@hotcell/daemon 0.1.22 → 0.1.24

package/dist/audit.js

@@ -0,0 +1,260 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { readFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { createHash } from "node:crypto";
+import { hostname } from "node:os";
+import { log } from "./logger.js";
+export const AUDIT_LIMITS = {
+    maxQueueEvents: 2048,
+    maxBatchEvents: 128,
+    maxBatchBytes: 512 * 1024,
+    maxAttempts: 3,
+};
+const HOST_NAME = hostname();
+const SERVICE_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+        return typeof pkg.version === "string" ? pkg.version : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+})();
+let cfg = { path: "", endpoint: "", headers: {} };
+let queue = [];
+let timer;
+let writes = Promise.resolve();
+let flushInFlight;
+let lastQueueWarningAt = 0;
+export function configureAudit(config) {
+    cfg = config;
+    if (cfg.endpoint && !timer) {
+        timer = setInterval(() => void flushAudit(), 3000);
+        timer.unref?.();
+    }
+}
+/** Emit one best-effort local JSONL event and, when configured, queue it for OTLP. */
+export function audit(event) {
+    const entry = buildAuditEntry(event);
+    if (cfg.path) {
+        const path = cfg.path;
+        writes = writes.then(async () => {
+            await mkdir(dirname(path), { recursive: true });
+            await appendFile(path, JSON.stringify(entry) + "\n", { mode: 0o600 });
+        }).catch((err) => log.warn("audit JSONL write failed", { error: String(err) }));
+    }
+    if (cfg.endpoint)
+        enqueue({ entry, attempts: 0, nextAttemptAt: 0 });
+}
+/** Build a stable local audit event; exported to keep serialization unit-testable. */
+export function buildAuditEntry(event, at = new Date()) {
+    const rawToken = event.attributes?.["token.raw"];
+    const attributes = Object.fromEntries(Object.entries(event.attributes ?? {}).filter(([key]) => key !== "token.raw"));
+    const severity = event.severity ?? severityForEvent(event.event);
+    const action = event.action ?? actionForEvent(event.event);
+    return {
+        ...attributes,
+        timestamp: at.toISOString(),
+        schema_version: "1.0",
+        event: event.event,
+        "event.action": action,
+        "beacon.event.action": action,
+        "session.id": event.sandboxId ?? "",
+        "sandbox.id": event.sandboxId ?? "",
+        "token.id": typeof rawToken === "string"
+            ? createHash("sha256").update(rawToken).digest("hex")
+            : undefined,
+        driver: event.driver ?? "",
+        host: HOST_NAME,
+        "host.name": HOST_NAME,
+        severityText: severity,
+        severityNumber: severityNumber(severity),
+    };
+}
+/** Convert an OTLP AnyValue; JSON numbers with fractions must use doubleValue. */
+export function toOtlpAnyValue(value) {
+    if (typeof value === "boolean")
+        return { boolValue: value };
+    if (typeof value === "number" && Number.isFinite(value)) {
+        return Number.isInteger(value) ? { intValue: value } : { doubleValue: value };
+    }
+    return { stringValue: String(value) };
+}
+/** Build an OTLP/JSON ExportLogsServiceRequest from already-normalized events. */
+export function buildOtlpLogsPayload(entries) {
+    return {
+        resourceLogs: [{
+                resource: { attributes: [
+                        { key: "service.name", value: { stringValue: "hotcell" } },
+                        { key: "service.version", value: { stringValue: SERVICE_VERSION } },
+                        { key: "host.name", value: { stringValue: HOST_NAME } },
+                    ] },
+                scopeLogs: [{
+                        scope: { name: "hotcell.audit", version: "1.0" },
+                        logRecords: entries.map((entry) => ({
+                            timeUnixNano: String(BigInt(Date.parse(String(entry.timestamp))) * 1000000n),
+                            severityNumber: entry.severityNumber ?? 9,
+                            severityText: entry.severityText ?? "INFO",
+                            body: { stringValue: String(entry.event ?? "") },
+                            attributes: Object.entries(entry)
+                                .filter(([key, value]) => value !== undefined
+                                && key !== "timestamp" && key !== "event"
+                                && key !== "severityText" && key !== "severityNumber")
+                                .map(([key, value]) => ({ key, value: toOtlpAnyValue(value) })),
+                        })),
+                    }],
+            }],
+    };
+}
+/** Best-effort bounded shutdown flush; a dead collector cannot hold shutdown forever. */
+export async function stopAudit() {
+    if (timer)
+        clearInterval(timer);
+    timer = undefined;
+    await flushAudit();
+    await writes;
+}
+/** Flush at most one bounded batch. Failures are retried a limited number of times. */
+export async function flushAudit() {
+    if (flushInFlight)
+        return flushInFlight;
+    if (!cfg.endpoint || !queue.length)
+        return;
+    const operation = deliverOneBatch();
+    flushInFlight = operation;
+    try {
+        await operation;
+    }
+    finally {
+        if (flushInFlight === operation)
+            flushInFlight = undefined;
+    }
+}
+async function deliverOneBatch() {
+    const batch = takeBatch();
+    if (batch.length === 0)
+        return;
+    try {
+        const response = await fetch(cfg.endpoint + "/v1/logs", {
+            method: "POST",
+            headers: { "content-type": "application/json", ...cfg.headers },
+            signal: AbortSignal.timeout(5000),
+            body: JSON.stringify(buildOtlpLogsPayload(batch.map((item) => item.entry))),
+        });
+        if (!response.ok)
+            throw new Error("status " + response.status);
+    }
+    catch (err) {
+        const now = Date.now();
+        let dropped = 0;
+        for (const item of batch) {
+            item.attempts += 1;
+            if (item.attempts >= AUDIT_LIMITS.maxAttempts) {
+                dropped += 1;
+                continue;
+            }
+            item.nextAttemptAt = now + Math.min(30_000, 1000 * 2 ** (item.attempts - 1));
+            enqueue(item);
+        }
+        log.warn("audit OTLP export failed", {
+            error: String(err), events: batch.length, retrying: batch.length - dropped, dropped,
+        });
+    }
+}
+function takeBatch() {
+    const batch = [];
+    let index = 0;
+    const now = Date.now();
+    while (index < queue.length && batch.length < AUDIT_LIMITS.maxBatchEvents) {
+        const item = queue[index];
+        if (item.nextAttemptAt > now) {
+            index += 1;
+            continue;
+        }
+        const candidateBody = JSON.stringify(buildOtlpLogsPayload([
+            ...batch.map((pending) => pending.entry), item.entry,
+        ]));
+        if (Buffer.byteLength(candidateBody, "utf8") > AUDIT_LIMITS.maxBatchBytes) {
+            if (batch.length > 0)
+                break;
+            queue.splice(index, 1);
+            log.warn("oversized audit event dropped from OTLP queue", {
+                maxBytes: AUDIT_LIMITS.maxBatchBytes,
+            });
+            continue;
+        }
+        queue.splice(index, 1);
+        batch.push(item);
+    }
+    return batch;
+}
+function enqueue(item) {
+    if (queue.length >= AUDIT_LIMITS.maxQueueEvents) {
+        queue.shift();
+        if (Date.now() - lastQueueWarningAt >= 60_000) {
+            lastQueueWarningAt = Date.now();
+            log.warn("audit OTLP queue full; oldest event dropped", {
+                maxQueueEvents: AUDIT_LIMITS.maxQueueEvents,
+            });
+        }
+    }
+    queue.push(item);
+}
+function actionForEvent(event) {
+    const known = {
+        "sandbox.create": "sandbox.created",
+        "sandbox.start": "sandbox.started",
+        "sandbox.stop": "sandbox.stopped",
+        "sandbox.pause": "sandbox.paused",
+        "sandbox.resume": "sandbox.resumed",
+        "sandbox.destroy": "sandbox.destroyed",
+        "sandbox.admission_denied": "sandbox.create.denied",
+        "sandbox.exec.start": "command.started",
+        "sandbox.exec": "command.executed",
+        "sandbox.process.start": "process.started",
+        "sandbox.file.read": "file.read",
+        "sandbox.file.write": "file.written",
+        "sandbox.file.mkdir": "file.directory_created",
+        "sandbox.terminal.open": "terminal.connected",
+        "sandbox.terminal.close": "terminal.disconnected",
+        "sandbox.preview.expose": "preview.port_exposed",
+        "sandbox.preview.unexpose": "preview.port_unexposed",
+        "sandbox.backup.create": "backup.created",
+        "sandbox.backup.restore": "backup.restored",
+        "sandbox.backup.delete": "backup.deleted",
+        "egress.firewall.drop": "egress.denied",
+        "egress.connection.allowed": "egress.allowed",
+        "egress.connection.denied": "egress.denied",
+        "gateway.call": "gateway.request.completed",
+        "gateway.policy.rejected": "egress.denied",
+        "gateway.spend_cap_reached": "spend.limit_reached",
+        "auth.rejected": "authentication.denied",
+        "auth.host_rejected": "authentication.host_denied",
+    };
+    return known[event] ?? event;
+}
+function severityForEvent(event) {
+    if (/\.(?:error|failed)$/.test(event))
+        return "ERROR";
+    if (/(?:denied|rejected|expired|drop|refused|spend_cap_reached|limit_reached)/i.test(event))
+        return "WARN";
+    return "INFO";
+}
+function severityNumber(severity) {
+    return severity === "ERROR" ? 17 : severity === "WARN" ? 13 : 9;
+}
+/** Redact likely credential forms from shell command strings before audit logging. */
+export function redactCommandForAudit(command) {
+    return command
+        .replace(/\b([A-Za-z_][A-Za-z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD)[A-Za-z0-9_]*\s*=\s*)(?:"[^"]*"|'[^']*'|[^\s;&|]+)/gi, "$1[REDACTED]")
+        .replace(/((?:^|\s)(?:-H|--header)(?:\s+|=))(["'])(?:authorization|x-api-key)\s*:[\s\S]*?\2/gi, "$1$2[REDACTED]$2")
+        .replace(/((?:^|\s)(?:-H|--header)(?:\s+|=))(authorization|x-api-key)\s*:\s*(?:bearer\s+)?[^\s"';&|]+/gi, "$1$2: [REDACTED]")
+        .replace(/((?:^|\s)(?:--token|--api[-_]?key|--secret|--password|--auth)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s;&|]+)/gi, "$1[REDACTED]")
+        .replace(/((?:^|\s)(?:-u|--user)(?:=|\s+))(?:"[^"]*"|'[^']*'|[^\s;&|]+)/gi, "$1[REDACTED]")
+        .replace(/(authorization\s*:\s*bearer\s+)[^\s"']+/gi, "$1[REDACTED]")
+        .replace(/(x-api-key\s*:\s*)[^\s"']+/gi, "$1[REDACTED]")
+        .replace(/\b(?:sk-[A-Za-z0-9_-]{12,}|gh[pousr]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16})\b/g, "[REDACTED]")
+        .replace(/(https?:\/\/)[^/@\s]+@/gi, "$1[REDACTED]@")
+        .slice(0, 512);
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAsBlC,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,cAAc,EAAE,IAAI;IACpB,cAAc,EAAE,GAAG;IACnB,aAAa,EAAE,GAAG,GAAG,IAAI;IACzB,WAAW,EAAE,CAAC;CACN,CAAC;AAEX,MAAM,SAAS,GAAG,QAAQ,EAAE,CAAC;AAC7B,MAAM,eAAe,GAAW,CAAC,GAAG,EAAE;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC;QACnH,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,IAAI,GAAG,GAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;AAC/D,IAAI,KAAK,GAAmB,EAAE,CAAC;AAC/B,IAAI,KAAiC,CAAC;AACtC,IAAI,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AAC/B,IAAI,aAAwC,CAAC;AAC7C,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAE3B,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,GAAG,GAAG,MAAM,CAAC;IACb,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QACnD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAClB,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,KAAK,CAAC,KAAiB;IACrC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC9B,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,MAAM,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ;QAAE,OAAO,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,eAAe,CAAC,KAAiB,EAAE,EAAE,GAAG,IAAI,IAAI,EAAE;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CACnC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,WAAW,CAAC,CAC9E,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3D,OAAO;QACL,GAAG,UAAU;QACb,SAAS,EAAE,EAAE,CAAC,WAAW,EAAE;QAC3B,cAAc,EAAE,KAAK;QACrB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,MAAM;QACtB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QACnC,YAAY,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;QACnC,UAAU,EAAE,OAAO,QAAQ,KAAK,QAAQ;YACtC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YACrD,CAAC,CAAC,SAAS;QACb,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,EAAE;QAC1B,IAAI,EAAE,SAAS;QACf,WAAW,EAAE,SAAS;QACtB,YAAY,EAAE,QAAQ;QACtB,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAChF,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACxC,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,oBAAoB,CAAC,OAAkC;IACrE,OAAO;QACL,YAAY,EAAE,CAAC;gBACb,QAAQ,EAAE,EAAE,UAAU,EAAE;wBACtB,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;wBAC1D,EAAE,GAAG,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,eAAe,EAAE,EAAE;wBACnE,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE;qBACxD,EAAE;gBACH,SAAS,EAAE,CAAC;wBACV,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE;wBAChD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;4BAClC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,QAAU,CAAC;4BAC9E,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,CAAC;4BACzC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,MAAM;4BAC1C,IAAI,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;4BAChD,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;iCAC9B,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS;mCACxC,GAAG,KAAK,WAAW,IAAI,GAAG,KAAK,OAAO;mCACtC,GAAG,KAAK,cAAc,IAAI,GAAG,KAAK,gBAAgB,CAAC;iCACvD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;yBAClE,CAAC,CAAC;qBACJ,CAAC;aACH,CAAC;KACH,CAAC;AACJ,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,KAAK;QAAE,aAAa,CAAC,KAAK,CAAC,CAAC;IAChC,KAAK,GAAG,SAAS,CAAC;IAClB,MAAM,UAAU,EAAE,CAAC;IACnB,MAAM,MAAM,CAAC;AACf,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO;IAC3C,MAAM,SAAS,GAAG,eAAe,EAAE,CAAC;IACpC,aAAa,GAAG,SAAS,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,SAAS,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,KAAK,SAAS;YAAE,aAAa,GAAG,SAAS,CAAC;IAC7D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe;IAC5B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,UAAU,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE;YAC/D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACjC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;SAC5E,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,IAAI,IAAI,CAAC,QAAQ,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;gBAC9C,OAAO,IAAI,CAAC,CAAC;gBACb,SAAS;YACX,CAAC;YACD,IAAI,CAAC,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE;YACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO;SACpF,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,OAAO,KAAK,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC;YACxD,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK;SACrD,CAAC,CAAC,CAAC;QACJ,IAAI,MAAM,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,CAAC,GAAG,YAAY,CAAC,aAAa,EAAE,CAAC;YAC1E,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM;YAC5B,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACvB,GAAG,CAAC,IAAI,CAAC,+CAA+C,EAAE;gBACxD,QAAQ,EAAE,YAAY,CAAC,aAAa;aACrC,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,IAAkB;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,YAAY,CAAC,cAAc,EAAE,CAAC;QAChD,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB,IAAI,MAAM,EAAE,CAAC;YAC9C,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;gBACtD,cAAc,EAAE,YAAY,CAAC,cAAc;aAC5C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,KAAK,GAA2B;QACpC,gBAAgB,EAAE,iBAAiB;QACnC,eAAe,EAAE,iBAAiB;QAClC,cAAc,EAAE,iBAAiB;QACjC,eAAe,EAAE,gBAAgB;QACjC,gBAAgB,EAAE,iBAAiB;QACnC,iBAAiB,EAAE,mBAAmB;QACtC,0BAA0B,EAAE,uBAAuB;QACnD,oBAAoB,EAAE,iBAAiB;QACvC,cAAc,EAAE,kBAAkB;QAClC,uBAAuB,EAAE,iBAAiB;QAC1C,mBAAmB,EAAE,WAAW;QAChC,oBAAoB,EAAE,cAAc;QACpC,oBAAoB,EAAE,wBAAwB;QAC9C,uBAAuB,EAAE,oBAAoB;QAC7C,wBAAwB,EAAE,uBAAuB;QACjD,wBAAwB,EAAE,sBAAsB;QAChD,0BAA0B,EAAE,wBAAwB;QACpD,uBAAuB,EAAE,gBAAgB;QACzC,wBAAwB,EAAE,iBAAiB;QAC3C,uBAAuB,EAAE,gBAAgB;QACzC,sBAAsB,EAAE,eAAe;QACvC,2BAA2B,EAAE,gBAAgB;QAC7C,0BAA0B,EAAE,eAAe;QAC3C,cAAc,EAAE,2BAA2B;QAC3C,yBAAyB,EAAE,eAAe;QAC1C,2BAA2B,EAAE,qBAAqB;QAClD,eAAe,EAAE,uBAAuB;QACxC,oBAAoB,EAAE,4BAA4B;KACnD,CAAC;IACF,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;AAC/B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACrC,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IACtD,IAAI,2EAA2E,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC3G,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,QAAuB;IAC7C,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,OAAO,OAAO;SACX,OAAO,CAAC,4GAA4G,EAAE,cAAc,CAAC;SACrI,OAAO,CAAC,qFAAqF,EAAE,kBAAkB,CAAC;SAClH,OAAO,CAAC,+FAA+F,EAAE,kBAAkB,CAAC;SAC5H,OAAO,CAAC,wGAAwG,EAAE,cAAc,CAAC;SACjI,OAAO,CAAC,iEAAiE,EAAE,cAAc,CAAC;SAC1F,OAAO,CAAC,2CAA2C,EAAE,cAAc,CAAC;SACpE,OAAO,CAAC,8BAA8B,EAAE,cAAc,CAAC;SACvD,OAAO,CAAC,4EAA4E,EAAE,YAAY,CAAC;SACnG,OAAO,CAAC,0BAA0B,EAAE,eAAe,CAAC;SACpD,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACnB,CAAC"}

package/dist/boot-scheduler.d.ts

@@ -0,0 +1,25 @@
+export interface BootSchedulerSnapshot {
+    limit: number;
+    active: number;
+    queued: number;
+    completed: number;
+    timedOut: number;
+}
+/** Bounds expensive VM boots without limiting cheap container creates. */
+export declare class BootScheduler {
+    private readonly limit;
+    private readonly timeoutMs;
+    private active;
+    private completed;
+    private timedOut;
+    private readonly queue;
+    constructor(limit: number, timeoutMs: number);
+    run<T>(name: string, run: () => Promise<T>, onQueued?: () => void): Promise<T>;
+    snapshot(): BootSchedulerSnapshot;
+    private execute;
+    private drain;
+}
+export declare class BootQueueTimeoutError extends Error {
+    readonly code = "BOOT_QUEUE_TIMEOUT";
+    constructor(timeoutMs: number);
+}

package/dist/boot-scheduler.js

@@ -0,0 +1,81 @@
+import { log } from "./logger.js";
+/** Bounds expensive VM boots without limiting cheap container creates. */
+export class BootScheduler {
+    limit;
+    timeoutMs;
+    active = 0;
+    completed = 0;
+    timedOut = 0;
+    queue = [];
+    constructor(limit, timeoutMs) {
+        this.limit = limit;
+        this.timeoutMs = timeoutMs;
+    }
+    run(name, run, onQueued) {
+        if (this.limit <= 0 || this.active < this.limit) {
+            this.active++;
+            return this.execute(name, run);
+        }
+        onQueued?.();
+        return new Promise((resolve, reject) => {
+            const waiter = { name, queuedAt: Date.now(), run, resolve, reject };
+            if (this.timeoutMs > 0) {
+                waiter.timer = setTimeout(() => {
+                    const index = this.queue.indexOf(waiter);
+                    if (index < 0)
+                        return;
+                    this.queue.splice(index, 1);
+                    this.timedOut++;
+                    reject(new BootQueueTimeoutError(this.timeoutMs));
+                    log.warn("microVM boot queue timeout", { name, timeoutMs: this.timeoutMs });
+                }, this.timeoutMs);
+                waiter.timer.unref?.();
+            }
+            this.queue.push(waiter);
+        });
+    }
+    snapshot() {
+        return {
+            limit: this.limit,
+            active: this.active,
+            queued: this.queue.length,
+            completed: this.completed,
+            timedOut: this.timedOut,
+        };
+    }
+    async execute(name, run) {
+        const startedAt = Date.now();
+        try {
+            return await run();
+        }
+        finally {
+            this.active--;
+            this.completed++;
+            log.debug("microVM boot slot released", {
+                name,
+                durationMs: Date.now() - startedAt,
+                ...this.snapshot(),
+            });
+            this.drain();
+        }
+    }
+    drain() {
+        while (this.active < this.limit && this.queue.length > 0) {
+            const waiter = this.queue.shift();
+            if (waiter.timer)
+                clearTimeout(waiter.timer);
+            this.active++;
+            const waitMs = Date.now() - waiter.queuedAt;
+            log.debug("microVM boot dequeued", { name: waiter.name, waitMs, ...this.snapshot() });
+            this.execute(waiter.name, waiter.run).then(waiter.resolve, waiter.reject);
+        }
+    }
+}
+export class BootQueueTimeoutError extends Error {
+    code = "BOOT_QUEUE_TIMEOUT";
+    constructor(timeoutMs) {
+        super(`microVM boot queue timed out after ${timeoutMs}ms`);
+        this.name = "BootQueueTimeoutError";
+    }
+}
+//# sourceMappingURL=boot-scheduler.js.map

package/dist/boot-scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"boot-scheduler.js","sourceRoot":"","sources":["../src/boot-scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAmBlC,0EAA0E;AAC1E,MAAM,OAAO,aAAa;IAOL;IACA;IAPX,MAAM,GAAG,CAAC,CAAC;IACX,SAAS,GAAG,CAAC,CAAC;IACd,QAAQ,GAAG,CAAC,CAAC;IACJ,KAAK,GAA2B,EAAE,CAAC;IAEpD,YACmB,KAAa,EACb,SAAiB;QADjB,UAAK,GAAL,KAAK,CAAQ;QACb,cAAS,GAAT,SAAS,CAAQ;IACjC,CAAC;IAEJ,GAAG,CAAI,IAAY,EAAE,GAAqB,EAAE,QAAqB;QAC/D,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,QAAQ,EAAE,EAAE,CAAC;QACb,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,MAAM,GAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC/E,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAyB,CAAC,CAAC;oBAC5D,IAAI,KAAK,GAAG,CAAC;wBAAE,OAAO;oBACtB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAC5B,IAAI,CAAC,QAAQ,EAAE,CAAC;oBAChB,MAAM,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;oBAClD,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC9E,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBACnB,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAyB,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,QAAQ;QACN,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,IAAY,EAAE,GAAqB;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,MAAM,GAAG,EAAE,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE;gBACtC,IAAI;gBACJ,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAClC,GAAG,IAAI,CAAC,QAAQ,EAAE;aACnB,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,EAAG,CAAC;YACnC,IAAI,MAAM,CAAC,KAAK;gBAAE,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;YAC5C,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACtF,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,IAAI,GAAG,oBAAoB,CAAC;IAErC,YAAY,SAAiB;QAC3B,KAAK,CAAC,sCAAsC,SAAS,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF"}

package/dist/config.d.ts

@@ -36,6 +36,10 @@ export interface Config {
     defaultCpus: number;
     /** Default per-sandbox process/thread cap for new sandboxes (`0` = unlimited). */
     defaultPidsLimit: number;
+    /** Maximum simultaneous cold microVM creates (`0` = unlimited). */
+    microvmBootConcurrency: number;
+    /** Maximum time a microVM create waits for a boot slot (`0` = unlimited). */
+    microvmBootQueueTimeoutMs: number;
     /**
      * Admission control: `enforce` rejects `create` when the host's memory budget
      * is exhausted (prevents over-subscription / OOM when launching many
@@ -216,11 +220,19 @@ export interface Config {
      */
     apiKey: string;
     /**
-     * OTLP/HTTP traces endpoint (e.g. `http://localhost:4318`). When set, spans are
-     * batch-exported to `<endpoint>/v1/traces`. Empty disables export; recent spans
-     * are always kept in-memory for `GET /traces` regardless.
+     * Shared OTLP/HTTP endpoint for traces and audit logs (e.g. `http://localhost:4318`).
+     * Spans export to `/v1/traces`; audit records export to `/v1/logs`. Empty disables
+     * trace export and is the audit fallback when no audit-specific override is set.
      */
     otlpEndpoint: string;
+    /** Headers shared by OTLP exporters, parsed from `HOTCELL_OTLP_HEADERS`. */
+    otlpHeaders: Record<string, string>;
+    /** Audit-only endpoint override; `HOTCELL_OTEL_ENDPOINT` remains a legacy alias. */
+    auditOtlpEndpoint: string;
+    /** Audit-only headers; `HOTCELL_OTEL_HEADERS` remains a legacy override. */
+    auditOtlpHeaders: Record<string, string>;
+    /** Local append-only JSONL audit log path; empty disables local persistence. */
+    auditPath: string;
     /** How many of the most recent metric samples per sandbox to retain in memory. */
     metricsHistory: number;
     /** How many of the most recent finished spans to retain in memory for `/traces`. */

package/dist/config.js

@@ -89,6 +89,8 @@ export function loadConfig() {
         defaultMemoryMb: Number(env("DEFAULT_MEMORY_MB") ?? 0),
         defaultCpus: Number(env("DEFAULT_CPUS") ?? 0),
         defaultPidsLimit: Number(env("DEFAULT_PIDS") ?? 0),
+        microvmBootConcurrency: Number(env("MICROVM_BOOT_CONCURRENCY") ?? 4),
+        microvmBootQueueTimeoutMs: Number(env("MICROVM_BOOT_QUEUE_TIMEOUT_MS") ?? 120000),
         admission: env("ADMISSION") === "off" ? "off" : "enforce",
         hostMemoryMb: Number(env("HOST_MEMORY_MB") ?? 0),
         hostCpus: Number(env("HOST_CPUS") ?? 0),
@@ -139,6 +141,12 @@ export function loadConfig() {
         logFormat: env("LOG_FORMAT") === "json" ? "json" : "pretty",
         apiKey: env("API_KEY") ?? "",
         otlpEndpoint: (env("OTLP_ENDPOINT") ?? "").replace(/\/$/, ""),
+        otlpHeaders: parseHeaders(env("OTLP_HEADERS")),
+        // Canonical OTLP endpoint/headers are shared; the older OTEL_* settings
+        // remain audit-specific overrides for backward compatibility.
+        auditOtlpEndpoint: (env("OTEL_ENDPOINT") ?? env("OTLP_ENDPOINT") ?? "").replace(/\/$/, ""),
+        auditOtlpHeaders: parseHeaders(env("OTEL_HEADERS") ?? env("OTLP_HEADERS")),
+        auditPath: env("AUDIT_FILE") ?? join(stateRoot(), "audit.jsonl"),
         metricsHistory: Number(env("METRICS_HISTORY") ?? 60),
         traceRing: Number(env("TRACE_RING") ?? 200),
         maxBodyBytes: Number(env("MAX_BODY_BYTES") ?? 32 * 1024 * 1024),
@@ -195,6 +203,20 @@ export function loadProviderConfigs() {
     }
     return out;
 }
+function parseHeaders(value) {
+    if (!value)
+        return {};
+    try {
+        const parsed = JSON.parse(value);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            return {};
+        return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === "string"));
+    }
+    catch {
+        console.error("[hotcell] ignoring malformed HOTCELL_OTEL_HEADERS (expected JSON object)");
+        return {};
+    }
+}
 function parseLogLevel(value) {
     return value === "debug" || value === "info" || value === "warn" || value === "error"
         ? value

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,kFAAkF;AAClF,6BAA6B;AAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,+EAA+E;AAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACxD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAC3C,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,CAAC,CAC1D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,EACvD,aAAa,CACd,CAAC;AACF,gFAAgF;AAChF,SAAS,cAAc;IACrB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,4BAA4B;IACzC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC7E,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,gCAAgC,WAAW,mBAAmB,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,GAA2B,cAAc,EAAE,CAAC;AAE5D;;;;GAIG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC1B,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AAgPD,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW;QAChC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QACjC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,wCAAwC;QACtE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;QACpC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACtD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAClD,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACzD,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC;QAClE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW;QAC3C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QAC5C,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,WAAW;QAC7C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC9C,mBAAmB,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,sBAAsB;QAC3E,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM;QAC/C,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,gBAAgB;QACxD,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,eAAe;QACrD,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1C,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QAClB,kBAAkB,EAAE,GAAG,CAAC,sBAAsB,CAAC,KAAK,OAAO;QAC3D,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACvD,YAAY,EAAE,gBAAgB,EAAE;QAChC,eAAe,EAAE,mBAAmB,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC;QAC5D,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC;QAClD,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;QACxD,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC;QAC9D,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC;QAC9D,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QAC1D,eAAe,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1C,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,oCAAoC,CAAC;QACtF,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC;QAC1D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,eAAe,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC3E,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa;QACrC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC;QAC1D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,eAAe,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC3E,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC3D,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5B,YAAY,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAC/D,YAAY,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;aACvC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,OAAO,GAAyC,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACjD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;oBAAE,SAAS;gBAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;gBACzD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;qBACxC,IAAI,KAAK,KAAK,YAAY;oBAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;qBACjE,IAAI,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;YAC1D,CAAC;QACH,CAAC;IACD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;QACnF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;IACxE,OAAO,UAAU,SAAS,IAAI,IAAI,cAAc,MAAM,CAAC,SAAS,GAAG,CAAC;AACtE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,iFAAiF;AACjF,kFAAkF;AAClF,gFAAgF;AAChF,4EAA4E;AAC5E,8EAA8E;AAC9E,kFAAkF;AAClF,6BAA6B;AAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,+EAA+E;AAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACxD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAC3C,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,CAAC,CAC1D,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAC7B,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,EACvD,aAAa,CACd,CAAC;AACF,gFAAgF;AAChF,SAAS,cAAc;IACrB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,4BAA4B;IACzC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC7E,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,gCAAgC,WAAW,mBAAmB,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,GAA2B,cAAc,EAAE,CAAC;AAE5D;;;;GAIG;AACH,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;QAC1B,UAAU,CAAC,WAAW,IAAI,EAAE,CAAC,CAC9B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS;IAChB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7D,OAAO,MAAM,CAAC;AAChB,CAAC;AA4PD,MAAM,UAAU,UAAU;IACxB,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,WAAW;QAChC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;QACjC,YAAY,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,wCAAwC;QACtE,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW;QACpC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACtD,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC7C,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAClD,sBAAsB,EAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC;QACpE,yBAAyB,EAAE,MAAM,CAAC,GAAG,CAAC,+BAA+B,CAAC,IAAI,MAAM,CAAC;QACjF,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACzD,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChD,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACvC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,oBAAoB,EAAE,MAAM,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,GAAG,CAAC;QAClE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW;QAC3C,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;QAC5C,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,IAAI,WAAW;QAC7C,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC;QAC9C,mBAAmB,EAAE,GAAG,CAAC,uBAAuB,CAAC,IAAI,sBAAsB;QAC3E,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM;QAC/C,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,gBAAgB;QACxD,YAAY,EAAE,GAAG,CAAC,eAAe,CAAC,IAAI,eAAe;QACrD,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE;QAC1C,aAAa,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE;QAC1C,cAAc,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;aAC3C,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;QAClB,kBAAkB,EAAE,GAAG,CAAC,sBAAsB,CAAC,KAAK,OAAO;QAC3D,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACvD,YAAY,EAAE,gBAAgB,EAAE;QAChC,eAAe,EAAE,mBAAmB,EAAE;QACtC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,CAAC;QAC5D,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,CAAC;QAClD,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACvD,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC;QACxD,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC;QAC9D,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC;QACxD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,KAAK,CAAC;QAC9D,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,IAAI,CAAC;QAC1D,eAAe,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;QAC1C,YAAY,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,SAAS,CAAC,oCAAoC,CAAC;QACtF,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC;QAC1D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,eAAe,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC3E,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa;QACrC,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,qCAAqC,CAAC;QAC9E,UAAU,EAAE,GAAG,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC;QAC1D,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACxC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC5C,eAAe,EAAE,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC3E,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzC,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;QAC3D,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;QAC5B,YAAY,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,WAAW,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,wEAAwE;QACxE,8DAA8D;QAC9D,iBAAiB,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC1F,gBAAgB,EAAE,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;QAC1E,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,CAAC;QAChE,cAAc,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACpD,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;QAC/D,YAAY,EAAE,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;aACvC,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC;KACnB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,+EAA+E;IAC/E,yEAAyE;IACzE,sEAAsE;IACtE,MAAM,OAAO,GAAyC,CAAC,cAAc,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtF,kEAAkE;IAClE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC/B,KAAK,MAAM,MAAM,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,EAAE,CAAC;YAC5D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACjD,IAAI,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC;oBAAE,SAAS;gBAC/F,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB;gBACzD,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACjC,IAAI,EAAE,IAAI,CAAC;oBAAE,SAAS;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnC,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,OAAO,GAAG,KAAK,CAAC;qBACxC,IAAI,KAAK,KAAK,YAAY;oBAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;qBACjE,IAAI,KAAK,KAAK,QAAQ;oBAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;YAC1D,CAAC;QACH,CAAC;IACD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QAC9E,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC/H,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAC1F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,OAAO,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;QACnF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,IAAY;IACxE,OAAO,UAAU,SAAS,IAAI,IAAI,cAAc,MAAM,CAAC,SAAS,GAAG,CAAC;AACtE,CAAC"}

package/dist/driver/container.d.ts

@@ -25,6 +25,9 @@ export declare class ContainerDriver implements Driver {
     private ensured;
     private egress?;
     private egressNetReady;
+    private egressIpCache;
+    private egressIpCacheAt;
+    private egressIpRefresh?;
     constructor(docker?: Docker, egress?: EgressNetConfig);
     private containerName;
     /** Deterministic name for the sandbox's persistent workspace volume. */
@@ -38,6 +41,9 @@ export declare class ContainerDriver implements Driver {
      * load). No-op when enforcement is off.
      */
     initEgress(): Promise<void>;
+    /** Map a logged firewall source IP back to the sandbox id Docker labeled on create. */
+    sandboxIdForEgressIp(ip: string): Promise<string | undefined>;
+    private refreshEgressIpCache;
     /**
      * Ensure the egress-enforcement bridge network exists on the configured subnet
      * (idempotent). The subnet must match so the host firewall's `-s <subnet>` rules
@@ -77,6 +83,15 @@ export declare class ContainerDriver implements Driver {
     private runSetup;
     start(opts: CreateOptions): Promise<void>;
     stop(id: string): Promise<void>;
+    /**
+     * Force-remove a container, absorbing every "someone beat us to it" answer:
+     * 404 (already gone) and 409 (a removal is already in progress — the idle
+     * reaper and a client DELETE routinely race here, and surfacing that race as
+     * a 500 once made a client read its own successful run as failed). On 409 we
+     * wait for the winning removal to finish, so callers can safely reclaim
+     * dependent resources like the workspace volume.
+     */
+    private removeContainerIdempotent;
     /** Shared create/start path: ensure image (+volume), then run the container. */
     private launchContainer;
     exec(id: string, command: string, opts: ExecOptions, onEvent: (e: ExecEvent) => void): Promise<number>;