@hotcell/daemon 0.1.22 → 0.1.24

package/dist/index.js

@@ -1,7 +1,9 @@
 #!/usr/bin/env node
 import { get as httpGet } from "node:http";
 import { BackupRegistry } from "./backups.js";
+import { configureAudit, stopAudit } from "./audit.js";
 import { Capacity } from "./capacity.js";
+import { BootScheduler } from "./boot-scheduler.js";
 import { loadConfig, loadProviderConfigs } from "./config.js";
 import { DriverRouter } from "./driver/router.js";
 import { startReaper } from "./lifecycle.js";
@@ -14,7 +16,7 @@ import { createProxyServer } from "./proxy/server.js";
 import { buildProviders, createEgressProxy } from "./proxy/egress.js";
 import { loadProviderKeyMap } from "./keystore.js";
 import { loadModelPrices } from "./pricing.js";
-import { ensureEgressFirewall } from "./net/firewall.js";
+import { ensureEgressFirewall, startEgressDropMonitor } from "./net/firewall.js";
 import { errorMessage } from "./util.js";
 /** A loopback bind host (unreachable from sandboxes on native-Linux dockerd). */
 function isLoopback(host) {
@@ -54,9 +56,11 @@ function reportPortInUse(host, port) {
 async function main() {
     const config = loadConfig();
     configureLogger({ level: config.logLevel, format: config.logFormat });
+    configureAudit({ path: config.auditPath, endpoint: config.auditOtlpEndpoint, headers: config.auditOtlpHeaders });
     configureTracing({
-        serviceName: "sbd",
+        serviceName: "hotcell",
         otlpEndpoint: config.otlpEndpoint,
+        headers: config.otlpHeaders,
         ringSize: config.traceRing,
     });
     const store = new SandboxStore(config.dbPath);
@@ -94,6 +98,7 @@ async function main() {
     // Host capacity for the meter + admission control (best-effort detection).
     const host = await driver.hostInfo().catch(() => null);
     const capacity = new Capacity(store, config, host, history, () => driver.poolStats());
+    const bootScheduler = new BootScheduler(config.microvmBootConcurrency, config.microvmBootQueueTimeoutMs);
     if (host) {
         log.info("host capacity", {
             memoryMb: host.memoryMb,
@@ -115,7 +120,7 @@ async function main() {
         log.info("provider keys reloaded", { providers: Object.keys(rebuilt).length });
         return { providers: Object.keys(rebuilt).length };
     };
-    const server = createApiServer({ config, driver, store, backups, history, capacity, reloadKeys });
+    const server = createApiServer({ config, driver, store, backups, history, capacity, bootScheduler, reloadKeys });
     server.on("error", (err) => {
         if (err.code === "EADDRINUSE")
             return reportPortInUse(config.host, config.port);
@@ -129,6 +134,7 @@ async function main() {
             image: config.defaultImage,
             auth: config.apiKey ? "on" : "off",
             otlp: config.otlpEndpoint || "off",
+            auditOtlp: config.auditOtlpEndpoint || "off",
         });
     });
     const proxy = createProxyServer({ config, driver, store, capacity });
@@ -149,13 +155,17 @@ async function main() {
     // provider keys (SBX_PROVIDER_KEY_*) are set.
     // Install the host default-deny egress firewall (Linux + SBX_EGRESS_ENFORCE only;
     // advisory no-op otherwise). Best-effort: logs and continues if it can't.
-    await ensureEgressFirewall(config);
+    let stopEgressDropMonitor = () => { };
+    const dropLoggingInstalled = await ensureEgressFirewall(config);
     // Reconcile the egress bridge network at boot so a subnet collision (e.g. a
     // stale network from a pre-rename daemon) fails fast with an actionable message
     // instead of a 422 on the first create.
     if (config.egressEnforce && typeof driver.initEgress === "function") {
         await driver.initEgress();
     }
+    if (dropLoggingInstalled) {
+        stopEgressDropMonitor = startEgressDropMonitor((sourceIp) => driver.resolveEgressSourceIp(sourceIp), config);
+    }
     const providers = buildProviders(config);
     const prices = loadModelPrices(config.modelPricesPath);
     // Native-Linux enforcement footgun: sandboxes reach the daemon via the bridge
@@ -206,6 +216,7 @@ async function main() {
             clearInterval(reaper);
         if (sampler)
             clearInterval(sampler);
+        stopEgressDropMonitor();
         // Failsafe: `server.close()`'s callback waits for every connection to drain,
         // and an attached terminal WebSocket / SSE exec stream / keep-alive client
         // NEVER drains — without this the process lingers forever as a listener-less
@@ -222,6 +233,7 @@ async function main() {
         failsafe.unref();
         await driver.shutdown().catch(() => { }); // tear down the VZ warm pool, if any
         stopTracing();
+        await stopAudit();
         egress?.close();
         egress?.closeAllConnections();
         proxy.close();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,EAAE;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACzD,IAAI,CAAC,OAAO;gBACV,CAAC,CAAC,CAAC,0CAA0C,IAAI,IAAI,IAAI,EAAE;oBACxD,iGAAiG,CAAC;gBACrG,CAAC,CAAC,CAAC,QAAQ,IAAI,uCAAuC;oBACnD,kEAAkE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,oBAAoB;QAC1D,kEAAkE,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,gBAAgB,CAAC;QACf,WAAW,EAAE,KAAK;QAClB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAC3C,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,gCAAgC,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACjD,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,MAAgC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,CAAC,eAAe,GAAG,mBAAmB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IAClG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAClC,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAClC,GAAG,EAAE,UAAU,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE;YACrD,QAAQ,EAAE,gCAAgC,MAAM,CAAC,SAAS,GAAG;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,8CAA8C;IAC9C,kFAAkF;IAClF,0EAA0E;IAC1E,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,gFAAgF;IAChF,wCAAwC;IACxC,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzF,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACrG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,4FAA4F,EAAE;YACrG,IAAI,EAAE,MAAM,CAAC,UAAU;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM;QACJ,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACjD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,GAAG,EAAE,UAAU,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE;YACpD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB;SAChG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,MAAM,GACV,MAAM,CAAC,cAAc,GAAG,CAAC;QACvB,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,2EAA2E;IAC3E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,GAAG,CAAC;QAC1B,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC9E,WAAW,EAAE,CAAC;QACd,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,yEAAyE;QACzE,uDAAuD;QACtD,KAA8C,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,8EAA8E;QAC9E,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAqB,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,iFAAiF;AACjF,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,CAAC;AACxE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,CAAC,KAAe,EAAE,EAAE;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;QAC1E,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,CAAC;gBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;YACzD,IAAI,CAAC,OAAO;gBACV,CAAC,CAAC,CAAC,0CAA0C,IAAI,IAAI,IAAI,EAAE;oBACxD,iGAAiG,CAAC;gBACrG,CAAC,CAAC,CAAC,QAAQ,IAAI,uCAAuC;oBACnD,kEAAkE,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,IAAI,oBAAoB;QAC1D,kEAAkE,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtE,cAAc,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACjH,gBAAgB,CAAC;QACf,WAAW,EAAE,SAAS;QACtB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,WAAW;QAC3B,QAAQ,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1D,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,uBAAuB,MAAM,CAAC,IAAI,UAAU,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,yEAAyE;IACzE,yEAAyE;IACzE,uEAAuE;IACvE,8CAA8C;IAC9C,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU;YAAE,SAAS;QAC3C,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC;QACxB,MAAM,CAAC,YAAY,GAAG,gCAAgC,CAAC;QACvD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACpF,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,IAAI,CAAC,0DAA0D,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IACtF,MAAM,aAAa,GAAG,IAAI,aAAa,CACrC,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,yBAAyB,CACjC,CAAC;IACF,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK;SACjD,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,iEAAiE;IACjE,IAAI,MAAgC,CAAC;IACrC,MAAM,UAAU,GAAG,GAAG,EAAE;QACtB,MAAM,CAAC,YAAY,GAAG,kBAAkB,EAAE,CAAC;QAC3C,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,CAAC,eAAe,GAAG,mBAAmB,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;IACpD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,CAAC;IACjH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAChF,GAAG,CAAC,KAAK,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE;QAC3C,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE;YAC3B,GAAG,EAAE,UAAU,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;YAC3C,MAAM,EAAE,MAAM,CAAC,IAAI;YACnB,KAAK,EAAE,MAAM,CAAC,YAAY;YAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAClC,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;YAClC,SAAS,EAAE,MAAM,CAAC,iBAAiB,IAAI,KAAK;SAC7C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;QACpD,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAClC,GAAG,EAAE,UAAU,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE;YACrD,QAAQ,EAAE,gCAAgC,MAAM,CAAC,SAAS,GAAG;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,6EAA6E;IAC7E,8EAA8E;IAC9E,8CAA8C;IAC9C,kFAAkF;IAClF,0EAA0E;IAC1E,IAAI,qBAAqB,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;IACrC,MAAM,oBAAoB,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAEhE,4EAA4E;IAC5E,gFAAgF;IAChF,wCAAwC;IACxC,IAAI,MAAM,CAAC,aAAa,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,oBAAoB,EAAE,CAAC;QACzB,qBAAqB,GAAG,sBAAsB,CAC5C,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EACpD,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACvD,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,8EAA8E;IAC9E,kBAAkB;IAClB,MAAM,aAAa,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACzF,MAAM,cAAc,GAClB,MAAM,CAAC,aAAa,IAAI,CAAC,aAAa,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;QACrG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,cAAc,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,GAAG,CAAC,IAAI,CAAC,4FAA4F,EAAE;YACrG,IAAI,EAAE,MAAM,CAAC,UAAU;SACxB,CAAC,CAAC;IACL,CAAC;IACD,MAAM;QACJ,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QACjD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;QACzF,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,EAAE,GAAG,EAAE;QACrD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE;YACjC,GAAG,EAAE,UAAU,cAAc,IAAI,MAAM,CAAC,UAAU,EAAE;YACpD,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,iBAAiB;SAChG,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,uEAAuE;IACvE,MAAM,MAAM,GACV,MAAM,CAAC,cAAc,GAAG,CAAC;QACvB,CAAC,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QACnE,CAAC,CAAC,SAAS,CAAC;IAEhB,2EAA2E;IAC3E,MAAM,OAAO,GACX,MAAM,CAAC,iBAAiB,GAAG,CAAC;QAC1B,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAChF,CAAC,CAAC,SAAS,CAAC;IAEhB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,YAAY;YAAE,OAAO;QACzB,YAAY,GAAG,IAAI,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1B,IAAI,MAAM;YAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,OAAO;YAAE,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,qBAAqB,EAAE,CAAC;QACxB,6EAA6E;QAC7E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE;YAC/B,IAAI,CAAC;gBACH,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,qCAAqC;QAC9E,WAAW,EAAE,CAAC;QACd,MAAM,SAAS,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,EAAE,mBAAmB,EAAE,CAAC;QAC9B,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,yEAAyE;QACzE,uDAAuD;QACtD,KAA8C,CAAC,mBAAmB,EAAE,EAAE,CAAC;QACxE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAChB,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,8EAA8E;QAC9E,MAAM,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lifecycle.d.ts

@@ -28,7 +28,7 @@ import type { SandboxRecord } from "./types.js";
  * processes, exposed ports) is only dropped on a cold pause — after a snapshot
  * pause it stays valid, because resume restores those processes live.
  */
-export declare function pauseSandbox(driver: Driver, store: SandboxStore, record: SandboxRecord): Promise<void>;
+export declare function pauseSandbox(driver: Driver, store: SandboxStore, record: SandboxRecord, automatic?: boolean): Promise<void>;
 /**
  * Resume a paused (or stopped) sandbox: recreate its container, reattaching the
  * persistent volume, and mark it running + active. When a `capacity` meter is

package/dist/lifecycle.js

@@ -1,4 +1,5 @@
 import { CapacityError } from "./capacity.js";
+import { audit } from "./audit.js";
 import { log } from "./logger.js";
 /**
  * Lifecycle FSM transitions and the idle reaper.
@@ -26,7 +27,7 @@ import { log } from "./logger.js";
  * processes, exposed ports) is only dropped on a cold pause — after a snapshot
  * pause it stays valid, because resume restores those processes live.
  */
-export async function pauseSandbox(driver, store, record) {
+export async function pauseSandbox(driver, store, record, automatic = false) {
     let hibernated = false;
     if (typeof driver.snapshot === "function" && (driver.canSnapshot?.(record.id) ?? true)) {
         try {
@@ -46,6 +47,7 @@ export async function pauseSandbox(driver, store, record) {
     }
     record.status = "paused";
     store.add(record);
+    audit({ event: "sandbox.pause", sandboxId: record.id, driver: record.driver ?? driver.name, attributes: { automatic } });
 }
 /**
  * Resume a paused (or stopped) sandbox: recreate its container, reattaching the
@@ -54,6 +56,7 @@ export async function pauseSandbox(driver, store, record) {
  * `CapacityError` instead of over-subscribing the host.
  */
 export async function resumeSandbox(driver, store, record, capacity) {
+    const previousStatus = record.status;
     // Reserve the sandbox's memory for the duration of the start: once the record
     // is written back as `running` it's counted by the meter itself, so the
     // pending reservation is released synchronously after the status write.
@@ -81,6 +84,7 @@ export async function resumeSandbox(driver, store, record, capacity) {
     record.status = "running";
     record.lastActivityAt = new Date().toISOString();
     store.add(record);
+    audit({ event: previousStatus === "stopped" ? "sandbox.start" : "sandbox.resume", sandboxId: record.id, driver: record.driver ?? driver.name });
     admitted.release();
 }
 /**
@@ -99,6 +103,11 @@ export async function reapIdle(driver, store, now = Date.now()) {
             continue;
         if (!record.sleepAfterMs || record.sleepAfterMs <= 0)
             continue;
+        // An open exec stream is live work, whatever the timestamps say: `touch`
+        // marks request ARRIVAL, so a long agent run looks idle while it is still
+        // streaming — and cold-pausing it means SIGKILLing that work mid-flight.
+        if (store.openExecs(record.id) > 0)
+            continue;
         const hasService = store.listExposed(record.id).length > 0;
         const hasLiveProcs = store.listProcesses(record.id).some((p) => p.status === "running");
         if ((hasService || hasLiveProcs) && !driver.canSnapshot?.(record.id))
@@ -106,7 +115,7 @@ export async function reapIdle(driver, store, now = Date.now()) {
         if (now - Date.parse(record.lastActivityAt) < record.sleepAfterMs)
             continue;
         try {
-            await pauseSandbox(driver, store, record);
+            await pauseSandbox(driver, store, record, true);
             paused.push(record.id);
         }
         catch (err) {
@@ -121,7 +130,20 @@ export async function reapIdle(driver, store, now = Date.now()) {
  */
 export function startReaper(opts) {
     const { driver, store, intervalMs } = opts;
+    let lastTickAt = Date.now();
     const timer = setInterval(() => {
+        const gap = Date.now() - lastTickAt;
+        lastTickAt = Date.now();
+        // A tick arriving far later than scheduled means the host slept — every
+        // sandbox's lastActivityAt is stale through no fault of its owner, whose
+        // own clocks froze with ours. Reaping on that evidence once SIGKILLed a
+        // healthy agent seconds after wake. Sit this cycle out; owners that are
+        // really alive re-beat within one interval, and true orphans are still
+        // reaped on the next tick.
+        if (gap > intervalMs * 2) {
+            log.info("host slept; skipping one reap cycle", { gapMs: gap });
+            return;
+        }
         reapIdle(driver, store)
             .then((ids) => {
             if (ids.length)

package/dist/lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,eAAe,CAAC;AAE7D,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmB,EACnB,MAAqB;IAErB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAC7D,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC;IAC9E,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,QAAmB;IAEnB,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpE,EAAE,EAAE,IAAa;QACjB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,KAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY;YAAE,SAAS;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;aACpB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,SAAS,GAAG,KAAK;IAEjB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAC7D,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC;IAC9E,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,QAAmB;IAEnB,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpE,EAAE,EAAE,IAAa;QACjB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChJ,QAAQ,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,KAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,SAAS;QAC/D,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY;YAAE,SAAS;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QACpC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,GAAG,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;aACpB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/net/firewall.d.ts

@@ -1,4 +1,29 @@
 import type { Config } from "../config.js";
+export interface FirewallDrop {
+    sourceIp: string;
+    destinationIp: string;
+    protocol: string;
+    port: number;
+}
+export interface EgressSandboxRef {
+    sandboxId: string;
+    driver: string;
+}
+export type EgressSourceResolver = (sourceIp: string) => Promise<EgressSandboxRef | undefined>;
 /** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
 export declare function gatewayOf(subnet: string): string;
-export declare function ensureEgressFirewall(config: Config): Promise<void>;
+/** Parse one Linux kernel LOG record emitted by the Hotcell default-deny rule. */
+export declare function parseEgressFirewallDrop(line: string): FirewallDrop | undefined;
+/**
+ * Host-side default-deny egress firewall for sandboxes (Linux only).
+ * Traffic that misses the gateway/DNS allow rules is logged (rate-limited) and
+ * then dropped. The daemon consumes those kernel records and resolves the source
+ * container IP through Docker's `sbx.id` label before emitting an audit event.
+ */
+export declare function ensureEgressFirewall(config: Config): Promise<boolean>;
+/**
+ * Consume Linux kernel firewall logs. `/dev/kmsg` is preferred; if its permissions
+ * prevent access, fall back to `journalctl -k -f`. The rate-limited firewall rule
+ * protects the kernel log from a sandbox generating a denial storm.
+ */
+export declare function startEgressDropMonitor(resolveSource: EgressSourceResolver, config: Config): () => void;

package/dist/net/firewall.js

@@ -1,29 +1,13 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { createReadStream, readFileSync } from "node:fs";
 import { platform } from "node:os";
 import { promisify } from "node:util";
+import { audit } from "../audit.js";
 import { log } from "../logger.js";
 const exec = promisify(execFile);
-/**
- * Host-side default-deny egress firewall for sandboxes (Linux only).
- *
- * When `SBX_EGRESS_ENFORCE=true`, sandboxes run on a dedicated bridge network
- * (`config.egressSubnet`). This installs `iptables` rules in the `DOCKER-USER`
- * chain — the supported, operator-owned hook Docker consults before its own rules
- * — so traffic from that subnet may reach ONLY the egress gateway (the bridge
- * gateway `.1` on `egressPort`) and the pinned DNS resolver; everything else is
- * dropped. The sandbox holds no `CAP_NET_ADMIN`, so it cannot edit these rules.
- *
- * Rules live in a dedicated `SBX-EGRESS` chain that is flushed + rebuilt on every
- * startup (idempotent), with a single jump from `DOCKER-USER`.
- *
- * NOT a hard isolation boundary: a kernel-shared container is weaker than a VM,
- * and on Docker Desktop (macOS) `DOCKER-USER` isn't host-editable — there
- * enforcement degrades to advisory (proxy env is still set, but direct egress is
- * not blocked). Transparent, in-guest-enforced default-deny is the microVM driver's
- * job; this is the best that plain Docker on Linux can do. Requires the daemon to
- * run with iptables privileges (root or `CAP_NET_ADMIN`).
- */
 const CHAIN = "SBX-EGRESS";
+const DROP_LOG_PREFIX = "HOTCELL_EGRESS_DROP ";
+const DROP_RULE = "hotcell-default-deny";
 /** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
 export function gatewayOf(subnet) {
     const base = subnet.split("/")[0] ?? subnet;
@@ -33,45 +17,201 @@ export function gatewayOf(subnet) {
     octets[3] = "1";
     return octets.join(".");
 }
+/** Parse one Linux kernel LOG record emitted by the Hotcell default-deny rule. */
+export function parseEgressFirewallDrop(line) {
+    const marker = line.indexOf(DROP_LOG_PREFIX);
+    if (marker < 0)
+        return undefined;
+    const message = line.slice(marker + DROP_LOG_PREFIX.length);
+    const fields = {};
+    for (const match of message.matchAll(/(?:^|\s)([A-Z][A-Z0-9_]*)=([^\s]*)/g)) {
+        fields[match[1]] = match[2];
+    }
+    if (!fields.SRC || !fields.DST)
+        return undefined;
+    const parsedPort = Number(fields.DPT);
+    return {
+        sourceIp: fields.SRC,
+        destinationIp: fields.DST,
+        protocol: (fields.PROTO ?? "unknown").toLowerCase(),
+        port: Number.isInteger(parsedPort) && parsedPort >= 0 ? parsedPort : 0,
+    };
+}
+/** Kernel log timestamps are monotonic microseconds since boot (`/dev/kmsg`). */
+function kernelUptimeUs(line) {
+    const semicolon = line.indexOf(";");
+    if (semicolon < 0)
+        return undefined; // journalctl output has no kmsg metadata
+    const metadata = line.slice(0, semicolon).replace(/^<\d+>/, "").split(",");
+    const value = Number(metadata[2]);
+    return Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+/**
+ * Host-side default-deny egress firewall for sandboxes (Linux only).
+ * Traffic that misses the gateway/DNS allow rules is logged (rate-limited) and
+ * then dropped. The daemon consumes those kernel records and resolves the source
+ * container IP through Docker's `sbx.id` label before emitting an audit event.
+ */
 export async function ensureEgressFirewall(config) {
     if (!config.egressEnforce)
-        return;
+        return false;
     if (platform() !== "linux") {
         log.warn("egress enforcement requested but host is not Linux — fail-closed firewall is ADVISORY only " +
             "(proxy env is injected, but direct egress is NOT blocked). Use the microVM driver for hard isolation.", { platform: platform() });
-        return;
+        return false;
     }
     const subnet = config.egressSubnet;
     const gateway = gatewayOf(subnet);
     const port = String(config.egressPort);
     const dns = config.egressDnsResolver;
-    // The ordered rule set for the SBX-EGRESS chain. Allows return traffic, the
-    // gateway, and DNS (to the pinned resolver if set, else the bridge gateway, which
-    // Docker's embedded resolver forwards through); drops the rest.
-    const rules = [
-        ["-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT"],
-        ["-p", "tcp", "-d", gateway, "--dport", port, "-j", "ACCEPT"],
-        ["-p", "udp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
-        ["-p", "tcp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
-        ["-j", "DROP"],
-    ];
     try {
         // Create (ignore "exists"), then flush so we rebuild cleanly each boot.
         await ipt(["-N", CHAIN]).catch(() => { });
         await ipt(["-F", CHAIN]);
-        for (const rule of rules)
+        const allowRules = [
+            ["-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT"],
+            ["-p", "tcp", "-d", gateway, "--dport", port, "-j", "ACCEPT"],
+            ["-p", "udp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+            ["-p", "tcp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+        ];
+        for (const rule of allowRules)
             await ipt(["-A", CHAIN, ...rule]);
+        // Logging is optional; install the DROP regardless if LOG/limit is unsupported.
+        let logInstalled = false;
+        try {
+            await ipt([
+                "-A", CHAIN,
+                "-m", "conntrack", "--ctstate", "NEW",
+                "-m", "limit", "--limit", "20/second", "--limit-burst", "50",
+                "-j", "LOG", "--log-prefix", DROP_LOG_PREFIX, "--log-level", "4",
+            ]);
+            logInstalled = true;
+        }
+        catch (err) {
+            log.warn("egress firewall drop logging unavailable; DROP enforcement remains active", {
+                error: String(err?.message ?? err),
+            });
+        }
+        await ipt(["-A", CHAIN, "-j", "DROP"]);
         // Jump from DOCKER-USER for our subnet, exactly once.
         const jump = ["-s", subnet, "-j", CHAIN];
         const present = await ipt(["-C", "DOCKER-USER", ...jump]).then(() => true, () => false);
         if (!present)
             await ipt(["-I", "DOCKER-USER", ...jump]);
-        log.info("egress firewall installed (default-deny)", { subnet, gateway, port, dns: dns || "embedded" });
+        log.info("egress firewall installed (default-deny)", {
+            subnet, gateway, port, dns: dns || "embedded", dropAudit: logInstalled,
+        });
+        return logInstalled;
     }
     catch (err) {
         log.error("egress firewall: failed to install iptables rules — egress is NOT locked down. " +
             "Run the daemon with root / CAP_NET_ADMIN, or disable SBX_EGRESS_ENFORCE.", { error: String(err?.message ?? err) });
+        return false;
+    }
+}
+/**
+ * Consume Linux kernel firewall logs. `/dev/kmsg` is preferred; if its permissions
+ * prevent access, fall back to `journalctl -k -f`. The rate-limited firewall rule
+ * protects the kernel log from a sandbox generating a denial storm.
+ */
+export function startEgressDropMonitor(resolveSource, config) {
+    if (platform() !== "linux")
+        return () => { };
+    let stopped = false;
+    let reader;
+    let journal;
+    let pending = "";
+    let processing = Promise.resolve();
+    let startUptimeUs = 0;
+    try {
+        startUptimeUs = Number(readFileSync("/proc/uptime", "utf8").trim().split(/\s+/)[0]) * 1_000_000;
+        if (!Number.isFinite(startUptimeUs))
+            startUptimeUs = 0;
+    }
+    catch {
+        // Without /proc uptime, the parser still works; it may replay buffered records.
     }
+    const handleLine = (line) => {
+        const drop = parseEgressFirewallDrop(line);
+        if (!drop)
+            return;
+        const eventTime = kernelUptimeUs(line);
+        if (eventTime !== undefined && eventTime < startUptimeUs)
+            return;
+        processing = processing.then(async () => {
+            if (stopped)
+                return;
+            let source;
+            try {
+                source = await resolveSource(drop.sourceIp);
+            }
+            catch (err) {
+                log.warn("could not map a firewall drop to a sandbox", {
+                    sourceIp: drop.sourceIp,
+                    error: String(err?.message ?? err),
+                });
+            }
+            audit({
+                event: "egress.connection.denied",
+                sandboxId: source?.sandboxId,
+                driver: source?.driver ?? "container",
+                attributes: {
+                    host: drop.destinationIp,
+                    port: drop.port,
+                    protocol: drop.protocol,
+                    rule: DROP_RULE,
+                    direction: "outbound",
+                    "source.ip": drop.sourceIp,
+                    network: config.egressNetwork,
+                },
+            });
+        }).catch((err) => log.warn("failed to process an egress firewall record", {
+            error: String(err?.message ?? err),
+        }));
+    };
+    const handleChunk = (chunk) => {
+        pending += chunk.toString();
+        let newline;
+        while ((newline = pending.indexOf("\n")) >= 0) {
+            const line = pending.slice(0, newline);
+            pending = pending.slice(newline + 1);
+            handleLine(line);
+        }
+        if (pending.length > 16_384)
+            pending = "";
+    };
+    const startJournalFallback = () => {
+        if (stopped || journal)
+            return;
+        const child = spawn("journalctl", ["-k", "-f", "-o", "cat", "--since=now"], {
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        journal = child;
+        child.stdout?.on("data", handleChunk);
+        child.once("error", (err) => log.warn("egress drop audit unavailable (no kernel log reader)", {
+            error: String(err),
+        }));
+        child.once("exit", (code) => {
+            if (!stopped)
+                log.warn("kernel journal reader exited", { code });
+        });
+    };
+    const stream = createReadStream("/dev/kmsg", { encoding: "utf8" });
+    reader = stream;
+    stream.on("data", handleChunk);
+    stream.once("error", (err) => {
+        if (stopped)
+            return;
+        log.warn("cannot read /dev/kmsg; trying journalctl for egress drop audit", {
+            error: String(err),
+        });
+        startJournalFallback();
+    });
+    return () => {
+        stopped = true;
+        reader?.destroy();
+        journal?.kill("SIGTERM");
+    };
 }
 /** Run an `iptables` command, throwing with stderr on failure. */
 async function ipt(args) {

package/dist/net/firewall.js.map

@@ -1 +1 @@
-{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/net/firewall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO;IAClC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,6FAA6F;YAC3F,uGAAuG,EACzG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAErC,4EAA4E;IAC5E,kFAAkF;IAClF,gEAAgE;IAChE,MAAM,KAAK,GAAe;QACxB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;QACjE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC7D,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,MAAM,CAAC;KACf,CAAC;IAEF,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5D,sDAAsD;QACtD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAC5D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,iFAAiF;YAC/E,0EAA0E,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/net/firewall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,KAAK,GAAG,YAAY,CAAC;AAC3B,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAgBzC,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,aAAa,EAAE,MAAM,CAAC,GAAG;QACzB,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE;QACnD,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,yCAAyC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,6FAA6F;YAC3F,uGAAuG,EACzG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACzB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAErC,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,MAAM,UAAU,GAAe;YAC7B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;YACjE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;YAC7D,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;YACpE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;SACrE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAEjE,gFAAgF;QAChF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC;gBACR,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK;gBACrC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI;gBAC5D,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG;aACjE,CAAC,CAAC;YACH,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2EAA2E,EAAE;gBACpF,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvC,sDAAsD;QACtD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAC5D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE,YAAY;SACvE,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,iFAAiF;YAC/E,0EAA0E,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAClD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAmC,EACnC,MAAc;IAEd,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAA4B,CAAC;IACjC,IAAI,OAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,aAAa,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,aAAa;YAAE,OAAO;QACjE,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,MAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC;gBACJ,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,MAAM,EAAE,SAAS;gBAC5B,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW;gBACrC,UAAU,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,aAAa;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,UAAU;oBACrB,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,OAAO,EAAE,MAAM,CAAC,aAAa;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;YACxE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;SAC9C,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAE,EAAE;QAC7C,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAe,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM;YAAE,OAAO,GAAG,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE;QAChC,IAAI,OAAO,IAAI,OAAO;YAAE,OAAO;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE;YAC1E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAC5F,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,IAAI,OAAO;YAAE,OAAO;QACpB,GAAG,CAAC,IAAI,CAAC,gEAAgE,EAAE;YACzE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;QACH,oBAAoB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}