@namzu/sandbox 2.0.1 → 2.0.3

package/dist/backends/firecracker/__tests__/backend.test.js

@@ -1,361 +0,0 @@
-/**
- * Firecracker `SandboxBackend` end-to-end over the loopback agent.
- *
- * Stubs the orchestrator control plane (`fetch` for `/sandboxes` create
- * + `:delete`) and points the returned vsock handle at a unix-socket
- * loopback running the REAL `agent/agent.cjs`. Proves the full
- * {@link Sandbox} handle the SDK consumes — `exec` / `writeFile` /
- * `readFile` / `listFiles` / `destroy` / `status` — speaks the NDJSON
- * wire over the vsock transport, and that the readiness fence waits on
- * the agent's healthz (not the orchestrator 2xx).
- */
-import { chmodSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { createRequire } from 'node:module';
-import { createServer } from 'node:net';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { buildFirecrackerBackend, normalizeHandle } from '../index.js';
-import { localIpcPath } from './fixtures/ipc-path.js';
-import { CA_CRT, CLIENT_CRT, CLIENT_KEY, startMtlsRelay, } from './fixtures/mtls-pki.js';
-// The loopback agent under test is the guest-side agent for a Linux microVM:
-// it spawns `/bin/sh` to run commands, and that binary does not exist on
-// Windows. These cases assert behavior the platform cannot produce, so they
-// skip there rather than leaving the suite permanently red for Windows
-// contributors. The socket-address fixture IS platform-correct, so the
-// transport is still exercised wherever it can be.
-const IS_WINDOWS = process.platform === 'win32';
-const require_ = createRequire(import.meta.url);
-let workDir;
-let sockPath;
-let server;
-let relay;
-let agent;
-const realFetch = globalThis.fetch;
-let realPath;
-beforeEach(() => {
-    workDir = mkdtempSync(join(tmpdir(), 'fc-backend-test-'));
-    sockPath = localIpcPath(workDir);
-    realPath = process.env.PATH;
-    process.env.NAMZU_SANDBOX_WORKSPACE = workDir;
-    delete require_.cache[require_.resolve('../../../../agent/agent.cjs')];
-    agent = require_('../../../../agent/agent.cjs');
-});
-afterEach(async () => {
-    globalThis.fetch = realFetch;
-    process.env.PATH = realPath;
-    if (relay) {
-        await new Promise((r) => relay?.server.close(() => r()));
-        relay = undefined;
-    }
-    if (server) {
-        await new Promise((r) => server?.close(() => r()));
-        server = undefined;
-    }
-    rmSync(workDir, { recursive: true, force: true });
-});
-function startAgent() {
-    return new Promise((resolve, reject) => {
-        const s = createServer(agent.handleConnection);
-        s.on('error', reject);
-        s.listen(sockPath, () => resolve(s));
-    });
-}
-/**
- * Stub the orchestrator: `POST /sandboxes` returns a handle pointing at
- * the loopback unix socket; `:delete` returns 204. Records calls so the
- * test can assert the create body + destroy round-trip.
- */
-function stubOrchestrator(handle) {
-    const calls = [];
-    globalThis.fetch = vi.fn(async (input, init) => {
-        const url = String(input);
-        const method = init?.method ?? 'GET';
-        const body = init?.body ? JSON.parse(String(init.body)) : undefined;
-        calls.push({ url, method, body });
-        if (method === 'POST' && url.endsWith('/sandboxes')) {
-            return new Response(JSON.stringify({ sandboxId: 'sbx_fc_test', agent: handle, rootDir: workDir }), { status: 200, headers: { 'content-type': 'application/json' } });
-        }
-        if (method === 'DELETE' && url.includes(':delete')) {
-            return new Response(null, { status: 204 });
-        }
-        return new Response('unexpected', { status: 500 });
-    });
-    return { calls };
-}
-describe.skipIf(IS_WINDOWS)('buildFirecrackerBackend (loopback agent)', () => {
-    it('creates a Sandbox handle and round-trips exec/write/read/listFiles/destroy', async () => {
-        server = await startAgent();
-        const { calls } = stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'token-123',
-            template: 'golden-rev-7',
-            readyTimeoutMs: 5_000,
-            readyPollIntervalMs: 50,
-        });
-        const sandbox = await backend.create({
-            workingDirectory: workDir,
-            memoryLimitMb: 512,
-            maxProcesses: 64,
-            timeoutMs: 60_000,
-            egress: { kind: 'static', allowedHosts: ['api.example.com'] },
-        });
-        // Handle shape.
-        expect(sandbox.id).toBe('sbx_fc_test');
-        expect(sandbox.rootDir).toBe(workDir);
-        expect(sandbox.environment).toBe('linux-namespace');
-        expect(sandbox.status).toBe('ready');
-        // Create body forwarded the resolved knobs + egress allowlist.
-        const createCall = calls.find((c) => c.method === 'POST');
-        expect(createCall?.body).toMatchObject({
-            template: 'golden-rev-7',
-            memoryLimitMb: 512,
-            maxProcesses: 64,
-            timeoutMs: 60_000,
-            egressAllowlist: ['api.example.com'],
-        });
-        // exec over the wire.
-        const r = await sandbox.exec('/bin/sh', ['-c', 'echo hello-fc']);
-        expect(r.stdout).toContain('hello-fc');
-        expect(r.exitCode).toBe(0);
-        // writeFile + readFile round-trip.
-        await sandbox.writeFile('out/result.txt', 'persisted');
-        const read = await sandbox.readFile('out/result.txt');
-        expect(read.toString('utf8')).toBe('persisted');
-        // listFiles uses the same `find -printf '%p\t%s\n'` wire as
-        // docker/aci. On a GNU-find host (the Ubuntu golden rootfs) it
-        // enumerates the file we wrote; on a BSD-find host (macOS CI
-        // runners) `-printf` is unsupported, find exits non-zero, and the
-        // contract maps that to an empty listing — exactly as docker/aci
-        // do. Assert the call path returns the SDK shape either way, and
-        // the file when GNU find is present.
-        const files = await sandbox.listFiles(workDir);
-        expect(Array.isArray(files)).toBe(true);
-        if (files.length > 0) {
-            expect(files.some((f) => f.path.endsWith('out/result.txt'))).toBe(true);
-            expect(files.every((f) => Number.isFinite(f.size))).toBe(true);
-        }
-        // destroy calls the orchestrator :delete and flips status.
-        await sandbox.destroy();
-        expect(sandbox.status).toBe('destroyed');
-        expect(calls.some((c) => c.method === 'DELETE' && c.url.includes(':delete'))).toBe(true);
-    });
-    it('tears down the microVM when the readiness fence times out (no orphan)', async () => {
-        // No agent listening → healthz never succeeds → readiness fence
-        // times out → backend must DELETE to avoid orphaning the microVM.
-        const { calls } = stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            readyTimeoutMs: 300,
-            readyPollIntervalMs: 50,
-            transport: { connectRetryBudgetMs: 100, connectTimeoutMs: 80, connectRetryIntervalMs: 30 },
-        });
-        await expect(backend.create({ workingDirectory: workDir })).rejects.toThrow(/did not become ready/);
-        expect(calls.some((c) => c.method === 'DELETE')).toBe(true);
-    });
-    it('parses listFiles output into {path,size} entries (GNU-find-shaped wire)', async () => {
-        // Make `find` deterministic across host platforms: shim a `find`
-        // on PATH that emits the GNU `-printf '%p\t%s\n'` wire the Ubuntu
-        // golden rootfs produces, so the backend's tab-split parser is
-        // proven without depending on the host having GNU findutils.
-        const binDir = mkdtempSync(join(tmpdir(), 'fc-bin-'));
-        const findShim = join(binDir, 'find');
-        writeFileSync(findShim, [
-            '#!/bin/sh',
-            `printf '%s\\t%s\\n' '${workDir}/out/result.txt' 9`,
-            `printf '%s\\t%s\\n' '${workDir}/out/other.bin' 42`,
-        ].join('\n'), { mode: 0o755 });
-        chmodSync(findShim, 0o755);
-        process.env.PATH = `${binDir}:${process.env.PATH}`;
-        server = await startAgent();
-        stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            readyTimeoutMs: 3_000,
-            readyPollIntervalMs: 50,
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        const files = await sandbox.listFiles(workDir);
-        expect(files).toEqual([
-            { path: `${workDir}/out/result.txt`, size: 9 },
-            { path: `${workDir}/out/other.bin`, size: 42 },
-        ]);
-        await sandbox.destroy();
-        rmSync(binDir, { recursive: true, force: true });
-    });
-    it('fills the contract vsock port when the orchestrator omits it', async () => {
-        // A vsock handle whose port is 0 should be normalized to the
-        // configured agentVsockPort. We can't bind a real AF_VSOCK here, so
-        // assert the normalization path via a unix handle is unaffected and
-        // that a portless vsock handle does not crash create's pre-dial.
-        // (Full vsock dial is the live increment.)
-        server = await startAgent();
-        stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            agentVsockPort: 1024,
-            readyTimeoutMs: 3_000,
-            readyPollIntervalMs: 50,
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        expect(sandbox.status).toBe('ready');
-        await sandbox.destroy();
-    });
-    it('carries agentSnapshot in the create body when the backend config sets it', async () => {
-        // OPEN-2 — the per-agent snapshot ref is a first-class, provider-agnostic
-        // field on the create contract (sibling to `template`). When set it must
-        // reach the orchestrator POST body verbatim.
-        server = await startAgent();
-        const { calls } = stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            template: 'golden-rev-7',
-            agentSnapshot: { orgId: 'org1', agentId: 'agent9', version: '3' },
-            readyTimeoutMs: 3_000,
-            readyPollIntervalMs: 50,
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        const createCall = calls.find((c) => c.method === 'POST');
-        expect(createCall?.body).toMatchObject({
-            template: 'golden-rev-7',
-            agentSnapshot: { orgId: 'org1', agentId: 'agent9', version: '3' },
-        });
-        await sandbox.destroy();
-    });
-    it('OMITS agentSnapshot from the create body when absent (byte-identical generic path)', async () => {
-        // DORMANT contract: absent ⇒ the POST body must NOT carry an
-        // `agentSnapshot` key at all (a JSON `undefined` would not serialise, but
-        // the conditional spread must drop the key entirely so the body is
-        // byte-identical to the pre-field generic create).
-        server = await startAgent();
-        const { calls } = stubOrchestrator({ kind: 'unix', path: sockPath });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            template: 'golden-rev-7',
-            readyTimeoutMs: 3_000,
-            readyPollIntervalMs: 50,
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        const createCall = calls.find((c) => c.method === 'POST');
-        expect(createCall?.body).toEqual({ template: 'golden-rev-7' });
-        expect(Object.prototype.hasOwnProperty.call(createCall?.body ?? {}, 'agentSnapshot')).toBe(false);
-        await sandbox.destroy();
-    });
-});
-// ---------------------------------------------------------------------------
-// Cert-injection seam (ses_051 P4 Track C) — the orchestrator returns a WIRE
-// `mtls` handle (host/port/sandboxId, NO certs); the consumer injects the
-// client CA/cert/key via `config.mtls`, which `normalizeHandle` MERGES onto
-// the handle before the transport dials the relay. Certs NEVER transit the
-// control plane.
-// ---------------------------------------------------------------------------
-describe('normalizeHandle (mtls cert injection)', () => {
-    const WIRE_MTLS = {
-        kind: 'mtls',
-        host: '10.60.1.7',
-        port: 8443,
-        sandboxId: 'sb-net',
-    };
-    it('merges the injected cert material onto a wire mtls handle', () => {
-        const handle = normalizeHandle(WIRE_MTLS, 1024, {
-            ca: CA_CRT,
-            cert: CLIENT_CRT,
-            key: CLIENT_KEY,
-            servername: 'sandbox.fc.internal',
-        });
-        expect(handle).toEqual({
-            kind: 'mtls',
-            host: '10.60.1.7',
-            port: 8443,
-            sandboxId: 'sb-net',
-            tls: {
-                ca: CA_CRT,
-                cert: CLIENT_CRT,
-                key: CLIENT_KEY,
-                servername: 'sandbox.fc.internal',
-            },
-        });
-    });
-    it('throws when an mtls handle arrives with NO injected cert material', () => {
-        // A network-mode backend that cannot present a client cert would be
-        // rejected by the relay — fail loud at handle-normalization instead.
-        expect(() => normalizeHandle(WIRE_MTLS, 1024, undefined)).toThrow(/no client cert material was injected/);
-    });
-    it('leaves vsock + unix handles untouched (cert material is ignored)', () => {
-        expect(normalizeHandle({ kind: 'unix', path: '/tmp/a.sock' }, 1024, undefined)).toEqual({
-            kind: 'unix',
-            path: '/tmp/a.sock',
-        });
-        // A vsock handle with a 0 port still normalizes to the contract port.
-        expect(normalizeHandle({ kind: 'vsock', udsPath: '/v.sock', port: 0 }, 1024, {
-            ca: CA_CRT,
-            cert: CLIENT_CRT,
-            key: CLIENT_KEY,
-        })).toEqual({ kind: 'vsock', udsPath: '/v.sock', port: 1024 });
-    });
-});
-describe.skipIf(IS_WINDOWS)('buildFirecrackerBackend (network mode over a loopback mTLS relay)', () => {
-    it('injects the client cert + round-trips exec/file-IO through the relay', async () => {
-        // The agent on a unix socket; a loopback mTLS relay in front of it.
-        server = await startAgent();
-        relay = await startMtlsRelay(sockPath);
-        // The orchestrator returns a WIRE mtls handle (NO cert material) whose
-        // host:port point at the relay; the relay resolves the sandboxId.
-        const { calls } = stubOrchestrator({
-            kind: 'mtls',
-            host: '127.0.0.1',
-            port: relay.port,
-            sandboxId: 'sb-net',
-        });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            readyTimeoutMs: 5_000,
-            readyPollIntervalMs: 50,
-            // The CONSUMER-injected client material — never returned by the
-            // orchestrator. Merged onto the handle's `tls` block.
-            mtls: {
-                ca: CA_CRT,
-                cert: CLIENT_CRT,
-                key: CLIENT_KEY,
-                servername: 'sandbox.fc.internal',
-            },
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        expect(sandbox.status).toBe('ready');
-        // The dialer wrote the `SANDBOX <id>` routing preamble (the relay's key).
-        expect(await relay.preamble()).toBe('sb-net');
-        // Full exec + file-IO round-trip over the mTLS tunnel.
-        const r = await sandbox.exec('/bin/sh', ['-c', 'echo hello-mtls']);
-        expect(r.stdout).toContain('hello-mtls');
-        await sandbox.writeFile('out/r.txt', 'via-relay');
-        expect((await sandbox.readFile('out/r.txt')).toString('utf8')).toBe('via-relay');
-        await sandbox.destroy();
-        expect(calls.some((c) => c.method === 'DELETE')).toBe(true);
-    });
-    it('rejects a create when the orchestrator returns mtls but no cert material is injected', async () => {
-        server = await startAgent();
-        relay = await startMtlsRelay(sockPath);
-        stubOrchestrator({
-            kind: 'mtls',
-            host: '127.0.0.1',
-            port: relay.port,
-            sandboxId: 'sb-net',
-        });
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: 'https://orchestrator.test/',
-            getToken: async () => 'tok',
-            readyTimeoutMs: 2_000,
-            readyPollIntervalMs: 50,
-            // No `mtls` material → normalizeHandle must throw at create time.
-        });
-        await expect(backend.create({ workingDirectory: workDir })).rejects.toThrow(/no client cert material was injected/);
-    });
-});
-//# sourceMappingURL=backend.test.js.map

package/dist/backends/firecracker/__tests__/backend.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"backend.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/backend.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACvE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAA4B,YAAY,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAExE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACN,MAAM,EACN,UAAU,EACV,UAAU,EAEV,cAAc,GACd,MAAM,wBAAwB,CAAA;AAC/B,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,uEAAuE;AACvE,mDAAmD;AACnD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAM/C,IAAI,OAAe,CAAA;AACnB,IAAI,QAAgB,CAAA;AACpB,IAAI,MAA0B,CAAA;AAC9B,IAAI,KAA8B,CAAA;AAClC,IAAI,KAAkB,CAAA;AACtB,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAA;AAClC,IAAI,QAA4B,CAAA;AAEhC,UAAU,CAAC,GAAG,EAAE;IACf,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAA;IACzD,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAChC,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA;IAC3B,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAA;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACtE,KAAK,GAAG,QAAQ,CAAC,6BAA6B,CAAgB,CAAA;AAC/D,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACpB,UAAU,CAAC,KAAK,GAAG,SAAS,CAAA;IAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAA;IAC3B,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,KAAK,GAAG,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxD,MAAM,GAAG,SAAS,CAAA;IACnB,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,SAAS,UAAU;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC9C,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,MAA8B;IAGvD,MAAM,KAAK,GAA2D,EAAE,CAAA;IACxE,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QACpF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,MAAM,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,KAAK,CAAA;QACpC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACjC,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,QAAQ,CAClB,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAC7E,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAChE,CAAA;QACF,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3C,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACnD,CAAC,CAAiB,CAAA;IAClB,OAAO,EAAE,KAAK,EAAE,CAAA;AACjB,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,0CAA0C,EAAE,GAAG,EAAE;IAC5E,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAEpE,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,WAAW;YACjC,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC;YACpC,gBAAgB,EAAE,OAAO;YACzB,aAAa,EAAE,GAAG;YAClB,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,iBAAiB,CAAC,EAAE;SAC7D,CAAC,CAAA;QAEF,gBAAgB;QAChB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QACnD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEpC,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QACzD,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;YACtC,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,GAAG;YAClB,YAAY,EAAE,EAAE;YAChB,SAAS,EAAE,MAAM;YACjB,eAAe,EAAE,CAAC,iBAAiB,CAAC;SACpC,CAAC,CAAA;QAEF,sBAAsB;QACtB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAA;QAChE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;QACtC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAE1B,mCAAmC;QACnC,MAAM,OAAO,CAAC,SAAS,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAA;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAA;QACrD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAE/C,4DAA4D;QAC5D,+DAA+D;QAC/D,6DAA6D;QAC7D,kEAAkE;QAClE,iEAAiE;QACjE,iEAAiE;QACjE,qCAAqC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACvE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACxC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACtF,gEAAgE;QAChE,kEAAkE;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,GAAG;YACnB,mBAAmB,EAAE,EAAE;YACvB,SAAS,EAAE,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE,EAAE,sBAAsB,EAAE,EAAE,EAAE;SAC1F,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1E,sBAAsB,CACtB,CAAA;QACD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACxF,iEAAiE;QACjE,kEAAkE;QAClE,+DAA+D;QAC/D,6DAA6D;QAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACrC,aAAa,CACZ,QAAQ,EACR;YACC,WAAW;YACX,wBAAwB,OAAO,oBAAoB;YACnD,wBAAwB,OAAO,oBAAoB;SACnD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,KAAK,EAAE,CACf,CAAA;QACD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAA;QAElD,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAA;QAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,IAAI,EAAE,GAAG,OAAO,iBAAiB,EAAE,IAAI,EAAE,CAAC,EAAE;YAC9C,EAAE,IAAI,EAAE,GAAG,OAAO,gBAAgB,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9C,CAAC,CAAA;QACF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC7E,6DAA6D;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,2CAA2C;QAC3C,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAClD,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,IAAI;YACpB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACpC,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACzF,0EAA0E;QAC1E,yEAAyE;QACzE,6CAA6C;QAC7C,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;YACjE,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QACzD,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;YACtC,QAAQ,EAAE,cAAc;YACxB,aAAa,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;SACjE,CAAC,CAAA;QACF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QACnG,6DAA6D;QAC7D,0EAA0E;QAC1E,mEAAmE;QACnE,mDAAmD;QACnD,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpE,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,QAAQ,EAAE,cAAc;YACxB,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAA;QACzD,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAA;QAC9D,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CACzF,KAAK,CACL,CAAA;QACD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACxB,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,2EAA2E;AAC3E,iBAAiB;AACjB,8EAA8E;AAE9E,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACtD,MAAM,SAAS,GAAG;QACjB,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,IAAI;QACV,SAAS,EAAE,QAAQ;KACuB,CAAA;IAE3C,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACpE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE;YAC/C,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;YACf,UAAU,EAAE,qBAAqB;SACjC,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;YACV,SAAS,EAAE,QAAQ;YACnB,GAAG,EAAE;gBACJ,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,qBAAqB;aACjC;SACD,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC5E,oEAAoE;QACpE,qEAAqE;QACrE,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAChE,sCAAsC,CACtC,CAAA;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC3E,MAAM,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACvF,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,aAAa;SACnB,CAAC,CAAA;QACF,sEAAsE;QACtE,MAAM,CACL,eAAe,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE;YACrE,EAAE,EAAE,MAAM;YACV,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;SACf,CAAC,CACF,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAC1B,mEAAmE,EACnE,GAAG,EAAE;IACJ,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,oEAAoE;QACpE,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;QACtC,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC;YAClC,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,QAAQ;SACnB,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;YACvB,gEAAgE;YAChE,sDAAsD;YACtD,IAAI,EAAE;gBACL,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,qBAAqB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEpC,0EAA0E;QAC1E,MAAM,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QAE7C,uDAAuD;QACvD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAA;QAClE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;QACjD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAEhF,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,GAAG,MAAM,UAAU,EAAE,CAAA;QAC3B,KAAK,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;QACtC,gBAAgB,CAAC;YAChB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EAAE,QAAQ;SACnB,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,4BAA4B;YAClD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;YACvB,kEAAkE;SAClE,CAAC,CAAA;QACF,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1E,sCAAsC,CACtC,CAAA;IACF,CAAC,CAAC,CAAA;AACH,CAAC,CACD,CAAA"}

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts

@@ -1,19 +0,0 @@
-/**
- * Control-plane mTLS dial for the Firecracker backend (additive
- * `config.controlPlaneMtls`).
- *
- * A loopback `https.createServer` with `requestCert + rejectUnauthorized`
- * (pinned to the test CA) stands in for the orchestrator over the public hop.
- * It serves the real `POST /sandboxes` + `:delete` routes; the create response
- * points the agent handle at a unix-socket loopback running the REAL
- * `agent/agent.cjs`, so the FULL create flow (control-plane POST over mTLS →
- * vsock readiness fence → exec) runs end to end.
- *
- * Proves:
- *  - with `controlPlaneMtls` injected, the create POST succeeds over mTLS and
- *    the sandbox round-trips an exec.
- *  - WITHOUT the client cert (no `controlPlaneMtls`, so the backend uses plain
- *    `fetch` against the https listener), create is rejected at the TLS layer.
- */
-export {};
-//# sourceMappingURL=control-plane-mtls.test.d.ts.map

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"control-plane-mtls.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/control-plane-mtls.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js

@@ -1,209 +0,0 @@
-/**
- * Control-plane mTLS dial for the Firecracker backend (additive
- * `config.controlPlaneMtls`).
- *
- * A loopback `https.createServer` with `requestCert + rejectUnauthorized`
- * (pinned to the test CA) stands in for the orchestrator over the public hop.
- * It serves the real `POST /sandboxes` + `:delete` routes; the create response
- * points the agent handle at a unix-socket loopback running the REAL
- * `agent/agent.cjs`, so the FULL create flow (control-plane POST over mTLS →
- * vsock readiness fence → exec) runs end to end.
- *
- * Proves:
- *  - with `controlPlaneMtls` injected, the create POST succeeds over mTLS and
- *    the sandbox round-trips an exec.
- *  - WITHOUT the client cert (no `controlPlaneMtls`, so the backend uses plain
- *    `fetch` against the https listener), create is rejected at the TLS layer.
- */
-import { mkdtempSync, rmSync } from 'node:fs';
-import { createServer as createHttpsServer, request as httpsRequest, } from 'node:https';
-import { createRequire } from 'node:module';
-import { createServer } from 'node:net';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { buildFirecrackerBackend } from '../index.js';
-import { localIpcPath } from './fixtures/ipc-path.js';
-import { CA_CRT, CLIENT_CRT, CLIENT_KEY, ROGUE_CLIENT_CRT, ROGUE_CLIENT_KEY, SERVER_CRT, SERVER_KEY, } from './fixtures/mtls-pki.js';
-// The loopback agent under test is the guest-side agent for a Linux microVM:
-// it spawns `/bin/sh` to run commands, and that binary does not exist on
-// Windows. These cases assert behavior the platform cannot produce, so they
-// skip there rather than leaving the suite permanently red for Windows
-// contributors. The socket-address fixture IS platform-correct, so the
-// transport is still exercised wherever it can be.
-const IS_WINDOWS = process.platform === 'win32';
-const require_ = createRequire(import.meta.url);
-let workDir;
-let sockPath;
-let agentServer;
-let orchestrator;
-let agent;
-beforeEach(() => {
-    workDir = mkdtempSync(join(tmpdir(), 'fc-cp-mtls-'));
-    sockPath = localIpcPath(workDir);
-    process.env.NAMZU_SANDBOX_WORKSPACE = workDir;
-    delete require_.cache[require_.resolve('../../../../agent/agent.cjs')];
-    agent = require_('../../../../agent/agent.cjs');
-});
-afterEach(async () => {
-    if (orchestrator) {
-        await new Promise((r) => orchestrator?.close(() => r()));
-        orchestrator = undefined;
-    }
-    if (agentServer) {
-        await new Promise((r) => agentServer?.close(() => r()));
-        agentServer = undefined;
-    }
-    rmSync(workDir, { recursive: true, force: true });
-});
-function startAgent() {
-    return new Promise((resolve, reject) => {
-        const s = createServer(agent.handleConnection);
-        s.on('error', reject);
-        s.listen(sockPath, () => resolve(s));
-    });
-}
-/**
- * A loopback mTLS orchestrator. Requires + verifies a client cert chaining to
- * the test CA, then serves the control-plane routes: `POST /sandboxes` returns
- * a unix agent handle, `:delete` returns 204. Records calls so the test can
- * assert the create round-trip.
- */
-function startMtlsOrchestrator(handlePath) {
-    const calls = [];
-    return new Promise((resolve, reject) => {
-        const server = createHttpsServer({
-            cert: SERVER_CRT,
-            key: SERVER_KEY,
-            ca: CA_CRT,
-            requestCert: true,
-            rejectUnauthorized: true,
-            minVersion: 'TLSv1.3',
-        }, (req, res) => {
-            const method = req.method ?? 'GET';
-            const url = req.url ?? '/';
-            calls.push({ method, url });
-            // Drain the body, then respond per route.
-            req.on('data', () => { });
-            req.on('end', () => {
-                if (method === 'POST' && url.endsWith('/sandboxes')) {
-                    res.statusCode = 200;
-                    res.setHeader('content-type', 'application/json');
-                    res.end(JSON.stringify({
-                        sandboxId: 'sbx_cp_mtls',
-                        agent: { kind: 'unix', path: handlePath },
-                        rootDir: workDir,
-                    }));
-                    return;
-                }
-                if (method === 'DELETE' && url.includes(':delete')) {
-                    res.statusCode = 204;
-                    res.end();
-                    return;
-                }
-                res.statusCode = 500;
-                res.end('unexpected');
-            });
-        });
-        server.on('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const addr = server.address();
-            if (addr === null || typeof addr === 'string') {
-                reject(new Error('orchestrator: no TCP port'));
-                return;
-            }
-            resolve({ server, port: addr.port, calls });
-        });
-    });
-}
-describe.skipIf(IS_WINDOWS)('buildFirecrackerBackend (control-plane mTLS dial)', () => {
-    it('create POST succeeds over mTLS and round-trips an exec', async () => {
-        agentServer = await startAgent();
-        const orch = await startMtlsOrchestrator(sockPath);
-        orchestrator = orch.server;
-        const backend = buildFirecrackerBackend({
-            // An https:// endpoint over the (loopback stand-in for the) public hop.
-            orchestratorEndpoint: `https://127.0.0.1:${orch.port}/`,
-            getToken: async () => 'tok',
-            readyTimeoutMs: 5_000,
-            readyPollIntervalMs: 50,
-            // CONTROL-plane client material — injected by the consumer, never
-            // shipped by the orchestrator. Drives the node:https mTLS dial.
-            controlPlaneMtls: {
-                ca: CA_CRT,
-                cert: CLIENT_CRT,
-                key: CLIENT_KEY,
-                servername: 'sandbox.fc.internal',
-            },
-        });
-        const sandbox = await backend.create({ workingDirectory: workDir });
-        expect(sandbox.id).toBe('sbx_cp_mtls');
-        expect(sandbox.status).toBe('ready');
-        // The control-plane POST reached the mTLS orchestrator.
-        expect(orch.calls.some((c) => c.method === 'POST' && c.url.endsWith('/sandboxes'))).toBe(true);
-        // Exec over the vsock tunnel (the data plane), proving the whole flow.
-        const r = await sandbox.exec('/bin/sh', ['-c', 'echo hello-cp-mtls']);
-        expect(r.stdout).toContain('hello-cp-mtls');
-        // destroy DELETE also rides the mTLS control plane.
-        await sandbox.destroy();
-        expect(orch.calls.some((c) => c.method === 'DELETE' && c.url.includes(':delete'))).toBe(true);
-    });
-    it('the backend without controlPlaneMtls cannot reach the mTLS orchestrator (plain fetch fails the handshake)', async () => {
-        agentServer = await startAgent();
-        const orch = await startMtlsOrchestrator(sockPath);
-        orchestrator = orch.server;
-        // No `controlPlaneMtls` → the backend uses plain `fetch`, which neither
-        // presents a client cert nor trusts the test CA, so the TLS handshake
-        // fails and create rejects BEFORE any route runs.
-        const backend = buildFirecrackerBackend({
-            orchestratorEndpoint: `https://127.0.0.1:${orch.port}/`,
-            getToken: async () => 'tok',
-            readyTimeoutMs: 2_000,
-            readyPollIntervalMs: 50,
-        });
-        await expect(backend.create({ workingDirectory: workDir })).rejects.toThrow(/failed to create microVM sandbox/);
-        expect(orch.calls.some((c) => c.method === 'POST' && c.url.endsWith('/sandboxes'))).toBe(false);
-    });
-    it("the orchestrator's requestCert rejects a client presenting NO cert (server-side proof)", async () => {
-        // Isolate the SERVER's requestCert+rejectUnauthorized from any client-side
-        // CA distrust: dial directly with node:https TRUSTING the server CA but
-        // presenting NO client cert. The handshake must be rejected by the server.
-        const orch = await startMtlsOrchestrator(sockPath);
-        orchestrator = orch.server;
-        const err = await new Promise((resolve) => {
-            const req = httpsRequest({
-                host: '127.0.0.1',
-                port: orch.port,
-                method: 'POST',
-                path: '/sandboxes',
-                ca: CA_CRT,
-                servername: 'sandbox.fc.internal',
-            }, () => resolve(undefined));
-            req.on('error', (e) => resolve(e));
-            req.end();
-        });
-        expect(err).toBeInstanceOf(Error);
-        expect(orch.calls.some((c) => c.method === 'POST')).toBe(false);
-    });
-    it("the orchestrator's requestCert rejects a client cert from a DIFFERENT CA", async () => {
-        const orch = await startMtlsOrchestrator(sockPath);
-        orchestrator = orch.server;
-        const err = await new Promise((resolve) => {
-            const req = httpsRequest({
-                host: '127.0.0.1',
-                port: orch.port,
-                method: 'POST',
-                path: '/sandboxes',
-                ca: CA_CRT,
-                cert: ROGUE_CLIENT_CRT,
-                key: ROGUE_CLIENT_KEY,
-                servername: 'sandbox.fc.internal',
-            }, () => resolve(undefined));
-            req.on('error', (e) => resolve(e));
-            req.end();
-        });
-        expect(err).toBeInstanceOf(Error);
-        expect(orch.calls.some((c) => c.method === 'POST')).toBe(false);
-    });
-});
-//# sourceMappingURL=control-plane-mtls.test.js.map

package/dist/backends/firecracker/__tests__/control-plane-mtls.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"control-plane-mtls.test.js","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/control-plane-mtls.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,EAEN,YAAY,IAAI,iBAAiB,EACjC,OAAO,IAAI,YAAY,GACvB,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAA4B,YAAY,EAAE,MAAM,UAAU,CAAA;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACrD,OAAO,EACN,MAAM,EACN,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,UAAU,GACV,MAAM,wBAAwB,CAAA;AAC/B,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,uEAAuE;AACvE,uEAAuE;AACvE,mDAAmD;AACnD,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE/C,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAM/C,IAAI,OAAe,CAAA;AACnB,IAAI,QAAgB,CAAA;AACpB,IAAI,WAA+B,CAAA;AACnC,IAAI,YAAqC,CAAA;AACzC,IAAI,KAAkB,CAAA;AAEtB,UAAU,CAAC,GAAG,EAAE;IACf,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAA;IACpD,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,CAAC,GAAG,CAAC,uBAAuB,GAAG,OAAO,CAAA;IAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,CAAA;IACtE,KAAK,GAAG,QAAQ,CAAC,6BAA6B,CAAgB,CAAA;AAC/D,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,KAAK,IAAI,EAAE;IACpB,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,YAAY,GAAG,SAAS,CAAA;IACzB,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAC7D,WAAW,GAAG,SAAS,CAAA;IACxB,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAClD,CAAC,CAAC,CAAA;AAEF,SAAS,UAAU;IAClB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAA;QAC9C,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,UAAkB;IAKhD,MAAM,KAAK,GAA2C,EAAE,CAAA;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,iBAAiB,CAC/B;YACC,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,UAAU;YACf,EAAE,EAAE,MAAM;YACV,WAAW,EAAE,IAAI;YACjB,kBAAkB,EAAE,IAAI;YACxB,UAAU,EAAE,SAAS;SACrB,EACD,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAA;YAClC,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAA;YAC1B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;YAC3B,0CAA0C;YAC1C,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACxB,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBAClB,IAAI,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBACpB,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAA;oBACjD,GAAG,CAAC,GAAG,CACN,IAAI,CAAC,SAAS,CAAC;wBACd,SAAS,EAAE,aAAa;wBACxB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE;wBACzC,OAAO,EAAE,OAAO;qBAChB,CAAC,CACF,CAAA;oBACD,OAAM;gBACP,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;oBACpB,GAAG,CAAC,GAAG,EAAE,CAAA;oBACT,OAAM;gBACP,CAAC;gBACD,GAAG,CAAC,UAAU,GAAG,GAAG,CAAA;gBACpB,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;YACtB,CAAC,CAAC,CAAA;QACH,CAAC,CACD,CAAA;QACD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC1B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAClC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAA;YAC7B,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/C,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAA;gBAC9C,OAAM;YACP,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5C,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,mDAAmD,EAAE,GAAG,EAAE;IACrF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACvE,WAAW,GAAG,MAAM,UAAU,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAE1B,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,wEAAwE;YACxE,oBAAoB,EAAE,qBAAqB,IAAI,CAAC,IAAI,GAAG;YACvD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;YACvB,kEAAkE;YAClE,gEAAgE;YAChE,gBAAgB,EAAE;gBACjB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,UAAU;gBAChB,GAAG,EAAE,UAAU;gBACf,UAAU,EAAE,qBAAqB;aACjC;SACD,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAA;QACnE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAEpC,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAE9F,uEAAuE;QACvE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;QAE3C,oDAAoD;QACpD,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACvB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2GAA2G,EAAE,KAAK,IAAI,EAAE;QAC1H,WAAW,GAAG,MAAM,UAAU,EAAE,CAAA;QAChC,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAE1B,wEAAwE;QACxE,sEAAsE;QACtE,kDAAkD;QAClD,MAAM,OAAO,GAAG,uBAAuB,CAAC;YACvC,oBAAoB,EAAE,qBAAqB,IAAI,CAAC,IAAI,GAAG;YACvD,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;YAC3B,cAAc,EAAE,KAAK;YACrB,mBAAmB,EAAE,EAAE;SACvB,CAAC,CAAA;QAEF,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC1E,kCAAkC,CAClC,CAAA;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACvG,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,YAAY,CACvB;gBACC,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,MAAM;gBACV,UAAU,EAAE,qBAAqB;aACjC,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAA;YACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACzC,GAAG,CAAC,GAAG,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,IAAI,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,CAAA;QAClD,YAAY,GAAG,IAAI,CAAC,MAAM,CAAA;QAC1B,MAAM,GAAG,GAAG,MAAM,IAAI,OAAO,CAAoB,CAAC,OAAO,EAAE,EAAE;YAC5D,MAAM,GAAG,GAAG,YAAY,CACvB;gBACC,IAAI,EAAE,WAAW;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,YAAY;gBAClB,EAAE,EAAE,MAAM;gBACV,IAAI,EAAE,gBAAgB;gBACtB,GAAG,EAAE,gBAAgB;gBACrB,UAAU,EAAE,qBAAqB;aACjC,EACD,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CACxB,CAAA;YACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACzC,GAAG,CAAC,GAAG,EAAE,CAAA;QACV,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAA;QACjC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;AACH,CAAC,CAAC,CAAA"}

package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=egress-policy.test.d.ts.map

package/dist/backends/firecracker/__tests__/egress-policy.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"egress-policy.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/firecracker/__tests__/egress-policy.test.ts"],"names":[],"mappings":""}