@namzu/sandbox 18.1.1 → 20.0.0

package/dist/egress/profile.js

@@ -0,0 +1,244 @@
+/**
+ * Egress profiles: one named, validated host allowlist, with optional ports,
+ * that a host can hand to more than one backend and have it mean the same
+ * thing on each.
+ *
+ * The idea is the Gateway allowlist of google/ax (`HostRule { host, port }`),
+ * re-implemented against this package's own types. What is deliberately NOT
+ * taken from it: a `*:443` fallback when nothing is listed, continuing after a
+ * failed apply, credentials in the profile, and a controller that watches for
+ * changes. A profile with no hosts is no egress; there is no wildcard; a
+ * backend that cannot honour a part of a profile refuses it at construction,
+ * before any I/O, rather than applying the rest.
+ *
+ * A profile carries no credentials. Credential brokering exists only on the
+ * docker egress proxy, and `ContainerBackendConfig.brokeredCredentials` stays
+ * where it is on purpose; under a profile, a credential for a host the profile
+ * does not allow is refused (see `assertBrokeredCredentialsFitProfile`).
+ */
+import { isHostAllowed } from './allowlist.js';
+/**
+ * A profile that is malformed, or that a backend cannot honour in full.
+ *
+ * `path` names the offending field relative to the profile (`hosts[1].ports`)
+ * or to the config it was combined with (`defaultEgress`); `backend` names the
+ * backend that refused, when the refusal is about a backend rather than about
+ * the profile itself.
+ */
+export class SandboxEgressProfileError extends Error {
+    code;
+    path;
+    backend;
+    name = 'SandboxEgressProfileError';
+    constructor(code, path, reason, backend) {
+        super(`egress profile: ${path} ${reason}${backend !== undefined ? ` (backend: ${backend})` : ''}. Refusing rather than applying part of the profile.`);
+        this.code = code;
+        this.path = path;
+        this.backend = backend;
+    }
+}
+const DNS_1123_LABEL = /^[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?$/;
+const DNS_NAME = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$/;
+/** Lowercase, no surrounding whitespace, no trailing dot. */
+function normalizeHost(host) {
+    return host.trim().toLowerCase().replace(/\.$/, '');
+}
+function hostProblem(host) {
+    if (host === '')
+        return 'is empty';
+    if (host.includes('*')) {
+        return "contains a wildcard; a domain and its subdomains are written with a leading dot ('.example.com'), and there is no allow-everything entry";
+    }
+    const bare = host.startsWith('.') ? host.slice(1) : host;
+    if (bare === '')
+        return 'names no domain after its leading dot';
+    if (!DNS_NAME.test(bare)) {
+        return 'is not a hostname (a scheme, a path, a port suffix and an IPv6 address all land here)';
+    }
+    if (bare.length > 253)
+        return 'is longer than a DNS name may be';
+    if (host.startsWith('.') && !bare.includes('.')) {
+        return "names a whole top-level domain; a domain entry needs at least two labels, as in '.example.com'";
+    }
+    if (/^[0-9]+$/.test(bare.slice(bare.lastIndexOf('.') + 1))) {
+        return 'ends in an all-numeric label, so it is an address rather than a hostname';
+    }
+    return undefined;
+}
+/**
+ * Validate and normalise a profile. The result is frozen, hosts are lowercased
+ * without a trailing dot, and ports are sorted.
+ *
+ * Refused with {@link SandboxEgressProfileError}: a name that is not a
+ * DNS-1123 label; a host outside the allowlist grammar (`*`, a scheme, a path,
+ * `host:port`, an IP literal); a port that is not an integer from 1 to 65535,
+ * a repeated port, or `ports: []` (write no `ports` for every port; an empty
+ * list would read as none and as all at once); and a host listed twice.
+ */
+export function defineEgressProfile(input) {
+    if (typeof input?.name !== 'string' || !DNS_1123_LABEL.test(input.name)) {
+        throw new SandboxEgressProfileError('invalid-name', 'name', `${JSON.stringify(input?.name)} is not a DNS-1123 label (lowercase letters, digits and dashes, starting and ending alphanumeric, at most 63 characters)`);
+    }
+    if (!Array.isArray(input.hosts)) {
+        throw new SandboxEgressProfileError('invalid-host', 'hosts', 'is not a list');
+    }
+    const seen = new Set();
+    const hosts = input.hosts.map((rule, index) => {
+        const path = `hosts[${index}]`;
+        if (typeof rule?.host !== 'string') {
+            throw new SandboxEgressProfileError('invalid-host', `${path}.host`, 'is not a string');
+        }
+        const host = normalizeHost(rule.host);
+        const problem = hostProblem(host);
+        if (problem !== undefined) {
+            throw new SandboxEgressProfileError('invalid-host', `${path}.host`, `${JSON.stringify(rule.host)} ${problem}`);
+        }
+        if (seen.has(host)) {
+            throw new SandboxEgressProfileError('duplicate-host', `${path}.host`, `${JSON.stringify(rule.host)} is listed more than once; merge the ports into one rule`);
+        }
+        seen.add(host);
+        if (rule.ports === undefined)
+            return Object.freeze({ host });
+        if (!Array.isArray(rule.ports) || rule.ports.length === 0) {
+            throw new SandboxEgressProfileError('invalid-port', `${path}.ports`, 'is empty; leave ports out to allow every port, or list at least one');
+        }
+        const ports = new Set();
+        rule.ports.forEach((port, portIndex) => {
+            if (!Number.isInteger(port) || port < 1 || port > 65535) {
+                throw new SandboxEgressProfileError('invalid-port', `${path}.ports[${portIndex}]`, `${JSON.stringify(port)} is not a TCP port (an integer from 1 to 65535)`);
+            }
+            if (ports.has(port)) {
+                throw new SandboxEgressProfileError('invalid-port', `${path}.ports[${portIndex}]`, `${port} is listed more than once`);
+            }
+            ports.add(port);
+        });
+        return Object.freeze({ host, ports: Object.freeze([...ports].sort((a, b) => a - b)) });
+    });
+    return Object.freeze({ name: input.name, hosts: Object.freeze(hosts) });
+}
+/**
+ * The ports `host` may use under `profile`, or `'any'`.
+ *
+ * The union over every rule that matches the host; a matching rule with no
+ * `ports` makes it `'any'`. No matching rule is the empty list.
+ */
+export function egressProfilePortsFor(profile, host) {
+    return portsForRules(profile.hosts, host);
+}
+function portsForRules(rules, host) {
+    const ports = new Set();
+    for (const rule of rules) {
+        if (!isHostAllowed(host, [rule.host]))
+            continue;
+        if (rule.ports === undefined)
+            return 'any';
+        for (const port of rule.ports)
+            ports.add(port);
+    }
+    return [...ports].sort((a, b) => a - b);
+}
+/**
+ * Whether `profile` lets `host` be reached on `port`: some matching rule
+ * either lists the port or lists no ports at all. This is the single
+ * implementation of the union rule; the docker proxy and the tests share it.
+ */
+export function egressProfileAllowsPort(profile, host, port) {
+    const ports = egressProfilePortsFor(profile, host);
+    return ports === 'any' || ports.includes(port);
+}
+/**
+ * An `EgressProxyOptions.allowedPorts` function for a list of profile rules,
+ * with the same union rule as {@link egressProfileAllowsPort}. This is how the
+ * egress proxy container turns the rules it is handed into a port check, so
+ * the proxy and the profile cannot disagree about what a rule means.
+ */
+export function egressPortsForRules(rules) {
+    return (host) => portsForRules(rules, host);
+}
+/** Whether any rule of the profile carries `ports`. */
+export function egressProfileHasPorts(profile) {
+    return profile.hosts.some((rule) => rule.ports !== undefined);
+}
+/**
+ * Whether an allowlist ENTRY (not a host) stays inside the profile.
+ *
+ * A plain host must be matched by a rule. A `.domain` entry covers a domain
+ * and all of its subdomains, so it needs a `.domain` rule for that domain or a
+ * parent of it: `api.example.com` in the profile does not cover
+ * `.api.example.com`, whose subdomains it never listed.
+ */
+export function egressProfileCoversEntry(profile, entry) {
+    const normalized = normalizeHost(entry);
+    if (!normalized.startsWith('.'))
+        return isHostAllowed(normalized, profile.hosts.map((r) => r.host));
+    const domain = normalized.slice(1);
+    return profile.hosts.some((rule) => rule.host.startsWith('.') && (domain === rule.host.slice(1) || domain.endsWith(rule.host)));
+}
+/**
+ * The shared {@link EgressPolicy} a profile becomes on a backend that takes
+ * one per create: `deny-all` for no hosts, otherwise a `static` allowlist of
+ * the hosts as normalised. Ports are not in `EgressPolicy`; a backend that
+ * enforces them reads them from the profile.
+ */
+export function egressPolicyFromProfile(profile) {
+    if (profile.hosts.length === 0)
+        return { kind: 'deny-all' };
+    return { kind: 'static', allowedHosts: profile.hosts.map((rule) => rule.host) };
+}
+/**
+ * Translate a profile into the existing {@link KubernetesEgressConfig}, for
+ * `KubernetesBackendConfig.egress`.
+ *
+ * Pure, and the one path for kubernetes: `createSandboxProvider` refuses
+ * `egressProfile` on a kubernetes backend and points here instead, because
+ * `createKubernetesWorkspace` takes the backend config directly and a
+ * provider-level profile would never reach a workspace. Put the result in
+ * `backend.egress` and task sandboxes and workspaces are enforced alike.
+ *
+ * No hosts is `deny-all`; otherwise a `static` allowlist. Ports become
+ * `ciliumNarrowing.hostPorts`, keyed by the host as written, and need
+ * `engine: 'cilium'`. A core engine with hosts is refused later, at wiring, by
+ * the backend's own `KubernetesUnenforceableEgressPolicyError`.
+ */
+export function kubernetesEgressFromProfile(profile, enforcement = {}) {
+    const defined = defineEgressProfile(profile);
+    const hostPorts = {};
+    defined.hosts.forEach((rule, index) => {
+        if (rule.ports === undefined)
+            return;
+        if (enforcement.engine !== 'cilium') {
+            throw new SandboxEgressProfileError('unsupported', `hosts[${index}].ports`, "needs engine: 'cilium'; core NetworkPolicy cannot restrict a hostname's ports", 'kubernetes');
+        }
+        hostPorts[rule.host] = rule.ports;
+    });
+    if (defined.hosts.length === 0 && enforcement.dnsNames !== undefined) {
+        throw new SandboxEgressProfileError('unsupported', 'enforcement.dnsNames', 'narrows the DNS rule of a hostname allowlist, and a profile with no hosts is deny-all', 'kubernetes');
+    }
+    if (enforcement.profileLabel !== true && enforcement.profileLabelKey !== undefined) {
+        throw new SandboxEgressProfileError('conflicting-policy', 'enforcement.profileLabelKey', 'is set without profileLabel: true, so no label would be written under it', 'kubernetes');
+    }
+    const narrowing = {
+        ...(Object.keys(hostPorts).length > 0 ? { hostPorts } : {}),
+        ...(enforcement.dnsNames !== undefined ? { dnsNames: enforcement.dnsNames } : {}),
+    };
+    return {
+        policy: defined.hosts.length === 0
+            ? { kind: 'deny-all' }
+            : { kind: 'static', allowedHosts: defined.hosts.map((rule) => rule.host) },
+        ...(enforcement.networkPolicyName !== undefined
+            ? { networkPolicyName: enforcement.networkPolicyName }
+            : {}),
+        ...(enforcement.engine !== undefined ? { engine: enforcement.engine } : {}),
+        ...(enforcement.verify !== undefined ? { verify: enforcement.verify } : {}),
+        ...(Object.keys(narrowing).length > 0 ? { ciliumNarrowing: narrowing } : {}),
+        ...(enforcement.profileLabel === true
+            ? {
+                profile: defined.name,
+                ...(enforcement.profileLabelKey !== undefined
+                    ? { profileLabelKey: enforcement.profileLabelKey }
+                    : {}),
+            }
+            : {}),
+    };
+}
+//# sourceMappingURL=profile.js.map

package/dist/egress/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../src/egress/profile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AASH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAwC9C;;;;;;;GAOG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAIzC;IACA;IAEA;IANQ,IAAI,GAAG,2BAA2B,CAAA;IAEpD,YACU,IAAmC,EACnC,IAAY,EACrB,MAAc,EACL,OAAgB;QAEzB,KAAK,CACJ,mBAAmB,IAAI,IAAI,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,sDAAsD,CAC/I,CAAA;QAPQ,SAAI,GAAJ,IAAI,CAA+B;QACnC,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAAS;IAK1B,CAAC;CACD;AAED,MAAM,cAAc,GAAG,sCAAsC,CAAA;AAC7D,MAAM,QAAQ,GAAG,mEAAmE,CAAA;AAEpF,6DAA6D;AAC7D,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AACpD,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAChC,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,UAAU,CAAA;IAClC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,0IAA0I,CAAA;IAClJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACxD,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,uCAAuC,CAAA;IAC/D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,OAAO,uFAAuF,CAAA;IAC/F,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,kCAAkC,CAAA;IAChE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,OAAO,gGAAgG,CAAA;IACxG,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,OAAO,0EAA0E,CAAA;IAClF,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA2B;IAC9D,IAAI,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,yBAAyB,CAClC,cAAc,EACd,MAAM,EACN,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,0HAA0H,CACxJ,CAAA;IACF,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,OAAO,EAAE,eAAe,CAAC,CAAA;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAyB,EAAE;QACpE,MAAM,IAAI,GAAG,SAAS,KAAK,GAAG,CAAA;QAC9B,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,yBAAyB,CAAC,cAAc,EAAE,GAAG,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,yBAAyB,CAClC,cAAc,EACd,GAAG,IAAI,OAAO,EACd,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CACzC,CAAA;QACF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,yBAAyB,CAClC,gBAAgB,EAChB,GAAG,IAAI,OAAO,EACd,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,0DAA0D,CACtF,CAAA;QACF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAC5D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,yBAAyB,CAClC,cAAc,EACd,GAAG,IAAI,QAAQ,EACf,qEAAqE,CACrE,CAAA;QACF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAC9B;QAAC,IAAI,CAAC,KAA2B,CAAC,OAAO,CAAC,CAAC,IAAY,EAAE,SAAiB,EAAE,EAAE;YAC9E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBACzD,MAAM,IAAI,yBAAyB,CAClC,cAAc,EACd,GAAG,IAAI,UAAU,SAAS,GAAG,EAC7B,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,iDAAiD,CACxE,CAAA;YACF,CAAC;YACD,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,yBAAyB,CAClC,cAAc,EACd,GAAG,IAAI,UAAU,SAAS,GAAG,EAC7B,GAAG,IAAI,2BAA2B,CAClC,CAAA;YACF,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;AACxE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACpC,OAA6B,EAC7B,IAAY;IAEZ,OAAO,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AAC1C,CAAC;AAED,SAAS,aAAa,CACrB,KAAuC,EACvC,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAE,SAAQ;QAC/C,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACtC,OAA6B,EAC7B,IAAY,EACZ,IAAY;IAEZ,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IAClD,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,KAAuC;IAEvC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;AAC5C,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,qBAAqB,CAAC,OAA6B;IAClE,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAA6B,EAAE,KAAa;IACpF,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;QAC9B,OAAO,aAAa,CACnB,UAAU,EACV,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAChC,CAAA;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CACxB,CAAC,IAAI,EAAE,EAAE,CACR,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC3F,CAAA;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAA6B;IACpE,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;IAC3D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAChF,CAAC;AA0BD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,2BAA2B,CAC1C,OAA6B,EAC7B,cAAkD,EAAE;IAEpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAsC,EAAE,CAAA;IACvD,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACrC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAM;QACpC,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,IAAI,yBAAyB,CAClC,aAAa,EACb,SAAS,KAAK,SAAS,EACvB,+EAA+E,EAC/E,YAAY,CACZ,CAAA;QACF,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;IAClC,CAAC,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,IAAI,yBAAyB,CAClC,aAAa,EACb,sBAAsB,EACtB,uFAAuF,EACvF,YAAY,CACZ,CAAA;IACF,CAAC;IACD,IAAI,WAAW,CAAC,YAAY,KAAK,IAAI,IAAI,WAAW,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACpF,MAAM,IAAI,yBAAyB,CAClC,oBAAoB,EACpB,6BAA6B,EAC7B,0EAA0E,EAC1E,YAAY,CACZ,CAAA;IACF,CAAC;IACD,MAAM,SAAS,GAAoC;QAClD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,WAAW,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAA;IACD,OAAO;QACN,MAAM,EACL,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YACzB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE;YACtB,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC5E,GAAG,CAAC,WAAW,CAAC,iBAAiB,KAAK,SAAS;YAC9C,CAAC,CAAC,EAAE,iBAAiB,EAAE,WAAW,CAAC,iBAAiB,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,WAAW,CAAC,YAAY,KAAK,IAAI;YACpC,CAAC,CAAC;gBACA,OAAO,EAAE,OAAO,CAAC,IAAI;gBACrB,GAAG,CAAC,WAAW,CAAC,eAAe,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,eAAe,EAAE,WAAW,CAAC,eAAe,EAAE;oBAClD,CAAC,CAAC,EAAE,CAAC;aACN;YACF,CAAC,CAAC,EAAE,CAAC;KACN,CAAA;AACF,CAAC"}

package/dist/egress/proxy.d.ts

@@ -91,6 +91,19 @@ export interface EgressProxyOptions {
     readonly selfNames?: readonly string[];
     /** Injected in tests. Defaults to the platform resolver. */
     readonly resolveAddresses?: ScreeningLookupOptions['resolve'];
+    /**
+     * The TCP ports a host may be dialled on, or `'any'`. Absent means every
+     * port, which is the behaviour before this option existed.
+     *
+     * Checked against the port the socket is about to open, not the port the
+     * request names: a plain-HTTP request to `http://host/` is dialled on 443
+     * when `upgradeToHttps` is on, and a `CONNECT host` with no port on
+     * 443. The check sits beside the allowlist check, before any credential is
+     * looked up, and a denial is named. A function that throws denies.
+     * `egressPortsForRules` builds one from an egress profile's rules with the
+     * profile's union rule.
+     */
+    readonly allowedPorts?: (host: string) => readonly number[] | 'any';
 }
 export interface RunningEgressProxy {
     readonly port: number;
@@ -121,9 +134,12 @@ export declare class EgressProxy {
     private readonly inwardAllowed;
     private readonly bindHost;
     private readonly selfNames;
+    private readonly allowedPorts;
     constructor(options: EgressProxyOptions);
     listen(port?: number): Promise<RunningEgressProxy>;
     private allowed;
+    /** Whether `port` is one `host` may be dialled on. See {@link EgressProxyOptions.allowedPorts}. */
+    private portAllowed;
     private deny;
     /**
      * Why this target may not be dialled as written, or `null`.

package/dist/egress/proxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAA;CAC7D;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,eAAe,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,IAAI,CAAA;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAUD,qBAAa,WAAW;IACvB,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;IAC/E,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAoB;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;gBAEjC,OAAO,EAAE,kBAAkB;IAiBjC,MAAM,CAAC,IAAI,SAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAuDrC,OAAO;IAWrB,OAAO,CAAC,IAAI;IAIZ;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAKrB,sEAAsE;YACxD,aAAa;IA4F3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,aAAa;IAkD3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,aAAa;CAGrB"}
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAG1D;;;;;;;;;;;;;;;;GAgBG;AAEH,wEAAwE;AACxE,MAAM,WAAW,kBAAkB;IAClC;;;;;;;OAOG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,iDAAiD;IACjD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,qEAAqE;IACrE,QAAQ,CAAC,YAAY,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IACpD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;IAC1D;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,4DAA4D;IAC5D,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,SAAS,CAAC,CAAA;IAC7D;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,GAAG,KAAK,CAAA;CACnE;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,kEAAkE;IAClE,eAAe,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,IAAI,CAAA;IAChE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACtB;AAUD,qBAAa,WAAW;IACvB,OAAO,CAAC,cAAc,CAAkC;IACxD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAsD;IAC/E,sCAAsC;IACtC,OAAO,CAAC,QAAQ,CAAoB;IACpC;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmB;IACjD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA2D;gBAE5E,OAAO,EAAE,kBAAkB;IAkBjC,MAAM,CAAC,IAAI,SAAI,GAAG,OAAO,CAAC,kBAAkB,CAAC;YAuDrC,OAAO;IAWrB,mGAAmG;IACnG,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,IAAI;IAIZ;;;;;;OAMG;IACH,OAAO,CAAC,aAAa;IAKrB,sEAAsE;YACxD,aAAa;IAwG3B;;;;;;;;;;;;;;;;;;;;;;OAsBG;YACW,aAAa;IA4D3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,aAAa;CAGrB"}

package/dist/egress/proxy.js

@@ -25,6 +25,7 @@ export class EgressProxy {
     inwardAllowed;
     bindHost;
     selfNames;
+    allowedPorts;
     constructor(options) {
         this.resolveAllowed = options.allowedHosts;
         this.credentials = options.credentials ?? [];
@@ -33,6 +34,7 @@ export class EgressProxy {
         this.inwardAllowed = options.allowInwardFor ?? [];
         this.bindHost = options.bindHost ?? LOOPBACK_BIND_HOST;
         this.selfNames = options.selfNames ?? [];
+        this.allowedPorts = options.allowedPorts;
         this.lookup = createScreeningLookup({
             ...(options.allowInwardFor ? { allowInwardFor: options.allowInwardFor } : {}),
             ...(options.resolveAddresses ? { resolve: options.resolveAddresses } : {}),
@@ -102,6 +104,20 @@ export class EgressProxy {
             return false;
         }
     }
+    /** Whether `port` is one `host` may be dialled on. See {@link EgressProxyOptions.allowedPorts}. */
+    portAllowed(host, port) {
+        if (this.allowedPorts === undefined)
+            return true;
+        try {
+            const ports = this.allowedPorts(host);
+            return ports === 'any' || ports.includes(port);
+        }
+        catch {
+            // A port table that could not be read is a policy that could not be
+            // read, and is denied for the reason `allowed` denies one.
+            return false;
+        }
+    }
     deny(host, reason) {
         this.onDenied?.(host, reason);
     }
@@ -139,6 +155,18 @@ export class EgressProxy {
             res.end(`Egress denied: ${target.host} is not on this sandbox's allowlist.\n`);
             return;
         }
+        // The port the socket will open, which is not always the port in the
+        // request: `http://host/` is dialled on 443 when the request is upgraded.
+        // Checked here, beside the allowlist and before the credential lookup,
+        // so a refused port never meets a token.
+        const secure = this.upgradeToHttps || target.protocol === 'https:';
+        const dialPort = target.port ?? (secure ? 443 : 80);
+        if (!this.portAllowed(target.host, dialPort)) {
+            this.deny(target.host, `port ${dialPort} is not allowed`);
+            res.writeHead(DENIED_STATUS, { 'content-type': 'text/plain' });
+            res.end(`Egress denied: ${target.host}:${dialPort} is not an allowed port.\n`);
+            return;
+        }
         const literal = this.literalDenial(target.host);
         if (literal) {
             this.deny(target.host, `is a ${literal} address`);
@@ -160,12 +188,11 @@ export class EgressProxy {
         if (credential) {
             headers[credential.header.toLowerCase()] = credential.value;
         }
-        const secure = this.upgradeToHttps || target.protocol === 'https:';
         const send = secure ? httpsRequest : httpRequest;
         const upstream = send({
             protocol: secure ? 'https:' : 'http:',
             host: target.host,
-            port: target.port ?? (secure ? 443 : 80),
+            port: dialPort,
             method: req.method,
             path: target.path,
             headers,
@@ -228,6 +255,13 @@ export class EgressProxy {
             socket.end();
             return;
         }
+        const dialPort = port ?? 443;
+        if (!this.portAllowed(host, dialPort)) {
+            this.deny(host, `port ${dialPort} is not allowed`);
+            socket.write(`HTTP/1.1 ${DENIED_STATUS} Forbidden\r\nContent-Type: text/plain\r\n\r\nEgress denied: ${host}:${dialPort} is not an allowed port.\n`);
+            socket.end();
+            return;
+        }
         const literal = this.literalDenial(host);
         if (literal) {
             this.deny(host, `is a ${literal} address`);
@@ -239,7 +273,7 @@ export class EgressProxy {
         // brokered credential, so the loss here is reach rather than a token —
         // but an allowlisted name pointing inward still turns this proxy into
         // a route to the host's own network, which is what a sandbox is for.
-        const upstream = netConnect({ port: port ?? 443, host, lookup: this.lookup }, () => {
+        const upstream = netConnect({ port: dialPort, host, lookup: this.lookup }, () => {
             socket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
             if (head.length > 0)
                 upstream.write(head);

package/dist/egress/proxy.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAE/F,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AA+G9D,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAEtC,sEAAsE;AACtE,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEhF,MAAM,OAAO,WAAW;IACf,cAAc,CAAkC;IACvC,WAAW,CAA+B;IAC1C,cAAc,CAAS;IACvB,QAAQ,CAAsD;IAC/E,sCAAsC;IAC9B,QAAQ,CAAoB;IACpC;;;;;OAKG;IACc,MAAM,CAA0C;IAChD,aAAa,CAAmB;IAChC,QAAQ,CAAQ;IAChB,SAAS,CAAmB;IAE7C,YAAY,OAA2B;QACtC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,YAAY,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAA;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAA;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;QACtD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAClC;YACC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,EACD,aAAa,CACb,CAAA;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC1C,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,qEAAqE;YACrE,oEAAoE;YACpE,2CAA2C;YAC3C,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACvC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC3B,OAAO,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QACvF,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;QACzB,IAAI,YAAuC,CAAA;QAE3C,OAAO;YACN,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;YAC3C,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;gBAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAA;YAC9B,CAAC;YACD,KAAK,EAAE,GAAG,EAAE;gBACX,YAAY,KAAK,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC9C,+DAA+D;oBAC/D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,KAAK,MAAM,MAAM,IAAI,WAAW;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;oBAClD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9B,CAAC,CAAC,CAAA;gBACF,OAAO,YAAY,CAAA;YACpB,CAAC;SACD,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QACjC,IAAI,CAAC;YACJ,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;YAC7D,iEAAiE;YACjE,uBAAuB;YACvB,OAAO,KAAK,CAAA;QACb,CAAC;IACF,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,MAAc;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACzF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAA;YACzE,OAAM;QACP,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CACN,4MAA4M,CAC5M,CAAA;YACD,OAAM;QACP,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;YACrD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC9D,gEAAgE;YAChE,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,wCAAwC,CAAC,CAAA;YAC9E,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,OAAO,UAAU,CAAC,CAAA;YACjD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,GAAG,CAAC,GAAG,CACN,kBAAkB,MAAM,CAAC,IAAI,SAAS,OAAO,oDAAoD,CACjG,CAAA;YACD,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;QAClC,mEAAmE;QACnE,6CAA6C;QAC7C,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAA;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAA;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;QAChD,MAAM,QAAQ,GAAG,IAAI,CACpB;YACC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;YACP,gEAAgE;YAChE,8DAA8D;YAC9D,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACnB,EACD,CAAC,QAAQ,EAAE,EAAE;YACZ,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CACD,CAAA;QAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,UAAU,CAAC,CAAA;gBAC1D,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpF,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAA;gBAC3B,OAAM;YACP,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,OAAO,IAAI,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY;QAC7E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAEpD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;YAC9C,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,gEAAgE,IAAI,wCAAwC,CACrI,CAAA;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,OAAO,UAAU,CAAC,CAAA;YAC1C,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,gEAAgE,IAAI,SAAS,OAAO,oDAAoD,CACjK,CAAA;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE;YAClF,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtB,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,UAAU,CAAC,CAAA;gBAC1D,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,iDAAiD,GAAG,CAAC,OAAO,IAAI,CACzF,CAAA;YACF,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACzB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM,CAAC,IAAY,EAAE,IAAa;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IAEO,aAAa,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;CACD;AASD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAoB;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAA;IAEzB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,OAAO;YACN,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACtB,CAAA;IACF,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO;QACN,IAAI;QACJ,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,IAAI,GAAG;QAChB,QAAQ,EAAE,OAAO;KACjB,CAAA;AACF,CAAC"}
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../src/egress/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AAEhE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAA;AAGhD,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AAE/F,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AA4H9D,MAAM,aAAa,GAAG,GAAG,CAAA;AAEzB,yEAAyE;AACzE,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAEtC,sEAAsE;AACtE,MAAM,mBAAmB,GAAsB,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAA;AAEhF,MAAM,OAAO,WAAW;IACf,cAAc,CAAkC;IACvC,WAAW,CAA+B;IAC1C,cAAc,CAAS;IACvB,QAAQ,CAAsD;IAC/E,sCAAsC;IAC9B,QAAQ,CAAoB;IACpC;;;;;OAKG;IACc,MAAM,CAA0C;IAChD,aAAa,CAAmB;IAChC,QAAQ,CAAQ;IAChB,SAAS,CAAmB;IAC5B,YAAY,CAA2D;IAExF,YAAY,OAA2B;QACtC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,YAAY,CAAA;QAC1C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAA;QAC5C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,IAAI,CAAA;QACpD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;QAChC,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;QACjD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,kBAAkB,CAAA;QACtD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,CAAA;QACxC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAA;QACxC,IAAI,CAAC,MAAM,GAAG,qBAAqB,CAClC;YACC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1E,EACD,aAAa,CACb,CAAA;IACF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC;QACpB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACxC,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;QACF,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;QACrC,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,EAAE;YAClC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC1C,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3C,CAAC,CAAC,CAAA;QACF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC5B,qEAAqE;YACrE,oEAAoE;YACpE,2CAA2C;YAC3C,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE;gBACvC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC3B,OAAO,EAAE,CAAA;YACV,CAAC,CAAC,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;QAChC,MAAM,SAAS,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QACvF,oEAAoE;QACpE,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,kEAAkE;QAClE,2DAA2D;QAC3D,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAA;QACzB,IAAI,YAAuC,CAAA;QAE3C,OAAO;YACN,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,UAAU,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE;YAC3C,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE;gBAC5B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAA;YAC9B,CAAC;YACD,KAAK,EAAE,GAAG,EAAE;gBACX,YAAY,KAAK,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBAC9C,+DAA+D;oBAC/D,6DAA6D;oBAC7D,4DAA4D;oBAC5D,KAAK,MAAM,MAAM,IAAI,WAAW;wBAAE,MAAM,CAAC,OAAO,EAAE,CAAA;oBAClD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC9B,CAAC,CAAC,CAAA;gBACF,OAAO,YAAY,CAAA;YACpB,CAAC;SACD,CAAA;IACF,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,IAAY;QACjC,IAAI,CAAC;YACJ,OAAO,aAAa,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;QACxD,CAAC;QAAC,MAAM,CAAC;YACR,6DAA6D;YAC7D,iEAAiE;YACjE,uBAAuB;YACvB,OAAO,KAAK,CAAA;QACb,CAAC;IACF,CAAC;IAED,mGAAmG;IAC3F,WAAW,CAAC,IAAY,EAAE,IAAY;QAC7C,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QAChD,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;YACrC,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAC/C,CAAC;QAAC,MAAM,CAAC;YACR,oEAAoE;YACpE,2DAA2D;YAC3D,OAAO,KAAK,CAAA;QACb,CAAC;IACF,CAAC;IAEO,IAAI,CAAC,IAAY,EAAE,MAAc;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC9B,CAAC;IAED;;;;;;OAMG;IACK,aAAa,CAAC,IAAY;QACjC,IAAI,IAAI,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,IAAI,CAAA;QACzF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAED,sEAAsE;IAC9D,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACpE,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CAAC,gEAAgE,CAAC,CAAA;YACzE,OAAM;QACP,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YACpD,GAAG,CAAC,GAAG,CACN,4MAA4M,CAC5M,CAAA;YACD,OAAM;QACP,CAAC;QAED,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;YACrD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC9D,gEAAgE;YAChE,+DAA+D;YAC/D,0DAA0D;YAC1D,GAAG,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,wCAAwC,CAAC,CAAA;YAC9E,OAAM;QACP,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,uEAAuE;QACvE,yCAAyC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAA;QAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACnD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,QAAQ,iBAAiB,CAAC,CAAA;YACzD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC9D,GAAG,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,IAAI,IAAI,QAAQ,4BAA4B,CAAC,CAAA;YAC9E,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,OAAO,UAAU,CAAC,CAAA;YACjD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC9D,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,8DAA8D;YAC9D,GAAG,CAAC,GAAG,CACN,kBAAkB,MAAM,CAAC,IAAI,SAAS,OAAO,oDAAoD,CACjG,CAAA;YACD,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAA;QAClC,mEAAmE;QACnE,6CAA6C;QAC7C,KAAK,MAAM,GAAG,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,EAAE,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3F,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;QACpB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,GAAG,UAAU,CAAC,KAAK,CAAA;QAC5D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAA;QAChD,MAAM,QAAQ,GAAG,IAAI,CACpB;YACC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO;YACrC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;YACP,gEAAgE;YAChE,8DAA8D;YAC9D,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACnB,EACD,CAAC,QAAQ,EAAE,EAAE;YACZ,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACnB,CAAC,CACD,CAAA;QAED,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,gEAAgE;YAChE,+DAA+D;YAC/D,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,UAAU,CAAC,CAAA;gBAC1D,IAAI,CAAC,GAAG,CAAC,WAAW;oBAAE,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;gBACpF,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,CAAC,CAAA;gBAC3B,OAAM;YACP,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAA;YAC1E,GAAG,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,OAAO,IAAI,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QACF,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACK,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,MAAc,EAAE,IAAY;QAC7E,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAA;QAEpD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,CAAC,CAAA;YAC9C,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,gEAAgE,IAAI,wCAAwC,CACrI,CAAA;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAA;QAC5B,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,QAAQ,iBAAiB,CAAC,CAAA;YAClD,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,gEAAgE,IAAI,IAAI,QAAQ,4BAA4B,CACrI,CAAA;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;QACxC,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,OAAO,UAAU,CAAC,CAAA;YAC1C,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,gEAAgE,IAAI,SAAS,OAAO,oDAAoD,CACjK,CAAA;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;YACZ,OAAM;QACP,CAAC;QAED,kEAAkE;QAClE,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE;YAC/E,MAAM,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;YAC3D,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACzC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACrB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtB,CAAC,CAAC,CAAA;QAEF,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,iBAAiB,GAAG,CAAC,MAAM,UAAU,CAAC,CAAA;gBAC1D,MAAM,CAAC,KAAK,CACX,YAAY,aAAa,iDAAiD,GAAG,CAAC,OAAO,IAAI,CACzF,CAAA;YACF,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,CAAA;QACb,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACzB,QAAQ,CAAC,OAAO,EAAE,CAAA;QACnB,CAAC,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM,CAAC,IAAY,EAAE,IAAa;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAA;QACvC,IAAI,mBAAmB,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IAEO,aAAa,CAAC,IAAY;QACjC,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC;CACD;AASD;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAoB;IACxC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAA;IAEzB,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QACxB,OAAO;YACN,IAAI,EAAE,GAAG,CAAC,QAAQ;YAClB,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;YACpC,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACtB,CAAA;IACF,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA;IACnC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAA;IAC5B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,UAAU,CAAC,CAAA;IACjD,OAAO;QACN,IAAI;QACJ,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI,EAAE,GAAG,IAAI,GAAG;QAChB,QAAQ,EAAE,OAAO;KACjB,CAAA;AACF,CAAC"}

package/dist/index.d.ts

@@ -58,6 +58,7 @@ import { type KubernetesAgentAddressMode, type KubernetesClusterAccess, type Kub
 import type { KubernetesIngressConfig } from './backends/kubernetes/ingress-policy.js';
 import { type KubernetesWorkspace, type KubernetesWorkspaceOptions, type KubernetesWorkspaceSummary, type KubernetesWorkspaceSuspendOptions, type KubernetesWorkspaceTransitionOptions } from './backends/kubernetes/workspace.js';
 import type { BrokeredCredential } from './egress/index.js';
+import type { SandboxEgressProfile } from './egress/profile.js';
 export type { ContainerSandboxLayout, ContainerSandboxLayoutMount, ContainerSandboxMountSource, ContainerSandboxSkillMount, ResolvedContainerSandboxLayout, } from '@namzu/sdk';
 export { SANDBOX_DEFAULT_OUTPUTS_PATH, SANDBOX_DEFAULT_SKILLS_PARENT, SANDBOX_DEFAULT_TOOL_RESULTS_PATH, SANDBOX_DEFAULT_TRANSCRIPTS_PATH, SANDBOX_DEFAULT_UPLOADS_PATH, } from '@namzu/sdk';
 export type { FirecrackerBackendInternalConfig, OrchestratorTokenProvider, } from './backends/firecracker/index.js';
@@ -725,7 +726,7 @@ export interface KubernetesBackendConfig {
  *   - `static` — fixed allowlist of hostnames at construction.
  *   - `resolver` — async closure returning the allowlist.
  *     Parameterless **on purpose**: the resolver is a closure that
- *     captures whatever context the host has (tenantId, runId,
+ *     captures whatever context the host has (tenantId, sessionId, turnId,
  *     auth token, etc.) at provider-construction time. Compass-
  *     platform's JWT-minting flow already works this way: the
  *     server knows the tenant when it issues the JWT, and the
@@ -736,6 +737,10 @@ export interface KubernetesBackendConfig {
  */
 export { EgressProxy, isHostAllowed, splitAuthority, } from './egress/index.js';
 export type { BrokeredCredential, EgressProxyOptions, RunningEgressProxy, } from './egress/index.js';
+export { defineEgressProfile, egressPortsForRules, egressProfileAllowsPort, kubernetesEgressFromProfile, SandboxEgressProfileError, } from './egress/profile.js';
+export type { KubernetesEgressProfileEnforcement, SandboxEgressHostRule, SandboxEgressProfile, SandboxEgressProfileErrorCode, } from './egress/profile.js';
+export { defineSandboxSeed, ensureSandboxSeed, sandboxSeedDigest, SandboxSeedError, } from './seed/index.js';
+export type { EnsureSandboxSeedOptions, SandboxSeed, SandboxSeedErrorCode, SandboxSeedReport, SandboxSeedRepository, SandboxSeedRepositoryReport, } from './seed/index.js';
 export type EgressPolicy = {
     readonly kind: 'deny-all';
 } | {
@@ -796,7 +801,7 @@ export interface SandboxBackend {
  *    is in play.
  *
  * `layout` is **not** here — see the type-level note on
- * {@link SandboxBackend}. Identity-aware fields (tenantId / runId /
+ * {@link SandboxBackend}. Identity-aware fields (tenantId / sessionId / turnId /
  * agentId) are deliberately NOT in this shape either; hosts that
  * need per-tenant sandbox config bake the tenant into the closure
  * that constructs the provider — see the `EgressPolicy` resolver
@@ -841,6 +846,18 @@ export type SandboxProviderConfig = (SandboxProviderConfigBase & {
 });
 interface SandboxProviderConfigBase {
     readonly defaultEgress?: EgressPolicy;
+    /**
+     * A named, validated host allowlist with optional ports, instead of
+     * `defaultEgress`. Validated here, synchronously, before any I/O, and
+     * refused (`SandboxEgressProfileError`) where the backend cannot honour all
+     * of it: beside `defaultEgress`; on the kubernetes backend, whose egress is
+     * config-level (use `kubernetesEgressFromProfile` for `backend.egress`); on
+     * the ACI standby pool; and ports on firecracker. On docker and runsc a
+     * brokered credential for a host outside the profile is refused, and a live
+     * `setNetworkPolicy` may only narrow within the profile. No hosts is
+     * `deny-all`. See `docs/sdk/sandbox-egress-profiles.md`.
+     */
+    readonly egressProfile?: SandboxEgressProfile;
     readonly defaultTimeoutMs?: number;
     readonly defaultMemoryLimitMb?: number;
     readonly defaultMaxProcesses?: number;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AACpF,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,sBAAsB,EAI3B,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACtF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAKzC,MAAM,oCAAoC,CAAA;AAK3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAK3D,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACN,wBAAwB,EACxB,KAAK,aAAa,GAClB,MAAM,oCAAoC,CAAA;AAK3C,OAAO,EACN,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACN,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC1B,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,0BAA0B,EAC1B,uBAAuB,GACvB,MAAM,gCAAgC,CAAA;AAKvC,YAAY,EACX,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAmB/C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,OAAO,EAAE,8CAA8C,EAAE,MAAM,wCAAwC,CAAA;AACvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAA;AAC7F,OAAO,EACN,oCAAoC,EACpC,uCAAuC,EACvC,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,6CAA6C,CAAA;AAMpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAA;AAMzF,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACN,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAW/C,OAAO,EACN,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAK/C,YAAY,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB;AACvB,0EAA0E;AAC1E,yBAAyB,EACzB,kBAAkB,GAClB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAA;AAKtF,OAAO,EACN,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACN,uCAAuC,EAKvC,4BAA4B,EAC5B,gCAAgC,GAChC,MAAM,oCAAoC,CAAA;AAO3C,YAAY,EACX,gCAAgC,EAChC,uBAAuB,EACvB,6BAA6B,GAC7B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,yCAAyC,EACzC,gCAAgC,EAChC,qCAAqC,GACrC,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,6BAA6B,EAC7B,kCAAkC,GAClC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAI/E,OAAO,EACN,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GACjB,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,wBAAwB,EACxB,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAY3C,YAAY,EACX,sBAAsB,EACtB,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AASlE,OAAO,EACN,8BAA8B,EAQ9B,kBAAkB,EAClB,KAAK,6BAA6B,EAClC,yBAAyB,EACzB,KAAK,oBAAoB,EAOzB,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,qCAAqC,CAAA;AAM5C,OAAO,EACN,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,qCAAqC,CAAA;AAQ5C,OAAO,EACN,sBAAsB,EACtB,KAAK,8BAA8B,EAInC,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,mCAAmC,EACnC,qCAAqC,EACrC,wCAAwC,GACxC,MAAM,wCAAwC,CAAA;AAC/C,uEAAuE;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAM5E,YAAY,EACX,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACvB,MAAM,+BAA+B,CAAA;AAQtC,YAAY,EACX,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,qCAAqC,EACrC,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,qCAAqC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,oCAAoC,GACpC,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAKN,iCAAiC,EAIjC,gCAAgC,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAMhC,oCAAoC,EACpC,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC5D;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,IAAI,CAAA;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAA;IAClD,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACxC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAoCpF;AAsMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,qCAAqC,GAC5C,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAgBD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AAKnB,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AACrF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AACpF,OAAO,EACN,KAAK,0BAA0B,EAE/B,KAAK,uBAAuB,EAC5B,KAAK,iCAAiC,EACtC,KAAK,qCAAqC,EAC1C,KAAK,sBAAsB,EAI3B,MAAM,gCAAgC,CAAA;AACvC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAA;AACtF,OAAO,EACN,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,oCAAoC,EAKzC,MAAM,oCAAoC,CAAA;AAK3C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAK/D,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,oBAAoB,EACpB,8BAA8B,EAC9B,mCAAmC,EACnC,2BAA2B,EAC3B,4BAA4B,EAC5B,kCAAkC,EAClC,KAAK,0BAA0B,EAC/B,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACN,wBAAwB,EACxB,KAAK,aAAa,GAClB,MAAM,oCAAoC,CAAA;AAK3C,OAAO,EACN,uBAAuB,EACvB,wBAAwB,EACxB,gCAAgC,EAChC,2BAA2B,EAC3B,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAM3C,OAAO,EACN,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,GAC1B,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,0BAA0B,EAC1B,uBAAuB,GACvB,MAAM,gCAAgC,CAAA;AAKvC,YAAY,EACX,kBAAkB,EAClB,4BAA4B,EAC5B,+BAA+B,EAC/B,sBAAsB,EACtB,sBAAsB,EACtB,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAmB/C,OAAO,EAAE,qCAAqC,EAAE,MAAM,wCAAwC,CAAA;AAC9F,OAAO,EAAE,8CAA8C,EAAE,MAAM,wCAAwC,CAAA;AACvG,OAAO,EAAE,oCAAoC,EAAE,MAAM,wCAAwC,CAAA;AAC7F,OAAO,EACN,oCAAoC,EACpC,uCAAuC,EACvC,gCAAgC,EAChC,8BAA8B,EAC9B,8BAA8B,GAC9B,MAAM,6CAA6C,CAAA;AAMpD,OAAO,EAAE,gCAAgC,EAAE,MAAM,wCAAwC,CAAA;AAMzF,YAAY,EACX,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACpB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACN,yCAAyC,EACzC,iCAAiC,EACjC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAW/C,OAAO,EACN,kCAAkC,EAClC,kCAAkC,EAClC,gCAAgC,GAChC,MAAM,wCAAwC,CAAA;AAK/C,YAAY,EACX,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB;AACvB,0EAA0E;AAC1E,yBAAyB,EACzB,kBAAkB,GAClB,MAAM,yCAAyC,CAAA;AAChD,OAAO,EAAE,4BAA4B,EAAE,MAAM,yCAAyC,CAAA;AAKtF,OAAO,EACN,6BAA6B,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GACzB,MAAM,0CAA0C,CAAA;AACjD,OAAO,EACN,+BAA+B,EAC/B,0BAA0B,GAC1B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACN,uCAAuC,EAKvC,4BAA4B,EAC5B,gCAAgC,GAChC,MAAM,oCAAoC,CAAA;AAO3C,YAAY,EACX,gCAAgC,EAChC,uBAAuB,EACvB,6BAA6B,GAC7B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,yCAAyC,EACzC,gCAAgC,EAChC,qCAAqC,GACrC,MAAM,oCAAoC,CAAA;AAQ3C,YAAY,EACX,+BAA+B,EAC/B,6BAA6B,EAC7B,4BAA4B,EAC5B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,GAC3B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,6BAA6B,EAC7B,kCAAkC,GAClC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,qCAAqC,CAAA;AAI/E,OAAO,EACN,gBAAgB,EAChB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,YAAY,GACjB,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,wBAAwB,EACxB,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAA;AACjF,OAAO,EACN,iCAAiC,EACjC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACN,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,eAAe,GACpB,MAAM,oCAAoC,CAAA;AAY3C,YAAY,EACX,sBAAsB,EACtB,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,YAAY,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EACN,+BAA+B,EAC/B,+BAA+B,EAC/B,+BAA+B,GAC/B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAA;AASlE,OAAO,EACN,8BAA8B,EAQ9B,kBAAkB,EAClB,KAAK,6BAA6B,EAClC,yBAAyB,EACzB,KAAK,oBAAoB,EAOzB,8BAA8B,EAC9B,0BAA0B,GAC1B,MAAM,qCAAqC,CAAA;AAM5C,OAAO,EACN,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,GACzB,MAAM,qCAAqC,CAAA;AAQ5C,OAAO,EACN,sBAAsB,EACtB,KAAK,8BAA8B,EAInC,oBAAoB,EACpB,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,mCAAmC,EACnC,qCAAqC,EACrC,wCAAwC,GACxC,MAAM,wCAAwC,CAAA;AAC/C,uEAAuE;AACvE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAA;AAM5E,YAAY,EACX,iCAAiC,EACjC,qCAAqC,EACrC,sBAAsB,GACtB,MAAM,gCAAgC,CAAA;AAOvC,OAAO,EACN,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,GACvB,MAAM,+BAA+B,CAAA;AAQtC,YAAY,EACX,4BAA4B,EAC5B,mBAAmB,EACnB,6BAA6B,EAC7B,qCAAqC,EACrC,iCAAiC,EACjC,0BAA0B,EAC1B,yBAAyB,EACzB,qCAAqC,EACrC,0BAA0B,EAC1B,iCAAiC,EACjC,mCAAmC,EACnC,oCAAoC,GACpC,MAAM,oCAAoC,CAAA;AAM3C,YAAY,EACX,uBAAuB,EACvB,sBAAsB,EACtB,4BAA4B,EAC5B,2BAA2B,GAC3B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAKN,iCAAiC,EAIjC,gCAAgC,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACN,4BAA4B,EAC5B,gCAAgC,EAMhC,oCAAoC,EACpC,sCAAsC,EACtC,iCAAiC,GACjC,MAAM,oCAAoC,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,GACpB,uBAAuB,CAAA;AAE1B;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,uDAAuD;IACvD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAC5D;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAClD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAChD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,uFAAuF;IACvF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,8DAA8D;IAC9D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,0BAA0B,KAAK,IAAI,CAAA;IACpE;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAA;IAC9B,8DAA8D;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAA;IACpC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,0BAA0B,CAAA;IAClD,mDAAmD;IACnD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,kFAAkF;IAClF,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAA;IACvD;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAA;IACxC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAA;IAC1C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC7C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACN,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GACzB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EACX,kCAAkC,EAClC,qBAAqB,EACrB,oBAAoB,EACpB,6BAA6B,GAC7B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACN,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,GAChB,MAAM,iBAAiB,CAAA;AACxB,YAAY,EACX,wBAAwB,EACxB,WAAW,EACX,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,GAC3B,MAAM,iBAAiB,CAAA;AAExB,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAA;IAC7C,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACxC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAA;IAC7C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CAuCpF;AA2MD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,0BAA0B,GACjC,OAAO,CAAC,mBAAmB,CAAC,CAE9B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAC7C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,SAAS,0BAA0B,EAAE,CAAC,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,yBAAyB,CAC9C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,oCAAoC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,8BAA8B,CACnD,MAAM,EAAE,uBAAuB,EAC/B,OAAO,EAAE,qCAAqC,GAC5C,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAE1E;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC/C,MAAM,EAAE,uBAAuB,EAC/B,OAAO,CAAC,EAAE,iCAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAgBD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}

package/dist/index.js

@@ -56,6 +56,7 @@ import { buildDockerBackend, resolveLayout } from './backends/docker/index.js';
 import { buildFirecrackerBackend } from './backends/firecracker/index.js';
 import { buildKubernetesBackend, readKubernetesTaskCapacity as readTaskCapacityOnCluster, releaseKubernetesTaskSandboxes as releaseTaskSandboxesOnCluster, } from './backends/kubernetes/index.js';
 import { createKubernetesWorkspace as buildKubernetesWorkspace, deleteKubernetesWorkspace as deleteWorkspaceOnCluster, listKubernetesWorkspaces as listWorkspacesOnCluster, suspendKubernetesWorkspace as suspendWorkspaceOnCluster, } from './backends/kubernetes/workspace.js';
+import { resolveProviderEgress } from './egress/profile-wiring.js';
 // Re-export the default container-path constants the prompt-template
 // generator side wants to import without also depending on
 // `@namzu/sdk` directly. Single source of truth: a Vandal prompt
@@ -229,7 +230,7 @@ KubernetesWorkspacePreconditionError, KubernetesWorkspaceSuspendTimeoutError, Ku
  *   - `static` — fixed allowlist of hostnames at construction.
  *   - `resolver` — async closure returning the allowlist.
  *     Parameterless **on purpose**: the resolver is a closure that
- *     captures whatever context the host has (tenantId, runId,
+ *     captures whatever context the host has (tenantId, sessionId, turnId,
  *     auth token, etc.) at provider-construction time. Compass-
  *     platform's JWT-minting flow already works this way: the
  *     server knows the tenant when it issues the JWT, and the
@@ -239,6 +240,8 @@ KubernetesWorkspacePreconditionError, KubernetesWorkspaceSuspendTimeoutError, Ku
  *     doesn't have to forward identity through `provider.create`.
  */
 export { EgressProxy, isHostAllowed, splitAuthority, } from './egress/index.js';
+export { defineEgressProfile, egressPortsForRules, egressProfileAllowsPort, kubernetesEgressFromProfile, SandboxEgressProfileError, } from './egress/profile.js';
+export { defineSandboxSeed, ensureSandboxSeed, sandboxSeedDigest, SandboxSeedError, } from './seed/index.js';
 /**
  * Build a {@link SandboxProvider} the SDK can wire into
  * `drainQuery`'s `sandboxProvider` field. Selects the backend at
@@ -264,7 +267,10 @@ export { EgressProxy, isHostAllowed, splitAuthority, } from './egress/index.js';
  * of a provider that confines nothing.
  */
 export function createSandboxProvider(config) {
-    const backend = pickBackend(config);
+    // Before the backend is built, so a profile the backend cannot honour is
+    // refused with nothing constructed.
+    const resolvedEgress = resolveProviderEgress(config);
+    const backend = pickBackend(config, resolvedEgress.profile);
     const id = `namzu-${backend.tier}-${backend.name}`;
     const name = `@namzu/sandbox: ${describeBackend(config.backend)}`;
     return {
@@ -279,7 +285,7 @@ export function createSandboxProvider(config) {
             return await backend.create({
                 ...(perCall?.signal !== undefined ? { signal: perCall.signal } : {}),
                 workingDirectory: perCall?.workingDirectory ?? '/workspace',
-                ...(config.defaultEgress !== undefined ? { egress: config.defaultEgress } : {}),
+                ...(resolvedEgress.egress !== undefined ? { egress: resolvedEgress.egress } : {}),
                 ...(perCall?.timeoutMs !== undefined
                     ? { timeoutMs: perCall.timeoutMs }
                     : config.defaultTimeoutMs !== undefined
@@ -300,7 +306,7 @@ export function createSandboxProvider(config) {
         },
     };
 }
-function pickBackend(config) {
+function pickBackend(config, egressProfile) {
     const backend = config.backend;
     // Checked ahead of the `docker` default below: `ACIStandbyPoolBackendConfig`
     // is a real arm of `SandboxProviderConfig` (see the discriminated union
@@ -373,6 +379,7 @@ function pickBackend(config) {
             ...(backend.writableRootfsPaths !== undefined
                 ? { writableRootfsPaths: backend.writableRootfsPaths }
                 : {}),
+            ...(egressProfile !== undefined ? { egressProfile } : {}),
         });
     }
     if (backend.tier === 'container' && backend.runtime === 'runsc') {
@@ -407,6 +414,7 @@ function pickBackend(config) {
             ...(backend.writableRootfsPaths !== undefined
                 ? { writableRootfsPaths: backend.writableRootfsPaths }
                 : {}),
+            ...(egressProfile !== undefined ? { egressProfile } : {}),
         });
     }
     // `microvm:self-hosted` targeting the OWNED Azure Firecracker