@hotcell/daemon 0.1.2 → 0.1.4

package/dist/driver/firecracker.js

@@ -31,6 +31,7 @@ export class FirecrackerDriver extends AgentDriver {
     pool = [];
     poolTarget;
     poolSeq = 0;
+    tapSeq = 0;
     filling = false;
     poolImage;
     poolDir;
@@ -114,7 +115,15 @@ export class FirecrackerDriver extends AgentDriver {
                     rmQuiet(f);
             }
         }
-        const vm = await this.bootMicroVm({ id, stateDir, image: opts.image, limits: opts.limits });
+        const vm = await this.bootMicroVm({
+            id,
+            stateDir,
+            image: opts.image,
+            limits: opts.limits,
+            networked: opts.networked,
+            writableRootfs: opts.writableRootfs,
+            cpuset: opts.cpuset,
+        });
         this.vms.set(id, vm);
         try {
             if (opts.env && Object.keys(opts.env).length) {
@@ -135,7 +144,24 @@ export class FirecrackerDriver extends AgentDriver {
      */
     async bootMicroVm(p) {
         mkdirSync(p.stateDir, { recursive: true });
-        const rootfs = await this.images.ensureRootfs(p.image);
+        let rootfs = await this.images.ensureRootfs(p.image);
+        // Opt-in NAT networking: give the guest a real eth0 (host TAP + masquerade).
+        // Default posture is no NIC (egress over vsock only).
+        const net = p.networked ? this.setupTap(p.id) : undefined;
+        // Private writable rootfs so the guest can write to `/` (apt, node into
+        // /opt, …). Implied by `networked` ("trusted VM" mode) or opted into alone
+        // via `writableRootfs` (contained: no NIC, egress via vsock only). The
+        // default shared rootfs is read-only. Cloned + grown once per sandbox.
+        let rootfsReadOnly = true;
+        if (p.networked || p.writableRootfs) {
+            const priv = join(p.stateDir, "rootfs.img");
+            if (!existsSync(priv)) {
+                cloneFile(rootfs, priv);
+                growExt4(priv, 8);
+            }
+            rootfs = priv;
+            rootfsReadOnly = false;
+        }
         // First boot only: give the sandbox its own workspace disk (clone the blank
         // pre-formatted template; else a sparse file the guest formats).
         const workspaceImg = join(p.stateDir, "workspace.img");
@@ -160,7 +186,7 @@ export class FirecrackerDriver extends AgentDriver {
         const pidsMax = p.limits?.pidsLimit && p.limits.pidsLimit > 0 ? p.limits.pidsLimit : 0;
         const bootArgs = pidsMax > 0 ? `${FC_DEFAULT_BOOT_ARGS} hotcell.pids=${pidsMax} sbx.pids=${pidsMax}` : FC_DEFAULT_BOOT_ARGS;
         const configureAndBoot = async () => {
-            const vm = await this.spawnVmm(p.stateDir);
+            const vm = await this.spawnVmm(p.stateDir, p.cpuset);
             try {
                 const api = new FcApi(vm.apiSock);
                 await api.applyAll(buildFcApiCalls({
@@ -171,8 +197,11 @@ export class FirecrackerDriver extends AgentDriver {
                     memMib,
                     vsockUds: vm.vsockUds,
                     bootArgs,
+                    net,
+                    rootfsReadOnly,
                 }));
                 await api.call(FC_START_ACTION);
+                vm.net = net;
                 return vm;
             }
             catch (err) {
@@ -202,6 +231,73 @@ export class FirecrackerDriver extends AgentDriver {
         }
         return vm;
     }
+    // --- opt-in NAT networking --------------------------------------------------
+    /**
+     * Create a host TAP device + masquerade NAT for a networked sandbox and return
+     * its `FcNetSpec`. Each sandbox gets a private /30 (gateway .1 = host TAP, guest
+     * .2). Requires the daemon to run with CAP_NET_ADMIN (root). Idempotent per id.
+     */
+    setupTap(id) {
+        const idx = (this.tapSeq++ % 250) + 2; // 2..251, avoids .0/.1 collisions
+        const tap = `hct${idx}`;
+        const net = {
+            tap,
+            guestMac: `02:fc:00:00:00:${idx.toString(16).padStart(2, "0")}`,
+            guestIp: `172.16.${idx}.2`,
+            gatewayIp: `172.16.${idx}.1`,
+            mask: "255.255.255.252",
+        };
+        const ext = this.defaultRouteIface();
+        const subnet = `172.16.${idx}.0/30`;
+        const sh = (cmd) => execFileSync("bash", ["-lc", cmd], { stdio: "ignore" });
+        try {
+            sh(`ip tuntap add dev ${tap} mode tap 2>/dev/null || true`);
+            sh(`ip addr add ${net.gatewayIp}/30 dev ${tap} 2>/dev/null || true`);
+            sh(`ip link set ${tap} up`);
+            sh(`sysctl -wq net.ipv4.ip_forward=1`);
+            sh(`iptables -t nat -C POSTROUTING -s ${subnet} -o ${ext} -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING -s ${subnet} -o ${ext} -j MASQUERADE`);
+            sh(`iptables -C FORWARD -i ${tap} -o ${ext} -j ACCEPT 2>/dev/null || iptables -A FORWARD -i ${tap} -o ${ext} -j ACCEPT`);
+            sh(`iptables -C FORWARD -i ${ext} -o ${tap} -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || iptables -A FORWARD -i ${ext} -o ${tap} -m state --state RELATED,ESTABLISHED -j ACCEPT`);
+            log.info("firecracker: NAT networking up", { sandbox: id, tap, guestIp: net.guestIp });
+        }
+        catch (err) {
+            throw new Error(`firecracker: TAP/NAT setup failed (needs root/CAP_NET_ADMIN): ${err.message}`);
+        }
+        return net;
+    }
+    /** Tear down a sandbox's TAP device + NAT rules. Best-effort. */
+    teardownTap(net) {
+        const ext = this.defaultRouteIface();
+        const subnet = net.guestIp.replace(/\.\d+$/, ".0") + "/30";
+        const sh = (cmd) => {
+            try {
+                execFileSync("bash", ["-lc", cmd], { stdio: "ignore" });
+            }
+            catch {
+                /* best-effort */
+            }
+        };
+        sh(`iptables -t nat -D POSTROUTING -s ${subnet} -o ${ext} -j MASQUERADE 2>/dev/null || true`);
+        sh(`iptables -D FORWARD -i ${net.tap} -o ${ext} -j ACCEPT 2>/dev/null || true`);
+        sh(`iptables -D FORWARD -i ${ext} -o ${net.tap} -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || true`);
+        sh(`ip link del ${net.tap} 2>/dev/null || true`);
+    }
+    _extIface;
+    /** The host's default-route interface (for NAT masquerade), cached. */
+    defaultRouteIface() {
+        if (this._extIface)
+            return this._extIface;
+        try {
+            const out = execFileSync("bash", ["-lc", "ip -o -4 route show to default | awk '{print $5; exit}'"])
+                .toString()
+                .trim();
+            this._extIface = out || "eth0";
+        }
+        catch {
+            this._extIface = "eth0";
+        }
+        return this._extIface;
+    }
     // --- warm pool --------------------------------------------------------------
     /** Spares currently ready for adoption (used by checks). */
     poolSize() {
@@ -281,12 +377,17 @@ export class FirecrackerDriver extends AgentDriver {
         }
     }
     /** Spawn a fresh VMM process for `stateDir` and wait for its API socket. */
-    async spawnVmm(stateDir) {
+    async spawnVmm(stateDir, cpuset) {
         const apiSock = join(stateDir, "fc-api.sock");
         const vsockUds = join(stateDir, "vsock.sock");
         for (const s of [apiSock, vsockUds])
             rmQuiet(s);
-        const proc = spawn(this.cfg.fcBin, ["--api-sock", apiSock], { stdio: ["ignore", "pipe", "pipe"] });
+        // Optional host-core pinning: constrain firecracker (and its vCPU threads) to
+        // a fixed cpuset via taskset — keeps a guest on one CCD / shared L3 for stable
+        // benchmark topology. Falls through to an unpinned spawn when cpuset is unset.
+        const proc = cpuset
+            ? spawn("taskset", ["-c", cpuset, this.cfg.fcBin, "--api-sock", apiSock], { stdio: ["ignore", "pipe", "pipe"] })
+            : spawn(this.cfg.fcBin, ["--api-sock", apiSock], { stdio: ["ignore", "pipe", "pipe"] });
         proc.stdout.pipe(createWriteStream(join(stateDir, "console.log"), { flags: "a" }));
         proc.stderr.pipe(createWriteStream(join(stateDir, "console.log"), { flags: "a" }));
         const vm = { proc, apiSock, vsockUds, workspaceImg: join(stateDir, "workspace.img"), stateDir };
@@ -443,6 +544,8 @@ export class FirecrackerDriver extends AgentDriver {
         await killAndWait(vm.proc); // tears down the microVM; workspace.img persists
         for (const s of [vm.apiSock, vm.vsockUds])
             rmQuiet(s);
+        if (vm.net)
+            this.teardownTap(vm.net);
     }
     async destroy(id) {
         await this.stop(id);
@@ -535,6 +638,13 @@ function cloneFile(src, dst) {
         execFileSync("cp", [src, dst]);
     }
 }
+/** Grow an ext4 image file to `gb` gigabytes (truncate + resize2fs). Used to
+ *  give a writable per-sandbox rootfs room for apt/node installs. Needs
+ *  e2fsprogs on the host. */
+function growExt4(path, gb) {
+    execFileSync("truncate", ["-s", `${gb}G`, path]);
+    execFileSync("bash", ["-lc", `e2fsck -fy ${path} >/dev/null 2>&1; resize2fs ${path} >/dev/null 2>&1`]);
+}
 /** Create a sparse file of `sizeBytes` if it doesn't exist (workspace disk). */
 function ensureSparseFile(path, sizeBytes) {
     if (existsSync(path))

package/dist/driver/firecracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/driver/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,KAAK,EACL,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAyCnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,+CAA+C;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAWnB;IAVpB,IAAI,GAAG,aAAa,CAAC;IACtB,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC9B,MAAM,CAAe;IACrB,IAAI,GAAW,EAAE,CAAC;IAClB,UAAU,CAAS;IACnB,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,CAAS;IAClB,OAAO,CAAS;IAEjC,YAA6B,GAAa;QACxC,KAAK,EAAE,CAAC;QADmB,QAAG,GAAH,GAAG,CAAU;QAExC,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB;YACtE,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,0EAA0E;YAC1E,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACxB,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,MAAM,CAAC,IAAmB;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;;gBACvE,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;2EACuE;IAC/D,KAAK,CAAC,MAAM,CAAC,IAAmB;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE7C,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wCAAwC;gBACxC,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBAClE,OAAO,EAAE,EAAE;oBACX,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,CAKzB;QACC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAEvD,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE;oBACxE,OAAO,EAAE,CAAC,CAAC,EAAE;oBACb,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;;gBACrC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,iBAAiB,OAAO,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAE5H,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;YACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YAC3C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,GAAG,CAAC,QAAQ,CAChB,eAAe,CAAC;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;oBAC3B,UAAU,EAAE,MAAM;oBAClB,aAAa,EAAE,YAAY;oBAC3B,KAAK,EAAE,IAAI;oBACX,MAAM;oBACN,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,QAAQ;iBACT,CAAC,CACH,CAAC;gBACF,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAChC,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5B,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC/C,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+EAA+E;IAE/E,4DAA4D;IAC5D,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,IAAmB;QAClC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,qCAAqC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,8BAA8B;QAC/C,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IACtE,QAAQ;QACd,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACjD,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;wBAChC,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACzC,KAAK,EAAE,IAAI,CAAC,SAAS;qBACtB,CAAC,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;wBAClE,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC9B,CAAC,CAAC;oBACH,MAAM,CAAC,yCAAyC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,QAAQ,CAAC,QAAgB;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACnG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,GAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,gDAAgD;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,EAAQ;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACtB,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACtE,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACxB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAI,EAAU,EAAE,IAAsB,EAAE,IAAY;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,uCAAuC,EAAE;gBACnE,OAAO,EAAE,EAAE;gBACX,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,YAAa,IAAc,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,EAAQ,EAAE,SAAS,GAAG,KAAK;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,OAAgB,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,QAAQ,4BAA4B,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAE,OAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;mDAE+C;IACvC,KAAK,CAAC,kBAAkB,CAC9B,EAAU,EACV,QAAgB,EAChB,OAAe,EACf,OAAe;QAEf,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;YAC7C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1E,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QAEtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5B,MAAM,GAAG,CAAC,IAAI,CACZ,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAClG,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC;QAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,sEAAsE;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,iDAAiD;QAC7E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E;wEACoE;IAC1D,KAAK,CAAC,QAAQ,CAAC,EAAU;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,GAAG,CAAC,KAAK,MAAO,GAAa,CAAC,OAAO,KAAK;gBACzE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,6CAA6C;AAC7C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,SAAS,WAAW,CAAC,IAAkB,EAAE,SAAS,GAAG,IAAI;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,OAAO,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;kFACkF;AAClF,SAAS,SAAS,CAAC,GAAW,EAAE,GAAW;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"firecracker.js","sourceRoot":"","sources":["../../src/driver/firecracker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC5E,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,MAAM,EACN,WAAW,EACX,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,IAAI,MAAM,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,KAAK,EAEL,cAAc,GACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AA2CnC,MAAM,gBAAgB,GAAG,IAAI,CAAC,CAAC,+CAA+C;AAE9E;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAkB,SAAQ,WAAW;IAYnB;IAXpB,IAAI,GAAG,aAAa,CAAC;IACtB,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IAC9B,MAAM,CAAe;IACrB,IAAI,GAAW,EAAE,CAAC;IAClB,UAAU,CAAS;IACnB,OAAO,GAAG,CAAC,CAAC;IACZ,MAAM,GAAG,CAAC,CAAC;IACX,OAAO,GAAG,KAAK,CAAC;IACP,SAAS,CAAS;IAClB,OAAO,CAAS;IAEjC,YAA6B,GAAa;QACxC,KAAK,EAAE,CAAC;QADmB,QAAG,GAAH,GAAG,CAAU;QAExC,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC;YAC7B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB;YACtE,QAAQ,EAAE,GAAG,CAAC,aAAa;YAC3B,cAAc,EAAE,GAAG,CAAC,MAAM;YAC1B,0EAA0E;YAC1E,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;SACrF,CAAC,CAAC;QACH,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACxB,2EAA2E;YAC3E,IAAI,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;YACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,MAAM,CAAC,IAAmB;QAC9B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;;gBACvE,GAAG,CAAC,IAAI,CAAC,mCAAmC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAmB;QAC7B,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED;2EACuE;IAC/D,KAAK,CAAC,MAAM,CAAC,IAAmB;QACtC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAE7C,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEzC,6EAA6E;QAC7E,yEAAyE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC9D,GAAG,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBAClE,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,0EAA0E;gBAC1E,wEAAwE;gBACxE,wCAAwC;gBACxC,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;oBAClE,OAAO,EAAE,EAAE;oBACX,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;gBACH,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;oBAAE,OAAO,CAAC,CAAC,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YAChC,EAAE;YACF,QAAQ;YACR,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAI,CAAC,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,WAAW,CAAC,CAQzB;QACC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAErD,6EAA6E;QAC7E,sDAAsD;QACtD,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1D,wEAAwE;QACxE,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,IAAI,cAAc,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC5C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtB,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACxB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,cAAc,GAAG,KAAK,CAAC;QACzB,CAAC;QAED,4EAA4E;QAC5E,iEAAiE;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC9B,IAAI,KAAK,GAAkB,IAAI,CAAC;YAChC,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,+DAA+D,EAAE;oBACxE,OAAO,EAAE,CAAC,CAAC,EAAE;oBACb,KAAK,EAAG,GAAa,CAAC,OAAO;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,IAAI,KAAK;gBAAE,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;;gBACrC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC;QACnE,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvF,MAAM,QAAQ,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,oBAAoB,iBAAiB,OAAO,aAAa,OAAO,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAE5H,MAAM,gBAAgB,GAAG,KAAK,IAAmB,EAAE;YACjD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YACrD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;gBAClC,MAAM,GAAG,CAAC,QAAQ,CAChB,eAAe,CAAC;oBACd,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM;oBAC3B,UAAU,EAAE,MAAM;oBAClB,aAAa,EAAE,YAAY;oBAC3B,KAAK,EAAE,IAAI;oBACX,MAAM;oBACN,QAAQ,EAAE,EAAE,CAAC,QAAQ;oBACrB,QAAQ;oBACR,GAAG;oBACH,cAAc;iBACf,CAAC,CACH,CAAC;gBACF,MAAM,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAChC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC;gBACb,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5B,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;gBACnD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;gBACxF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;gBAC7D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC/C,CAAC;wBAAS,CAAC;oBACT,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,+EAA+E;IAE/E;;;;OAIG;IACK,QAAQ,CAAC,EAAU;QACzB,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACzE,MAAM,GAAG,GAAG,MAAM,GAAG,EAAE,CAAC;QACxB,MAAM,GAAG,GAAc;YACrB,GAAG;YACH,QAAQ,EAAE,kBAAkB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC/D,OAAO,EAAE,UAAU,GAAG,IAAI;YAC1B,SAAS,EAAE,UAAU,GAAG,IAAI;YAC5B,IAAI,EAAE,iBAAiB;SACxB,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC;QACpC,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC;YACH,EAAE,CAAC,qBAAqB,GAAG,+BAA+B,CAAC,CAAC;YAC5D,EAAE,CAAC,eAAe,GAAG,CAAC,SAAS,WAAW,GAAG,sBAAsB,CAAC,CAAC;YACrE,EAAE,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC;YAC5B,EAAE,CAAC,kCAAkC,CAAC,CAAC;YACvC,EAAE,CAAC,qCAAqC,MAAM,OAAO,GAAG,mEAAmE,MAAM,OAAO,GAAG,gBAAgB,CAAC,CAAC;YAC7J,EAAE,CAAC,0BAA0B,GAAG,OAAO,GAAG,oDAAoD,GAAG,OAAO,GAAG,YAAY,CAAC,CAAC;YACzH,EAAE,CAAC,0BAA0B,GAAG,OAAO,GAAG,yFAAyF,GAAG,OAAO,GAAG,iDAAiD,CAAC,CAAC;YACnM,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iEAAkE,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,iEAAiE;IACzD,WAAW,CAAC,GAAc;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;QAC3D,MAAM,EAAE,GAAG,CAAC,GAAW,EAAE,EAAE;YACzB,IAAI,CAAC;gBACH,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC,CAAC;QACF,EAAE,CAAC,qCAAqC,MAAM,OAAO,GAAG,oCAAoC,CAAC,CAAC;QAC9F,EAAE,CAAC,0BAA0B,GAAG,CAAC,GAAG,OAAO,GAAG,gCAAgC,CAAC,CAAC;QAChF,EAAE,CAAC,0BAA0B,GAAG,OAAO,GAAG,CAAC,GAAG,qEAAqE,CAAC,CAAC;QACrH,EAAE,CAAC,eAAe,GAAG,CAAC,GAAG,sBAAsB,CAAC,CAAC;IACnD,CAAC;IAEO,SAAS,CAAU;IAC3B,uEAAuE;IAC/D,iBAAiB;QACvB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,yDAAyD,CAAC,CAAC;iBACjG,QAAQ,EAAE;iBACV,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,SAAS,GAAG,GAAG,IAAI,MAAM,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QAC1B,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,+EAA+E;IAE/E,4DAA4D;IAC5D,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACK,QAAQ,CAAC,IAAmB;QAClC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtF,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,qCAAqC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,8BAA8B;QAC/C,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IACtE,QAAQ;QACd,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACjD,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC;IAEO,KAAK,CAAC,MAAM;QAClB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBAC1C,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;wBAChC,EAAE,EAAE,QAAQ,CAAC,EAAE;wBACf,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;wBACzC,KAAK,EAAE,IAAI,CAAC,SAAS;qBACtB,CAAC,CAAC;oBACH,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACnB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAClG,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,IAAI,CAAC,yDAAyD,EAAE;wBAClE,KAAK,EAAG,GAAa,CAAC,OAAO;qBAC9B,CAAC,CAAC;oBACH,MAAM,CAAC,yCAAyC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,4EAA4E;IACpE,KAAK,CAAC,QAAQ,CAAC,QAAgB,EAAE,MAAe;QACtD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChD,8EAA8E;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,MAAM,IAAI,GAAG,MAAM;YACjB,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAChH,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACnF,MAAM,EAAE,GAAS,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtG,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,gDAAgD;QACpF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,EAAQ;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO;QAC/B,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC;QACd,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,KAAK,EAAE,EAAE;YACpC,MAAM,EAAE,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;YAChE,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,KAAK,CAAC,OAAO,EAAE,CAAC;gBAChB,EAAE,CAAC,OAAO,EAAE,CAAC;YACf,CAAC,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACf,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACf,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACtB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACzB,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CACtB,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CACtE,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACjB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACxB,GAAG,CAAC,KAAK,EAAE,CAAC;YACZ,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,YAAY,CAAI,EAAU,EAAE,IAAsB,EAAE,IAAY;QAC5E,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,uCAAuC,EAAE;gBACnE,OAAO,EAAE,EAAE;gBACX,KAAK,EAAG,GAAa,CAAC,OAAO;aAC9B,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,OAAO,MAAM,IAAI,EAAE,CAAC;YACtB,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,YAAa,IAAc,CAAC,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,YAAY,CAAC,EAAQ,EAAE,SAAS,GAAG,KAAK;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,OAAgB,CAAC;QACrB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,QAAQ,4BAA4B,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC;gBACvF,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;gBAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,GAAG,GAAG,CAAC;gBACd,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,qCAAqC,MAAM,CAAE,OAAiB,EAAE,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACzG,CAAC;IAED;;mDAE+C;IACvC,KAAK,CAAC,kBAAkB,CAC9B,EAAU,EACV,QAAgB,EAChB,OAAe,EACf,OAAe;QAEf,MAAM,YAAY,GAAG,KAAK,IAAmB,EAAE;YAC7C,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC1E,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,EAAE,eAAe,CAAC,CAAC;QAEtE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,6EAA6E;QAC7E,6EAA6E;QAC7E,kDAAkD;QAClD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,EAAU;QACpB,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC5B,MAAM,GAAG,CAAC,IAAI,CACZ,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAClG,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,gCAAgC;QAC5D,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAU;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,sEAAsE;QACtE,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,iDAAiD;QAC7E,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,EAAE,CAAC,GAAG;YAAE,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC;YACH,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC1C,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,UAAU,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IAED,6EAA6E;IAE7E;wEACoE;IAC1D,KAAK,CAAC,QAAQ,CAAC,EAAU;QACjC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QACtE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,6EAA6E;IAE7E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,8EAA8E;gBAC5E,qFAAqF,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4BAA4B,IAAI,CAAC,GAAG,CAAC,KAAK,MAAO,GAAa,CAAC,OAAO,KAAK;gBACzE,wCAAwC,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,6EAA6E;QAC7E,4EAA4E;QAC5E,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YACtD,MAAM,CAAC,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC;gBAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAC7C,CAAC;CACF;AAED,6CAA6C;AAC7C,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,UAAU,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED;mEACmE;AACnE,SAAS,WAAW,CAAC,IAAkB,EAAE,SAAS,GAAG,IAAI;IACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;YAAE,OAAO,OAAO,EAAE,CAAC;QACzE,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;kFACkF;AAClF,SAAS,SAAS,CAAC,GAAW,EAAE,GAAW;IACzC,IAAI,CAAC;QACH,YAAY,CAAC,IAAI,EAAE,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,CAAC;AACH,CAAC;AAED;;6BAE6B;AAC7B,SAAS,QAAQ,CAAC,IAAY,EAAE,EAAU;IACxC,YAAY,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,YAAY,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,cAAc,IAAI,+BAA+B,IAAI,kBAAkB,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,IAAY,EAAE,SAAiB;IACvD,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7B,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO;QAC7B,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/driver/router.d.ts

@@ -38,6 +38,8 @@ export declare class DriverRouter implements Driver {
     snapshot(id: string): Promise<void>;
     /** Whether the backing driver can memory-snapshot this sandbox right now. */
     canSnapshot(id: string): boolean;
+    /** Startup egress reconcile on the default driver (where enforcement lives). */
+    initEgress(): Promise<void>;
     destroy(id: string): Promise<void>;
     exec(id: string, command: string, opts: ExecOptions, onEvent: (e: ExecEvent) => void): Promise<number>;
     writeFile(id: string, opts: WriteFileOptions): Promise<void>;

package/dist/driver/router.js

@@ -65,6 +65,12 @@ export class DriverRouter {
         const d = this.forId(id);
         return typeof d.snapshot === "function" && (d.canSnapshot ? d.canSnapshot(id) : true);
     }
+    /** Startup egress reconcile on the default driver (where enforcement lives). */
+    async initEgress() {
+        const d = this.instance(this.defaultName);
+        if (typeof d.initEgress === "function")
+            await d.initEgress();
+    }
     destroy(id) {
         return this.forId(id).destroy(id);
     }

package/dist/driver/router.js.map

@@ -1 +1 @@
-{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/driver/router.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAa/C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAY;IAKJ;IACA;IACA;IANV,IAAI,CAAS;IACd,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,YACmB,MAAc,EACd,KAAmB,EACnB,WAAmB;QAFnB,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAc;QACnB,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;IAED,gFAAgF;IACxE,QAAQ,CAAC,IAAwB;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,uFAAuF;IAC/E,OAAO,CAAC,IAAmB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,6EAA6E;IAE7E,MAAM,CAAC,IAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,IAAmB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,EAAU;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD;;uEAEmE;IACnE,QAAQ,CAAC,EAAU;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,6EAA6E;IAC7E,WAAW,CAAC,EAAU;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,6EAA6E;IAE7E,IAAI,CACF,EAAU,EACV,OAAe,EACf,IAAiB,EACjB,OAA+B;QAE/B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAsB;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,CAAC,EAAU,EAAE,IAAqB;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,EAAU,EAAE,IAAkB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAsB;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,UAAU,CACR,EAAU,EACV,IAAY,EACZ,IAA4C,EAC5C,OAAqC;QAErC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,YAAY,CACV,EAAU,EACV,MAAc,EACd,OAAe,EACf,IAAyB;QAEzB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,aAAa,CACX,EAAU,EACV,KAA6C;QAE7C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,WAAW,CAAC,EAAU,EAAE,GAAW,EAAE,MAAe;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CACf,EAAU,EACV,OAAe,EACf,IAA8C,EAC9C,MAA+B;QAE/B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,WAAW,CAAC,EAAU,EAAE,IAAY,EAAE,IAAwB;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,aAAa,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,YAAY,CAAC,EAAU,EAAE,IAAqB;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,YAAY,CAAC,EAAU,EAAE,OAAe;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,aAAa,CAAC,EAAU,EAAE,OAAe;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,CAAC,EAAU;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,6EAA6E;IAE7E;0EACsE;IACtE,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,IAAI,GAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;gEAC4D;IAC5D,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAyC,CAAC,SAAS,CAAC;YACnE,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/driver/router.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAa/C;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,YAAY;IAKJ;IACA;IACA;IANV,IAAI,CAAS;IACd,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,YACmB,MAAc,EACd,KAAmB,EACnB,WAAmB;QAFnB,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAc;QACnB,gBAAW,GAAX,WAAW,CAAQ;QAEpC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;IAED,gFAAgF;IACxE,QAAQ,CAAC,IAAwB;QACvC,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,WAAW,CAAC;QACrC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,uFAAuF;IAC/E,OAAO,CAAC,IAAmB;QACjC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC;IAED,6EAA6E;IAE7E,MAAM,CAAC,IAAmB;QACxB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IACD,KAAK,CAAC,IAAmB;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,EAAU;QACb,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC;IACD;;uEAEmE;IACnE,QAAQ,CAAC,EAAU;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,6EAA6E;IAC7E,WAAW,CAAC,EAAU;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,OAAO,OAAO,CAAC,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,gFAAgF;IAChF,KAAK,CAAC,UAAU;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,UAAU;YAAE,MAAM,CAAC,CAAC,UAAU,EAAE,CAAC;IAC/D,CAAC;IACD,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,6EAA6E;IAE7E,IAAI,CACF,EAAU,EACV,OAAe,EACf,IAAiB,EACjB,OAA+B;QAE/B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAsB;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,CAAC,EAAU,EAAE,IAAqB;QACxC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,EAAU,EAAE,IAAkB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,SAAS,CAAC,EAAU,EAAE,IAAsB;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,UAAU,CACR,EAAU,EACV,IAAY,EACZ,IAA4C,EAC5C,OAAqC;QAErC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,YAAY,CACV,EAAU,EACV,MAAc,EACd,OAAe,EACf,IAAyB;QAEzB,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;IACD,aAAa,CACX,EAAU,EACV,KAA6C;QAE7C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,WAAW,CAAC,EAAU,EAAE,GAAW,EAAE,MAAe;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,iBAAiB,CACf,EAAU,EACV,OAAe,EACf,IAA8C,EAC9C,MAA+B;QAE/B,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrE,CAAC;IACD,WAAW,CAAC,EAAU,EAAE,IAAY,EAAE,IAAwB;QAC5D,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IACD,aAAa,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,YAAY,CAAC,EAAU,EAAE,IAAqB;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IACD,YAAY,CAAC,EAAU,EAAE,OAAe;QACtC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IACD,aAAa,CAAC,EAAU,EAAE,OAAe;QACvC,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,KAAK,CAAC,EAAU;QACd,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,6EAA6E;IAE7E;0EACsE;IACtE,IAAI;QACF,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,CAAC;IACD;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ;QACZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/F,IAAI,IAAI,GAAa,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC7B,IAAI,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9F,CAAC;YAAC,MAAM,CAAC;gBACP,uEAAuE;YACzE,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED;gEAC4D;IAC5D,KAAK,CAAC,QAAQ;QACZ,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,CAAC;YACxC,MAAM,KAAK,GAAI,CAAyC,CAAC,SAAS,CAAC;YACnE,IAAI,OAAO,KAAK,KAAK,UAAU;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;CACF"}

package/dist/driver/types.d.ts

@@ -98,6 +98,29 @@ export interface CreateOptions {
     repoRef?: string;
     /** Hard CPU/memory/PID caps for the sandbox (resolved effective values). */
     limits?: ResourceLimits;
+    /**
+     * Opt-in outbound networking for a microVM sandbox (Firecracker): give the
+     * guest a real NAT'd NIC instead of the default no-network-device posture.
+     * For trusted workloads that need general internet (apt/git/pip/benchmarks).
+     * Ignored by the container driver (containers are networked already).
+     */
+    networked?: boolean;
+    /**
+     * Give a microVM sandbox a private, writable rootfs (cloned + grown from the
+     * shared image) WITHOUT implying a NIC. `networked: true` already does this;
+     * `writableRootfs: true` grants the same disk posture to a contained sandbox —
+     * no network device, egress via the vsock gateway only — so workloads that
+     * write to `/` (apt, node into /opt, …) still run in the default-deny posture.
+     * Ignored by the container driver (its filesystem is already writable).
+     */
+    writableRootfs?: boolean;
+    /**
+     * Host-core pinning for a microVM sandbox (Firecracker): a `taskset`-style CPU
+     * list (e.g. `"0-7"`) the firecracker process — and thus its vCPU threads — is
+     * constrained to. Used to keep a guest on a single CCD / shared L3 for stable,
+     * disclosed benchmark topology. Ignored by the container driver.
+     */
+    cpuset?: string;
 }
 /**
  * Runtime-driver interface — the core abstraction of sbx.
@@ -142,6 +165,12 @@ export interface Driver {
      * processes when they'll survive the resume.
      */
     canSnapshot?(id: string): boolean;
+    /**
+     * Optional startup hook: reconcile any host-level egress state (e.g. the
+     * enforcement bridge network) so a collision fails fast at boot with an
+     * actionable message rather than as an error on the first sandbox create.
+     */
+    initEgress?(): Promise<void>;
     /**
      * Run a command inside the sandbox, streaming output via `onEvent`.
      * Resolves with the process exit code.

package/dist/fc-check.js

@@ -74,6 +74,28 @@ async function main() {
     });
     assert.match(withPids[0].body.boot_args, /hotcell\.pids=64/);
     ok("custom boot args (pidsLimit cmdline) flow through");
+    // 2b. Opt-in networking adds a network-interface + the kernel ip= autoconfig.
+    const withNet = buildFcApiCalls({
+        kernelPath: "/k",
+        rootfsPath: "/r",
+        workspacePath: "/w",
+        vcpus: 1,
+        memMib: 256,
+        vsockUds: "/v",
+        net: {
+            tap: "hct2",
+            guestMac: "02:fc:00:00:00:02",
+            guestIp: "172.16.2.2",
+            gatewayIp: "172.16.2.1",
+            mask: "255.255.255.252",
+        },
+    });
+    const nic = withNet.find((c) => c.path === "/network-interfaces/eth0");
+    assert.ok(nic, "network-interface call is present when networked");
+    assert.equal(nic.body.host_dev_name, "hct2");
+    assert.match(withNet[0].body.boot_args, /ip=172\.16\.2\.2::172\.16\.2\.1:255\.255\.255\.252::eth0:off/);
+    assert.ok(!buildFcApiCalls({ kernelPath: "/k", rootfsPath: "/r", workspacePath: "/w", vcpus: 1, memMib: 256, vsockUds: "/v" }).some((c) => c.path.includes("network-interfaces")), "no NIC by default");
+    ok("opt-in networking: eth0 NIC + kernel ip= autoconfig (none by default)");
     // 3. vsock handshake parser: incomplete → null; OK line → split leftover; bad → not ok.
     assert.equal(parseVsockHandshake(Buffer.from("OK 1024")), null, "no newline yet → null");
     const okParse = parseVsockHandshake(Buffer.from("OK 1024\nHELLOBYTES"));

package/dist/fc-check.js.map

@@ -1 +1 @@
-{"version":3,"file":"fc-check.js","sourceRoot":"","sources":["../src/fc-check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,IAAI,MAAM,GAAG,CAAC,CAAC;AACf,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE;IACvB,MAAM,EAAE,CAAC;IACT,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,8EAA8E;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,WAAW;QAC1B,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CACd,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACxB,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EACpF,oDAAoD,CACrD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAwD,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAoD,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACnC,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA0D,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA0D,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA+C,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACjC,EAAE,CAAC,0EAA0E,CAAC,CAAC;IAE/E,MAAM,CAAC,KAAK,CAAE,eAAe,CAAC,IAAgC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC7F,EAAE,CAAC,8BAA8B,CAAC,CAAC;IAEnC,iFAAiF;IACjF,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAE,WAAW,CAAC,IAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,uBAAuB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAA+E,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAIvB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,wFAAwF,CAAC,CAAC;IAE7F,iEAAiE;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,GAAG,oBAAoB,8BAA8B;KAChE,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,IAA8B,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzF,EAAE,CAAC,mDAAmD,CAAC,CAAC;IAExD,wFAAwF;IACxF,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAC;IACpE,EAAE,CAAC,oEAAoE,CAAC,CAAC;IAEzE,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,qCAAqC;QAC7C,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;QACT,aAAa,EAAE,8BAA8B;KAC9C,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,iDAAiD,CAAC,CAAC;QAC3G,EAAE,CAAC,oDAAoD,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,oEAAoE,CAAC,CAAC;IAC3E,CAAC;IAED,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IACrC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,wDAAwD,CAAC,CAAC;AAC7F,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}
+{"version":3,"file":"fc-check.js","sourceRoot":"","sources":["../src/fc-check.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,WAAW,EACX,eAAe,EACf,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,IAAI,MAAM,GAAG,CAAC,CAAC;AACf,MAAM,EAAE,GAAG,CAAC,CAAS,EAAE,EAAE;IACvB,MAAM,EAAE,CAAC;IACT,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC1B,CAAC,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,8EAA8E;IAC9E,MAAM,KAAK,GAAG,eAAe,CAAC;QAC5B,UAAU,EAAE,YAAY;QACxB,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,WAAW;QAC1B,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,WAAW;KACtB,CAAC,CAAC;IACH,MAAM,CAAC,SAAS,CACd,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EACxB,CAAC,cAAc,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EACpF,oDAAoD,CACrD,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAwD,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAoD,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IACnC,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA0D,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA0D,CAAC;IACrF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAA+C,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACjC,EAAE,CAAC,0EAA0E,CAAC,CAAC;IAE/E,MAAM,CAAC,KAAK,CAAE,eAAe,CAAC,IAAgC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;IAC7F,EAAE,CAAC,8BAA8B,CAAC,CAAC;IAEnC,iFAAiF;IACjF,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,CAAC,KAAK,CAAE,WAAW,CAAC,IAA0B,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtE,MAAM,UAAU,GAAG,uBAAuB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACvE,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,UAAU,CAAC,IAA+E,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,IAIvB,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrC,EAAE,CAAC,wFAAwF,CAAC,CAAC;IAE7F,iEAAiE;IACjE,MAAM,QAAQ,GAAG,eAAe,CAAC;QAC/B,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,GAAG,oBAAoB,8BAA8B;KAChE,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAE,QAAQ,CAAC,CAAC,CAAE,CAAC,IAA8B,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;IACzF,EAAE,CAAC,mDAAmD,CAAC,CAAC;IAExD,8EAA8E;IAC9E,MAAM,OAAO,GAAG,eAAe,CAAC;QAC9B,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,aAAa,EAAE,IAAI;QACnB,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG;QACX,QAAQ,EAAE,IAAI;QACd,GAAG,EAAE;YACH,GAAG,EAAE,MAAM;YACX,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,YAAY;YACvB,IAAI,EAAE,iBAAiB;SACxB;KACF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,0BAA0B,CAAC,CAAC;IACvE,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,kDAAkD,CAAC,CAAC;IACnE,MAAM,CAAC,KAAK,CAAE,GAAI,CAAC,IAAkC,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,CAAC,KAAK,CACT,OAAO,CAAC,CAAC,CAAE,CAAC,IAA8B,CAAC,SAAS,EACrD,8DAA8D,CAC/D,CAAC;IACF,MAAM,CAAC,EAAE,CAAC,CAAC,eAAe,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACxM,EAAE,CAAC,uEAAuE,CAAC,CAAC;IAE5E,wFAAwF;IACxF,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,OAAO,CAAC,EAAE,EAAE,sBAAsB,CAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,OAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,YAAY,EAAE,gCAAgC,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,8BAA8B,CAAC,CAAC;IACpE,EAAE,CAAC,oEAAoE,CAAC,CAAC;IAEzE,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,iBAAiB,CAAC;QACnC,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,sBAAsB;QAC9B,MAAM,EAAE,qCAAqC;QAC7C,QAAQ,EAAE,uBAAuB;QACjC,MAAM,EAAE,CAAC;QACT,aAAa,EAAE,8BAA8B;KAC9C,CAAC,CAAC;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,iDAAiD,CAAC,CAAC;QAC3G,EAAE,CAAC,oDAAoD,CAAC,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,oEAAoE,CAAC,CAAC;IAC3E,CAAC;IAED,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IACrC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,yBAAyB,CAAC,CAAC;IACxD,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,EAAE,uBAAuB,CAAC,CAAC;IAClD,EAAE,CAAC,aAAa,IAAI,CAAC,QAAQ,QAAQ,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC;IAEvD,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,wDAAwD,CAAC,CAAC;AAC7F,CAAC;AAED,IAAI,EAAE,CAAC,IAAI,CACT,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EACrB,CAAC,GAAG,EAAE,EAAE;IACN,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CACF,CAAC"}

package/dist/index.js

@@ -13,6 +13,10 @@ import { createProxyServer } from "./proxy/server.js";
 import { buildProviders, createEgressProxy } from "./proxy/egress.js";
 import { loadModelPrices } from "./pricing.js";
 import { ensureEgressFirewall } from "./net/firewall.js";
+/** A loopback bind host (unreachable from sandboxes on native-Linux dockerd). */
+function isLoopback(host) {
+    return host === "127.0.0.1" || host === "localhost" || host === "::1";
+}
 async function main() {
     const config = loadConfig();
     configureLogger({ level: config.logLevel, format: config.logFormat });
@@ -59,7 +63,7 @@ async function main() {
             otlp: config.otlpEndpoint || "off",
         });
     });
-    const proxy = createProxyServer({ config, driver, store });
+    const proxy = createProxyServer({ config, driver, store, capacity });
     proxy.listen(config.proxyPort, config.proxyHost, () => {
         log.info("preview proxy listening", {
             url: `http://${config.proxyHost}:${config.proxyPort}`,
@@ -72,12 +76,34 @@ async function main() {
     // Install the host default-deny egress firewall (Linux + SBX_EGRESS_ENFORCE only;
     // advisory no-op otherwise). Best-effort: logs and continues if it can't.
     await ensureEgressFirewall(config);
+    // Reconcile the egress bridge network at boot so a subnet collision (e.g. a
+    // stale network from a pre-rename daemon) fails fast with an actionable message
+    // instead of a 422 on the first create.
+    if (config.egressEnforce && typeof driver.initEgress === "function") {
+        await driver.initEgress();
+    }
     const providers = buildProviders(config);
     const prices = loadModelPrices(config.modelPricesPath);
+    // Native-Linux enforcement footgun: sandboxes reach the daemon via the bridge
+    // gateway (host.docker.internal → ~172.17.0.1), so a loopback-only egress bind
+    // is unreachable from them and every outbound call (npm, the LLM gateway) fails
+    // with ECONNREFUSED. When enforcement is on, the platform is Linux, and the
+    // operator hasn't pinned a host explicitly, bind 0.0.0.0 — access is still gated
+    // by the per-sandbox egress token + the host firewall. Block the port at your
+    // cloud firewall.
+    const egressHostSet = !!(process.env.HOTCELL_EGRESS_HOST ?? process.env.SBX_EGRESS_HOST);
+    const egressBindHost = config.egressEnforce && !egressHostSet && process.platform === "linux" && isLoopback(config.egressHost)
+        ? "0.0.0.0"
+        : config.egressHost;
+    if (egressBindHost !== config.egressHost) {
+        log.info("egress proxy binding 0.0.0.0 for native-Linux enforcement (token-gated; firewall the port)", {
+            port: config.egressPort,
+        });
+    }
     const egress = config.egressPort > 0 ? createEgressProxy({ config, store, providers, prices }) : undefined;
-    egress?.listen(config.egressPort, config.egressHost, () => {
+    egress?.listen(config.egressPort, egressBindHost, () => {
         log.info("egress proxy listening", {
-            url: `http://${config.egressHost}:${config.egressPort}`,
+            url: `http://${egressBindHost}:${config.egressPort}`,
             providers: Object.keys(providers).length ? Object.keys(providers).join(",") : "none configured",
         });
     });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,gBAAgB,CAAC;QACf,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAClC,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAClC,GAAG,EAAE,UAAU,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE;YACrD,QAAQ,EAAE,gCAAgC,MAAM,CAAC,SAAS,GAAG;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,8CAA8C;IAC9C,kFAAkF;IAClF,0EAA0E;IAC1E,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE;QACxD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,GAAG,EAAE,UAAU,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,EAAE;YACvD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB;SAChG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,MAAM,GACV,MAAM,CAAC,cAAc,GAAG,CAAC;QACvB,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,2EAA2E;IAC3E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,GAAG,CAAC;QAC1B,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC9E,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,gBAAgB,CAAC;QACf,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACtE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5D,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACjD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAClC,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAClC,GAAG,EAAE,UAAU,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE;YACrD,QAAQ,EAAE,gCAAgC,MAAM,CAAC,SAAS,GAAG;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,8CAA8C;IAC9C,kFAAkF;IAClF,0EAA0E;IAC1E,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,gFAAgF;IAChF,wCAAwC;IACxC,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzF,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACrG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,4FAA4F,EAAE;YACrG,IAAI,EAAE,MAAM,CAAC,UAAU;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GACV,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,GAAG,EAAE,UAAU,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE;YACpD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB;SAChG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,MAAM,GACV,MAAM,CAAC,cAAc,GAAG,CAAC;QACvB,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,2EAA2E;IAC3E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,GAAG,CAAC;QAC1B,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC9E,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lifecycle.d.ts

@@ -1,3 +1,4 @@
+import { type Capacity } from "./capacity.js";
 import type { Driver } from "./driver/types.js";
 import type { SandboxStore } from "./store.js";
 import type { SandboxRecord } from "./types.js";
@@ -15,6 +16,11 @@ import type { SandboxRecord } from "./types.js";
  * alive on resume — nothing is lost by pausing); otherwise it's the cold
  * stop-with-volume (workspace survives, processes don't). A `stopped` sandbox is
  * user-intent and is never auto-resumed nor auto-paused.
+ *
+ * The paused/stopped → running edge is **admission-gated**: a resume re-commits
+ * the sandbox's memory, so it must fit the host budget just like a create
+ * (`Capacity.admitAndReserve`); an over-budget resume throws `CapacityError`,
+ * which API/proxy callers surface as 503.
  */
 /**
  * Pause a running sandbox, preferring a memory snapshot (fast resume, live
@@ -25,9 +31,11 @@ import type { SandboxRecord } from "./types.js";
 export declare function pauseSandbox(driver: Driver, store: SandboxStore, record: SandboxRecord): Promise<void>;
 /**
  * Resume a paused (or stopped) sandbox: recreate its container, reattaching the
- * persistent volume, and mark it running + active.
+ * persistent volume, and mark it running + active. When a `capacity` meter is
+ * given the resume is admission-gated — an over-budget wake throws
+ * `CapacityError` instead of over-subscribing the host.
  */
-export declare function resumeSandbox(driver: Driver, store: SandboxStore, record: SandboxRecord): Promise<void>;
+export declare function resumeSandbox(driver: Driver, store: SandboxStore, record: SandboxRecord, capacity?: Capacity): Promise<void>;
 /**
  * Auto-pause sandboxes that have been idle past their `sleepAfterMs`. A sandbox
  * advertising a service (an exposed port) or running a tracked background

package/dist/lifecycle.js

@@ -1,3 +1,4 @@
+import { CapacityError } from "./capacity.js";
 import { log } from "./logger.js";
 /**
  * Lifecycle FSM transitions and the idle reaper.
@@ -13,6 +14,11 @@ import { log } from "./logger.js";
  * alive on resume — nothing is lost by pausing); otherwise it's the cold
  * stop-with-volume (workspace survives, processes don't). A `stopped` sandbox is
  * user-intent and is never auto-resumed nor auto-paused.
+ *
+ * The paused/stopped → running edge is **admission-gated**: a resume re-commits
+ * the sandbox's memory, so it must fit the host budget just like a create
+ * (`Capacity.admitAndReserve`); an over-budget resume throws `CapacityError`,
+ * which API/proxy callers surface as 503.
  */
 /**
  * Pause a running sandbox, preferring a memory snapshot (fast resume, live
@@ -43,21 +49,39 @@ export async function pauseSandbox(driver, store, record) {
 }
 /**
  * Resume a paused (or stopped) sandbox: recreate its container, reattaching the
- * persistent volume, and mark it running + active.
+ * persistent volume, and mark it running + active. When a `capacity` meter is
+ * given the resume is admission-gated — an over-budget wake throws
+ * `CapacityError` instead of over-subscribing the host.
  */
-export async function resumeSandbox(driver, store, record) {
-    await driver.start({
-        id: record.id,
-        image: record.image,
-        driver: record.driver,
-        env: record.env,
-        labels: record.labels,
-        persist: record.persist,
-        limits: record.limits,
-    });
+export async function resumeSandbox(driver, store, record, capacity) {
+    // Reserve the sandbox's memory for the duration of the start: once the record
+    // is written back as `running` it's counted by the meter itself, so the
+    // pending reservation is released synchronously after the status write.
+    const admitted = capacity?.admitAndReserve(record.limits.memoryMb) ?? {
+        ok: true,
+        release: () => { },
+    };
+    if (!admitted.ok)
+        throw new CapacityError(admitted.reason);
+    try {
+        await driver.start({
+            id: record.id,
+            image: record.image,
+            driver: record.driver,
+            env: record.env,
+            labels: record.labels,
+            persist: record.persist,
+            limits: record.limits,
+        });
+    }
+    catch (err) {
+        admitted.release();
+        throw err;
+    }
     record.status = "running";
     record.lastActivityAt = new Date().toISOString();
     store.add(record);
+    admitted.release();
 }
 /**
  * Auto-pause sandboxes that have been idle past their `sleepAfterMs`. A sandbox