@hotcell/daemon 0.1.0

package/dist/driver/vz-image.d.ts

@@ -0,0 +1,35 @@
+/**
+ * On-demand OCI→ext4 image cache for the Apple VZ driver. Converts an OCI image
+ * (e.g. `python:3.11-slim`) into a VZ-bootable read-only rootfs — with the
+ * in-sandbox agent injected as PID 1 — and caches it keyed by image name, so a
+ * VZ sandbox runs the same image as the container driver. Also builds the blank
+ * pre-formatted workspace template the driver clones per sandbox.
+ *
+ * Both artifacts are produced by helper shell scripts that use Docker's
+ * `mkfs.ext4 -d` (populate-from-dir) — no privileges or loop-mounts, so it works
+ * on macOS where there is no native `mke2fs`.
+ */
+export interface VzImageCacheOpts {
+    /** The `helpers/hotcell-vz` dir holding the converter scripts + staged guest files. */
+    vzDir: string;
+    /** Where converted rootfs images + the blank workspace template are cached. */
+    cacheDir: string;
+    /** Prebuilt Alpine base rootfs used for the sentinel image names (no conversion). */
+    prebuiltRootfs: string;
+    /** Target platform for the guest (default linux/arm64 — Apple silicon + VZ). */
+    platform?: string;
+}
+export declare class VzImageCache {
+    private readonly o;
+    private inflight;
+    constructor(o: VzImageCacheOpts);
+    /** Resolve an OCI image to a VZ-bootable rootfs path, converting on cache miss. */
+    ensureRootfs(image: string): Promise<string>;
+    /** Path to a blank pre-formatted workspace image of `diskGb`, building on miss. */
+    ensureBlankWorkspace(diskGb: number): Promise<string>;
+    private get platform();
+    /** Dedupe concurrent builds of the same artifact (key = output path). */
+    private once;
+    private sanitize;
+    private run;
+}

package/dist/driver/vz-image.js

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+import { existsSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { log } from "../logger.js";
+// Image names that map to the prebuilt Alpine base rootfs instead of converting:
+// the lightweight default for tests/dev that needs no Docker pull.
+const SENTINELS = new Set(["base", "alpine", "hotcell/base", "hotcell/base:latest", "sbx/base", "sbx/base:latest", "default"]);
+export class VzImageCache {
+    o;
+    inflight = new Map();
+    constructor(o) {
+        this.o = o;
+    }
+    /** Resolve an OCI image to a VZ-bootable rootfs path, converting on cache miss. */
+    async ensureRootfs(image) {
+        if (SENTINELS.has(image))
+            return this.o.prebuiltRootfs;
+        const out = join(this.o.cacheDir, `${this.sanitize(image)}.img`);
+        if (existsSync(out))
+            return out;
+        return this.once(out, async () => {
+            mkdirSync(this.o.cacheDir, { recursive: true });
+            log.info("converting OCI image to a VZ rootfs (first use; cached after)", { image, out });
+            await this.run(join(this.o.vzDir, "convert-image.sh"), [
+                image,
+                out,
+                join(this.o.vzDir, "guest", "hotcell-agent"),
+                join(this.o.vzDir, "guest", "init.sh"),
+                this.platform,
+            ]);
+            return out;
+        });
+    }
+    /** Path to a blank pre-formatted workspace image of `diskGb`, building on miss. */
+    async ensureBlankWorkspace(diskGb) {
+        const sizeMb = Math.max(64, Math.round(diskGb * 1024));
+        const out = join(this.o.cacheDir, `blank-${sizeMb}m.img`);
+        if (existsSync(out))
+            return out;
+        return this.once(out, async () => {
+            mkdirSync(this.o.cacheDir, { recursive: true });
+            log.info("building the blank workspace template (first use; cached after)", { sizeMb, out });
+            await this.run(join(this.o.vzDir, "build-blank-workspace.sh"), [out, String(sizeMb), this.platform]);
+            return out;
+        });
+    }
+    get platform() {
+        return this.o.platform ?? "linux/arm64";
+    }
+    /** Dedupe concurrent builds of the same artifact (key = output path). */
+    once(key, fn) {
+        const existing = this.inflight.get(key);
+        if (existing)
+            return existing;
+        const p = fn().finally(() => this.inflight.delete(key));
+        this.inflight.set(key, p);
+        return p;
+    }
+    sanitize(image) {
+        return image.replace(/[^a-zA-Z0-9._-]+/g, "_");
+    }
+    run(script, args) {
+        return new Promise((resolve, reject) => {
+            const child = spawn("bash", [script, ...args], { stdio: ["ignore", "pipe", "pipe"] });
+            let err = "";
+            child.stderr.on("data", (d) => (err += d.toString()));
+            child.stdout.resume();
+            child.on("error", reject);
+            child.on("close", (code) => code === 0
+                ? resolve()
+                : reject(new Error(`${script} exited ${code}: ${err.trim().slice(-600)}`)));
+        });
+    }
+}
+//# sourceMappingURL=vz-image.js.map

package/dist/driver/vz-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vz-image.js","sourceRoot":"","sources":["../../src/driver/vz-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAwBnC,iFAAiF;AACjF,mEAAmE;AACnE,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,qBAAqB,EAAE,UAAU,EAAE,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/H,MAAM,OAAO,YAAY;IAGM;IAFrB,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAEtD,YAA6B,CAAmB;QAAnB,MAAC,GAAD,CAAC,CAAkB;IAAG,CAAC;IAEpD,mFAAmF;IACnF,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC1F,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE;gBACrD,KAAK;gBACL,GAAG;gBACH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC;gBACtC,IAAI,CAAC,QAAQ;aACd,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,oBAAoB,CAAC,MAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,MAAM,OAAO,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QAChC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE;YAC/B,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,GAAG,CAAC,IAAI,CAAC,iEAAiE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7F,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,0BAA0B,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrG,OAAO,GAAG,CAAC;QACb,CAAC,CAAC,CAAC;IACL,CAAC;IAED,IAAY,QAAQ;QAClB,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC;IAC1C,CAAC;IAED,yEAAyE;IACjE,IAAI,CAAC,GAAW,EAAE,EAAyB;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1B,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,QAAQ,CAAC,KAAa;QAC5B,OAAO,KAAK,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;IAEO,GAAG,CAAC,MAAc,EAAE,IAAc;QACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACtF,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,OAAO,EAAE;gBACX,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,WAAW,IAAI,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/e2e-harness.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/e2e-harness.js

@@ -0,0 +1,99 @@
+/**
+ * Real-harness e2e (plan §Verification 5): run **headless Claude Code** inside a
+ * sandbox with provider keys injected by the egress gateway — the sandbox only
+ * ever sees a revocable per-sandbox token; the daemon swaps it for the real key
+ * and meters the call.
+ *
+ * The gateway's `openrouter` provider serves Anthropic's Messages API
+ * (openrouter.ai/api is Anthropic-compatible), so Claude Code speaks its native
+ * protocol through the gateway with the OpenRouter key held on the daemon host.
+ *
+ * Prereqs: a daemon whose environment has SBX_PROVIDER_KEY_OPENROUTER, Docker
+ * (container driver), and internet egress for the gateway itself.
+ * Env: SBX_ENDPOINT (default http://127.0.0.1:4750), SBX_API_KEY (if auth on),
+ *      SBX_E2E_MODEL (OpenRouter slug; default anthropic/claude-3.5-haiku),
+ *      SBX_E2E_EXPECT — "completion" (default; needs a real provider key) or
+ *      "auth-fail": run with a dummy key and accept the provider's auth error
+ *      as proof the whole chain works (sandbox → token env → headless Claude
+ *      Code → gateway → key injection → real provider), minus the billing.
+ * Run: npm run e2e:harness
+ */
+import assert from "node:assert/strict";
+import { HotcellClient } from "@hotcell/sdk";
+async function main() {
+    const endpoint = process.env.SBX_ENDPOINT ?? "http://127.0.0.1:4750";
+    const model = process.env.SBX_E2E_MODEL ?? "anthropic/claude-3.5-haiku";
+    const client = new HotcellClient({ endpoint, apiKey: process.env.SBX_API_KEY });
+    let passed = 0;
+    const ok = (l) => {
+        passed++;
+        console.log(`  ✓ ${l}`);
+    };
+    const info = await client.info();
+    assert.ok(info.egressProviders?.includes("openrouter"), `daemon has no openrouter provider key (providers: ${info.egressProviders?.join(", ") || "none"})`);
+    ok(`daemon up (${endpoint}); gateway providers: ${info.egressProviders.join(", ")}`);
+    let sandbox;
+    try {
+        // Node image: Claude Code is an npm package. `egress: true` auto-wires the
+        // provider env (BASE_URLs at the gateway + the token as key).
+        sandbox = await client.getSandbox(undefined, { image: "node:22-slim", egress: true });
+        ok(`sandbox ${sandbox.id} created (node:22-slim, egress wired)`);
+        const wiring = await sandbox.exec("echo url=$OPENROUTER_BASE_URL; echo tok=${OPENROUTER_API_KEY:+set}");
+        assert.match(wiring.stdout, /url=http.+\/openrouter/, "OPENROUTER_BASE_URL not injected");
+        assert.match(wiring.stdout, /tok=set/, "egress token not injected");
+        assert.ok(!/sk-or-/.test(wiring.stdout), "a real provider key leaked into the sandbox env");
+        ok("egress env wired: gateway base URL + token (no real key in the sandbox)");
+        console.error("[e2e] installing @anthropic-ai/claude-code in the sandbox (~1-2 min)…");
+        const install = await sandbox.exec("npm install -g @anthropic-ai/claude-code --no-fund --no-audit 2>&1 | tail -2 && claude --version");
+        assert.equal(install.exitCode, 0, `install failed:\n${install.stdout}\n${install.stderr}`);
+        ok(`headless harness installed: claude ${install.stdout.trim().split("\n").pop()}`);
+        console.error("[e2e] running headless Claude Code through the gateway…");
+        const run = await sandbox.exec([
+            // Claude Code → gateway → openrouter.ai/api/v1/messages, per OpenRouter's
+            // Claude Code integration guide: base URL swap, token as auth, blank the
+            // real-key var so nothing conflicts, model pinned to a cheap Anthropic slug.
+            `export ANTHROPIC_BASE_URL="$OPENROUTER_BASE_URL"`,
+            `export ANTHROPIC_AUTH_TOKEN="$OPENROUTER_API_KEY"`,
+            `export ANTHROPIC_API_KEY=""`,
+            `export ANTHROPIC_DEFAULT_HAIKU_MODEL="${model}"`,
+            `export DISABLE_TELEMETRY=1 CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1`,
+            `export HOME=/root IS_SANDBOX=1`,
+            `claude -p "Reply with exactly: SBX_E2E_OK" --model haiku 2>&1`,
+        ].join(" && "));
+        const expect = process.env.SBX_E2E_EXPECT ?? "completion";
+        if (expect === "auth-fail") {
+            // Dummy-key mode: the provider rejecting our injected key IS the proof —
+            // the request left headless Claude Code, crossed the gateway, had the
+            // (dummy) real key injected, and reached the provider over the internet.
+            assert.match(run.stdout, /401|unauthori[sz]ed|invalid.*(key|token)|authentication/i, `expected a provider auth error, got:\n${run.stdout.slice(-800)}`);
+            ok("★ headless Claude Code → gateway → real provider (auth error as expected with a dummy key)");
+        }
+        else {
+            assert.match(run.stdout, /SBX_E2E_OK/, `no completion came back through the gateway:\n${run.stdout.slice(-800)}`);
+            ok("★ headless Claude Code completed a real prompt through the egress gateway");
+        }
+        // The gateway metered the traffic: provider calls on the record.
+        const metrics = await sandbox.metrics();
+        if (expect === "auth-fail") {
+            ok(`gateway saw ${metrics.usage?.providerCalls ?? 0} provider call(s) (auth-fail mode)`);
+        }
+        else {
+            assert.ok((metrics.usage?.providerCalls ?? 0) > 0, "gateway did not meter any provider call");
+            ok(`gateway metered ${metrics.usage.providerCalls} provider call(s), ` +
+                `${metrics.usage.providerTokensIn}/${metrics.usage.providerTokensOut} tokens in/out, ` +
+                `provider cost $${metrics.usage.providerCost.toFixed(4)}`);
+        }
+        console.log(`\ne2e-harness: ${passed} checks passed (real agent, real completion, key never in sandbox)`);
+        return 0;
+    }
+    catch (err) {
+        console.error(`e2e-harness FAILED: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    finally {
+        if (sandbox)
+            await sandbox.destroy().catch(() => { });
+    }
+}
+main().then((code) => process.exit(code));
+//# sourceMappingURL=e2e-harness.js.map

package/dist/e2e-harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e-harness.js","sourceRoot":"","sources":["../src/e2e-harness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,aAAa,EAAgB,MAAM,cAAc,CAAC;AAE3D,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,uBAAuB,CAAC;IACrE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,4BAA4B,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IAEhF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE;QACvB,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,CAAC,EAAE,CACP,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5C,qDAAqD,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CACnG,CAAC;IACF,EAAE,CAAC,cAAc,QAAQ,yBAAyB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAErF,IAAI,OAA4B,CAAC;IACjC,IAAI,CAAC;QACH,2EAA2E;QAC3E,8DAA8D;QAC9D,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,EAAE,CAAC,WAAW,OAAO,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,wBAAwB,EAAE,kCAAkC,CAAC,CAAC;QAC1F,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,2BAA2B,CAAC,CAAC;QACpE,MAAM,CAAC,EAAE,CACP,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAC7B,iDAAiD,CAClD,CAAC;QACF,EAAE,CAAC,yEAAyE,CAAC,CAAC;QAE9E,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAChC,kGAAkG,CACnG,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,EAAE,oBAAoB,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,EAAE,CAAC,sCAAsC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAEpF,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAC5B;YACE,0EAA0E;YAC1E,yEAAyE;YACzE,6EAA6E;YAC7E,kDAAkD;YAClD,mDAAmD;YACnD,6BAA6B;YAC7B,yCAAyC,KAAK,GAAG;YACjD,uEAAuE;YACvE,gCAAgC;YAChC,+DAA+D;SAChE,CAAC,IAAI,CAAC,MAAM,CAAC,CACf,CAAC;QACF,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,YAAY,CAAC;QAC1D,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,yEAAyE;YACzE,sEAAsE;YACtE,yEAAyE;YACzE,MAAM,CAAC,KAAK,CACV,GAAG,CAAC,MAAM,EACV,0DAA0D,EAC1D,yCAAyC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAClE,CAAC;YACF,EAAE,CAAC,4FAA4F,CAAC,CAAC;QACnG,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,CACV,GAAG,CAAC,MAAM,EACV,YAAY,EACZ,iDAAiD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAC1E,CAAC;YACF,EAAE,CAAC,2EAA2E,CAAC,CAAC;QAClF,CAAC;QAED,iEAAiE;QACjE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,EAAE,CAAC,eAAe,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,oCAAoC,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,EAAE,CACP,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC,GAAG,CAAC,EACvC,yCAAyC,CAC1C,CAAC;YACF,EAAE,CACA,mBAAmB,OAAO,CAAC,KAAK,CAAC,aAAa,qBAAqB;gBACjE,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,IAAI,OAAO,CAAC,KAAK,CAAC,iBAAiB,kBAAkB;gBACtF,kBAAkB,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,oEAAoE,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,uBAAuB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,IAAI,OAAO;YAAE,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/egress-check.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Docker-free egress control-plane check. Exercises the gateway's policy
+ * enforcement + cost metering entirely in-process (mock upstream + in-memory
+ * store), so the per-token policy logic can be verified anywhere — no container
+ * runtime required (the full container-backed flow is asserted by `smoke.ts` /
+ * `smoke-remote.ts` against a real daemon). Run: `npm run check:egress`.
+ */
+export {};

package/dist/egress-check.js

@@ -0,0 +1,317 @@
+/**
+ * Docker-free egress control-plane check. Exercises the gateway's policy
+ * enforcement + cost metering entirely in-process (mock upstream + in-memory
+ * store), so the per-token policy logic can be verified anywhere — no container
+ * runtime required (the full container-backed flow is asserted by `smoke.ts` /
+ * `smoke-remote.ts` against a real daemon). Run: `npm run check:egress`.
+ */
+import { createServer, request as httpRequest } from "node:http";
+import { createServer as netCreateServer } from "node:net";
+import assert from "node:assert/strict";
+import { buildProviders, createEgressProxy } from "./proxy/egress.js";
+import { Allowlist } from "./proxy/allowlist.js";
+import { DEFAULT_MODEL_PRICES } from "./pricing.js";
+import { loadConfig } from "./config.js";
+import { emptyUsage, SandboxStore } from "./store.js";
+const REAL_KEY = "REAL-KEY-123";
+async function main() {
+    const config = loadConfig();
+    config.dbPath = ":memory:";
+    const store = new SandboxStore(":memory:");
+    const sandboxId = "sbxtest01";
+    const rec = {
+        id: sandboxId,
+        image: "test",
+        status: "running",
+        createdAt: new Date().toISOString(),
+        labels: {},
+        env: {},
+        persist: false,
+        lastActivityAt: new Date().toISOString(),
+        sleepAfterMs: 0,
+        limits: {},
+        usage: emptyUsage(),
+    };
+    store.add(rec);
+    // Mock provider upstream: echoes the auth header it received, echoes the
+    // request's `model`, returns 11/7 tokens, and includes `usage.cost` only when
+    // asked via `x-mock-cost` — so we can exercise both the reported-cost and the
+    // computed-from-table paths.
+    const upstream = createServer((req, res) => {
+        let body = "";
+        req.on("data", (c) => (body += c));
+        req.on("end", () => {
+            let model = "gpt-4o";
+            try {
+                const o = JSON.parse(body || "{}");
+                if (typeof o.model === "string")
+                    model = o.model;
+            }
+            catch {
+                /* ignore */
+            }
+            const usage = { prompt_tokens: 11, completion_tokens: 7 };
+            if (req.headers["x-mock-cost"])
+                usage.cost = 0.0123;
+            res.writeHead(200, { "content-type": "application/json" });
+            res.end(JSON.stringify({ model, usage, receivedAuth: req.headers["authorization"] }));
+        });
+    });
+    const upstreamPort = await listen(upstream);
+    const egress = createEgressProxy({
+        config,
+        store,
+        prices: DEFAULT_MODEL_PRICES,
+        providers: {
+            mock: {
+                baseUrl: `http://127.0.0.1:${upstreamPort}`,
+                authHeader: "authorization",
+                format: (k) => `Bearer ${k}`,
+                apiKey: REAL_KEY,
+            },
+        },
+    });
+    const egressPort = await listen(egress);
+    const base = `http://127.0.0.1:${egressPort}`;
+    const mint = (policy = {}) => {
+        const token = SandboxStore.newEgressToken();
+        store.addEgressToken(token, sandboxId, policy);
+        return token;
+    };
+    const call = async (token, body = { model: "gpt-4o" }, headers = {}) => {
+        const res = await fetch(`${base}/mock/v1/chat/completions`, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-hotcell-egress": token, ...headers },
+            body: JSON.stringify(body),
+        });
+        const text = await res.text();
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            json = text;
+        }
+        return { status: res.status, json };
+    };
+    let passed = 0;
+    const ok = (label) => {
+        passed++;
+        console.log(`  ✓ ${label}`);
+    };
+    // 1) Key injection: upstream sees the REAL key, never the token.
+    {
+        const token = mint();
+        const r = await call(token);
+        assert.equal(r.status, 200, "valid call should 200");
+        assert.equal(r.json.receivedAuth, `Bearer ${REAL_KEY}`, "upstream must see injected real key");
+        ok("key injection: upstream receives real key, not the token");
+    }
+    // 2) Computed cost from the price table (no provider-reported cost).
+    {
+        const token = mint();
+        await call(token, { model: "gpt-4o" });
+        const u = store.get(sandboxId).usage;
+        // gpt-4o = $2.5/1M in, $10/1M out → 11*2.5e-6 + 7*10e-6 = 9.75e-5
+        const expected = (11 / 1e6) * 2.5 + (7 / 1e6) * 10;
+        const spend = store.resolveEgressTokenFull(token).spendUsd;
+        assert.ok(Math.abs(spend - expected) < 1e-12, `computed cost ${spend} != ${expected}`);
+        assert.ok(u.providerCalls >= 1 && u.providerTokensIn >= 11, "tokens metered");
+        ok(`computed cost from table: $${spend.toFixed(8)} for gpt-4o 11/7`);
+    }
+    // 3) Reported cost is authoritative (not recomputed) when present.
+    {
+        const token = mint();
+        await call(token, { model: "gpt-4o" }, { "x-mock-cost": "1" });
+        const spend = store.resolveEgressTokenFull(token).spendUsd;
+        assert.ok(Math.abs(spend - 0.0123) < 1e-9, `reported cost should win, got ${spend}`);
+        ok("reported cost authoritative ($0.0123)");
+    }
+    // 4) Invalid token → 403.
+    {
+        const r = await call("sbx-nope");
+        assert.equal(r.status, 403, "invalid token should 403");
+        ok("invalid token → 403");
+    }
+    // 5) Expired token → 403.
+    {
+        const token = mint({ expiresAt: new Date(Date.now() - 1000).toISOString() });
+        const r = await call(token);
+        assert.equal(r.status, 403, "expired token should 403");
+        ok("expired token → 403");
+    }
+    // 6) Provider not in scope → 403.
+    {
+        const token = mint({ providers: ["openai"] }); // calling /mock
+        const r = await call(token);
+        assert.equal(r.status, 403, "out-of-scope provider should 403");
+        ok("provider out of scope → 403");
+    }
+    // 7) Model not in allowlist → 403; allowed model → 200.
+    {
+        const token = mint({ models: ["gpt-4o"] });
+        const bad = await call(token, { model: "gpt-3.5-turbo" });
+        assert.equal(bad.status, 403, "disallowed model should 403");
+        const good = await call(token, { model: "gpt-4o" });
+        assert.equal(good.status, 200, "allowed model should 200");
+        ok("model allowlist: gpt-3.5 → 403, gpt-4o → 200");
+    }
+    // 8) Spend cap → 402 once accumulated spend reaches the cap.
+    {
+        const token = mint({ spendCapUsd: 0.01 });
+        const first = await call(token, { model: "gpt-4o" }, { "x-mock-cost": "1" }); // spends 0.0123
+        assert.equal(first.status, 200, "first call under cap should 200");
+        const second = await call(token, { model: "gpt-4o" }, { "x-mock-cost": "1" });
+        assert.equal(second.status, 402, "second call over cap should 402");
+        ok("spend cap → first 200, then 402");
+    }
+    // 9) Rate limit (calls) → 429 on the 2nd call within the window.
+    {
+        const token = mint({ rateLimit: { calls: 1, windowMs: 60_000 } });
+        const first = await call(token);
+        assert.equal(first.status, 200, "first call should 200");
+        const second = await call(token);
+        assert.equal(second.status, 429, "second call should 429");
+        ok("rate limit (calls=1) → first 200, then 429");
+    }
+    // 10) Config-driven providers: built-ins, custom shapes, and CF-gateway repoint.
+    {
+        const cfg = loadConfig();
+        cfg.providerKeys = { openai: "k1", google: "k2", cfopenai: "k3", noshape: "k4" };
+        cfg.providerConfigs = {
+            // Cloudflare AI Gateway prefix in front of OpenAI, expressed as a custom provider.
+            cfopenai: {
+                baseUrl: "https://gateway.ai.cloudflare.com/v1/acct/gw/openai",
+                authHeader: "authorization",
+                formatTemplate: "Bearer {key}",
+            },
+        };
+        const built = buildProviders(cfg);
+        assert.ok(built.openai && built.openai.baseUrl === "https://api.openai.com", "built-in openai");
+        assert.ok(built.google && built.google.authHeader === "x-goog-api-key", "built-in google");
+        assert.ok(built.cfopenai, "custom cfopenai provider present");
+        assert.equal(built.cfopenai.format("XYZ"), "Bearer XYZ", "custom format template applied");
+        assert.ok(built.cfopenai.baseUrl.includes("cloudflare"), "custom base URL used");
+        assert.ok(!built.noshape, "keyed-but-shapeless provider is omitted");
+        ok("config-driven providers: built-ins + custom CF-gateway, shapeless omitted");
+    }
+    // 11) Allowlist matcher (pure): exact, wildcard, denylist, port-strip.
+    {
+        const al = new Allowlist(["pypi.org", "*.githubusercontent.com"], ["dns.google"]);
+        assert.equal(al.check("pypi.org").allow, true, "exact allow");
+        assert.equal(al.check("raw.githubusercontent.com").allow, true, "wildcard allow");
+        assert.equal(al.check("evil.example").allow, false, "default deny");
+        assert.equal(al.check("dns.google").allow, false, "denylist wins");
+        assert.equal(al.check("pypi.org:443").allow, true, "port stripped");
+        ok("allowlist matcher: exact, wildcard, denylist, port-strip");
+    }
+    // 12) Forward proxy + CONNECT tunnel + provider-domain guard (custom allowlist
+    //     that permits 127.0.0.1 only). Exercises the security-critical path.
+    {
+        const fwAllow = new Allowlist(["127.0.0.1", "localhost"], []);
+        const fwProxy = createEgressProxy({
+            config,
+            store,
+            prices: DEFAULT_MODEL_PRICES,
+            allowlist: fwAllow,
+            providers: {}, // provider-host guard still derives from built-in defaults
+        });
+        const fwPort = await listen(fwProxy);
+        const token = mint();
+        // Absolute-form HTTP forward proxy: allowed host → 200, denied → 403,
+        // LLM-provider host → 403 (guard).
+        const fAllowed = await forward(fwPort, `http://127.0.0.1:${upstreamPort}/v1/x`, token);
+        assert.equal(fAllowed.status, 200, "forward to allowed host should 200");
+        const fDenied = await forward(fwPort, "http://evil.example/x", token);
+        assert.equal(fDenied.status, 403, "forward to denied host should 403");
+        const fProvider = await forward(fwPort, "http://api.openai.com/v1/chat", token);
+        assert.equal(fProvider.status, 403, "forward to LLM provider should 403 (guard)");
+        // CONNECT tunnel: allowed host round-trips bytes; denied + provider → 403.
+        const echo = netCreateServer((s) => s.pipe(s));
+        const echoPort = await listen(echo);
+        const cOk = await connectProxy(fwPort, `127.0.0.1:${echoPort}`, token);
+        assert.equal(cOk.status, 200, "CONNECT to allowed host should 200");
+        const echoed = await new Promise((resolve) => {
+            cOk.socket.once("data", (d) => resolve(d.toString()));
+            cOk.socket.write("ping");
+        });
+        assert.equal(echoed, "ping", "CONNECT tunnel round-trips bytes");
+        cOk.socket.destroy();
+        const cDenied = await connectProxy(fwPort, "evil.example:443", token);
+        assert.equal(cDenied.status, 403, "CONNECT to denied host should 403");
+        const cProvider = await connectProxy(fwPort, "api.openai.com:443", token);
+        assert.equal(cProvider.status, 403, "CONNECT to LLM provider should 403 (guard)");
+        fwProxy.close();
+        echo.close();
+        ok("forward proxy + CONNECT: allow round-trips, deny → 403, provider guard → 403");
+    }
+    // 13) Per-sandbox spend ceiling: a hard cap across all of a sandbox's tokens,
+    //     independent of per-token policy.
+    {
+        const sb2 = { ...rec, id: "sbxcap0002", egressSpendCapUsd: 0.01, usage: emptyUsage() };
+        store.add(sb2);
+        const token = SandboxStore.newEgressToken();
+        store.addEgressToken(token, sb2.id); // no per-token policy
+        const first = await fetch(`${base}/mock/v1/chat`, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-hotcell-egress": token, "x-mock-cost": "1" },
+            body: JSON.stringify({ model: "gpt-4o" }),
+        });
+        assert.equal(first.status, 200, "first call under sandbox cap should 200");
+        const second = await fetch(`${base}/mock/v1/chat`, {
+            method: "POST",
+            headers: { "content-type": "application/json", "x-hotcell-egress": token, "x-mock-cost": "1" },
+            body: JSON.stringify({ model: "gpt-4o" }),
+        });
+        assert.equal(second.status, 402, "second call over sandbox cap should 402");
+        ok("per-sandbox spend ceiling → first 200, then 402");
+    }
+    console.log(`\negress-check: ${passed} checks passed`);
+    egress.close();
+    upstream.close();
+    store.close();
+}
+/** Send an absolute-form (forward-proxy) GET through the gateway. */
+function forward(port, absUrl, token) {
+    return new Promise((resolve) => {
+        const req = httpRequest({ host: "127.0.0.1", port, method: "GET", path: absUrl, headers: { "proxy-authorization": `Bearer ${token}` } }, (res) => {
+            let b = "";
+            res.on("data", (c) => (b += c));
+            res.on("end", () => resolve({ status: res.statusCode ?? -1, body: b }));
+        });
+        req.on("error", () => resolve({ status: -1, body: "" }));
+        req.end();
+    });
+}
+/** Open a CONNECT tunnel through the gateway. Resolves on either outcome. */
+function connectProxy(port, authority, token) {
+    return new Promise((resolve) => {
+        const req = httpRequest({
+            method: "CONNECT",
+            host: "127.0.0.1",
+            port,
+            path: authority,
+            headers: { "proxy-authorization": `Bearer ${token}` },
+        });
+        req.on("connect", (res, socket) => resolve({ status: res.statusCode ?? -1, socket }));
+        req.on("response", (res) => {
+            res.resume();
+            resolve({ status: res.statusCode ?? -1 });
+        });
+        req.on("error", () => resolve({ status: -1 }));
+        req.end();
+    });
+}
+function listen(server) {
+    return new Promise((resolve) => {
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            resolve(typeof addr === "object" && addr ? addr.port : 0);
+        });
+    });
+}
+main().then(() => process.exit(0), (err) => {
+    console.error("egress-check FAILED:", err);
+    process.exit(1);
+});
+//# sourceMappingURL=egress-check.js.map

package/dist/egress-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-check.js","sourceRoot":"","sources":["../src/egress-check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAGtD,MAAM,QAAQ,GAAG,cAAc,CAAC;AAEhC,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC;IAE3C,MAAM,SAAS,GAAG,WAAW,CAAC;IAC9B,MAAM,GAAG,GAAkB;QACzB,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,MAAM;QACb,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,EAAE;QACV,GAAG,EAAE,EAAE;QACP,OAAO,EAAE,KAAK;QACd,cAAc,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACxC,YAAY,EAAE,CAAC;QACf,MAAM,EAAE,EAAE;QACV,KAAK,EAAE,UAAU,EAAE;KACpB,CAAC;IACF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEf,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,6BAA6B;IAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACzC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,KAAK,GAAG,QAAQ,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;gBACnC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;oBAAE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,MAAM,KAAK,GAA2B,EAAE,aAAa,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YAClF,IAAI,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;gBAAE,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC;YACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,iBAAiB,CAAC;QAC/B,MAAM;QACN,KAAK;QACL,MAAM,EAAE,oBAAoB;QAC5B,SAAS,EAAE;YACT,IAAI,EAAE;gBACJ,OAAO,EAAE,oBAAoB,YAAY,EAAE;gBAC3C,UAAU,EAAE,eAAe;gBAC3B,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;gBACpC,MAAM,EAAE,QAAQ;aACjB;SACF;KACF,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,oBAAoB,UAAU,EAAE,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,SAAuB,EAAE,EAAU,EAAE;QACjD,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAC5C,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAChB,KAAa,EACb,OAAgC,EAAE,KAAK,EAAE,QAAQ,EAAE,EACnD,UAAkC,EAAE,EACI,EAAE;QAC1C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,2BAA2B,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE;YACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAS,CAAC;QACd,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IACtC,CAAC,CAAC;IAEF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,EAAE,GAAG,CAAC,KAAa,EAAE,EAAE;QAC3B,MAAM,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,iEAAiE;IACjE,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,QAAQ,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC/F,EAAE,CAAC,0DAA0D,CAAC,CAAC;IACjE,CAAC;IAED,qEAAqE;IACrE,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAE,CAAC,KAAK,CAAC;QACtC,kEAAkE;QAClE,MAAM,QAAQ,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,QAAQ,CAAC,GAAG,KAAK,EAAE,iBAAiB,KAAK,OAAO,QAAQ,EAAE,CAAC,CAAC;QACvF,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,CAAC,gBAAgB,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC9E,EAAE,CAAC,8BAA8B,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;IACvE,CAAC;IAED,mEAAmE;IACnE,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAE,CAAC,QAAQ,CAAC;QAC5D,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,iCAAiC,KAAK,EAAE,CAAC,CAAC;QACrF,EAAE,CAAC,uCAAuC,CAAC,CAAC;IAC9C,CAAC;IAED,0BAA0B;IAC1B,CAAC;QACC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACxD,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC5B,CAAC;IAED,0BAA0B;IAC1B,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC7E,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACxD,EAAE,CAAC,qBAAqB,CAAC,CAAC;IAC5B,CAAC;IAED,kCAAkC;IAClC,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAC/D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,kCAAkC,CAAC,CAAC;QAChE,EAAE,CAAC,6BAA6B,CAAC,CAAC;IACpC,CAAC;IAED,wDAAwD;IACxD,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;QAC3D,EAAE,CAAC,8CAA8C,CAAC,CAAC;IACrD,CAAC;IAED,6DAA6D;IAC7D,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,gBAAgB;QAC9F,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,iCAAiC,CAAC,CAAC;QACpE,EAAE,CAAC,iCAAiC,CAAC,CAAC;IACxC,CAAC;IAED,iEAAiE;IACjE,CAAC;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC3D,EAAE,CAAC,4CAA4C,CAAC,CAAC;IACnD,CAAC;IAED,iFAAiF;IACjF,CAAC;QACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,GAAG,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjF,GAAG,CAAC,eAAe,GAAG;YACpB,mFAAmF;YACnF,QAAQ,EAAE;gBACR,OAAO,EAAE,qDAAqD;gBAC9D,UAAU,EAAE,eAAe;gBAC3B,cAAc,EAAE,cAAc;aAC/B;SACF,CAAC;QACF,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QAChG,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,UAAU,KAAK,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC3F,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,kCAAkC,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAS,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,gCAAgC,CAAC,CAAC;QAC5F,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAClF,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,yCAAyC,CAAC,CAAC;QACrE,EAAE,CAAC,2EAA2E,CAAC,CAAC;IAClF,CAAC;IAED,uEAAuE;IACvE,CAAC;QACC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC,UAAU,EAAE,yBAAyB,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;QAClF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;QACnE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;QACpE,EAAE,CAAC,0DAA0D,CAAC,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,0EAA0E;IAC1E,CAAC;QACC,MAAM,OAAO,GAAG,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,iBAAiB,CAAC;YAChC,MAAM;YACN,KAAK;YACL,MAAM,EAAE,oBAAoB;YAC5B,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,EAAE,EAAE,2DAA2D;SAC3E,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;QAErB,sEAAsE;QACtE,mCAAmC;QACnC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,oBAAoB,YAAY,OAAO,EAAE,KAAK,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAC;QAChF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,4CAA4C,CAAC,CAAC;QAElF,2EAA2E;QAC3E,MAAM,IAAI,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,aAAa,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;QACvE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,GAAG,CAAC,MAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,kCAAkC,CAAC,CAAC;QACjE,GAAG,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;QAEtB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,kBAAkB,EAAE,KAAK,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,oBAAoB,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,4CAA4C,CAAC,CAAC;QAElF,OAAO,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,EAAE,CAAC,8EAA8E,CAAC,CAAC;IACrF,CAAC;IAED,8EAA8E;IAC9E,uCAAuC;IACvC,CAAC;QACC,MAAM,GAAG,GAAkB,EAAE,GAAG,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;QACtG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,KAAK,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAC5C,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB;QAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE;YAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;QAC3E,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,eAAe,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE;YAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,yCAAyC,CAAC,CAAC;QAC5E,EAAE,CAAC,iDAAiD,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,gBAAgB,CAAC,CAAC;IACvD,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,QAAQ,CAAC,KAAK,EAAE,CAAC;IACjB,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED,qEAAqE;AACrE,SAAS,OAAO,CACd,IAAY,EACZ,MAAc,EACd,KAAa;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,WAAW,CACrB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,qBAAqB,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,EAC/G,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,CAAC,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACzD,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,YAAY,CACnB,IAAY,EACZ,SAAiB,EACjB,KAAa;IAEb,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,WAAW,CAAC;YACtB,MAAM,EAAE,SAAS;YACjB,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,EAAE,qBAAqB,EAAE,UAAU,KAAK,EAAE,EAAE;SACtD,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACtF,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,MAA4D;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/fc-check.d.ts

@@ -0,0 +1 @@
+export {};