@hotcell/daemon 0.1.0

package/dist/driver/firecracker.js

@@ -0,0 +1,560 @@
+import { execFileSync, spawn } from "node:child_process";
+import { createServer as createNetServer, connect as netConnect } from "node:net";
+import { closeSync, createWriteStream, existsSync, ftruncateSync, lstatSync, mkdirSync, openSync, readlinkSync, rmSync, symlinkSync, unlinkSync, } from "node:fs";
+import { totalmem, cpus as osCpus } from "node:os";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { setTimeout as sleep } from "node:timers/promises";
+import { AgentConn } from "./agent.js";
+import { AgentDriver } from "./agent-driver.js";
+import { buildFcApiCalls, buildSnapshotCreateCall, buildSnapshotLoadCall, FC_DEFAULT_BOOT_ARGS, FC_PAUSE_VM, FC_START_ACTION, FcApi, fcVsockConnect, } from "./fc-api.js";
+import { VzImageCache } from "./vz-image.js";
+import { log } from "../logger.js";
+const AGENT_VSOCK_PORT = 1024; // the in-guest agent listens here (matches VZ)
+/**
+ * Firecracker microVM driver (Linux, KVM). Each sandbox is a Firecracker microVM:
+ * the driver spawns `firecracker`, configures it over its HTTP-API-over-unix-socket
+ * (boot source / machine-config / drives / vsock), boots it, and reaches the
+ * in-guest `sbx-agent` over virtio-vsock — the **same agent and wire protocol the
+ * Apple VZ driver uses**, so the entire agent-served surface (exec/files/processes/
+ * ports/terminal/stats/backup) is inherited from {@link AgentDriver} unchanged.
+ *
+ * **Host requirement:** `/dev/kvm` + the `firecracker` binary. All the code here is
+ * host-agnostic and compiles/unit-tests anywhere (see `check:fc`); only the live
+ * boot needs a KVM (or nested-virt) Linux host, gated behind `smoke:fc`.
+ */
+export class FirecrackerDriver extends AgentDriver {
+    cfg;
+    name = "firecracker";
+    vms = new Map();
+    images;
+    pool = [];
+    poolTarget;
+    poolSeq = 0;
+    filling = false;
+    poolImage;
+    poolDir;
+    constructor(cfg) {
+        super();
+        this.cfg = cfg;
+        // The OCI→ext4 converter + staged guest files live under `helpers/hotcell-vz`
+        // (shared with the VZ driver: same rootfs artifact, same agent-as-init).
+        const vzDir = join(dirname(dirname(cfg.rootfs)));
+        this.images = new VzImageCache({
+            vzDir: vzDir.endsWith("guest") ? dirname(vzDir) : "helpers/hotcell-vz",
+            cacheDir: cfg.imageCacheDir,
+            prebuiltRootfs: cfg.rootfs,
+            // Convert OCI images for the host arch (the guest runs on this KVM host).
+            platform: cfg.platform ?? (process.arch === "arm64" ? "linux/arm64" : "linux/amd64"),
+        });
+        this.poolTarget = Math.max(0, cfg.warmPool ?? 0);
+        this.poolImage = cfg.poolImage ?? "base";
+        this.poolDir = join(cfg.stateDir, "_pool");
+        if (this.poolTarget > 0) {
+            // Clear stale slots from a previous run (their VMMs died with the daemon).
+            try {
+                rmSync(this.poolDir, { recursive: true, force: true });
+            }
+            catch {
+                /* not there */
+            }
+            this.fillPool();
+        }
+    }
+    // --- lifecycle ------------------------------------------------------------
+    async create(opts) {
+        await this.launch(opts);
+        for (const command of opts.setup ?? []) {
+            const code = await this.exec(opts.id, command, {}, () => { }).catch(() => -1);
+            if (code === 0)
+                log.info("setup command ok", { sandbox: opts.id, command });
+            else
+                log.warn("setup command failed (continuing)", { sandbox: opts.id, command, code });
+        }
+    }
+    async start(opts) {
+        await this.launch(opts);
+    }
+    /** Bring a sandbox live: adopt a warm-pool spare when eligible (instant), else
+     *  resume its snapshot, else cold-boot. Then apply the sandbox env. */
+    async launch(opts) {
+        const id = opts.id;
+        if (this.vms.has(id))
+            return;
+        const stateDir = join(this.cfg.stateDir, id);
+        // Warm-pool adoption — must run before the canonical dir is created, since
+        // adoption makes that path a symlink to the spare's slot dir.
+        if (this.tryAdopt(opts)) {
+            if (opts.env && Object.keys(opts.env).length) {
+                await this.withConn(id, (c) => c.setEnv(opts.env));
+            }
+            log.info("firecracker VM up", { sandbox: id, warm: true });
+            return;
+        }
+        mkdirSync(stateDir, { recursive: true });
+        // If a snapshot exists from a fast-pause, resume from it (guest RAM + device
+        // state restored — no kernel boot; background processes come back live).
+        const vmstate = join(stateDir, "snapshot.vmstate");
+        const memFile = join(stateDir, "snapshot.mem");
+        if (existsSync(vmstate) && existsSync(memFile)) {
+            try {
+                await this.resumeFromSnapshot(id, stateDir, vmstate, memFile);
+                log.info("firecracker VM resumed from snapshot", { sandbox: id });
+                return;
+            }
+            catch (err) {
+                // A snapshot that won't load must never brick the sandbox: discard it and
+                // cold-boot (workspace intact — `snapshot()` synced the guest fs first;
+                // only live RAM/process state is lost).
+                log.warn("snapshot restore failed; discarding it and cold-booting", {
+                    sandbox: id,
+                    error: err.message,
+                });
+                for (const f of [vmstate, memFile])
+                    rmQuiet(f);
+            }
+        }
+        const vm = await this.bootMicroVm({ id, stateDir, image: opts.image, limits: opts.limits });
+        this.vms.set(id, vm);
+        try {
+            if (opts.env && Object.keys(opts.env).length) {
+                await this.withConn(id, (c) => c.setEnv(opts.env));
+            }
+        }
+        catch (err) {
+            this.vms.delete(id);
+            await killAndWait(vm.proc);
+            throw err;
+        }
+        log.info("firecracker VM up", { sandbox: id });
+    }
+    /**
+     * Cold-boot a microVM in `stateDir` and wait for its in-guest agent, returning
+     * the live FcVm. Shared by the launch path and the warm-pool filler. Does not
+     * touch `this.vms` or apply sandbox env — the caller owns those.
+     */
+    async bootMicroVm(p) {
+        mkdirSync(p.stateDir, { recursive: true });
+        const rootfs = await this.images.ensureRootfs(p.image);
+        // First boot only: give the sandbox its own workspace disk (clone the blank
+        // pre-formatted template; else a sparse file the guest formats).
+        const workspaceImg = join(p.stateDir, "workspace.img");
+        if (!existsSync(workspaceImg)) {
+            let blank = null;
+            try {
+                blank = await this.images.ensureBlankWorkspace(this.cfg.diskGb);
+            }
+            catch (err) {
+                log.warn("blank workspace build failed; guest will format a sparse disk", {
+                    sandbox: p.id,
+                    error: err.message,
+                });
+            }
+            if (blank)
+                cloneFile(blank, workspaceImg);
+            else
+                ensureSparseFile(workspaceImg, this.cfg.diskGb * 1024 ** 3);
+        }
+        const cpus = p.limits?.cpus ? Math.max(1, Math.ceil(p.limits.cpus)) : 2;
+        const memMib = p.limits?.memoryMb && p.limits.memoryMb > 0 ? p.limits.memoryMb : 1024;
+        const pidsMax = p.limits?.pidsLimit && p.limits.pidsLimit > 0 ? p.limits.pidsLimit : 0;
+        const bootArgs = pidsMax > 0 ? `${FC_DEFAULT_BOOT_ARGS} hotcell.pids=${pidsMax} sbx.pids=${pidsMax}` : FC_DEFAULT_BOOT_ARGS;
+        const configureAndBoot = async () => {
+            const vm = await this.spawnVmm(p.stateDir);
+            try {
+                const api = new FcApi(vm.apiSock);
+                await api.applyAll(buildFcApiCalls({
+                    kernelPath: this.cfg.kernel,
+                    rootfsPath: rootfs,
+                    workspacePath: workspaceImg,
+                    vcpus: cpus,
+                    memMib,
+                    vsockUds: vm.vsockUds,
+                    bootArgs,
+                }));
+                await api.call(FC_START_ACTION);
+                return vm;
+            }
+            catch (err) {
+                await killAndWait(vm.proc);
+                throw err;
+            }
+        };
+        const vm = await this.withOneRetry(p.id, configureAndBoot, "boot");
+        try {
+            await this.waitForAgent(vm);
+            // Cold boots need the in-guest side of the egress relay started (after a
+            // snapshot resume it's already alive in the restored RAM).
+            if (this.cfg.egressPort && this.cfg.egressPort > 0) {
+                const { socket, leftover } = await fcVsockConnect(vm.vsockUds, AGENT_VSOCK_PORT, 15000);
+                const conn = await AgentConn.attach(socket, leftover, 15000);
+                try {
+                    await conn.egressListen(this.cfg.egressPort);
+                }
+                finally {
+                    conn.close();
+                }
+            }
+        }
+        catch (err) {
+            await killAndWait(vm.proc);
+            throw err;
+        }
+        return vm;
+    }
+    // --- warm pool --------------------------------------------------------------
+    /** Spares currently ready for adoption (used by checks). */
+    poolSize() {
+        return this.pool.length;
+    }
+    /**
+     * Adopt a pre-booted spare for `opts` when eligible — a plain create of the
+     * pool image with default limits and no prior state. Adoption moves nothing:
+     * the canonical state dir becomes a **symlink** to the spare's slot dir, so
+     * every path the daemon joins under it resolves correctly while the absolute
+     * slot paths Firecracker recorded at boot (drives, vsock UDS) stay real — which
+     * keeps a later `snapshot()`/restore of the adopted VM loadable (`/snapshot/load`
+     * re-opens the boot-time paths embedded in the vmstate).
+     */
+    tryAdopt(opts) {
+        if (this.poolTarget <= 0)
+            return false;
+        const noLimits = !opts.limits || (!opts.limits.memoryMb && !opts.limits.cpus && !opts.limits.pidsLimit);
+        const canonical = join(this.cfg.stateDir, opts.id);
+        if (opts.image !== this.poolImage || !noLimits || existsSync(canonical))
+            return false;
+        const spare = this.pool.shift();
+        if (!spare) {
+            this.fillPool(); // none ready — warm up for next time
+            return false;
+        }
+        mkdirSync(dirname(canonical), { recursive: true });
+        symlinkSync(spare.stateDir, canonical);
+        this.vms.set(opts.id, spare);
+        this.fillPool(); // replenish in the background
+        log.info("firecracker adopted a warm-pool microVM", { sandbox: opts.id });
+        return true;
+    }
+    /** Top the pool up to its target in the background (one filler at a time). */
+    fillPool() {
+        if (this.poolTarget <= 0 || this.filling)
+            return;
+        void this.doFill();
+    }
+    async doFill() {
+        this.filling = true;
+        try {
+            while (this.pool.length < this.poolTarget) {
+                const n = ++this.poolSeq;
+                try {
+                    const vm = await this.bootMicroVm({
+                        id: `pool-${n}`,
+                        stateDir: join(this.poolDir, `slot-${n}`),
+                        image: this.poolImage,
+                    });
+                    this.pool.push(vm);
+                    log.info("warm pool: spare microVM ready", { size: this.pool.length, target: this.poolTarget });
+                }
+                catch (err) {
+                    log.warn("warm pool: spare boot failed (will retry on next claim)", {
+                        error: err.message,
+                    });
+                    break; // don't hot-loop on a persistent failure
+                }
+            }
+        }
+        finally {
+            this.filling = false;
+        }
+    }
+    /** Tear down all spare microVMs (e.g. on daemon shutdown). Idempotent. */
+    async drainPool() {
+        this.poolTarget = 0;
+        const spares = this.pool.splice(0);
+        for (const vm of spares)
+            await killAndWait(vm.proc);
+        try {
+            rmSync(this.poolDir, { recursive: true, force: true });
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    /** Spawn a fresh VMM process for `stateDir` and wait for its API socket. */
+    async spawnVmm(stateDir) {
+        const apiSock = join(stateDir, "fc-api.sock");
+        const vsockUds = join(stateDir, "vsock.sock");
+        for (const s of [apiSock, vsockUds])
+            rmQuiet(s);
+        const proc = spawn(this.cfg.fcBin, ["--api-sock", apiSock], { stdio: ["ignore", "pipe", "pipe"] });
+        proc.stdout.pipe(createWriteStream(join(stateDir, "console.log"), { flags: "a" }));
+        proc.stderr.pipe(createWriteStream(join(stateDir, "console.log"), { flags: "a" }));
+        const vm = { proc, apiSock, vsockUds, workspaceImg: join(stateDir, "workspace.img"), stateDir };
+        this.startEgressRelay(vm);
+        try {
+            await waitForFile(apiSock, 5000); // firecracker creates the API socket on startup
+        }
+        catch (err) {
+            await killAndWait(proc);
+            throw err;
+        }
+        return vm;
+    }
+    /**
+     * Host side of the guest egress relay. When the guest dials vsock port P,
+     * firecracker connects to the unix socket `<vsockUds>_P` — so we listen there
+     * and splice every such connection to the egress gateway. Set up per-VMM
+     * (boot, snapshot-load, and pool spares alike) before the guest can dial;
+     * torn down automatically with the VMM process.
+     */
+    startEgressRelay(vm) {
+        const port = this.cfg.egressPort;
+        if (!port || port <= 0)
+            return;
+        const path = `${vm.vsockUds}_${port}`;
+        rmQuiet(path);
+        const srv = createNetServer((guest) => {
+            const up = netConnect(port, this.cfg.egressHost ?? "127.0.0.1");
+            const close = () => {
+                guest.destroy();
+                up.destroy();
+            };
+            guest.pipe(up);
+            up.pipe(guest);
+            guest.on("error", close);
+            up.on("error", close);
+            guest.on("close", close);
+            up.on("close", close);
+        });
+        srv.on("error", (err) => log.warn("egress relay listener error", { path, error: String(err) }));
+        srv.listen(path);
+        vm.proc.once("exit", () => {
+            srv.close();
+            rmQuiet(path);
+        });
+    }
+    /**
+     * Run a VMM bring-up step, retrying once on a fresh process. Rationale: a VMM
+     * spawned immediately after the previous one's SIGKILL can die silently before
+     * serving its API (a transient KVM/VMM teardown race seen on nested-virt
+     * hosts, ~ECONNRESET mid-configure); a single respawn reliably clears it.
+     */
+    async withOneRetry(id, step, what) {
+        try {
+            return await step();
+        }
+        catch (err) {
+            log.warn(`firecracker ${what} failed; retrying once on a fresh VMM`, {
+                sandbox: id,
+                error: err.message,
+            });
+            try {
+                return await step();
+            }
+            catch (err2) {
+                throw new Error(`firecracker: VM ${what} failed: ${err2.message}`);
+            }
+        }
+    }
+    /** Poll the guest vsock until the agent answers its Hello, or time out. */
+    async waitForAgent(vm, timeoutMs = 30000) {
+        const deadline = Date.now() + timeoutMs;
+        let lastErr;
+        while (Date.now() < deadline) {
+            if (vm.proc.exitCode !== null) {
+                throw new Error(`firecracker exited (code ${vm.proc.exitCode}) before the agent came up`);
+            }
+            try {
+                const { socket, leftover } = await fcVsockConnect(vm.vsockUds, AGENT_VSOCK_PORT, 2000);
+                const conn = await AgentConn.attach(socket, leftover, 2000);
+                conn.close();
+                return;
+            }
+            catch (err) {
+                lastErr = err;
+                await sleep(400);
+            }
+        }
+        throw new Error(`firecracker: agent never came up: ${String(lastErr?.message ?? lastErr)}`);
+    }
+    /** Boot a fresh VMM and load the saved snapshot into it (no kernel boot). The
+     *  snapshot pins the vsock UDS path; firecracker re-binds it on load (stale
+     *  socket files are cleared by `spawnVmm`). */
+    async resumeFromSnapshot(id, stateDir, vmstate, memFile) {
+        const loadSnapshot = async () => {
+            const vm = await this.spawnVmm(stateDir);
+            try {
+                await new FcApi(vm.apiSock).call(buildSnapshotLoadCall(vmstate, memFile));
+                return vm;
+            }
+            catch (err) {
+                await killAndWait(vm.proc);
+                throw err;
+            }
+        };
+        const vm = await this.withOneRetry(id, loadSnapshot, "snapshot load");
+        this.vms.set(id, vm);
+        try {
+            await this.waitForAgent(vm);
+        }
+        catch (err) {
+            this.vms.delete(id);
+            await killAndWait(vm.proc);
+            throw err;
+        }
+        // One-shot: guest state diverges the moment the VM resumes, so a second load
+        // from these files would resurrect a stale past. Unlinking is safe — the VMM
+        // maps the memory file privately (copy-on-write).
+        for (const f of [vmstate, memFile])
+            rmQuiet(f);
+    }
+    /** A live VM can always be snapshot-paused (KVM snapshots have no OS gate). */
+    canSnapshot(id) {
+        return this.vms.has(id);
+    }
+    /**
+     * Fast-pause (B7): pause the vCPUs, write a Full Firecracker snapshot (device
+     * state + guest RAM) into the sandbox's state dir, and tear the VMM down. The
+     * next `start` resumes from it **without a kernel boot** — background
+     * processes/servers come back live. Same contract as the VZ driver's
+     * `snapshot()`: the guest fs is synced first, so if the later restore has to
+     * fall back to a cold boot the workspace is still intact.
+     */
+    async snapshot(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`firecracker: sandbox ${id} is not running`);
+        await this.exec(id, "sync", {}, () => { }).catch(() => { });
+        const api = new FcApi(vm.apiSock);
+        await api.call(FC_PAUSE_VM);
+        await api.call(buildSnapshotCreateCall(join(vm.stateDir, "snapshot.vmstate"), join(vm.stateDir, "snapshot.mem")));
+        this.vms.delete(id);
+        await killAndWait(vm.proc); // state saved; free the compute
+        for (const s of [vm.apiSock, vm.vsockUds])
+            rmQuiet(s);
+    }
+    async stop(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            return;
+        // Flush the guest fs so workspace writes survive the abrupt teardown.
+        await this.exec(id, "sync", {}, () => { }).catch(() => { });
+        this.vms.delete(id);
+        await killAndWait(vm.proc); // tears down the microVM; workspace.img persists
+        for (const s of [vm.apiSock, vm.vsockUds])
+            rmQuiet(s);
+    }
+    async destroy(id) {
+        await this.stop(id);
+        const canonical = join(this.cfg.stateDir, id);
+        try {
+            // An adopted sandbox's canonical dir is a symlink to its warm-pool slot:
+            // remove the real slot dir first, then the link itself.
+            if (lstatSync(canonical).isSymbolicLink()) {
+                rmSync(readlinkSync(canonical), { recursive: true, force: true });
+                unlinkSync(canonical);
+            }
+            else {
+                rmSync(canonical, { recursive: true, force: true });
+            }
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    // --- agent transport ------------------------------------------------------
+    /** Open a fresh AgentConn to the guest over Firecracker's vsock UDS (CONNECT
+     *  handshake → the live socket carries the agent wire protocol). */
+    async openConn(id) {
+        const vm = this.vms.get(id);
+        if (!vm)
+            throw new Error(`firecracker: sandbox ${id} is not running`);
+        const { socket, leftover } = await fcVsockConnect(vm.vsockUds, AGENT_VSOCK_PORT, 15000);
+        return AgentConn.attach(socket, leftover, 15000);
+    }
+    // --- host probes ----------------------------------------------------------
+    async ping() {
+        if (!existsSync("/dev/kvm")) {
+            throw new Error("firecracker: /dev/kvm not present — needs a Linux host with KVM (bare metal " +
+                "or a nested-virtualization VM, e.g. GCE N2/C3). Use SBX_DRIVER=container otherwise.");
+        }
+        try {
+            execFileSync(this.cfg.fcBin, ["--version"], { stdio: "ignore" });
+        }
+        catch (err) {
+            throw new Error(`firecracker: cannot run "${this.cfg.fcBin}" (${err.message}). ` +
+                "Install firecracker or set SBX_FC_BIN.");
+        }
+    }
+    async hostInfo() {
+        // Prefer /proc on Linux; fall back to the os module elsewhere (e.g. building
+        // on a Mac, where this driver can't actually boot but should still report).
+        let memoryMb = Math.round(totalmem() / (1024 * 1024));
+        try {
+            const meminfo = readFileSync("/proc/meminfo", "utf8");
+            const m = /MemTotal:\s+(\d+)\s+kB/.exec(meminfo);
+            if (m)
+                memoryMb = Math.round(Number(m[1]) / 1024);
+        }
+        catch {
+            /* not Linux; use totalmem() */
+        }
+        return { memoryMb, cpus: osCpus().length };
+    }
+}
+/** Remove a file, ignoring a missing one. */
+function rmQuiet(path) {
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        /* not there */
+    }
+}
+/** SIGKILL a VMM and wait until the process has actually exited, so the next
+ *  spawn never overlaps the previous VM's kernel-side teardown. */
+function killAndWait(proc, timeoutMs = 3000) {
+    return new Promise((resolve) => {
+        if (proc.exitCode !== null || proc.signalCode !== null)
+            return resolve();
+        const timer = setTimeout(resolve, timeoutMs);
+        proc.once("exit", () => {
+            clearTimeout(timer);
+            resolve();
+        });
+        proc.kill("SIGKILL");
+    });
+}
+/** Copy `src`→`dst`, preferring a CoW reflink (btrfs/xfs) and falling back to a
+ *  plain sparse-aware copy. Gives each sandbox its own workspace disk cheaply. */
+function cloneFile(src, dst) {
+    try {
+        execFileSync("cp", ["--reflink=auto", src, dst]);
+    }
+    catch {
+        execFileSync("cp", [src, dst]);
+    }
+}
+/** Create a sparse file of `sizeBytes` if it doesn't exist (workspace disk). */
+function ensureSparseFile(path, sizeBytes) {
+    if (existsSync(path))
+        return;
+    const fd = openSync(path, "w");
+    try {
+        ftruncateSync(fd, sizeBytes);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Resolve once `path` exists, polling, or reject after `timeoutMs`. */
+async function waitForFile(path, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (existsSync(path))
+            return;
+        await sleep(50);
+    }
+    throw new Error(`timed out waiting for ${path}`);
+}
+//# sourceMappingURL=firecracker.js.map

package/dist/driver/firecracker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/driver/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,KAAK,EACL,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAyCnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,+CAA+C;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAWnB;IAVpB,IAAI,GAAG,aAAa,CAAC;IACtB,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC9B,MAAM,CAAe;IACrB,IAAI,GAAW,EAAE,CAAC;IAClB,UAAU,CAAS;IACnB,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,CAAS;IAClB,OAAO,CAAS;IAEjC,YAA6B,GAAa;QACxC,KAAK,EAAE,CAAC;QADmB,QAAG,GAAH,GAAG,CAAU;QAExC,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB;YACtE,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,0EAA0E;YAC1E,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACxB,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,MAAM,CAAC,IAAmB;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;;gBACvE,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;2EACuE;IAC/D,KAAK,CAAC,MAAM,CAAC,IAAmB;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE7C,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wCAAwC;gBACxC,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBAClE,OAAO,EAAE,EAAE;oBACX,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,CAKzB;QACC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvD,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE;oBACxE,OAAO,EAAE,CAAC,CAAC,EAAE;oBACb,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;;gBACrC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,iBAAiB,OAAO,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAE5H,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;YACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,GAAG,CAAC,QAAQ,CAChB,eAAe,CAAC;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;oBAC3B,UAAU,EAAE,MAAM;oBAClB,aAAa,EAAE,YAAY;oBAC3B,KAAK,EAAE,IAAI;oBACX,MAAM;oBACN,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,QAAQ;iBACT,CAAC,CACH,CAAC;gBACF,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5B,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC/C,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+EAA+E;IAE/E,4DAA4D;IAC5D,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,IAAmB;QAClC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,qCAAqC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,8BAA8B;QAC/C,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IACtE,QAAQ;QACd,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACjD,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;wBAChC,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACzC,KAAK,EAAE,IAAI,CAAC,SAAS;qBACtB,CAAC,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;wBAClE,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC9B,CAAC,CAAC;oBACH,MAAM,CAAC,yCAAyC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,GAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,gDAAgD;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,EAAQ;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACtB,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACtE,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACxB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAI,EAAU,EAAE,IAAsB,EAAE,IAAY;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,uCAAuC,EAAE;gBACnE,OAAO,EAAE,EAAE;gBACX,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,YAAa,IAAc,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,EAAQ,EAAE,SAAS,GAAG,KAAK;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,OAAgB,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,QAAQ,4BAA4B,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAE,OAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;mDAE+C;IACvC,KAAK,CAAC,kBAAkB,CAC9B,EAAU,EACV,QAAgB,EAChB,OAAe,EACf,OAAe;QAEf,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;YAC7C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1E,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QAEtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5B,MAAM,GAAG,CAAC,IAAI,CACZ,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAClG,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC;QAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,sEAAsE;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,iDAAiD;QAC7E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E;wEACoE;IAC1D,KAAK,CAAC,QAAQ,CAAC,EAAU;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,GAAG,CAAC,KAAK,MAAO,GAAa,CAAC,OAAO,KAAK;gBACzE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,6CAA6C;AAC7C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,SAAS,WAAW,CAAC,IAAkB,EAAE,SAAS,GAAG,IAAI;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,OAAO,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;kFACkF;AAClF,SAAS,SAAS,CAAC,GAAW,EAAE,GAAW;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/driver/index.d.ts

@@ -0,0 +1,17 @@
+import type { Config } from "../config.js";
+import type { Driver } from "./types.js";
+/** Known driver names, in preference/isolation order. */
+export declare const DRIVER_NAMES: readonly ["container", "firecracker", "applevz"];
+/**
+ * Construct the runtime driver named by `config.driver` (`SBX_DRIVER`) — the
+ * daemon's default. The `DriverRouter` calls `createNamedDriver` to build other
+ * drivers on demand for per-sandbox isolation selection.
+ */
+export declare function createDriver(config: Config): Driver;
+/**
+ * Construct a specific runtime driver by name. The container driver is fully
+ * built; the microVM drivers compile and report a clear "needs <host>" error
+ * from `ping()` so a bad selection fails with guidance. Adding a real driver is
+ * a one-line change here.
+ */
+export declare function createNamedDriver(name: string, config: Config): Driver;

package/dist/driver/index.js

@@ -0,0 +1,61 @@
+import { AppleVzDriver } from "./applevz.js";
+import { ContainerDriver } from "./container.js";
+import { FirecrackerDriver } from "./firecracker.js";
+/** Known driver names, in preference/isolation order. */
+export const DRIVER_NAMES = ["container", "firecracker", "applevz"];
+/**
+ * Construct the runtime driver named by `config.driver` (`SBX_DRIVER`) — the
+ * daemon's default. The `DriverRouter` calls `createNamedDriver` to build other
+ * drivers on demand for per-sandbox isolation selection.
+ */
+export function createDriver(config) {
+    return createNamedDriver(config.driver, config);
+}
+/**
+ * Construct a specific runtime driver by name. The container driver is fully
+ * built; the microVM drivers compile and report a clear "needs <host>" error
+ * from `ping()` so a bad selection fails with guidance. Adding a real driver is
+ * a one-line change here.
+ */
+export function createNamedDriver(name, config) {
+    switch (name) {
+        case "container":
+            return new ContainerDriver(undefined, {
+                enforce: config.egressEnforce,
+                network: config.egressNetwork,
+                subnet: config.egressSubnet,
+                dns: config.egressDnsResolver,
+            });
+        case "firecracker":
+            return new FirecrackerDriver({
+                fcBin: config.fcBin,
+                kernel: config.fcKernel,
+                rootfs: config.fcRootfs,
+                stateDir: config.fcStateDir,
+                diskGb: config.fcDiskGb,
+                imageCacheDir: config.fcImageCacheDir,
+                warmPool: config.fcWarmPool,
+                // A plain create of the daemon's default image adopts a spare.
+                poolImage: config.defaultImage,
+                // Guest egress relay target: the gateway on this host.
+                egressPort: config.egressPort,
+                egressHost: config.host,
+            });
+        case "applevz":
+            return new AppleVzDriver({
+                helperPath: config.vzHelperPath,
+                kernel: config.vzKernel,
+                rootfs: config.vzRootfs,
+                stateDir: config.vzStateDir,
+                diskGb: config.vzDiskGb,
+                imageCacheDir: config.vzImageCacheDir,
+                warmPool: config.vzWarmPool,
+                // Guest egress relay target: the gateway on this host.
+                egressPort: config.egressPort,
+                egressHost: config.host,
+            });
+        default:
+            throw new Error(`unknown driver "${name}" (expected: ${DRIVER_NAMES.join(" | ")})`);
+    }
+}
+//# sourceMappingURL=index.js.map