, { workspaceId });
   }
   saveImportBatch(input) {
     const createdAt = new Date().toISOString();
@@ -4774,6 +4817,49 @@ class UptimeStore {
       this.db.run("PRAGMA foreign_keys = ON");
     }
   }
+  ensureMonitorProvenanceWorkspaceScoped() {
+    const row = this.db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'monitor_provenance'").get();
+    const columns = this.db.query("PRAGMA table_info(monitor_provenance)").all();
+    const hasWorkspaceId = columns.some((column) => column.name === "workspace_id");
+    const hasWorkspacePrimaryKey = Boolean(row?.sql?.includes("PRIMARY KEY (workspace_id, source, source_id)"));
+    if (hasWorkspaceId && hasWorkspacePrimaryKey)
+      return;
+    this.db.run("PRAGMA foreign_keys = OFF");
+    this.db.run("PRAGMA legacy_alter_table = ON");
+    try {
+      const migrate = this.db.transaction(() => {
+        this.db.run("ALTER TABLE monitor_provenance RENAME TO monitor_provenance_old_workspace");
+        this.db.run(`
+          CREATE TABLE monitor_provenance (
+            workspace_id TEXT NOT NULL DEFAULT 'local',
+            monitor_id TEXT NOT NULL REFERENCES monitors(id) ON DELETE CASCADE,
+            source TEXT NOT NULL,
+            source_id TEXT NOT NULL,
+            source_label TEXT,
+            imported_at TEXT NOT NULL,
+            snapshot_json TEXT NOT NULL,
+            PRIMARY KEY (workspace_id, source, source_id)
+          )
+        `);
+        const workspaceSelect = hasWorkspaceId ? "COALESCE(old.workspace_id, monitors.workspace_id, 'local')" : "COALESCE(monitors.workspace_id, 'local')";
+        this.db.run(`
+          INSERT OR REPLACE INTO monitor_provenance (
+            workspace_id, monitor_id, source, source_id, source_label, imported_at, snapshot_json
+          )
+          SELECT
+            ${workspaceSelect}, old.monitor_id, old.source, old.source_id, old.source_label,
+            old.imported_at, old.snapshot_json
+          FROM monitor_provenance_old_workspace old
+          LEFT JOIN monitors ON monitors.id = old.monitor_id
+        `);
+        this.db.run("DROP TABLE monitor_provenance_old_workspace");
+      });
+      migrate();
+    } finally {
+      this.db.run("PRAGMA legacy_alter_table = OFF");
+      this.db.run("PRAGMA foreign_keys = ON");
+    }
+  }
   vacuumInto(backupPath) {
     const quoted = backupPath.replace(/'/g, "''");
     this.db.run(`VACUUM INTO '${quoted}'`);
@@ -4803,10 +4889,11 @@ function verifyBackupFile(backupPath) {
     const missingTables = REQUIRED_TABLES.filter((table) => !tableExists(db, table));
     const schemaVersion = missingTables.includes("schema_migrations") ? null : db.query("SELECT value FROM schema_migrations WHERE key = 'schema_version'").get()?.value ?? null;
     const currentOk = missingTables.length === 0 && schemaVersion === CURRENT_SCHEMA_VERSION;
+    const restorableV4 = schemaVersion === "4" && missingTables.length === 0;
     const restorableV1 = schemaVersion === "1" && missingTables.every((table) => PROBE_TABLES.has(table) || REPORT_AUDIT_TABLES.has(table));
     const restorableV2 = schemaVersion === "2" && missingTables.every((table) => REPORT_AUDIT_TABLES.has(table));
     return {
-      ok: integrity === "ok" && (currentOk || restorableV1 || restorableV2),
+      ok: integrity === "ok" && (currentOk || restorableV4 || restorableV1 || restorableV2),
       backupPath,
       integrity,
       schemaVersion,
@@ -5191,6 +5278,7 @@ function checkResultFromRow(row) {
 }
 function provenanceFromRow(row) {
   return {
+    workspaceId: row.workspace_id,
     monitorId: row.monitor_id,
     source: row.source,
     sourceId: row.source_id,
@@ -5278,6 +5366,7 @@ function reportRunFromRow(row) {
 function auditEventFromRow(row) {
   return {
     id: row.id,
+    workspaceId: row.workspace_id,
     action: row.action,
     resourceType: row.resource_type,
     resourceId: row.resource_id,
@@ -5639,12 +5728,18 @@ var MAX_PROBE_RESULT_FUTURE_MS = 5 * 60000;
 class UptimeService {
   store;
   checkRunner;
+  hostedResolveHost;
+  hostedHttpRequest;
+  hostedMaxRedirects;
   leaseOwner = `svc_${randomUUID3().replace(/-/g, "").slice(0, 18)}`;
   inFlightChecks = new Set;
   inFlightReportSchedules = new Set;
   constructor(options = {}) {
     this.store = options.store ?? new UptimeStore({ mode: "local", ...options });
     this.checkRunner = options.checkRunner ?? runMonitorCheck;
+    this.hostedResolveHost = options.hostedResolveHost;
+    this.hostedHttpRequest = options.hostedHttpRequest;
+    this.hostedMaxRedirects = options.hostedMaxRedirects;
   }
   close() {
     this.store.close();
@@ -5779,10 +5874,10 @@ class UptimeService {
     return this.reportStore().listReportRuns(options);
   }
   listAuditEvents(options = {}) {
-    return this.reportStore().listAuditEvents(options);
+    return this.auditStore().listAuditEvents(options);
   }
   recordAuditEvent(input) {
-    return this.reportStore().recordAuditEvent(input);
+    return this.auditStore().recordAuditEvent(input);
   }
   async runReportSchedule(idOrName, options = {}) {
     const store = this.reportStore();
@@ -5851,39 +5946,7 @@ class UptimeService {
     const monitor = this.store.getMonitor(idOrName);
     if (!monitor)
       throw new Error(`Monitor not found: ${idOrName}`);
-    if (!monitor.enabled)
-      throw new Error(`Monitor is disabled: ${monitor.name}`);
-    if (this.inFlightChecks.has(monitor.id))
-      throw new Error(`Monitor check already in progress: ${monitor.name}`);
-    const leaseTtlMs = Math.max(60000, (monitor.retryCount + 1) * monitor.timeoutMs + 1e4);
-    if (!this.store.acquireCheckLease(monitor.id, this.leaseOwner, leaseTtlMs)) {
-      throw new MonitorCheckBusyError(`Monitor check already in progress: ${monitor.name}`);
-    }
-    this.inFlightChecks.add(monitor.id);
-    try {
-      let attemptCount = 0;
-      let last = null;
-      const maxAttempts = Math.max(1, monitor.retryCount + 1);
-      while (attemptCount < maxAttempts) {
-        attemptCount += 1;
-        last = await this.checkRunner(monitor);
-        if (last.status === "up")
-          break;
-      }
-      return this.store.recordCheckResult({
-        monitorId: monitor.id,
-        status: last.status,
-        latencyMs: last.latencyMs,
-        statusCode: last.statusCode ?? null,
-        error: last.error ?? null,
-        evidence: last.evidence ?? null,
-        attemptCount,
-        expectedMonitorRevision: monitor.revision
-      });
-    } finally {
-      this.inFlightChecks.delete(monitor.id);
-      this.store.releaseCheckLease(monitor.id, this.leaseOwner);
-    }
+    return this.recordMonitorCheck(monitor, { hostedTargetPolicy: false });
   }
   async checkAll() {
     if (this.store.mode === "hosted")
@@ -5895,6 +5958,49 @@ class UptimeService {
     }
     return results;
   }
+  async checkHostedPublicMonitor(idOrName, options = {}) {
+    this.assertHostedPublicChecksEnabled();
+    const workspaceId = this.requireHostedWorkerWorkspaceId(options.workspaceId);
+    const monitor = this.store.getMonitor(idOrName, { workspaceId });
+    if (!monitor)
+      throw new Error(`Monitor not found: ${idOrName}`);
+    this.assertHostedPublicMonitor(monitor);
+    const result = await this.recordMonitorCheck(monitor, { hostedTargetPolicy: true });
+    this.auditStore().recordAuditEvent({
+      workspaceId,
+      action: "hosted_public_check.run",
+      resourceType: "monitor",
+      resourceId: monitor.id,
+      message: `Ran hosted public check for ${monitor.name}`,
+      metadata: {
+        checkResultId: result.id,
+        status: result.status,
+        monitorKind: monitor.kind,
+        operatorPath: "hosted_public_check"
+      },
+      actor: "hosted-public-check-worker"
+    });
+    return result;
+  }
+  async runDueHostedPublicChecks(now = new Date, options = {}) {
+    this.assertHostedPublicChecksEnabled();
+    const workspaceId = this.requireHostedWorkerWorkspaceId(options.workspaceId);
+    const due = this.store.listMonitors({ workspaceId }).filter((monitor) => this.isHostedPublicMonitor(monitor) && this.isDue(monitor, now));
+    const results = [];
+    for (const monitor of due) {
+      const current = this.store.getMonitor(monitor.id, { workspaceId });
+      if (!current || !this.isHostedPublicMonitor(current) || !this.isDue(current, now))
+        continue;
+      try {
+        results.push(await this.checkHostedPublicMonitor(current.id, { workspaceId }));
+      } catch (error) {
+        if (error instanceof MonitorCheckBusyError || error instanceof StaleCheckResultError)
+          continue;
+        throw error;
+      }
+    }
+    return results;
+  }
   startScheduler(options = {}) {
     if (this.store.mode === "hosted")
       throw new Error("hosted scheduler requires check_jobs and probes");
@@ -5940,6 +6046,67 @@ class UptimeService {
     const last = new Date(monitor.lastCheckedAt).getTime();
     return now.getTime() - last >= monitor.intervalSeconds * 1000;
   }
+  async recordMonitorCheck(monitor, options) {
+    if (!monitor.enabled)
+      throw new Error(`Monitor is disabled: ${monitor.name}`);
+    if (this.inFlightChecks.has(monitor.id))
+      throw new Error(`Monitor check already in progress: ${monitor.name}`);
+    const leaseTtlMs = Math.max(60000, (monitor.retryCount + 1) * monitor.timeoutMs + 1e4);
+    if (!this.store.acquireCheckLease(monitor.id, this.leaseOwner, leaseTtlMs)) {
+      throw new MonitorCheckBusyError(`Monitor check already in progress: ${monitor.name}`);
+    }
+    this.inFlightChecks.add(monitor.id);
+    try {
+      let attemptCount = 0;
+      let last = null;
+      const maxAttempts = Math.max(1, monitor.retryCount + 1);
+      while (attemptCount < maxAttempts) {
+        attemptCount += 1;
+        last = options.hostedTargetPolicy ? await this.runHostedPublicCheckAttempt(monitor) : await this.checkRunner(monitor);
+        if (last.status === "up")
+          break;
+      }
+      return this.store.recordCheckResult({
+        monitorId: monitor.id,
+        status: last.status,
+        latencyMs: last.latencyMs,
+        statusCode: last.statusCode ?? null,
+        error: last.error ?? null,
+        evidence: last.evidence ?? null,
+        attemptCount,
+        expectedMonitorRevision: monitor.revision
+      });
+    } finally {
+      this.inFlightChecks.delete(monitor.id);
+      this.store.releaseCheckLease(monitor.id, this.leaseOwner);
+    }
+  }
+  runHostedPublicCheckAttempt(monitor) {
+    return runMonitorCheck(monitor, {
+      hostedTargetPolicy: true,
+      resolveHost: this.hostedResolveHost,
+      hostedHttpRequest: this.hostedHttpRequest,
+      maxRedirects: this.hostedMaxRedirects
+    });
+  }
+  assertHostedPublicChecksEnabled() {
+    if (this.store.mode !== "hosted")
+      throw new Error("hosted public checks require hosted mode");
+  }
+  requireHostedWorkerWorkspaceId(workspaceId) {
+    const value = workspaceId?.trim() || process.env.HASNA_UPTIME_WORKSPACE_ID?.trim();
+    if (!value)
+      throw new Error("hosted public checks require a workspace id");
+    return value;
+  }
+  assertHostedPublicMonitor(monitor) {
+    if (!this.isHostedPublicMonitor(monitor)) {
+      throw new Error("hosted public checks support only HTTP and TCP monitors");
+    }
+  }
+  isHostedPublicMonitor(monitor) {
+    return monitor.kind === "http" || monitor.kind === "tcp";
+  }
   probeStore() {
     if (this.store.mode === "hosted") {
       throw new Error("hosted probe APIs require cloud check_jobs, workspace stores, and audit logging");
@@ -5989,6 +6156,13 @@ class UptimeService {
     }
     return store;
   }
+  auditStore() {
+    const store = this.store;
+    if (typeof store.recordAuditEvent !== "function" || typeof store.listAuditEvents !== "function") {
+      throw new Error("audit logging requires an audit-capable store");
+    }
+    return store;
+  }
   audit(action, resourceType, resourceId, message, metadata) {
     this.reportStore().recordAuditEvent({
       action,
@@ -6712,7 +6886,10 @@ async function handleApiRoute(service, request, url, apiPath, options, hosted, a
     return json(service.listMonitors({ includeDisabled: url.searchParams.get("includeDisabled") === "true", workspaceId: actor?.workspaceId }));
   }
   if (request.method === "POST" && apiPath === "/api/monitors") {
-    return json(service.createMonitor(await jsonBody(request), { workspaceId: actor?.workspaceId }), 201);
+    const monitor = service.createMonitor(await jsonBody(request), { workspaceId: actor?.workspaceId });
+    if (hosted && actor)
+      recordHostedMonitorAudit(service, actor, "monitor.create", monitor, { method: request.method, apiPath });
+    return json(monitor, 201);
   }
   if (request.method === "GET" && apiPath === "/api/incidents") {
     const status = url.searchParams.get("status");
@@ -6789,10 +6966,25 @@ async function handleApiRoute(service, request, url, apiPath, options, hosted, a
       return monitor ? json(monitor) : json({ error: "not found" }, 404);
     }
     if (request.method === "PATCH" && !monitorMatch[2]) {
-      return json(service.updateMonitor(id, await jsonBody(request), { workspaceId: actor?.workspaceId }));
+      const before = hosted ? service.getMonitor(id, { workspaceId: actor?.workspaceId }) : null;
+      const monitor = service.updateMonitor(id, await jsonBody(request), { workspaceId: actor?.workspaceId });
+      if (hosted && actor) {
+        recordHostedMonitorAudit(service, actor, "monitor.update", monitor, {
+          method: request.method,
+          apiPath,
+          previousRevision: before?.revision ?? null,
+          nextRevision: monitor.revision
+        });
+      }
+      return json(monitor);
     }
     if (request.method === "DELETE" && !monitorMatch[2]) {
-      return json({ deleted: service.deleteMonitor(id, { workspaceId: actor?.workspaceId }) });
+      const before = hosted ? service.getMonitor(id, { workspaceId: actor?.workspaceId }) : null;
+      const deleted = service.deleteMonitor(id, { workspaceId: actor?.workspaceId });
+      if (hosted && actor && deleted && before) {
+        recordHostedMonitorAudit(service, actor, "monitor.delete", before, { method: request.method, apiPath });
+      }
+      return json({ deleted });
     }
     if (request.method === "POST" && monitorMatch[2] === "check") {
       if (hosted)
@@ -6836,7 +7028,29 @@ function requireHostedActor(request, url, options, scope) {
   if (requestedWorkspace && requestedWorkspace !== workspaceId) {
     throw new ApiError("workspace access denied", 403);
   }
-  return { scopes, workspaceId };
+  return {
+    scopes,
+    workspaceId,
+    actor: token.actor ?? `hosted-token:${workspaceId}:${[...scopes].sort().join(",")}`
+  };
+}
+function recordHostedMonitorAudit(service, actor, action, monitor, metadata) {
+  service.recordAuditEvent({
+    workspaceId: actor.workspaceId,
+    action,
+    actor: actor.actor,
+    resourceType: "monitor",
+    resourceId: monitor.id,
+    metadata: {
+      ...metadata,
+      monitorName: monitor.name,
+      monitorKind: monitor.kind,
+      monitorEnabled: monitor.enabled,
+      monitorRevision: monitor.revision,
+      workspaceId: monitor.workspaceId,
+      scopes: [...actor.scopes].sort()
+    }
+  });
 }
 function isLoopbackHost(hostname) {
   const host = hostname.toLowerCase().replace(/^\[|\]$/g, "");
@@ -6914,7 +7128,8 @@ function normalizeHostedTokenEntry(entry, defaultWorkspaceId, source) {
   }
   const scopes = normalizeHostedScopes(entry.scopes, `${source}.scopes`);
   const workspaceId = typeof entry.workspaceId === "string" && entry.workspaceId.trim() ? entry.workspaceId.trim() : defaultWorkspaceId;
-  return { token: entry.token.trim(), scopes, workspaceId };
+  const actor = typeof entry.actor === "string" && entry.actor.trim() ? entry.actor.trim() : typeof entry.subject === "string" && entry.subject.trim() ? entry.subject.trim() : typeof entry.id === "string" && entry.id.trim() ? entry.id.trim() : undefined;
+  return { token: entry.token.trim(), scopes, workspaceId, actor };
 }
 function normalizeHostedScopes(value, source) {
   if (!Array.isArray(value) || value.length === 0) {
@@ -7014,7 +7229,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.22");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.24");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;
@@ -7259,7 +7474,10 @@ function buildPrivateProbeCloudConfig(options = {}) {
     }
   };
 }
-function renderPrivateProbeEnv(config) {
+function renderPrivateProbeEnv(config, options = {}) {
+  if (!options.allowBlocked && (!config.canStart || config.blockers.length > 0)) {
+    throw new Error("private probe env output is blocked until hosted probe routes and cloud jobs are implemented");
+  }
   const required = ["HASNA_UPTIME_PRIVATE_PROBE_ID"];
   const missing = required.filter((key) => !config.env[key]);
   if (missing.length > 0) {
@@ -7302,6 +7520,13 @@ program2.name("uptime").description("Local-first uptime and downtime monitoring"
 function service() {
   return new UptimeService({ mode: "local" });
 }
+function hostedService(opts) {
+  return new UptimeService({
+    mode: "hosted",
+    hostedSqliteDbPath: opts.hostedSqliteDb,
+    allowHostedLocalStore: opts.allowHostedLocalStore
+  });
+}
 function wantsJson(opts) {
   return Boolean(opts?.json || program2.opts().json);
 }
@@ -7627,7 +7852,7 @@ cloud.command("plan").description("Generate a dry-run AWS deployment plan").opti
     fail(error);
   }
 });
-cloud.command("private-probe-config").description("Generate hosted-targeted private probe preflight configuration").option("--api-url <url>", "hosted Open Uptime API URL", "https://uptime.example.com/api/v1").option("--workspace-id <id>", "workspace id", "workspace-id").option("--probe-id <id>", "cloud registered private probe id").option("--private-key-file <path>", "private probe key file", "~/.hasna/uptime/probes/private-probe-01.key.pem").option("--machine-id <id>", "machine id", "private-probe-01").option("--log-level <level>", "probe log level", "info").option("--env", "print shell env file instead of summary text").option("-j, --json", "print JSON").action((opts) => {
+cloud.command("private-probe-config").description("Generate hosted-targeted private probe preflight configuration").option("--api-url <url>", "hosted Open Uptime API URL", "https://uptime.example.com/api/v1").option("--workspace-id <id>", "workspace id", "workspace-id").option("--probe-id <id>", "cloud registered private probe id").option("--private-key-file <path>", "private probe key file", "~/.hasna/uptime/probes/private-probe-01.key.pem").option("--machine-id <id>", "machine id", "private-probe-01").option("--log-level <level>", "probe log level", "info").option("--env", "print shell env file instead of summary text").option("--allow-blocked-env", "print the blocked preflight env anyway for review artifacts; do not start the probe").option("-j, --json", "print JSON").action((opts) => {
   try {
     const config = buildPrivateProbeCloudConfig({
       apiUrl: opts.apiUrl,
@@ -7638,7 +7863,7 @@ cloud.command("private-probe-config").description("Generate hosted-targeted priv
       logLevel: opts.logLevel
     });
     if (opts.env && !wantsJson(opts)) {
-      console.log(renderPrivateProbeEnv(config));
+      console.log(renderPrivateProbeEnv(config, { allowBlocked: opts.allowBlockedEnv }));
       return;
     }
     print(config, renderPrivateProbeConfig(config), opts);
@@ -7646,6 +7871,22 @@ cloud.command("private-probe-config").description("Generate hosted-targeted priv
     fail(error);
   }
 });
+var cloudPublicChecks = cloud.command("public-checks").description("Run hosted public HTTP/TCP checks against the configured hosted store");
+cloudPublicChecks.command("run-due").description("Run due hosted public HTTP/TCP checks for one workspace").option("--workspace-id <id>", "workspace id; defaults to HASNA_UPTIME_WORKSPACE_ID").option("--now <iso>", "due timestamp", new Date().toISOString()).option("--hosted-sqlite-db <path>", "hosted SQLite path on cloud-mounted storage").option("--allow-hosted-local-store", "allow hosted mode to use local SQLite as an explicit fallback").option("-j, --json", "print JSON").action(async (opts) => {
+  try {
+    const svc = hostedService({
+      hostedSqliteDb: opts.hostedSqliteDb,
+      allowHostedLocalStore: opts.allowHostedLocalStore
+    });
+    const workspaceId = opts.workspaceId || process.env.HASNA_UPTIME_WORKSPACE_ID;
+    const results = await svc.runDueHostedPublicChecks(new Date(opts.now), { workspaceId });
+    svc.close();
+    const data = { ok: true, workspaceId, checked: results.length, results };
+    print(data, results.length ? renderCheckResults(results) : "No due hosted public checks", opts);
+  } catch (error) {
+    fail(error);
+  }
+});
 program2.command("results").description("List recent check results").option("--monitor <id>", "filter by monitor id").option("--limit <n>", "max rows", parseInteger, 20).option("-j, --json", "print JSON").action((opts) => {
   try {
     const svc = service();

package/dist/cloud-plan.d.ts

@@ -137,5 +137,7 @@ export interface PrivateProbeCloudConfig {
 }
 export declare function buildAwsDeploymentPlan(options?: AwsDeploymentPlanOptions): AwsDeploymentPlan;
 export declare function buildPrivateProbeCloudConfig(options?: PrivateProbeCloudConfigOptions): PrivateProbeCloudConfig;
-export declare function renderPrivateProbeEnv(config: PrivateProbeCloudConfig): string;
+export declare function renderPrivateProbeEnv(config: PrivateProbeCloudConfig, options?: {
+    allowBlocked?: boolean;
+}): string;
 //# sourceMappingURL=cloud-plan.d.ts.map

package/dist/cloud-plan.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-plan.d.ts","sourceRoot":"","sources":["../src/cloud-plan.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,2BAA2B,GAAG,gBAAgB,CAAC;IACrE,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,2BAA2B,GAAG,gBAAgB,CAAC;QACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE;YAClB,IAAI,EAAE,0BAA0B,GAAG,SAAS,CAAC;YAC7C,qBAAqB,EAAE,OAAO,CAAC;YAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,2BAA2B,EAAE,OAAO,CAAC;YACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;SAC7B,CAAC;QACF,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,eAAe,EAAE,KAAK,CAAC;QACvB,gBAAgB,EAAE,KAAK,CAAC;QACxB,wBAAwB,EAAE,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE;QACN,gBAAgB,EAAE,KAAK,CAAC;QACxB,WAAW,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAYD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,wBAA6B,GAAG,iBAAiB,CA4MhG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA2DlH;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,GAAG,MAAM,CAS7E"}
+{"version":3,"file":"cloud-plan.d.ts","sourceRoot":"","sources":["../src/cloud-plan.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,2BAA2B,GAAG,gBAAgB,CAAC;IACrE,wFAAwF;IACxF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,iCAAiC,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;IACf,SAAS,EAAE;QACT,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,MAAM,CAAC;QACvB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,YAAY,EAAE,MAAM,CAAC;QACrB,mBAAmB,EAAE,2BAA2B,GAAG,gBAAgB,CAAC;QACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE;YAClB,IAAI,EAAE,0BAA0B,GAAG,SAAS,CAAC;YAC7C,qBAAqB,EAAE,OAAO,CAAC;YAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;YACpB,2BAA2B,EAAE,OAAO,CAAC;YACrC,kBAAkB,CAAC,EAAE,MAAM,CAAC;SAC7B,CAAC;QACF,YAAY,EAAE,MAAM,EAAE,CAAC;QACvB,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CAAC;IACF,KAAK,EAAE;QACL,UAAU,EAAE,MAAM,CAAC;QACnB,GAAG,EAAE,MAAM,CAAC;QACZ,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;KACrB,CAAC;IACF,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE;QACN,eAAe,EAAE,KAAK,CAAC;QACvB,gBAAgB,EAAE,KAAK,CAAC;QACxB,wBAAwB,EAAE,KAAK,CAAC;QAChC,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,KAAK,GAAG,WAAW,GAAG,cAAc,GAAG,UAAU,GAAG,WAAW,CAAC;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,8BAA8B;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,wCAAwC,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,eAAe,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,EAAE;QACN,gBAAgB,EAAE,KAAK,CAAC;QACxB,WAAW,EAAE,KAAK,CAAC;QACnB,KAAK,EAAE,MAAM,EAAE,CAAC;KACjB,CAAC;CACH;AAYD,wBAAgB,sBAAsB,CAAC,OAAO,GAAE,wBAA6B,GAAG,iBAAiB,CA4MhG;AAED,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,8BAAmC,GAAG,uBAAuB,CA2DlH;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,uBAAuB,EAAE,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,MAAM,CAYvH"}