@hotcell/daemon 0.1.23 → 0.1.25

package/dist/lifecycle.js

@@ -1,4 +1,5 @@
 import { CapacityError } from "./capacity.js";
+import { audit } from "./audit.js";
 import { log } from "./logger.js";
 /**
  * Lifecycle FSM transitions and the idle reaper.
@@ -26,7 +27,7 @@ import { log } from "./logger.js";
  * processes, exposed ports) is only dropped on a cold pause — after a snapshot
  * pause it stays valid, because resume restores those processes live.
  */
-export async function pauseSandbox(driver, store, record) {
+export async function pauseSandbox(driver, store, record, automatic = false) {
     let hibernated = false;
     if (typeof driver.snapshot === "function" && (driver.canSnapshot?.(record.id) ?? true)) {
         try {
@@ -46,6 +47,7 @@ export async function pauseSandbox(driver, store, record) {
     }
     record.status = "paused";
     store.add(record);
+    audit({ event: "sandbox.pause", sandboxId: record.id, driver: record.driver ?? driver.name, attributes: { automatic } });
 }
 /**
  * Resume a paused (or stopped) sandbox: recreate its container, reattaching the
@@ -54,6 +56,7 @@ export async function pauseSandbox(driver, store, record) {
  * `CapacityError` instead of over-subscribing the host.
  */
 export async function resumeSandbox(driver, store, record, capacity) {
+    const previousStatus = record.status;
     // Reserve the sandbox's memory for the duration of the start: once the record
     // is written back as `running` it's counted by the meter itself, so the
     // pending reservation is released synchronously after the status write.
@@ -81,6 +84,7 @@ export async function resumeSandbox(driver, store, record, capacity) {
     record.status = "running";
     record.lastActivityAt = new Date().toISOString();
     store.add(record);
+    audit({ event: previousStatus === "stopped" ? "sandbox.start" : "sandbox.resume", sandboxId: record.id, driver: record.driver ?? driver.name });
     admitted.release();
 }
 /**
@@ -111,7 +115,7 @@ export async function reapIdle(driver, store, now = Date.now()) {
         if (now - Date.parse(record.lastActivityAt) < record.sleepAfterMs)
             continue;
         try {
-            await pauseSandbox(driver, store, record);
+            await pauseSandbox(driver, store, record, true);
             paused.push(record.id);
         }
         catch (err) {

package/dist/lifecycle.js.map

@@ -1 +1 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,eAAe,CAAC;AAE7D,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmB,EACnB,MAAqB;IAErB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAC7D,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC;IAC9E,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACpB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,QAAmB;IAEnB,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpE,EAAE,EAAE,IAAa;QACjB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,QAAQ,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,KAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,SAAS;QAC/D,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY;YAAE,SAAS;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YAC1C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QACpC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,GAAG,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;aACpB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../src/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAIlC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,SAAS,GAAG,KAAK;IAEjB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjC,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,EAAE;gBAC7D,OAAO,EAAE,MAAM,CAAC,EAAE;gBAClB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;aACnB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7B,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,wCAAwC;IAC9E,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC;IACzB,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC3H,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,KAAmB,EACnB,MAAqB,EACrB,QAAmB;IAEnB,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,8EAA8E;IAC9E,wEAAwE;IACxE,wEAAwE;IACxE,MAAM,QAAQ,GAAG,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI;QACpE,EAAE,EAAE,IAAa;QACjB,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC;KAClB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,aAAa,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC;YACjB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,cAAc,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChJ,QAAQ,CAAC,OAAO,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAc,EACd,KAAmB,EACnB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QAC1C,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,IAAI,CAAC;YAAE,SAAS;QAC/D,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC;YAAE,SAAS;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/E,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,YAAY;YAAE,SAAS;QAC5E,IAAI,CAAC;YACH,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC;QACpC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACxB,wEAAwE;QACxE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uEAAuE;QACvE,2BAA2B;QAC3B,IAAI,GAAG,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;aACpB,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,GAAG,CAAC,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/net/firewall.d.ts

@@ -1,4 +1,29 @@
 import type { Config } from "../config.js";
+export interface FirewallDrop {
+    sourceIp: string;
+    destinationIp: string;
+    protocol: string;
+    port: number;
+}
+export interface EgressSandboxRef {
+    sandboxId: string;
+    driver: string;
+}
+export type EgressSourceResolver = (sourceIp: string) => Promise<EgressSandboxRef | undefined>;
 /** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
 export declare function gatewayOf(subnet: string): string;
-export declare function ensureEgressFirewall(config: Config): Promise<void>;
+/** Parse one Linux kernel LOG record emitted by the Hotcell default-deny rule. */
+export declare function parseEgressFirewallDrop(line: string): FirewallDrop | undefined;
+/**
+ * Host-side default-deny egress firewall for sandboxes (Linux only).
+ * Traffic that misses the gateway/DNS allow rules is logged (rate-limited) and
+ * then dropped. The daemon consumes those kernel records and resolves the source
+ * container IP through Docker's `sbx.id` label before emitting an audit event.
+ */
+export declare function ensureEgressFirewall(config: Config): Promise<boolean>;
+/**
+ * Consume Linux kernel firewall logs. `/dev/kmsg` is preferred; if its permissions
+ * prevent access, fall back to `journalctl -k -f`. The rate-limited firewall rule
+ * protects the kernel log from a sandbox generating a denial storm.
+ */
+export declare function startEgressDropMonitor(resolveSource: EgressSourceResolver, config: Config): () => void;

package/dist/net/firewall.js

@@ -1,29 +1,13 @@
-import { execFile } from "node:child_process";
+import { execFile, spawn } from "node:child_process";
+import { createReadStream, readFileSync } from "node:fs";
 import { platform } from "node:os";
 import { promisify } from "node:util";
+import { audit } from "../audit.js";
 import { log } from "../logger.js";
 const exec = promisify(execFile);
-/**
- * Host-side default-deny egress firewall for sandboxes (Linux only).
- *
- * When `SBX_EGRESS_ENFORCE=true`, sandboxes run on a dedicated bridge network
- * (`config.egressSubnet`). This installs `iptables` rules in the `DOCKER-USER`
- * chain — the supported, operator-owned hook Docker consults before its own rules
- * — so traffic from that subnet may reach ONLY the egress gateway (the bridge
- * gateway `.1` on `egressPort`) and the pinned DNS resolver; everything else is
- * dropped. The sandbox holds no `CAP_NET_ADMIN`, so it cannot edit these rules.
- *
- * Rules live in a dedicated `SBX-EGRESS` chain that is flushed + rebuilt on every
- * startup (idempotent), with a single jump from `DOCKER-USER`.
- *
- * NOT a hard isolation boundary: a kernel-shared container is weaker than a VM,
- * and on Docker Desktop (macOS) `DOCKER-USER` isn't host-editable — there
- * enforcement degrades to advisory (proxy env is still set, but direct egress is
- * not blocked). Transparent, in-guest-enforced default-deny is the microVM driver's
- * job; this is the best that plain Docker on Linux can do. Requires the daemon to
- * run with iptables privileges (root or `CAP_NET_ADMIN`).
- */
 const CHAIN = "SBX-EGRESS";
+const DROP_LOG_PREFIX = "HOTCELL_EGRESS_DROP ";
+const DROP_RULE = "hotcell-default-deny";
 /** Derive the bridge gateway IP (`.1`) from a `/24`-style subnet base. */
 export function gatewayOf(subnet) {
     const base = subnet.split("/")[0] ?? subnet;
@@ -33,45 +17,201 @@ export function gatewayOf(subnet) {
     octets[3] = "1";
     return octets.join(".");
 }
+/** Parse one Linux kernel LOG record emitted by the Hotcell default-deny rule. */
+export function parseEgressFirewallDrop(line) {
+    const marker = line.indexOf(DROP_LOG_PREFIX);
+    if (marker < 0)
+        return undefined;
+    const message = line.slice(marker + DROP_LOG_PREFIX.length);
+    const fields = {};
+    for (const match of message.matchAll(/(?:^|\s)([A-Z][A-Z0-9_]*)=([^\s]*)/g)) {
+        fields[match[1]] = match[2];
+    }
+    if (!fields.SRC || !fields.DST)
+        return undefined;
+    const parsedPort = Number(fields.DPT);
+    return {
+        sourceIp: fields.SRC,
+        destinationIp: fields.DST,
+        protocol: (fields.PROTO ?? "unknown").toLowerCase(),
+        port: Number.isInteger(parsedPort) && parsedPort >= 0 ? parsedPort : 0,
+    };
+}
+/** Kernel log timestamps are monotonic microseconds since boot (`/dev/kmsg`). */
+function kernelUptimeUs(line) {
+    const semicolon = line.indexOf(";");
+    if (semicolon < 0)
+        return undefined; // journalctl output has no kmsg metadata
+    const metadata = line.slice(0, semicolon).replace(/^<\d+>/, "").split(",");
+    const value = Number(metadata[2]);
+    return Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+/**
+ * Host-side default-deny egress firewall for sandboxes (Linux only).
+ * Traffic that misses the gateway/DNS allow rules is logged (rate-limited) and
+ * then dropped. The daemon consumes those kernel records and resolves the source
+ * container IP through Docker's `sbx.id` label before emitting an audit event.
+ */
 export async function ensureEgressFirewall(config) {
     if (!config.egressEnforce)
-        return;
+        return false;
     if (platform() !== "linux") {
         log.warn("egress enforcement requested but host is not Linux — fail-closed firewall is ADVISORY only " +
             "(proxy env is injected, but direct egress is NOT blocked). Use the microVM driver for hard isolation.", { platform: platform() });
-        return;
+        return false;
     }
     const subnet = config.egressSubnet;
     const gateway = gatewayOf(subnet);
     const port = String(config.egressPort);
     const dns = config.egressDnsResolver;
-    // The ordered rule set for the SBX-EGRESS chain. Allows return traffic, the
-    // gateway, and DNS (to the pinned resolver if set, else the bridge gateway, which
-    // Docker's embedded resolver forwards through); drops the rest.
-    const rules = [
-        ["-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT"],
-        ["-p", "tcp", "-d", gateway, "--dport", port, "-j", "ACCEPT"],
-        ["-p", "udp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
-        ["-p", "tcp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
-        ["-j", "DROP"],
-    ];
     try {
         // Create (ignore "exists"), then flush so we rebuild cleanly each boot.
         await ipt(["-N", CHAIN]).catch(() => { });
         await ipt(["-F", CHAIN]);
-        for (const rule of rules)
+        const allowRules = [
+            ["-m", "state", "--state", "ESTABLISHED,RELATED", "-j", "ACCEPT"],
+            ["-p", "tcp", "-d", gateway, "--dport", port, "-j", "ACCEPT"],
+            ["-p", "udp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+            ["-p", "tcp", "-d", dns || gateway, "--dport", "53", "-j", "ACCEPT"],
+        ];
+        for (const rule of allowRules)
             await ipt(["-A", CHAIN, ...rule]);
+        // Logging is optional; install the DROP regardless if LOG/limit is unsupported.
+        let logInstalled = false;
+        try {
+            await ipt([
+                "-A", CHAIN,
+                "-m", "conntrack", "--ctstate", "NEW",
+                "-m", "limit", "--limit", "20/second", "--limit-burst", "50",
+                "-j", "LOG", "--log-prefix", DROP_LOG_PREFIX, "--log-level", "4",
+            ]);
+            logInstalled = true;
+        }
+        catch (err) {
+            log.warn("egress firewall drop logging unavailable; DROP enforcement remains active", {
+                error: String(err?.message ?? err),
+            });
+        }
+        await ipt(["-A", CHAIN, "-j", "DROP"]);
         // Jump from DOCKER-USER for our subnet, exactly once.
         const jump = ["-s", subnet, "-j", CHAIN];
         const present = await ipt(["-C", "DOCKER-USER", ...jump]).then(() => true, () => false);
         if (!present)
             await ipt(["-I", "DOCKER-USER", ...jump]);
-        log.info("egress firewall installed (default-deny)", { subnet, gateway, port, dns: dns || "embedded" });
+        log.info("egress firewall installed (default-deny)", {
+            subnet, gateway, port, dns: dns || "embedded", dropAudit: logInstalled,
+        });
+        return logInstalled;
     }
     catch (err) {
         log.error("egress firewall: failed to install iptables rules — egress is NOT locked down. " +
             "Run the daemon with root / CAP_NET_ADMIN, or disable SBX_EGRESS_ENFORCE.", { error: String(err?.message ?? err) });
+        return false;
+    }
+}
+/**
+ * Consume Linux kernel firewall logs. `/dev/kmsg` is preferred; if its permissions
+ * prevent access, fall back to `journalctl -k -f`. The rate-limited firewall rule
+ * protects the kernel log from a sandbox generating a denial storm.
+ */
+export function startEgressDropMonitor(resolveSource, config) {
+    if (platform() !== "linux")
+        return () => { };
+    let stopped = false;
+    let reader;
+    let journal;
+    let pending = "";
+    let processing = Promise.resolve();
+    let startUptimeUs = 0;
+    try {
+        startUptimeUs = Number(readFileSync("/proc/uptime", "utf8").trim().split(/\s+/)[0]) * 1_000_000;
+        if (!Number.isFinite(startUptimeUs))
+            startUptimeUs = 0;
+    }
+    catch {
+        // Without /proc uptime, the parser still works; it may replay buffered records.
     }
+    const handleLine = (line) => {
+        const drop = parseEgressFirewallDrop(line);
+        if (!drop)
+            return;
+        const eventTime = kernelUptimeUs(line);
+        if (eventTime !== undefined && eventTime < startUptimeUs)
+            return;
+        processing = processing.then(async () => {
+            if (stopped)
+                return;
+            let source;
+            try {
+                source = await resolveSource(drop.sourceIp);
+            }
+            catch (err) {
+                log.warn("could not map a firewall drop to a sandbox", {
+                    sourceIp: drop.sourceIp,
+                    error: String(err?.message ?? err),
+                });
+            }
+            audit({
+                event: "egress.connection.denied",
+                sandboxId: source?.sandboxId,
+                driver: source?.driver ?? "container",
+                attributes: {
+                    host: drop.destinationIp,
+                    port: drop.port,
+                    protocol: drop.protocol,
+                    rule: DROP_RULE,
+                    direction: "outbound",
+                    "source.ip": drop.sourceIp,
+                    network: config.egressNetwork,
+                },
+            });
+        }).catch((err) => log.warn("failed to process an egress firewall record", {
+            error: String(err?.message ?? err),
+        }));
+    };
+    const handleChunk = (chunk) => {
+        pending += chunk.toString();
+        let newline;
+        while ((newline = pending.indexOf("\n")) >= 0) {
+            const line = pending.slice(0, newline);
+            pending = pending.slice(newline + 1);
+            handleLine(line);
+        }
+        if (pending.length > 16_384)
+            pending = "";
+    };
+    const startJournalFallback = () => {
+        if (stopped || journal)
+            return;
+        const child = spawn("journalctl", ["-k", "-f", "-o", "cat", "--since=now"], {
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        journal = child;
+        child.stdout?.on("data", handleChunk);
+        child.once("error", (err) => log.warn("egress drop audit unavailable (no kernel log reader)", {
+            error: String(err),
+        }));
+        child.once("exit", (code) => {
+            if (!stopped)
+                log.warn("kernel journal reader exited", { code });
+        });
+    };
+    const stream = createReadStream("/dev/kmsg", { encoding: "utf8" });
+    reader = stream;
+    stream.on("data", handleChunk);
+    stream.once("error", (err) => {
+        if (stopped)
+            return;
+        log.warn("cannot read /dev/kmsg; trying journalctl for egress drop audit", {
+            error: String(err),
+        });
+        startJournalFallback();
+    });
+    return () => {
+        stopped = true;
+        reader?.destroy();
+        journal?.kill("SIGTERM");
+    };
 }
 /** Run an `iptables` command, throwing with stderr on failure. */
 async function ipt(args) {

package/dist/net/firewall.js.map

@@ -1 +1 @@
-{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/net/firewall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEjC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,KAAK,GAAG,YAAY,CAAC;AAE3B,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO;IAClC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,6FAA6F;YAC3F,uGAAuG,EACzG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACzB,CAAC;QACF,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAErC,4EAA4E;IAC5E,kFAAkF;IAClF,gEAAgE;IAChE,MAAM,KAAK,GAAe;QACxB,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;QACjE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QAC7D,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;QACpE,CAAC,IAAI,EAAE,MAAM,CAAC;KACf,CAAC;IAEF,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC5D,sDAAsD;QACtD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAC5D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,CAAC,CAAC;IAC1G,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,iFAAiF;YAC/E,0EAA0E,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAClD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}
+{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/net/firewall.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzD,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAEnC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACjC,MAAM,KAAK,GAAG,YAAY,CAAC;AAC3B,MAAM,eAAe,GAAG,sBAAsB,CAAC;AAC/C,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAgBzC,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAChB,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,IAAY;IAClD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC5E,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,aAAa,EAAE,MAAM,CAAC,GAAG;QACzB,QAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE;QACnD,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC,CAAC,yCAAyC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAc;IACvD,IAAI,CAAC,MAAM,CAAC,aAAa;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,GAAG,CAAC,IAAI,CACN,6FAA6F;YAC3F,uGAAuG,EACzG,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CACzB,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC;IACnC,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC;IAErC,IAAI,CAAC;QACH,wEAAwE;QACxE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACzC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACzB,MAAM,UAAU,GAAe;YAC7B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC;YACjE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;YAC7D,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;YACpE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC;SACrE,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAEjE,gFAAgF;QAChF,IAAI,YAAY,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC;gBACR,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK;gBACrC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI;gBAC5D,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,GAAG;aACjE,CAAC,CAAC;YACH,YAAY,GAAG,IAAI,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,2EAA2E,EAAE;gBACpF,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAEvC,sDAAsD;QACtD,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAC5D,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;QACF,IAAI,CAAC,OAAO;YAAE,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE;YACnD,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,UAAU,EAAE,SAAS,EAAE,YAAY;SACvE,CAAC,CAAC;QACH,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CACP,iFAAiF;YAC/E,0EAA0E,EAC5E,EAAE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAClD,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,aAAmC,EACnC,MAAc;IAEd,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAE5C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAA4B,CAAC;IACjC,IAAI,OAAiC,CAAC;IACtC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;QAChG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,aAAa,GAAG,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,gFAAgF;IAClF,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI;YAAE,OAAO;QAClB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,GAAG,aAAa;YAAE,OAAO;QACjE,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,MAAoC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE;oBACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;iBAC9C,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC;gBACJ,KAAK,EAAE,0BAA0B;gBACjC,SAAS,EAAE,MAAM,EAAE,SAAS;gBAC5B,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW;gBACrC,UAAU,EAAE;oBACV,IAAI,EAAE,IAAI,CAAC,aAAa;oBACxB,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,IAAI,EAAE,SAAS;oBACf,SAAS,EAAE,UAAU;oBACrB,WAAW,EAAE,IAAI,CAAC,QAAQ;oBAC1B,OAAO,EAAE,MAAM,CAAC,aAAa;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,6CAA6C,EAAE;YACxE,KAAK,EAAE,MAAM,CAAE,GAAa,EAAE,OAAO,IAAI,GAAG,CAAC;SAC9C,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAE,EAAE;QAC7C,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAe,CAAC;QACpB,OAAO,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACvC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACrC,UAAU,CAAC,IAAI,CAAC,CAAC;QACnB,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM;YAAE,OAAO,GAAG,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,oBAAoB,GAAG,GAAG,EAAE;QAChC,IAAI,OAAO,IAAI,OAAO;YAAE,OAAO;QAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,EAAE;YAC1E,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,GAAG,KAAK,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACtC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAC5F,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC,CAAC;QACJ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,GAAG,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3B,IAAI,OAAO;YAAE,OAAO;QACpB,GAAG,CAAC,IAAI,CAAC,gEAAgE,EAAE;YACzE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC;SACnB,CAAC,CAAC;QACH,oBAAoB,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,MAAM,EAAE,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/proxy/egress.js

@@ -1,5 +1,6 @@
 import { createServer } from "node:http";
 import { connect as netConnect } from "node:net";
+import { audit } from "../audit.js";
 import { log } from "../logger.js";
 import { computeModelCost } from "../pricing.js";
 import { startSpan } from "../tracing.js";
@@ -219,18 +220,22 @@ async function handle(req, res, deps) {
     const now = Date.now();
     // --- policy enforcement (cheapest, most-decisive checks first) -----------
     if (policy.expiresAt && now > Date.parse(policy.expiresAt)) {
+        audit({ event: "gateway.token.expired", sandboxId, driver: store.get(sandboxId)?.driver, attributes: { "token.raw": token, provider: providerName, status: 403 } });
         return sendText(res, 403, "egress token expired");
     }
     if (policy.providers && !policy.providers.includes(providerName)) {
+        audit({ event: "gateway.policy.rejected", sandboxId, driver: store.get(sandboxId)?.driver, attributes: { "token.raw": token, provider: providerName, reason: "provider_scope", status: 403 } });
         return sendText(res, 403, `provider not in token scope: ${providerName}`);
     }
     if (policy.spendCapUsd !== undefined && record.spendUsd >= policy.spendCapUsd) {
+        audit({ event: "gateway.policy.rejected", sandboxId, driver: store.get(sandboxId)?.driver, attributes: { "token.raw": token, provider: providerName, reason: "token_spend_cap", status: 402, spendUsd: record.spendUsd, spendCapUsd: policy.spendCapUsd } });
         return sendText(res, 402, "egress spend cap exceeded (token)");
     }
     // Per-sandbox ceiling: a hard cap across ALL of the sandbox's tokens, so an
     // abused token can't exceed it even before it's revoked.
     const sb = store.get(sandboxId);
     if (sb?.egressSpendCapUsd && sb.usage.providerCost >= sb.egressSpendCapUsd) {
+        audit({ event: "gateway.policy.rejected", sandboxId, driver: sb.driver ?? undefined, attributes: { "token.raw": token, provider: providerName, reason: "sandbox_spend_cap", status: 402, spendUsd: sb.usage.providerCost, spendCapUsd: sb.egressSpendCapUsd } });
         return sendText(res, 402, "egress spend cap exceeded (sandbox)");
     }
     const method = req.method ?? "GET";
@@ -252,6 +257,7 @@ async function handle(req, res, deps) {
     // is rejected.
     const reqModel = reqBody ? parseModel(reqBody) : undefined;
     if (policy.models && reqModel && !matchModel(policy.models, reqModel)) {
+        audit({ event: "gateway.policy.rejected", sandboxId, driver: sb?.driver ?? undefined, attributes: { "token.raw": token, provider: providerName, model: reqModel.slice(0, 128), reason: "model_scope", status: 403 } });
         return sendText(res, 403, `model not allowed: ${reqModel}`);
     }
     // Rate limit: check the token budget (read-only) before consuming a call slot,
@@ -260,11 +266,13 @@ async function handle(req, res, deps) {
         const tok = deps.limiter.checkTokens(token, policy.rateLimit, now);
         if (!tok.ok) {
             res.setHeader("retry-after", Math.ceil(tok.retryAfterMs / 1000));
+            audit({ event: "gateway.policy.rejected", sandboxId, driver: sb?.driver ?? undefined, attributes: { "token.raw": token, provider: providerName, reason: "token_rate_limit", status: 429 } });
             return sendText(res, 429, "egress rate limit (tokens) exceeded");
         }
         const call = deps.limiter.allow(token, policy.rateLimit, now);
         if (!call.ok) {
             res.setHeader("retry-after", Math.ceil(call.retryAfterMs / 1000));
+            audit({ event: "gateway.policy.rejected", sandboxId, driver: sb?.driver ?? undefined, attributes: { "token.raw": token, provider: providerName, reason: "call_rate_limit", status: 429 } });
             return sendText(res, 429, "egress rate limit (calls) exceeded");
         }
     }
@@ -327,11 +335,22 @@ async function handle(req, res, deps) {
     // two — the result is folded into `providerCost`, keeping one source of truth.
     const model = respModel ?? reqModel;
     const cost = reportedCost > 0 ? reportedCost : computeModelCost(model, tokensIn, tokensOut, deps.prices ?? {});
+    const previousTokenSpend = record.spendUsd;
+    const previousSandboxSpend = sb?.usage.providerCost ?? 0;
     store.addProviderUsage(sandboxId, { bytes, tokensIn, tokensOut, cost });
     if (cost > 0)
         store.addEgressTokenSpend(token, cost);
     if (policy.rateLimit)
         deps.limiter.note(token, policy.rateLimit, tokensIn + tokensOut, now);
+    const updatedSandbox = store.get(sandboxId);
+    const updatedToken = store.resolveEgressTokenFull(token);
+    audit({ event: "gateway.call", sandboxId, driver: updatedSandbox?.driver ?? undefined, attributes: { "token.raw": token, provider: providerName, model: model?.slice(0, 128) ?? "", status: upstream.status, tokensIn, tokensOut, cost } });
+    if (policy.spendCapUsd !== undefined && previousTokenSpend < policy.spendCapUsd && (updatedToken?.spendUsd ?? previousTokenSpend) >= policy.spendCapUsd) {
+        audit({ event: "gateway.spend_cap_reached", sandboxId, driver: updatedSandbox?.driver ?? undefined, attributes: { "token.raw": token, scope: "token", spendUsd: updatedToken?.spendUsd ?? previousTokenSpend, spendCapUsd: policy.spendCapUsd } });
+    }
+    if (updatedSandbox?.egressSpendCapUsd && previousSandboxSpend < updatedSandbox.egressSpendCapUsd && updatedSandbox.usage.providerCost >= updatedSandbox.egressSpendCapUsd) {
+        audit({ event: "gateway.spend_cap_reached", sandboxId, driver: updatedSandbox.driver ?? undefined, attributes: { "token.raw": token, scope: "sandbox", spendUsd: updatedSandbox.usage.providerCost, spendCapUsd: updatedSandbox.egressSpendCapUsd } });
+    }
     span
         .setAttribute("http.status_code", upstream.status)
         .setAttribute("egress.tokens_in", tokensIn)
@@ -453,11 +472,13 @@ async function handleForwardHttp(req, res, deps) {
     }
     if (deps.providerHosts.has(host)) {
         log.warn("egress forward denied: LLM provider host", { sandbox: rec.sandboxId, host });
+        audit({ event: "egress.connection.denied", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host, port: Number(target.port) || (target.protocol === "https:" ? 443 : 80), rule: "provider_gateway_required", protocol: target.protocol } });
         return sendText(res, 403, `direct egress to LLM provider blocked: ${host} — use the gateway path`);
     }
     const decision = deps.allowlist.check(host);
     if (!decision.allow) {
         log.warn("egress forward denied", { sandbox: rec.sandboxId, host, reason: decision.reason });
+        audit({ event: "egress.connection.denied", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host, port: Number(target.port) || (target.protocol === "https:" ? 443 : 80), rule: decision.reason, protocol: target.protocol } });
         return sendText(res, 403, `egress to ${host} denied (${decision.reason})`);
     }
     const method = req.method ?? "GET";
@@ -513,6 +534,7 @@ async function handleForwardHttp(req, res, deps) {
     }
     res.end();
     deps.store.addEgress(rec.sandboxId, bytes);
+    audit({ event: "egress.connection.allowed", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host, port: Number(target.port) || (target.protocol === "https:" ? 443 : 80), rule: decision.reason, protocol: target.protocol, method, status: upstream.status, bytes } });
     log.info("egress forward", { sandbox: rec.sandboxId, host, status: upstream.status, bytes });
 }
 /**
@@ -538,12 +560,14 @@ async function handleConnect(req, clientSocket, head, deps) {
     // never re-open a key-bypass tunnel to an LLM provider.
     if (deps.providerHosts.has(nhost)) {
         log.warn("egress CONNECT denied: LLM provider host", { sandbox: rec.sandboxId, host: nhost });
+        audit({ event: "egress.connection.denied", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host: nhost, port, rule: "provider_gateway_required", protocol: "connect" } });
         clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
         return;
     }
     const decision = deps.allowlist.check(nhost);
     if (!decision.allow) {
         log.warn("egress CONNECT denied", { sandbox: rec.sandboxId, host: nhost, reason: decision.reason });
+        audit({ event: "egress.connection.denied", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host: nhost, port, rule: decision.reason, protocol: "connect" } });
         clientSocket.end("HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n");
         return;
     }
@@ -569,6 +593,7 @@ async function handleConnect(req, clientSocket, head, deps) {
         upstream.on("data", (c) => (bytes += c.length));
         clientSocket.pipe(upstream);
         upstream.pipe(clientSocket);
+        audit({ event: "egress.connection.allowed", sandboxId: rec.sandboxId, driver: deps.store.get(rec.sandboxId)?.driver, attributes: { host: nhost, port, rule: decision.reason, protocol: "connect" } });
         log.info("egress CONNECT", { sandbox: rec.sandboxId, host: nhost, port });
     });
     upstream.on("error", () => {

package/dist/proxy/egress.js.map

@@ -1 +1 @@
-{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/proxy/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,UAAU,CAAC;AAE9D,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAa,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA0B7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,iBAAiB,GAAqD;IAC1E,MAAM,EAAE;QACN,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KAC7B;IACD,SAAS,EAAE;QACT,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;IACD,UAAU,EAAE;QACV,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KAC7B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;IACD,0EAA0E;IAC1E,MAAM,EAAE;QACN,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAqC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAAiD,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,GAAG,EAAE,UAAU,CAAC;QACzD,IAAI,MAAM,GAAwC,GAAG,EAAE,MAAM,CAAC;QAC9D,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;YAC1C,gEAAgE;YAChE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,IAAI,UAAU,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,kFAAkF;IAClF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,MAAM,GAAG;YACjB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAyBD,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,QAAQ,GAAiB;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,WAAW,EAAE;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;KACpD,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,aAAa,CAAC,GAAG,EAAE,MAAgB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAsB,CAAC;IACtC,MAAM,CAAC,eAAe,GAAG,CAAC,SAAS,EAAE,EAAE;QACrC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,QAAQ,CAAC,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,SAA2C;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnC,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAkB;IACjF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,0EAA0E;IAC1E,iFAAiF;IACjF,iDAAiD;IACjD,IAAI,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAE3D,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAErC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,6EAA6E;QAC7E,yEAAyE;QACzE,oCAAoC;QACpC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,IAAI,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,+EAA+E;IAC/E,oEAAoE;IACpE,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnE,QAAQ,GAAG;YACT,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/E,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,YAAY,EAAE,CAAC,CAAC;IAE9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,4EAA4E;IAC5E,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;IACjE,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,EAAE,EAAE,iBAAiB,IAAI,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC3E,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,eAAe;IACf,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YAClE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,EAAE;QAC7C,YAAY,EAAE,SAAS;QACvB,iBAAiB,EAAE,YAAY;KAChC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI;YAAE,SAAS;QAC5D,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,IAAI,KAAK,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IAEjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5C,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,yBAAyB;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,SAAS,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;IAEV,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,uEAAuE;IACvE,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,SAAS,IAAI,QAAQ,CAAC;IACpC,MAAM,IAAI,GACR,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAEpG,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,CAAC;QAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,SAAS;QAAE,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7F,IAAI;SACD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC;SACjD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SAC1C,YAAY,CAAC,mBAAmB,EAAE,SAAS,CAAC;SAC5C,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QACtB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK;QACL,KAAK;QACL,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAkB,EAAE,KAAa;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrD,6EAA6E;QAC7E,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,OAAO,IAAI,IAAI,IAAI,IAAI,SAAS,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;QACpE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,IAAI,yBAAyB,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,IAAI,YAAY,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,IACE,CAAC,IAAI,IAAI;YACT,EAAE,KAAK,qBAAqB;YAC5B,EAAE,KAAK,kBAAkB;YACzB,EAAE,KAAK,kBAAkB;YACzB,EAAE,KAAK,cAAc;YACrB,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IACjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;IACV,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,YAAoB,EACpB,IAAY,EACZ,IAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,sEAAsE;QACtE,2EAA2E;QAC3E,wEAAwE;QACxE,mEAAmE;QACnE,YAAY,CAAC,GAAG,CACd,kJAAkJ,CACnJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,gFAAgF;IAChF,wDAAwD;IACxD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,YAAY,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,YAAY,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,EAAE,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAWD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAM,EAAsB,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QACnB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,aAAa,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,sDAAsD;QAC3E,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACvB,KAAK;SACN,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,+EAA+E;IAC/E,uCAAuC;IACvC,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ;YAAE,SAAS;QAC/C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ;gBAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"egress.js","sourceRoot":"","sources":["../../src/proxy/egress.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,OAAO,IAAI,UAAU,EAAe,MAAM,UAAU,CAAC;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAoB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACnF,OAAO,EAAa,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AA0B7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,iBAAiB,GAAqD;IAC1E,MAAM,EAAE;QACN,OAAO,EAAE,wBAAwB;QACjC,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KAC7B;IACD,SAAS,EAAE;QACT,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,WAAW;QACvB,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;IACD,UAAU,EAAE;QACV,OAAO,EAAE,2BAA2B;QACpC,UAAU,EAAE,eAAe;QAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;KAC7B;IACD,MAAM,EAAE;QACN,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;IACD,0EAA0E;IAC1E,MAAM,EAAE;QACN,OAAO,EAAE,2CAA2C;QACpD,UAAU,EAAE,gBAAgB;QAC5B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;KACjB;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc;IAC3C,MAAM,SAAS,GAAqC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,GAAG,GAAiD,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,GAAG,EAAE,OAAO,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,GAAG,EAAE,UAAU,CAAC;QACzD,IAAI,MAAM,GAAwC,GAAG,EAAE,MAAM,CAAC;QAC9D,IAAI,MAAM,EAAE,cAAc,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;YACnC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3C,CAAC;aAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,EAAE,CAAC;YAC1C,gEAAgE;YAChE,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,OAAO,IAAI,UAAU,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,+EAA+E;IAC/E,6EAA6E;IAC7E,kFAAkF;IAClF,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,SAAS,CAAC,MAAM,GAAG;YACjB,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE;YAC5B,MAAM,EAAE,SAAS;SAClB,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAyBD,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,MAAM,QAAQ,GAAiB;QAC7B,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,WAAW,EAAE;QAC1C,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QACvD,aAAa,EAAE,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC;KACpD,CAAC;IACF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,uBAAuB,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QACzC,aAAa,CAAC,GAAG,EAAE,MAAgB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC9D,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,yBAAyB;YAC3B,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,MAAM,GAAG,MAAsB,CAAC;IACtC,MAAM,CAAC,eAAe,GAAG,CAAC,SAAS,EAAE,EAAE;QACrC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QAC/B,QAAQ,CAAC,aAAa,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,SAA2C;IACvE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,OAAe,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,sBAAsB;QACxB,CAAC;IACH,CAAC,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,MAAM;IACN,YAAY;IACZ,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,cAAc;IACd,eAAe;CAChB,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,kBAAkB;IAClB,mBAAmB;IACnB,gBAAgB;IAChB,YAAY;CACb,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAC;AAEnC,KAAK,UAAU,MAAM,CAAC,GAAoB,EAAE,GAAmB,EAAE,IAAkB;IACjF,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,0EAA0E;IAC1E,iFAAiF;IACjF,iDAAiD;IACjD,IAAI,GAAG,CAAC,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,OAAO,iBAAiB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,qBAAqB,CAAC,CAAC;IAE3D,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;IAErC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,6EAA6E;QAC7E,yEAAyE;QACzE,oCAAoC;QACpC,GAAG,CAAC,SAAS,CAAC,kBAAkB,EAAE,8BAA8B,CAAC,CAAC;QAClE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAE7B,IAAI,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;IACvC,+EAA+E;IAC/E,oEAAoE;IACpE,6EAA6E;IAC7E,6DAA6D;IAC7D,IAAI,CAAC,QAAQ,IAAI,YAAY,KAAK,YAAY,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnE,QAAQ,GAAG;YACT,OAAO,EAAE,oBAAoB;YAC7B,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/E,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM;SAChC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qBAAqB,YAAY,EAAE,CAAC,CAAC;IAE9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,4EAA4E;IAC5E,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACpK,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACjE,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAChM,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,gCAAgC,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC9E,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAC7P,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,mCAAmC,CAAC,CAAC;IACjE,CAAC;IACD,4EAA4E;IAC5E,yDAAyD;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,IAAI,EAAE,EAAE,iBAAiB,IAAI,EAAE,CAAC,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAC;QAC3E,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACjQ,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,eAAe;IACf,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3D,IAAI,MAAM,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QACtE,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACvN,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,sBAAsB,QAAQ,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,+EAA+E;IAC/E,8DAA8D;IAC9D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YACjE,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7L,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,qCAAqC,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC;YAClE,KAAK,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5L,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,oCAAoC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,EAAE;QAC7C,YAAY,EAAE,SAAS;QACvB,iBAAiB,EAAE,YAAY;KAChC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,IAAI;YAAE,SAAS;QAC5D,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAEnE,IAAI,KAAK,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IAEjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC;QAC9B,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE5C,gFAAgF;IAChF,8EAA8E;IAC9E,8EAA8E;IAC9E,gFAAgF;IAChF,yBAAyB;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACf,SAAS,IAAI,GAAG,CAAC,MAAM,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC,IAAI,eAAe,EAAE,CAAC;gBAChF,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC7B,SAAS,IAAI,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;IAEV,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,uEAAuE;IACvE,gFAAgF;IAChF,+EAA+E;IAC/E,MAAM,KAAK,GAAG,SAAS,IAAI,QAAQ,CAAC;IACpC,MAAM,IAAI,GACR,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAEpG,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC3C,MAAM,oBAAoB,GAAG,EAAE,EAAE,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC;IACzD,KAAK,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,IAAI,GAAG,CAAC;QAAE,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,SAAS;QAAE,IAAI,CAAC,OAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,GAAG,SAAS,EAAE,GAAG,CAAC,CAAC;IAC7F,MAAM,cAAc,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACzD,KAAK,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5O,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,IAAI,kBAAkB,GAAG,MAAM,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,QAAQ,IAAI,kBAAkB,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxJ,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,IAAI,kBAAkB,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrP,CAAC;IACD,IAAI,cAAc,EAAE,iBAAiB,IAAI,oBAAoB,GAAG,cAAc,CAAC,iBAAiB,IAAI,cAAc,CAAC,KAAK,CAAC,YAAY,IAAI,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC1K,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,SAAS,EAAE,UAAU,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACzP,CAAC;IACD,IAAI;SACD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC;SACjD,YAAY,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SAC1C,YAAY,CAAC,mBAAmB,EAAE,SAAS,CAAC;SAC5C,YAAY,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,KAAK;QAAE,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE;QACtB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,YAAY;QACtB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,KAAK;QACL,KAAK;QACL,QAAQ;QACR,SAAS;QACT,IAAI;QACJ,OAAO,EAAE,IAAI,CAAC,OAAO;KACtB,CAAC,CAAC;AACL,CAAC;AAED,sEAAsE;AACtE,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,QAAkB,EAAE,KAAa;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAC9B,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;IACxE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8GAA8G;AAC9G,SAAS,YAAY,CAAC,GAAoB;IACxC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACrD,6EAA6E;QAC7E,qCAAqC;QACrC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,OAAO,IAAI,IAAI,IAAI,IAAI,SAAS,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,GAAoB;IAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC9C,IAAI,OAAO,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,IAAI;gBAAE,OAAO,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IACxD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,CAAS;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QAC7C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAAkB;IAElB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,8BAA8B,CAAC,CAAC;QACpE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClR,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,0CAA0C,IAAI,yBAAyB,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7F,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACtQ,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,IAAI,YAAY,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;IACnC,IAAI,OAA2B,CAAC;IAChC,IAAI,CAAC;QACH,OAAO;YACL,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,iBAAiB;YAAE,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,IACE,CAAC,IAAI,IAAI;YACT,EAAE,KAAK,qBAAqB;YAC5B,EAAE,KAAK,kBAAkB;YACzB,EAAE,KAAK,kBAAkB;YACzB,EAAE,KAAK,cAAc;YACrB,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,EACnB,CAAC;YACD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,KAAK,GAAG,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;IACjC,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,yBAAyB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,SAAS,CAAC;YACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACf,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC;QACtB,CAAC;IACH,CAAC;IACD,GAAG,CAAC,GAAG,EAAE,CAAC;IACV,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/S,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAC/F,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAoB,EACpB,YAAoB,EACpB,IAAY,EACZ,IAAkB;IAElB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,sEAAsE;QACtE,2EAA2E;QAC3E,wEAAwE;QACxE,mEAAmE;QACnE,YAAY,CAAC,GAAG,CACd,kJAAkJ,CACnJ,CAAC;QACF,OAAO;IACT,CAAC;IACD,gFAAgF;IAChF,wDAAwD;IACxD,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,GAAG,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9F,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,2BAA2B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACjN,YAAY,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,KAAK,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACrM,YAAY,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,KAAK,GAAG,IAAI,EAAE,MAAM,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,EAAE;QACpB,MAAM,EAAE,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE,CAAC;QACnB,YAAY,CAAC,OAAO,EAAE,CAAC;IACzB,CAAC,CAAC;IACF,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QAC1B,YAAY,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAClE,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM;YAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5B,KAAK,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtM,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,YAAY,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QACD,QAAQ,EAAE,CAAC;IACb,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAC/B,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACrC,CAAC;AAWD;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,CAAC,CAAM,EAAsB,EAAE;QAC7C,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QACnB,MAAM,KAAK,GAAG,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,GAAG,GAAG,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,YAAY,CAAC;QAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,aAAa,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,sDAAsD;QAC3E,IAAI,GAAG,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC5D,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAC1B,SAAS,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;YAC3B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;YACvB,KAAK;SACN,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACxC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;IACvD,CAAC;IACD,+EAA+E;IAC/E,uCAAuC;IACvC,IAAI,IAAI,GAAuB,IAAI,CAAC;IACpC,IAAI,SAA6B,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,QAAQ;YAAE,SAAS;QAC/C,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC9B,IAAI,OAAO,CAAC,EAAE,KAAK,KAAK,QAAQ;gBAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC;YACtD,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;YACrB,IAAI,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;IACH,CAAC;IACD,IAAI,IAAI;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC;IAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAClE,CAAC"}

package/dist/smoke.js

@@ -172,6 +172,14 @@ async function main() {
         if (!names.includes("smoke.txt") || !names.includes("nested")) {
             throw new Error(`unexpected directory listing: ${names.join(", ")}`);
         }
+        if (entries.some((e) => e.path === "/workspace")) {
+            throw new Error("directory listing includes the listed directory itself");
+        }
+        for (const e of entries) {
+            if (Number.isNaN(Date.parse(e.modifiedAt)) || !e.modifiedAt.endsWith("Z")) {
+                throw new Error(`modifiedAt is not a UTC ISO timestamp: ${e.modifiedAt}`);
+            }
+        }
         console.error("[smoke] listed files");
         // Background process + port readiness + preview proxy.
         const startRes = await fetch(`${endpoint}/sandboxes/${id}/processes`, {