@namzu/sandbox 3.0.0 → 5.0.0

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # @namzu/sandbox
 
+## 5.0.0
+
+### Major Changes
+
+- a208ba8: The docker backend's default configuration could not create a sandbox, and the test that would have caught it had never run
+
+  `create()` failed on the documented defaults — `network: 'none'`, `hostReachability: 'host-port'` — with `index of untyped nil` thrown out of a `docker inspect` template, reported as "the container exited immediately". The container was alive and well. Docker binds a published port to the container's address by NAT, so a container with no route out has no address to bind to and nothing is published; measured against Docker 29.6, `--network none --publish 127.0.0.1::2024` is _accepted_ and `NetworkSettings.Ports` comes back `{"2024/tcp":[]}`. An `--internal` network behaves the same way.
+
+  `deny-all` had the same defect from the other side. It answered `--network none`, which reads as the strictest possible answer and removes the interface the worker is reached on — so it denied the way _in_ along with the way out, in both reachability modes.
+
+  **Why no one noticed.** `packages/sandbox/vitest.config.ts` excludes `**/*.smoke.test.ts` from every run it governs, including the `test:smoke` run that exists to run them; naming the files as CLI arguments does not re-include them, because positional arguments filter what discovery already found. With `--passWithNoTests`, `pnpm sandbox:smoke` printed `No test files found, exiting with code 0` and the workflow went green — after building a Debian image with a browser and an office suite in it to run nothing. The suite's own fail-fast guard for a misconfigured CI could not fire either: it lives inside a file that was never loaded.
+
+  **What changes for you.**
+
+  - The smoke suite has its own config and no `--passWithNoTests`, so an empty run is now a failure.
+  - `create()` checks the container's network against the daemon before starting anything, and refuses with the reason. **The `network` default of `'none'` is one of the pairings it refuses** — name a bridge to reach the worker by host port, or set `hostReachability: 'container-network'`.
+  - `deny-all` now keeps the configured network and **requires it to be one created with `docker network create --internal`**, verified rather than trusted. That is a real boundary: outbound gets `Network unreachable` from the kernel, not from an environment variable a workload may decline to read, while sibling containers still reach the worker by name.
+  - Consequently **`deny-all` over a published host port is refused as impossible**, not unsupported: a published port needs a route out and `deny-all` needs none. Closing that means moving the worker's control channel off TCP, which is tracked separately.
+  - `resolveNetwork` no longer returns `'none'` for `deny-all`. `assertNetworkCarriesThePolicy` and `isInternalNetwork` are exported alongside it.
+
+### Patch Changes
+
+- 3e591c7: Record why the capability drop is load-bearing for egress denial
+
+  Comment only; no behaviour change.
+
+  `deny-all` is now enforced by the container's network being `--internal`, and it was worth measuring what that is actually worth. A container on such a network has no default route — but `ip route add default via <sibling>` is refused with `Operation not permitted` under docker's **default** capability set, before `--cap-drop=ALL` is applied at all. `NET_ADMIN` is what would lift that.
+
+  So the internal network removes the route and the capability drop removes the ability to put one back. Both are needed, and `HARDENING_ARGS` previously justified the drop only on unrelated grounds (`CAP_DAC_OVERRIDE` walking past read-only binds) — a rationale that would survive softening the flag, while this one would not.
+
+  Also recorded: given `NET_ADMIN` and a manually installed route, a dual-homed sibling _does_ forward the packet (`net.ipv4.ip_forward` is `1` inside a container). No connection establishes because nothing masquerades the internal subnet, but the docblock says plainly that this is not a security property — one-way egress is enough for exfiltration, and what was measured is a failed handshake, not a dropped packet.
+
+## 4.0.0
+
+### Major Changes
+
+- d33bfdd: The standby-pool backend refuses to claim a container group on a public address
+
+  Omitting `subnetId` meant the platform assigned a public address, and the backend claimed the group and dialled it without comment. The worker answering there has no authentication of any kind — `worker/server.js` states "Authn: none" in its own docblock — so an unauthenticated execute endpoint was reachable from the internet, chosen by a caller who had never heard of a field.
+
+  The backend now refuses that combination. Two ways forward, and the error names both:
+
+  - **`subnetId`** — inject the group into a private network. This is the production answer, and the file already recommended it.
+  - **`allowPublicAddress: true`** — a new option, off by default, for a benchmark where you mean it.
+
+  **This is `major` and it will stop a deployment that works today.** If you run this backend with no `subnetId`, the next claim throws instead of succeeding. That is deliberate: the alternative is a warning on a path that otherwise succeeds, which is read once and never again.
+
+  The trust-model docblock used to end "Caller decides". Nothing asked them — omitting a field chose the public address silently, which is not a decision. That sentence has been corrected rather than deleted, so a reader who saw the old one learns what changed.
+
+### Minor Changes
+
+- 3f44f0d: A command running in a sandbox now reports progress while it runs
+
+  Both halves of this existed and neither was connected to the other.
+
+  Every container worker streams its output a chunk at a time — the wire has always carried `stdout_delta` and `stderr_delta` events — and every backend concatenated those chunks into a string and returned it when the process exited. Separately, `ToolContext.report` exists precisely to answer "is it still working?", is supplied per call by the executor, emits a `tool_progress` event, and is mapped onto the event stream for live consumers. It had **no caller anywhere in the tree**.
+
+  So a command that ran for eight minutes said nothing for eight minutes, over a transport that had been reporting the whole time.
+
+  **New:** `SandboxExecOptions.onOutput`, called as output arrives. Optional and additive — a backend that cannot stream never calls it, and `SandboxExecResult.stdout` still carries the complete output either way, so a caller that ignores it behaves exactly as before. Wired through the two container backends that carry the streaming worker protocol.
+
+  **The `bash` builtin now uses it**, sending the last non-empty line of each chunk to `context.report`. A progress slot renders one line and replaces it, so sending a whole chunk would put a wall of text in a space that shows one line of it.
+
+  Progress is ephemeral by design — `tool_progress` is excluded from the durable transcript so a tool reporting every file it compiles cannot write thousands of lines into the record. The model is still given `result.stdout`; this is a status signal, not a second copy of the output.
+
+### Patch Changes
+
+- 1cb8cc9: The package description no longer claims an authentication this proxy does not have
+
+  `package.json#description` described the container tier as an "HTTP worker + JWT-authenticated egress proxy". The egress proxy has no inbound authentication of any kind — no token, no JWT, no check. The only occurrence of `proxy-authorization` in `src/egress/proxy.ts` is in the list of hop-by-hop headers it deletes, so the header a client would authenticate with is explicitly stripped.
+
+  This mattered more than an ordinary comment would, because a package description is the text on the registry page — where somebody decides whether this package is safe to depend on, before they have any source to read.
+
+  The description now says what the proxy actually is: loopback-bound, deciding by resolved address rather than by hostname, and brokering outbound credentials so a token never enters the sandbox. Those are the controls it has, and they are the ones worth knowing about.
+
+  No behaviour changes.
+
 ## 3.0.0
 
 ### Major Changes

package/README.md

@@ -64,11 +64,34 @@ throws instead of quietly ignoring it:
 
 | Backend | `deny-all` | `allow-all` | `static` | `resolver` |
 |---|---|---|---|---|
-| `container:docker` | enforced (`--network none`) | enforced | **throws** — no proxy to filter through | **throws** |
+| `container:docker` | enforced on an `--internal` network, and **throws** under `hostReachability: 'host-port'` | enforced | **throws** — no proxy to filter through | **throws** |
 | `container:standby-pool` | **throws** | **throws** | **throws** | **throws** |
 | `microvm:firecracker` | enforced (empty allowlist) | enforced (no allowlist) | enforced | enforced — `resolve()` is called and its result forwarded |
 
-Two rows carry the same lesson from opposite directions.
+### The network has to be able to carry the policy
+
+`network` and `hostReachability` are not independent of the egress policy,
+and pairing them wrongly used to produce a container nobody could reach:
+
+| You want | `network` | `hostReachability` |
+|---|---|---|
+| no egress, enforced | a network created `--internal` | `container-network` |
+| egress, restricted by allowlist | a bridge, plus an egress proxy | either |
+| egress, unrestricted | a bridge | either |
+
+Docker binds a published port to the container's address by NAT, so a
+container with no route out has no address to bind to and **nothing is
+published** — that holds for `--network none` and for an `--internal`
+network alike. `deny-all` needs exactly such a network. The two
+requirements are opposites, so *no egress plus a published host port* is
+impossible rather than unsupported; closing that means moving the worker's
+control channel off TCP.
+
+`create()` checks both against the daemon and refuses with the reason.
+Note that the `network` default of `'none'` is one of the pairings it
+refuses.
+
+Two rows of the table above carry the same lesson from opposite directions.
 
 The docker row used to accept a restrictive policy and silently grant the
 configured network, which is worse than not supporting the feature: the
@@ -120,7 +143,8 @@ Every container is launched with:
   layout advisory rather than enforced.
 - `--security-opt=no-new-privileges` — without it a setuid binary in the
   image re-escalates after the drop.
-- `--network none` by default (see the egress table above).
+- the configured network, which defaults to `none` (see the egress table
+  above, and the network note below it).
 
 There is deliberately **no re-add list** for capabilities. A workload that
 genuinely needs one should say so somewhere a reviewer sees it, not inherit

package/dist/backends/aci-standby-pool/index.d.ts

@@ -29,8 +29,12 @@
  *  - ACI runs the container in a Microsoft-owned isolation host;
  *    inside, the worker is a non-root user (image's `USER namzu`).
  *  - The container group can be subnet-injected (no public IP) when
- *    `subnetId` is supplied. Without it the IP is public — fine for
- *    benchmarking, NOT acceptable for production. Caller decides.
+ *    `subnetId` is supplied. Without it the address is public — fine for
+ *    benchmarking, NOT acceptable for production. The caller decides,
+ *    but has to say so: with neither `subnetId` nor `allowPublicAddress`
+ *    the backend refuses to claim. This line used to end "Caller
+ *    decides", and nothing asked them — omitting a field they had never
+ *    heard of chose the public address silently.
  *  - The Confidential variant of Standby Pools (AMD SEV-SNP TEE) is
  *    a pool-side knob, not a backend knob — the backend never
  *    chooses; it just PUTs against whichever pool the caller named.
@@ -74,11 +78,28 @@ export interface ACIStandbyPoolBackendInternalConfig {
      */
     readonly getArmToken: ArmTokenProvider;
     /**
-     * Optional subnet to inject the container group into (no public IP).
-     * Strongly recommended for production. When omitted, ACI assigns a
-     * public IP — fine for benchmarks, attack-surface for prod.
+     * Subnet to inject the container group into, so it has no public
+     * address. Omitting it means the platform assigns a public one, which
+     * the backend now refuses unless {@link allowPublicAddress} says
+     * otherwise — so this is optional in the type and required in practice
+     * for anything but a benchmark.
      */
     readonly subnetId?: string;
+    /**
+     * Claim a container group on a public address anyway, with no subnet.
+     *
+     * Off by default, and the default is the whole point. The worker this
+     * backend dials has no authentication of any kind — its own docblock
+     * says so — so a public address puts an unauthenticated control API on
+     * the internet. That is a fine trade for a benchmark and never for
+     * production, and the difference between the two is a decision an
+     * operator makes rather than one a missing field makes for them.
+     *
+     * Named for what it grants rather than what it disables: an operator
+     * reading `allowPublicAddress: true` in a config review knows what they
+     * are looking at.
+     */
+    readonly allowPublicAddress?: boolean;
     readonly readyPollIntervalMs?: number;
     readonly readyTimeoutMs?: number;
     /**
@@ -102,4 +123,25 @@ export interface ACIStandbyPoolBackendInternalConfig {
  */
 export declare function buildAciStandbyPoolBackend(config: ACIStandbyPoolBackendInternalConfig): SandboxBackend;
 export declare function assertEnforceable(options: SandboxBackendOptions): void;
+/**
+ * Refuse to claim a container group that will answer on a public address.
+ *
+ * The sibling above refuses controls this backend cannot enforce. This
+ * refuses one it *can* enforce and would otherwise skip by omission —
+ * which is the more dangerous shape, because nothing is being dropped and
+ * so nothing looks wrong. A caller who never heard of `subnetId` gets a
+ * working sandbox on the internet and no signal at all.
+ *
+ * What is on that address matters: `worker/server.js` states "Authn: none"
+ * in its own docblock and binds every interface. Inside a private network
+ * that is the boundary doing the work. With a public address there is no
+ * boundary left, and the worker's `/execute` is reachable by anyone.
+ *
+ * Defaulting to refusal rather than to a warning, because a warning on a
+ * path that otherwise succeeds is read once and never again.
+ */
+export declare function assertNotPubliclyAddressed(config: {
+    subnetId?: string;
+    allowPublicAddress?: boolean;
+}): void;
 //# sourceMappingURL=index.d.ts.map

package/dist/backends/aci-standby-pool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAQ9B,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAQhB;AA2LD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAQ9B,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAQhB;AA2LD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,IAAI,CAOP"}

package/dist/backends/aci-standby-pool/index.js

@@ -29,8 +29,12 @@
  *  - ACI runs the container in a Microsoft-owned isolation host;
  *    inside, the worker is a non-root user (image's `USER namzu`).
  *  - The container group can be subnet-injected (no public IP) when
- *    `subnetId` is supplied. Without it the IP is public — fine for
- *    benchmarking, NOT acceptable for production. Caller decides.
+ *    `subnetId` is supplied. Without it the address is public — fine for
+ *    benchmarking, NOT acceptable for production. The caller decides,
+ *    but has to say so: with neither `subnetId` nor `allowPublicAddress`
+ *    the backend refuses to claim. This line used to end "Caller
+ *    decides", and nothing asked them — omitting a field they had never
+ *    heard of chose the public address silently.
  *  - The Confidential variant of Standby Pools (AMD SEV-SNP TEE) is
  *    a pool-side knob, not a backend knob — the backend never
  *    chooses; it just PUTs against whichever pool the caller named.
@@ -199,8 +203,33 @@ export function assertEnforceable(options) {
         .map(([, label]) => label)
         .join(', ')}: the pool's claim API rejects every property override except a config map, so these would be accepted and silently dropped. Set them on the container group profile the pool is built from, or use a backend that applies them per sandbox. Refusing rather than silently granting more than was asked for.`);
 }
+/**
+ * Refuse to claim a container group that will answer on a public address.
+ *
+ * The sibling above refuses controls this backend cannot enforce. This
+ * refuses one it *can* enforce and would otherwise skip by omission —
+ * which is the more dangerous shape, because nothing is being dropped and
+ * so nothing looks wrong. A caller who never heard of `subnetId` gets a
+ * working sandbox on the internet and no signal at all.
+ *
+ * What is on that address matters: `worker/server.js` states "Authn: none"
+ * in its own docblock and binds every interface. Inside a private network
+ * that is the boundary doing the work. With a public address there is no
+ * boundary left, and the worker's `/execute` is reachable by anyone.
+ *
+ * Defaulting to refusal rather than to a warning, because a warning on a
+ * path that otherwise succeeds is read once and never again.
+ */
+export function assertNotPubliclyAddressed(config) {
+    if (config.subnetId)
+        return;
+    if (config.allowPublicAddress)
+        return;
+    throw new Error('The standby-pool sandbox backend will not claim a container group without `subnetId`: with no subnet the platform assigns a public address, and the worker on it has no authentication of any kind, so its execute endpoint would be reachable from the internet. Supply `subnetId` to inject the group into a private network, or set `allowPublicAddress: true` if this is a benchmark and you mean it.');
+}
 async function spawnAciSandbox(config, options) {
     assertEnforceable(options);
+    assertNotPubliclyAddressed(config);
     const id = generateSandboxId();
     const prefix = config.containerNamePrefix ?? DEFAULT_CONTAINER_NAME_PREFIX;
     const cgName = `${prefix}-${id
@@ -401,10 +430,14 @@ async function execViaWorker(baseUrl, command, argv, opts) {
             if (line) {
                 try {
                     const event = JSON.parse(line);
-                    if (event.type === 'stdout_delta')
+                    if (event.type === 'stdout_delta') {
                         stdout += event.data;
-                    else if (event.type === 'stderr_delta')
+                        opts?.onOutput?.({ stream: 'stdout', data: event.data });
+                    }
+                    else if (event.type === 'stderr_delta') {
                         stderr += event.data;
+                        opts?.onOutput?.({ stream: 'stderr', data: event.data });
+                    }
                     else if (event.type === 'result') {
                         exitCode = event.exitCode;
                         timedOut = event.timedOut;

package/dist/backends/aci-standby-pool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA4EH,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAAuF,EACvF,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,IAAI,iBAAiB,GAAG,CAAC,CAAA;AACzB,SAAS,iBAAiB;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,iBAAiB,IAAI,CAAC,CAAA;IACtB,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,iBAAiB,EAAe,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc;IAEd,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAC/B,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B;IAE9B,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,EACnD,MAAM,CAAC,cAAc,IAAI,wBAAwB,CACjD,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QAED,IAAI,MAAM,GAAkB,OAAO,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QAEnD,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,OAAO,MAAM,CAAA;YACd,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,MAAM,GAAG,MAAM,CAAA;gBACf,IAAI,CAAC;oBACJ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;wBAAS,CAAC;oBACV,MAAM,GAAG,OAAO,CAAA;gBACjB,CAAC;YACF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAY;gBAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;gBACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACnD,CAAC;YAED,KAAK,CAAC,OAAO;gBACZ,MAAM,GAAG,WAAW,CAAA;gBACpB,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACpD,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,2DAA2D;YAC3D,6DAA6D;YAC7D,4DAA4D;QAC7D,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,cAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAiB,EACjB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAM;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,oCAAoC;QACrC,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,IAA0B,EAC1B,IAAoC;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,EAAE,OAAO;SACxB,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,SAAS,CAAC;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIM,CAAA;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;wBACzB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;oBAC1B,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBAC7B,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;wBAAE,MAAM,GAAG,CAAA;gBAC7C,CAAC;YACF,CAAC;YACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM;QACN,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KACT,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AA6FH,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAAuF,EACvF,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,IAAI,iBAAiB,GAAG,CAAC,CAAA;AACzB,SAAS,iBAAiB;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,iBAAiB,IAAI,CAAC,CAAA;IACtB,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,iBAAiB,EAAe,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc;IAEd,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAC/B,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B;IAE9B,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,EACnD,MAAM,CAAC,cAAc,IAAI,wBAAwB,CACjD,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QAED,IAAI,MAAM,GAAkB,OAAO,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QAEnD,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,OAAO,MAAM,CAAA;YACd,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,MAAM,GAAG,MAAM,CAAA;gBACf,IAAI,CAAC;oBACJ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;wBAAS,CAAC;oBACV,MAAM,GAAG,OAAO,CAAA;gBACjB,CAAC;YACF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAY;gBAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;gBACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACnD,CAAC;YAED,KAAK,CAAC,OAAO;gBACZ,MAAM,GAAG,WAAW,CAAA;gBACpB,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACpD,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,2DAA2D;YAC3D,6DAA6D;YAC7D,4DAA4D;QAC7D,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,cAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAiB,EACjB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAM;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,oCAAoC;QACrC,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,IAA0B,EAC1B,IAAoC;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,EAAE,OAAO;SACxB,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,SAAS,CAAC;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIM,CAAA;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;wBACpB,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;oBACzD,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;wBACpB,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;oBACzD,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACpC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;wBACzB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;oBAC1B,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBAC7B,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;wBAAE,MAAM,GAAG,CAAA;gBAC7C,CAAC;YACF,CAAC;YACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM;QACN,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KACT,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/backends/docker/index.d.ts

@@ -134,10 +134,17 @@ export declare function buildDockerBackend(config: DockerBackendInternalConfig):
  *
  * The policy used to be accepted and silently ignored, which is worse than
  * not supporting it: a host that set `deny-all` believed the container had
- * no network and it had the configured one. Docker can enforce `deny-all`
- * natively (`--network none`); it cannot enforce a host allowlist without
- * a proxy this backend does not have, so those policies are REFUSED rather
- * than quietly downgraded to "allow everything".
+ * no network and it had the configured one. It cannot enforce a host
+ * allowlist without a proxy this backend does not have, so those policies
+ * are REFUSED rather than quietly downgraded to "allow everything".
+ *
+ * `deny-all` used to answer `'none'`, which reads as the strictest possible
+ * answer and produced a sandbox nobody could reach. `--network none`
+ * removes every interface, and this backend's control channel is inbound
+ * TCP to the worker — so removing the interfaces removes the way IN, not
+ * just the way out. It now keeps the configured network, and
+ * {@link assertNetworkCarriesThePolicy} is what makes that network a
+ * boundary.
  */
 export declare function resolveNetwork(configured: string, egress: EgressPolicy | undefined, hasProxy?: boolean): string;
 /**
@@ -151,6 +158,45 @@ export declare function resolveNetwork(configured: string, egress: EgressPolicy
 export declare function resolveAllowedHosts(egress: EgressPolicy): Promise<readonly string[]>;
 /** Whether a policy needs a boundary before it can be enforced at all. */
 export declare function needsEgressProxy(egress: EgressPolicy | undefined): boolean;
+/**
+ * Whether the daemon says a network has no route out.
+ *
+ * Takes the raw `docker network inspect --format '{{.Internal}}'` output
+ * rather than reading it, so every decision below is testable without a
+ * daemon and the daemon call stays one line. Anything other than a literal
+ * `true` counts as "not internal": an unreadable answer is not evidence of
+ * a boundary.
+ */
+export declare function isInternalNetwork(inspectedInternalFlag: string): boolean;
+/**
+ * Refuse a container whose network cannot do what was asked of it.
+ *
+ * Two requirements meet on the same object here, and both were previously
+ * unstated — which is how the backend came to ship a default configuration
+ * that could not create a sandbox at all:
+ *
+ *  - **A published host port needs a route out.** Docker binds the port by
+ *    NAT to the container's address, so a container with no address gets no
+ *    binding. Measured against Docker 29.6: `--network none --publish
+ *    127.0.0.1::2024` is *accepted*, `NetworkSettings.Ports` comes back
+ *    `{"2024/tcp":[]}`, and `docker port` prints nothing. An `--internal`
+ *    network behaves the same way. The port readback then failed with
+ *    `index of untyped nil` and reported it as "the container exited
+ *    immediately" — blaming a container that was alive and well.
+ *  - **`deny-all` needs a network with no route out.** Since it no longer
+ *    answers `--network none`, the configured name is all that stands
+ *    between the policy and ordinary outbound networking, and a name says
+ *    nothing. `deny-all` pointed at the default bridge would be full egress
+ *    under a policy object claiming none — the "accepted and silently
+ *    ignored" failure the rest of this file exists to refuse.
+ *
+ * They are exact opposites, so `deny-all` over a published host port is
+ * impossible rather than merely unsupported: no arrangement of docker
+ * networking both denies all egress and lets the host reach the worker over
+ * TCP. Closing that needs the control channel moved off TCP — see #398 —
+ * and is not a flag this function could accept.
+ */
+export declare function assertNetworkCarriesThePolicy(network: string, reachability: 'host-port' | 'container-network', egress: EgressPolicy | undefined, inspectedInternalFlag: string): void;
 /**
  * The options the boundary is built from, as a value.
  *

package/dist/backends/docker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,8BAA8B,EAenC,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EACX,kBAAkB,EAClB,kBAAkB,EAElB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAE9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAE3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAE5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC5C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,GAAG,cAAc,CAQtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,QAAQ,UAAQ,GACd,MAAM,CAmBR;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM1F;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,EACnF,MAAM,EAAE,YAAY,GAClB,kBAAkB,CASpB;AAsjBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAmI5F;AAkCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,EAAE,CA+BtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAUvF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAKxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,8BAA8B,EAenC,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EACX,kBAAkB,EAClB,kBAAkB,EAElB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAE9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAE3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAE5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC5C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,GAAG,cAAc,CAQtF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,QAAQ,UAAQ,GACd,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM1F;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,WAAW,GAAG,mBAAmB,EAC/C,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,qBAAqB,EAAE,MAAM,GAC3B,IAAI,CAcN;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,EACnF,MAAM,EAAE,YAAY,GAClB,kBAAkB,CASpB;AAunBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAmI5F;AAkCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,EAAE,CA+BtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAUvF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAKxF"}

package/dist/backends/docker/index.js

@@ -47,17 +47,23 @@ export function buildDockerBackend(config) {
  *
  * The policy used to be accepted and silently ignored, which is worse than
  * not supporting it: a host that set `deny-all` believed the container had
- * no network and it had the configured one. Docker can enforce `deny-all`
- * natively (`--network none`); it cannot enforce a host allowlist without
- * a proxy this backend does not have, so those policies are REFUSED rather
- * than quietly downgraded to "allow everything".
+ * no network and it had the configured one. It cannot enforce a host
+ * allowlist without a proxy this backend does not have, so those policies
+ * are REFUSED rather than quietly downgraded to "allow everything".
+ *
+ * `deny-all` used to answer `'none'`, which reads as the strictest possible
+ * answer and produced a sandbox nobody could reach. `--network none`
+ * removes every interface, and this backend's control channel is inbound
+ * TCP to the worker — so removing the interfaces removes the way IN, not
+ * just the way out. It now keeps the configured network, and
+ * {@link assertNetworkCarriesThePolicy} is what makes that network a
+ * boundary.
  */
 export function resolveNetwork(configured, egress, hasProxy = false) {
     if (!egress)
         return configured;
     switch (egress.kind) {
         case 'deny-all':
-            return 'none';
         case 'allow-all':
             return configured;
         default:
@@ -90,6 +96,55 @@ export async function resolveAllowedHosts(egress) {
 export function needsEgressProxy(egress) {
     return egress?.kind === 'static' || egress?.kind === 'resolver';
 }
+/**
+ * Whether the daemon says a network has no route out.
+ *
+ * Takes the raw `docker network inspect --format '{{.Internal}}'` output
+ * rather than reading it, so every decision below is testable without a
+ * daemon and the daemon call stays one line. Anything other than a literal
+ * `true` counts as "not internal": an unreadable answer is not evidence of
+ * a boundary.
+ */
+export function isInternalNetwork(inspectedInternalFlag) {
+    return inspectedInternalFlag.trim() === 'true';
+}
+/**
+ * Refuse a container whose network cannot do what was asked of it.
+ *
+ * Two requirements meet on the same object here, and both were previously
+ * unstated — which is how the backend came to ship a default configuration
+ * that could not create a sandbox at all:
+ *
+ *  - **A published host port needs a route out.** Docker binds the port by
+ *    NAT to the container's address, so a container with no address gets no
+ *    binding. Measured against Docker 29.6: `--network none --publish
+ *    127.0.0.1::2024` is *accepted*, `NetworkSettings.Ports` comes back
+ *    `{"2024/tcp":[]}`, and `docker port` prints nothing. An `--internal`
+ *    network behaves the same way. The port readback then failed with
+ *    `index of untyped nil` and reported it as "the container exited
+ *    immediately" — blaming a container that was alive and well.
+ *  - **`deny-all` needs a network with no route out.** Since it no longer
+ *    answers `--network none`, the configured name is all that stands
+ *    between the policy and ordinary outbound networking, and a name says
+ *    nothing. `deny-all` pointed at the default bridge would be full egress
+ *    under a policy object claiming none — the "accepted and silently
+ *    ignored" failure the rest of this file exists to refuse.
+ *
+ * They are exact opposites, so `deny-all` over a published host port is
+ * impossible rather than merely unsupported: no arrangement of docker
+ * networking both denies all egress and lets the host reach the worker over
+ * TCP. Closing that needs the control channel moved off TCP — see #398 —
+ * and is not a flag this function could accept.
+ */
+export function assertNetworkCarriesThePolicy(network, reachability, egress, inspectedInternalFlag) {
+    const internal = isInternalNetwork(inspectedInternalFlag);
+    if (reachability === 'host-port' && (network === 'none' || internal)) {
+        throw new Error(`The docker sandbox backend cannot publish the worker's port on network '${network}': docker binds a published port to the container's address, and a container with no route out has no address to bind to, so nothing is published and the sandbox is unreachable. Either give config.network a bridge that has one, or set hostReachability: 'container-network' and reach the worker by container name. Refusing rather than starting a container nobody can reach.`);
+    }
+    if (egress?.kind === 'deny-all' && !internal) {
+        throw new Error(`The docker sandbox backend was asked for an egress policy of 'deny-all' on network '${network}', but that network is not internal, so the container can still reach the world. Create it with 'docker network create --internal ${network}' — an internal bridge denies egress in the kernel, rather than through an environment variable a workload may decline to read, while sibling containers still reach the worker by name. Refusing rather than reporting a boundary that is not there.`);
+    }
+}
 /**
  * The options the boundary is built from, as a value.
  *
@@ -122,6 +177,30 @@ export function egressProxyOptions(config, policy) {
  * `--cap-drop=ALL` is deliberately not softened by a re-add list: a
  * workload that genuinely needs a capability should say so through
  * `extraRunArgs` and be visible in review.
+ *
+ * **It carries a second, independent load, and this is the one that would
+ * survive being forgotten.** An egress policy of `deny-all` is enforced by
+ * the container's network being `--internal`, which gives it no route out.
+ * Measured against Docker 29.6: a container on such a network has only its
+ * own subnet in `ip route` and no default, and `ip route add default via
+ * <a sibling>` answers `RTNETLINK answers: Operation not permitted` —
+ * already, with docker's DEFAULT capability set, before this flag is
+ * applied. `NET_ADMIN` is what would lift that, and dropping every
+ * capability is what guarantees the workload does not have it.
+ *
+ * So the internal network removes the route and this flag removes the
+ * ability to put one back. Both are needed. Measured on a container given
+ * `--cap-add=NET_ADMIN`, adding the route and reaching a sibling attached
+ * to an external bridge produces `download timed out` rather than
+ * `Network unreachable` — the route existed, the packet left, and the
+ * dual-homed sibling forwarded it (`net.ipv4.ip_forward` is `1` inside a
+ * container). Nothing masquerades the internal subnet so no reply finds its
+ * way back and no connection establishes, **but that is not a security
+ * property**: one-way egress is sufficient for exfiltration, and what was
+ * measured is that the handshake fails, not that the packet was dropped.
+ *
+ * Recorded here because the first justification above would survive
+ * softening this flag and the second would not.
  */
 const HARDENING_ARGS = ['--cap-drop=ALL', '--security-opt=no-new-privileges'];
 /** Name the container reaches the host-side egress proxy by. */
@@ -139,9 +218,25 @@ async function spawnDockerSandbox(config, options) {
         const policy = options.egress;
         egressProxy = await new EgressProxy(egressProxyOptions(config, policy)).listen();
     }
+    const hostReachability = config.hostReachability ?? 'host-port';
     const network = resolveNetwork(config.network ?? 'none', options.egress, egressProxy !== undefined);
+    // Whether this network can carry the reachability mode and the policy is
+    // a fact about the network, so it is checked against the daemon rather
+    // than inferred from its name. Before the container starts on purpose: a
+    // refusal here is a wiring mistake and must not arrive dressed as a
+    // container that failed to come up, which is exactly how it used to
+    // arrive.
+    try {
+        assertNetworkCarriesThePolicy(network, hostReachability, options.egress, await inspectNetworkInternalFlag(docker, network));
+    }
+    catch (err) {
+        // The allowlist kinds start a proxy above, and this is outside the
+        // try/catch that owns teardown — so without this the refusal would
+        // leave a listening server on loopback stamping real credentials.
+        await egressProxy?.close().catch(() => undefined);
+        throw err;
+    }
     const runtime = config.runtime;
-    const hostReachability = config.hostReachability ?? 'host-port';
     const containerName = `namzu-sandbox-${id}`;
     // All bind sources come from the consumer-supplied layout. The
     // backend never allocates host directories and never removes them
@@ -440,10 +535,14 @@ async function execViaWorker(baseUrl, command, argv, opts) {
             if (line) {
                 try {
                     const event = JSON.parse(line);
-                    if (event.type === 'stdout_delta')
+                    if (event.type === 'stdout_delta') {
                         stdout += event.data;
-                    else if (event.type === 'stderr_delta')
+                        opts?.onOutput?.({ stream: 'stdout', data: event.data });
+                    }
+                    else if (event.type === 'stderr_delta') {
                         stderr += event.data;
+                        opts?.onOutput?.({ stream: 'stderr', data: event.data });
+                    }
                     else if (event.type === 'result') {
                         exitCode = event.exitCode;
                         timedOut = event.timedOut;
@@ -559,6 +658,23 @@ function runOnce(binary, args) {
         });
     });
 }
+/**
+ * Read a network's `Internal` flag from the daemon.
+ *
+ * A network that does not exist, or a daemon that is down, comes back as the
+ * empty string rather than throwing, so {@link assertNetworkCarriesThePolicy}
+ * refuses it for the reason the caller actually cares about — "this is not
+ * a boundary" — instead of surfacing a docker CLI error that says nothing
+ * about the egress policy that prompted the lookup.
+ */
+async function inspectNetworkInternalFlag(docker, network) {
+    try {
+        return await runOnce(docker, ['network', 'inspect', '--format', '{{.Internal}}', network]);
+    }
+    catch {
+        return '';
+    }
+}
 function runOnceQuiet(binary, args) {
     return new Promise((resolve) => {
         const child = spawn(binary, args, { stdio: 'ignore' });

package/dist/backends/docker/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAIN,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,EAQ5B,QAAQ,GACR,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAOnD,OAAO,EACN,qCAAqC,GAIrC,MAAM,gBAAgB,CAAA;AA2GvB,MAAM,qBAAqB,GAAG,QAAQ,CAAA;AACtC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmC;IACrE,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjD,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC7B,UAAkB,EAClB,MAAgC,EAChC,QAAQ,GAAG,KAAK;IAEhB,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAA;IAE9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,UAAU;YACd,OAAO,MAAM,CAAA;QACd,KAAK,WAAW;YACf,OAAO,UAAU,CAAA;QAClB;YACC,+DAA+D;YAC/D,iEAAiE;YACjE,iEAAiE;YACjE,8DAA8D;YAC9D,yCAAyC;YACzC,IAAI,QAAQ;gBAAE,OAAO,UAAU,CAAA;YAC/B,MAAM,IAAI,KAAK,CACd,uEAAuE,MAAM,CAAC,IAAI,kMAAkM,CACpR,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,YAAY,CAAA;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,IAAI,KAAK,CACd,0BAA0B,MAAM,CAAC,IAAI,gFAAgF,CACrH,CAAA;AACF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,EAAE,IAAI,KAAK,UAAU,CAAA;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAmF,EACnF,MAAoB;IAEpB,OAAO;QACN,qEAAqE;QACrE,qEAAqE;QACrE,qBAAqB;QACrB,YAAY,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE;QAC7C,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,cAAc,GAAsB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAA;AAEhG,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,cAAc,CAAA;AAEvC,KAAK,UAAU,kBAAkB,CAChC,MAAmC,EACnC,OAA8B;IAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAE3D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,WAA2C,CAAA;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,WAAW,GAAG,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACjF,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAC7B,MAAM,CAAC,OAAO,IAAI,MAAM,EACxB,OAAO,CAAC,MAAM,EACd,WAAW,KAAK,SAAS,CACzB,CAAA;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAA;IAC/D,MAAM,aAAa,GAAG,iBAAiB,EAAE,EAAE,CAAA;IAE3C,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,4DAA4D;IAC5D,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,UAAU,gBAAgB;QAC9B,IAAI,gBAAgB,EAAE,CAAC;YACtB,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,oEAAoE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACjD,WAAW,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,IAAI,QAAgB,CAAA;IACpB,IAAI,OAAe,CAAA;IACnB,+DAA+D;IAC/D,+DAA+D;IAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAA;IAEpD,IAAI,CAAC;QACJ,6DAA6D;QAC7D,6DAA6D;QAC7D,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,0DAA0D;QAC1D,MAAM,IAAI,GAAa;YACtB,KAAK;YACL,UAAU;YACV,MAAM;YACN,QAAQ;YACR,aAAa;YACb,WAAW;YACX,OAAO;YACP,GAAG,cAAc;YACjB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAA;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,wBAAwB;QACxB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CACd,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qCAAqC,CAC5E,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;YACxC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAA;QACnD,0DAA0D;QAC1D,6DAA6D;QAC7D,0DAA0D;QAC1D,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,wDAAwD;QACxD,IAAI,WAAW,EAAE,CAAC;YACjB,iEAAiE;YACjE,kEAAkE;YAClE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,gBAAgB,eAAe,CAAC,CAAA;YAC3D,MAAM,QAAQ,GAAG,UAAU,gBAAgB,IAAI,WAAW,CAAC,IAAI,EAAE,CAAA;YACjE,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAA;YACzC,CAAC;YACD,6DAA6D;YAC7D,UAAU;YACV,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAA;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAA;QACnD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,OAAO,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,4BAA4B,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,yBAAyB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAE5F,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,+DAA+D;QAC/D,oDAAoD;QACpD,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,4BAA4B,EAAE,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAChC,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACxD,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAEvB,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3B,gBAAgB,GAAG,IAAI,CAAA;QAEvB,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YACtD,OAAO,GAAG,oBAAoB,QAAQ,EAAE,CAAA;YACxC,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QACF,CAAC;aAAM,CAAC;YACP,0DAA0D;YAC1D,2DAA2D;YAC3D,yCAAyC;YACzC,OAAO,GAAG,UAAU,aAAa,IAAI,4BAA4B,EAAE,CAAA;YACnE,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,gBAAgB,EAAE,CAAA;QACxB,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,MAAM,GAAkB,OAAO,CAAA;IAEnC,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,OAAO,MAAM,CAAA;QACd,CAAC;QACD,OAAO;QACP,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,MAAM,GAAG,MAAM,CAAA;YACf,IAAI,CAAC;gBACJ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACzD,CAAC;oBAAS,CAAC;gBACV,MAAM,GAAG,OAAO,CAAA;YACjB,CAAC;QACF,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC5B,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,qCAAqC;YACrC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,gOAAgO,CAChO,EACD,+HAA+H,CAC/H,CAAA;YACF,CAAC;YACD,WAAW,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC7D,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,GAAa,CAAA;YACjB,IAAI,CAAC;gBACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAC1C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC1D,MAAM,QAAQ,GACb,KAAK,YAAY,KAAK;oBACrB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,GAAI,KAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,KAAmC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzH,CAAC,CAAC,KAAK;wBACN,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACf,CAAC,CAAC,SAAS,CAAA;gBACd,MAAM,IAAI,KAAK,CACd,mDAAmD,OAAO,UAAU,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,EACrJ,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAA;YACF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC7E,CAAC;QACF,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAY;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;aAClD,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;YACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;YACvD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,CAAC,OAAO;YACZ,MAAM,GAAG,WAAW,CAAA;YACpB,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;YACvD,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,WAAW,EAAE,KAAK,EAAE,CAAA;YAC1B,yDAAyD;YACzD,qDAAqD;YACrD,uDAAuD;YACvD,wBAAwB;QACzB,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,aAAqB;IAClE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;QAC3C,SAAS;QACT,UAAU;QACV,2CAA2C,4BAA4B,sBAAsB;QAC7F,aAAa;KACb,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC1D,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,2DAA2D,aAAa,MAAM,aAAa,GAAG,CAC9F,EACD,kKAAkK,CAClK,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,IAA0B,EAC1B,IAAoC;IAEpC,0EAA0E;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO;gBACP,IAAI,EAAE,IAAI,IAAI,EAAE;gBAChB,GAAG,EAAE,IAAI,EAAE,GAAG;gBACd,GAAG,EAAE,IAAI,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI,EAAE,OAAO;aACxB,CAAC;SACF,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,6DAA6D;QAC7D,8DAA8D;QAC9D,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1D,MAAM,QAAQ,GACb,KAAK,YAAY,KAAK;YACrB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,GAAI,KAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,KAAmC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACzH,CAAC,CAAC,KAAK;gBACN,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACf,CAAC,CAAC,SAAS,CAAA;QACd,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,gDAAgD,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,EACpI,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,EACD,+MAA+M,CAC/M,CAAA;IACF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,MAA0B,CAAA;IAE9B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,SAAS,CAAC;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CASM,CAAA;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;wBACzB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;oBAC1B,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBAC7B,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;wBAChC,0CAA0C;oBAC3C,CAAC;yBAAM,CAAC;wBACP,MAAM,GAAG,CAAA;oBACV,CAAC;gBACF,CAAC;YACF,CAAC;YACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;IAED,OAAO;QACN,QAAQ;QACR,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,+DAA+D;QAC/D,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IAClD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IAClD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,EAAe,CAAA;AACnE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,IAAI,SAAkB,CAAA;IACtB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,CAAC,CAAA;YAC7C,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAM;YAClB,SAAS,GAAG,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,SAAS,GAAG,GAAG,CAAA;QAChB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,CAAC;IACD,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,oDAAoD,SAAS,OAC5D,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAClE,EAAE,CACF,EACD,yNAAyN,CACzN,CAAA;AACF,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,IAAc;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;;gBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACvF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAc;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,6DAA6D;IAC7D,8DAA8D;IAC9D,6DAA6D;IAC7D,gEAAgE;IAChE,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACX,oHAAoH,CACpH,CAAA;IACF,CAAC;IAED,8DAA8D;IAC9D,8DAA8D;IAC9D,+DAA+D;IAC/D,kBAAkB;IAClB,EAAE;IACF,+DAA+D;IAC/D,wDAAwD;IACxD,4DAA4D;IAC5D,qDAAqD;IACrD,+CAA+C;IAC/C,+DAA+D;IAC/D,8DAA8D;IAC9D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACX,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,6CAA6C,CACjF,CAAA;YACF,CAAC;iBAAM,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACX,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,2CAA2C,CAC/E,CAAA;YACF,CAAC;iBAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC/D,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACvB,CAAC;QACF,CAAC;IACF,CAAC;IAED,0DAA0D;IAC1D,+DAA+D;IAC/D,6DAA6D;IAC7D,iEAAiE;IACjE,iEAAiE;IACjE,SAAS;IACT,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW;QAC7C,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACjC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,iCAAiC;SACpF;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW;QAC7C,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACjC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,gCAAgC;SACnF;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,6BAA6B,IAAI,CAAC,CAAC,EAAE,EAAE;KAC5E,CAAC,CAAC,CAAA;IAEH,8DAA8D;IAC9D,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACrD,SAAS,KAAK,CAAC,KAAa,EAAE,CAAqB;QAClD,IAAI,CAAC,CAAC;YAAE,OAAM;QACd,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CACX,2BAA2B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,KAAK,QAAQ,KAAK,EAAE,CACrF,CAAA;QACF,CAAC;aAAM,CAAC;YACP,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IACD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAA;IACxD,KAAK,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAA;IACxD,IAAI,cAAc,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACpC,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;QAChD,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,qCAAqC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IAED,kEAAkE;IAClE,iDAAiD;IACjD,MAAM,QAAQ,GAAmC;QAChD,2EAA2E;QAC3E,OAAO,EAAE,eAAgB;QACzB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAA;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,SAAS,cAAc,CACtB,MAA6C,EAC7C,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACd,mDAAmD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8GAA8G,CACzM,CAAA;IACF,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC3E,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,2DAA2D;QAC3D,+DAA+D;QAC/D,6DAA6D;QAC7D,kCAAkC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsC;IAC9E,MAAM,KAAK,GAAG;QACb,MAAM,CAAC,OAAO,CAAC,aAAa;QAC5B,MAAM,CAAC,OAAO,EAAE,aAAa;QAC7B,MAAM,CAAC,OAAO,EAAE,aAAa;QAC7B,MAAM,CAAC,WAAW,EAAE,aAAa;QACjC,MAAM,CAAC,WAAW,EAAE,aAAa;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;KAC7D,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAsC;IAC/E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,MAAM,CACjF,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAE1C,OAAO,EAIN,4BAA4B,EAC5B,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,EAQ5B,QAAQ,GACR,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAOnD,OAAO,EACN,qCAAqC,GAIrC,MAAM,gBAAgB,CAAA;AA2GvB,MAAM,qBAAqB,GAAG,QAAQ,CAAA;AACtC,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AAEzC;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAmC;IACrE,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,QAAQ;QACd,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QACjD,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAC7B,UAAkB,EAClB,MAAgC,EAChC,QAAQ,GAAG,KAAK;IAEhB,IAAI,CAAC,MAAM;QAAE,OAAO,UAAU,CAAA;IAE9B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC;QAChB,KAAK,WAAW;YACf,OAAO,UAAU,CAAA;QAClB;YACC,+DAA+D;YAC/D,iEAAiE;YACjE,iEAAiE;YACjE,8DAA8D;YAC9D,yCAAyC;YACzC,IAAI,QAAQ;gBAAE,OAAO,UAAU,CAAA;YAC/B,MAAM,IAAI,KAAK,CACd,uEAAuE,MAAM,CAAC,IAAI,kMAAkM,CACpR,CAAA;IACH,CAAC;AACF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,MAAoB;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,YAAY,CAAA;IACxD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,MAAM,MAAM,CAAC,OAAO,EAAE,CAAA;IAC7D,MAAM,IAAI,KAAK,CACd,0BAA0B,MAAM,CAAC,IAAI,gFAAgF,CACrH,CAAA;AACF,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAChE,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,MAAM,EAAE,IAAI,KAAK,UAAU,CAAA;AAChE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,qBAA6B;IAC9D,OAAO,qBAAqB,CAAC,IAAI,EAAE,KAAK,MAAM,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,6BAA6B,CAC5C,OAAe,EACf,YAA+C,EAC/C,MAAgC,EAChC,qBAA6B;IAE7B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,CAAA;IAEzD,IAAI,YAAY,KAAK,WAAW,IAAI,CAAC,OAAO,KAAK,MAAM,IAAI,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACd,2EAA2E,OAAO,sXAAsX,CACxc,CAAA;IACF,CAAC;IAED,IAAI,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACd,uFAAuF,OAAO,qIAAqI,OAAO,uPAAuP,CACje,CAAA;IACF,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CACjC,MAAmF,EACnF,MAAoB;IAEpB,OAAO;QACN,qEAAqE;QACrE,qEAAqE;QACrE,qBAAqB;QACrB,YAAY,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC/C,WAAW,EAAE,MAAM,CAAC,mBAAmB,IAAI,EAAE;QAC7C,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,cAAc,GAAsB,CAAC,gBAAgB,EAAE,kCAAkC,CAAC,CAAA;AAEhG,gEAAgE;AAChE,MAAM,gBAAgB,GAAG,cAAc,CAAA;AAEvC,KAAK,UAAU,kBAAkB,CAChC,MAAmC,EACnC,OAA8B;IAE9B,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAA;IACpC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,IAAI,qBAAqB,CAAA;IAE3D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,mDAAmD;IACnD,IAAI,WAA2C,CAAA;IAC/C,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC7B,WAAW,GAAG,MAAM,IAAI,WAAW,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAA;IACjF,CAAC;IAED,MAAM,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,WAAW,CAAA;IAC/D,MAAM,OAAO,GAAG,cAAc,CAC7B,MAAM,CAAC,OAAO,IAAI,MAAM,EACxB,OAAO,CAAC,MAAM,EACd,WAAW,KAAK,SAAS,CACzB,CAAA;IACD,yEAAyE;IACzE,uEAAuE;IACvE,yEAAyE;IACzE,oEAAoE;IACpE,oEAAoE;IACpE,UAAU;IACV,IAAI,CAAC;QACJ,6BAA6B,CAC5B,OAAO,EACP,gBAAgB,EAChB,OAAO,CAAC,MAAM,EACd,MAAM,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CACjD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACjD,MAAM,GAAG,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,MAAM,aAAa,GAAG,iBAAiB,EAAE,EAAE,CAAA;IAE3C,+DAA+D;IAC/D,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,+DAA+D;IAC/D,4DAA4D;IAC5D,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,UAAU,gBAAgB;QAC9B,IAAI,gBAAgB,EAAE,CAAC;YACtB,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;QACxD,CAAC;QACD,oEAAoE;QACpE,+DAA+D;QAC/D,qEAAqE;QACrE,kEAAkE;QAClE,qEAAqE;QACrE,gEAAgE;QAChE,oEAAoE;QACpE,qEAAqE;QACrE,sDAAsD;QACtD,MAAM,WAAW,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACjD,WAAW,GAAG,SAAS,CAAA;IACxB,CAAC;IAED,IAAI,QAAgB,CAAA;IACpB,IAAI,OAAe,CAAA;IACnB,+DAA+D;IAC/D,+DAA+D;IAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,aAAa,CAAA;IAEpD,IAAI,CAAC;QACJ,6DAA6D;QAC7D,6DAA6D;QAC7D,6DAA6D;QAC7D,4DAA4D;QAC5D,8DAA8D;QAC9D,0DAA0D;QAC1D,MAAM,IAAI,GAAa;YACtB,KAAK;YACL,UAAU;YACV,MAAM;YACN,QAAQ;YACR,aAAa;YACb,WAAW;YACX,OAAO;YACP,GAAG,cAAc;YACjB,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAA;QAED,8DAA8D;QAC9D,0DAA0D;QAC1D,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,wBAAwB;QACxB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC1D,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC/B,MAAM,IAAI,KAAK,CACd,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,qCAAqC,CAC5E,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;YACxC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC,CAAA;QACnD,0DAA0D;QAC1D,6DAA6D;QAC7D,0DAA0D;QAC1D,2DAA2D;QAC3D,wDAAwD;QACxD,wDAAwD;QACxD,wDAAwD;QACxD,IAAI,WAAW,EAAE,CAAC;YACjB,iEAAiE;YACjE,kEAAkE;YAClE,iEAAiE;YACjE,2DAA2D;YAC3D,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,gBAAgB,eAAe,CAAC,CAAA;YAC3D,MAAM,QAAQ,GAAG,UAAU,gBAAgB,IAAI,WAAW,CAAC,IAAI,EAAE,CAAA;YACjE,gEAAgE;YAChE,gEAAgE;YAChE,+DAA+D;YAC/D,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC9E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC,CAAA;YACzC,CAAC;YACD,6DAA6D;YAC7D,UAAU;YACV,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAA;YAClD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAA;QACnD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,OAAO,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,4BAA4B,wBAAwB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAC1F,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,yBAAyB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAE5F,+DAA+D;QAC/D,8DAA8D;QAC9D,+DAA+D;QAC/D,+DAA+D;QAC/D,oDAAoD;QACpD,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,4BAA4B,EAAE,CAAC,CAAA;QACrE,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QAChC,CAAC;QAED,IAAI,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,GAAG,CAAC,CAAA;QACnD,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;YACtD,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAA;QACxD,CAAC;QAED,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QACtC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAEvB,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAC3B,gBAAgB,GAAG,IAAI,CAAA;QAEvB,IAAI,gBAAgB,KAAK,WAAW,EAAE,CAAC;YACtC,QAAQ,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;YACtD,OAAO,GAAG,oBAAoB,QAAQ,EAAE,CAAA;YACxC,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QACF,CAAC;aAAM,CAAC;YACP,0DAA0D;YAC1D,2DAA2D;YAC3D,yCAAyC;YACzC,OAAO,GAAG,UAAU,aAAa,IAAI,4BAA4B,EAAE,CAAA;YACnE,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QACF,CAAC;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,gBAAgB,EAAE,CAAA;QACxB,MAAM,GAAG,CAAA;IACV,CAAC;IAED,IAAI,MAAM,GAAkB,OAAO,CAAA;IAEnC,OAAO;QACN,EAAE;QACF,IAAI,MAAM;YACT,OAAO,MAAM,CAAA;QACd,CAAC;QACD,OAAO;QACP,WAAW,EAAE,iBAAiB,EAAE;QAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;YAEzB,MAAM,GAAG,MAAM,CAAA;YACf,IAAI,CAAC;gBACJ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;YACzD,CAAC;oBAAS,CAAC;gBACV,MAAM,GAAG,OAAO,CAAA;YACjB,CAAC;QACF,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAM;YAC5B,6DAA6D;YAC7D,+DAA+D;YAC/D,gEAAgE;YAChE,8DAA8D;YAC9D,2DAA2D;YAC3D,qCAAqC;YACrC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClB,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,gOAAgO,CAChO,EACD,+HAA+H,CAC/H,CAAA;YACF,CAAC;YACD,WAAW,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;QAC7D,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;YACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC7E,IAAI,GAAa,CAAA;YACjB,IAAI,CAAC;gBACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAC1C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;YACH,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;gBAC1D,MAAM,QAAQ,GACb,KAAK,YAAY,KAAK;oBACrB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,GAAI,KAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,KAAmC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzH,CAAC,CAAC,KAAK;wBACN,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBACf,CAAC,CAAC,SAAS,CAAA;gBACd,MAAM,IAAI,KAAK,CACd,mDAAmD,OAAO,UAAU,IAAI,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,EACrJ,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,CAAA;YACF,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC7E,CAAC;QACF,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAY;YAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;aAClD,CAAC,CAAA;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC5E,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;YACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;YACvD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,QAAgB;YAC/B,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QACnD,CAAC;QAED,KAAK,CAAC,OAAO;YACZ,MAAM,GAAG,WAAW,CAAA;YACpB,MAAM,YAAY,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAA;YACvD,iEAAiE;YACjE,8DAA8D;YAC9D,gEAAgE;YAChE,0DAA0D;YAC1D,MAAM,WAAW,EAAE,KAAK,EAAE,CAAA;YAC1B,yDAAyD;YACzD,qDAAqD;YACrD,uDAAuD;YACvD,wBAAwB;QACzB,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,MAAc,EAAE,aAAqB;IAClE,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE;QAC3C,SAAS;QACT,UAAU;QACV,2CAA2C,4BAA4B,sBAAsB;QAC7F,aAAa;KACb,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;QAC1D,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,2DAA2D,aAAa,MAAM,aAAa,GAAG,CAC9F,EACD,kKAAkK,CAClK,CAAA;IACF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,IAA0B,EAC1B,IAAoC;IAEpC,0EAA0E;IAC1E,yEAAyE;IACzE,kDAAkD;IAClD,0EAA0E;IAC1E,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACJ,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACvC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACpB,OAAO;gBACP,IAAI,EAAE,IAAI,IAAI,EAAE;gBAChB,GAAG,EAAE,IAAI,EAAE,GAAG;gBACd,GAAG,EAAE,IAAI,EAAE,GAAG;gBACd,SAAS,EAAE,IAAI,EAAE,OAAO;aACxB,CAAC;SACF,CAAC,CAAA;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,6DAA6D;QAC7D,8DAA8D;QAC9D,iEAAiE;QACjE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAC1D,MAAM,QAAQ,GACb,KAAK,YAAY,KAAK;YACrB,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,GAAI,KAAmC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAM,KAAmC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACzH,CAAC,CAAC,KAAK;gBACN,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBACf,CAAC,CAAC,SAAS,CAAA;QACd,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,gDAAgD,OAAO,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,QAAQ,EAAE,EACpI,EAAE,KAAK,EAAE,GAAG,EAAE,CACd,EACD,+MAA+M,CAC/M,CAAA;IACF,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,IAAI,MAA0B,CAAA;IAE9B,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,SAAS,CAAC;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CASM,CAAA;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;wBACpB,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;oBACzD,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;wBAC1C,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;wBACpB,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;oBACzD,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBACpC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;wBACzB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;oBAC1B,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBAC7B,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;wBAChC,0CAA0C;oBAC3C,CAAC;yBAAM,CAAC;wBACP,MAAM,GAAG,CAAA;oBACV,CAAC;gBACF,CAAC;YACF,CAAC;YACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;IAED,OAAO;QACN,QAAQ;QACR,MAAM;QACN,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC9B,CAAA;AACF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,+DAA+D;QAC/D,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;IACjC,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IAClD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAA;IAClD,OAAO,OAAO,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB;IACzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACtD,OAAO,WAAW,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,MAAM,EAAe,CAAA;AACnE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAiB,EACjB,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,IAAI,SAAkB,CAAA;IACtB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,CAAC,CAAA;YAC7C,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAM;YAClB,SAAS,GAAG,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,SAAS,GAAG,GAAG,CAAA;QAChB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;IAC5D,CAAC;IACD,wEAAwE;IACxE,uEAAuE;IACvE,wEAAwE;IACxE,gCAAgC;IAChC,MAAM,QAAQ,CACb,IAAI,KAAK,CACR,oDAAoD,SAAS,OAC5D,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAClE,EAAE,CACF,EACD,yNAAyN,CACzN,CAAA;AACF,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,IAAc;IAC9C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAA;QACxE,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,IAAI,MAAM,GAAG,EAAE,CAAA;QACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QACjC,CAAC,CAAC,CAAA;QACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACzB,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;;gBACjC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACvF,CAAC,CAAC,CAAA;IACH,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CAAC,MAAc,EAAE,OAAe;IACxE,IAAI,CAAC;QACJ,OAAO,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAA;IAC3F,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAA;IACV,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,IAAc;IACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACtD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;QAClC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,cAAc,GAAG,mBAAmB,CAAA;AAE1C;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,MAA8B;IAC3D,MAAM,OAAO,GAAa,EAAE,CAAA;IAE5B,6DAA6D;IAC7D,8DAA8D;IAC9D,6DAA6D;IAC7D,gEAAgE;IAChE,kDAAkD;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,OAAO,CAAC,IAAI,CACX,oHAAoH,CACpH,CAAA;IACF,CAAC;IAED,8DAA8D;IAC9D,8DAA8D;IAC9D,+DAA+D;IAC/D,kBAAkB;IAClB,EAAE;IACF,+DAA+D;IAC/D,wDAAwD;IACxD,4DAA4D;IAC5D,qDAAqD;IACrD,+CAA+C;IAC/C,+DAA+D;IAC/D,8DAA8D;IAC9D,wCAAwC;IACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACX,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,6CAA6C,CACjF,CAAA;YACF,CAAC;iBAAM,IAAI,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,OAAO,CAAC,IAAI,CACX,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,2CAA2C,CAC/E,CAAA;YACF,CAAC;iBAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,OAAO,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;YAC/D,CAAC;iBAAM,CAAC;gBACP,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACvB,CAAC;QACF,CAAC;IACF,CAAC;IAED,0DAA0D;IAC1D,+DAA+D;IAC/D,6DAA6D;IAC7D,iEAAiE;IACjE,iEAAiE;IACjE,SAAS;IACT,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO;QACrC,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC7B,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,IAAI,4BAA4B;SAC3E;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW;QAC7C,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACjC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,iCAAiC;SACpF;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,mBAAmB,GAAG,MAAM,CAAC,WAAW;QAC7C,CAAC,CAAC;YACA,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACjC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,IAAI,gCAAgC;SACnF;QACF,CAAC,CAAC,SAAS,CAAA;IACZ,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,GAAG,6BAA6B,IAAI,CAAC,CAAC,EAAE,EAAE;KAC5E,CAAC,CAAC,CAAA;IAEH,8DAA8D;IAC9D,gEAAgE;IAChE,gEAAgE;IAChE,+DAA+D;IAC/D,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAkB,CAAA;IACrD,SAAS,KAAK,CAAC,KAAa,EAAE,CAAqB;QAClD,IAAI,CAAC,CAAC;YAAE,OAAM;QACd,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CACX,2BAA2B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,KAAK,QAAQ,KAAK,EAAE,CACrF,CAAA;QACF,CAAC;aAAM,CAAC;YACP,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;IACF,CAAC;IACD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAChD,KAAK,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAA;IACxD,KAAK,CAAC,aAAa,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAA;IACxD,IAAI,cAAc,EAAE,CAAC;QACpB,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACpC,KAAK,CAAC,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,aAAa,CAAC,CAAA;QAChD,CAAC;IACF,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,qCAAqC,CAAC,OAAO,CAAC,CAAA;IACzD,CAAC;IAED,kEAAkE;IAClE,iDAAiD;IACjD,MAAM,QAAQ,GAAmC;QAChD,2EAA2E;QAC3E,OAAO,EAAE,eAAgB;QACzB,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClF,CAAA;IACD,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,SAAS,cAAc,CACtB,MAA6C,EAC7C,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACd,mDAAmD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8GAA8G,CACzM,CAAA;IACF,CAAC;IACD,OAAO,MAAM,CAAA;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAsC;IAC3E,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;IAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAC/E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,2DAA2D;QAC3D,+DAA+D;QAC/D,6DAA6D;QAC7D,kCAAkC;QAClC,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;QAChE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,KAAK,CAAC,CAAA;IAChF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,CAAC,CAAA;IACxF,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YAClE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,KAAK,CAAC,aAAa,KAAK,CAAC,CAAA;QACxE,CAAC;IACF,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;QAC5E,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,WAAW,CAAC,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,KAAK,CAAC,CAAA;IACxF,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAsC;IAC9E,MAAM,KAAK,GAAG;QACb,MAAM,CAAC,OAAO,CAAC,aAAa;QAC5B,MAAM,CAAC,OAAO,EAAE,aAAa;QAC7B,MAAM,CAAC,OAAO,EAAE,aAAa;QAC7B,MAAM,CAAC,WAAW,EAAE,aAAa;QACjC,MAAM,CAAC,WAAW,EAAE,aAAa;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;KAC7D,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,MAAsC;IAC/E,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,MAAM,CACjF,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CACvC,CAAA;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -148,11 +148,19 @@ export interface ContainerBackendConfig {
     readonly hostReachability?: 'host-port' | 'container-network';
     /**
      * Docker network the spawned container attaches to. Default
-     * `'none'` (no inbound or outbound network). Set to a docker
-     * bridge name when `hostReachability='container-network'` so the
-     * SDK consumer (also on that bridge) can reach the worker by
-     * container DNS name. Egress from the sandbox is governed
-     * separately by `EgressPolicy`.
+     * `'none'` (no inbound or outbound network).
+     *
+     * **The default does not work with the default `hostReachability`,
+     * and `create()` refuses rather than starting a container nobody can
+     * reach.** Docker binds a published port to the container's address,
+     * so a container with no route out has no address to bind to and
+     * nothing is published. Name a bridge here to reach the worker by host
+     * port, or set `hostReachability: 'container-network'` and reach it by
+     * container name — that mode works on an `--internal` network, which
+     * is also the only way to get `deny-all` enforced.
+     *
+     * Egress from the sandbox is governed separately by `EgressPolicy`,
+     * which is checked against this network rather than trusted.
      */
     readonly network?: 'none' | 'bridge' | string;
     /**

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AASnB,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAM5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,CAAA;AAEvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CA+BpF;AAyHD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,KAAK,EACX,sBAAsB,EACtB,OAAO,EAEP,eAAe,EACf,MAAM,YAAY,CAAA;AASnB,YAAY,EACX,sBAAsB,EACtB,2BAA2B,EAC3B,2BAA2B,EAC3B,0BAA0B,EAC1B,8BAA8B,GAC9B,MAAM,YAAY,CAAA;AAOnB,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAMnB,YAAY,EACX,gCAAgC,EAChC,yBAAyB,GACzB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACN,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAM5C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;AAEjD;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAC7B,sBAAsB,GACtB,2BAA2B,GAC3B,oBAAoB,CAAA;AAEvB;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,oBAAoB,GAAG;IAClC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAA;IAC/B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAA;IACzC,4DAA4D;IAC5D,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;IACD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAA;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;QAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAA;QAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAC5B,CAAA;CACD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAC1B,YAAY,EACX,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,mBAAmB,CAAA;AAE1B,MAAM,MAAM,YAAY,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GACrE;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAAE,CAAA;AAEpF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IAErB,MAAM,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACxD;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAA;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAMD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,qBAAqB,GAC9B,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,sBAAsB,CAAA;IACxC,QAAQ,CAAC,MAAM,EAAE,sBAAsB,CAAA;CACtC,CAAC,GACF,CAAC,yBAAyB,GAAG;IAC7B,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CACrC,CAAC,CAAA;AAEL,UAAU,yBAAyB;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,YAAY,CAAA;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;IACtC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,qBAAqB,GAAG,eAAe,CA+BpF;AAyHD;;;;;;;;GAQG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;aAG/B,OAAO,EAAE,MAAM;IAF3C,SAAkB,IAAI,uCAAsC;gBAEhC,OAAO,EAAE,MAAM;CAK3C;AAED;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qCAAsC,SAAQ,KAAK;aAI9C,OAAO,EAAE,SAAS,MAAM,EAAE;IAH3C,SAAkB,IAAI,2CAA0C;gBAG/C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1C,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;IAQ9B,MAAM,IAAI;QACT,IAAI,EAAE,MAAM,CAAA;QACZ,OAAO,EAAE,MAAM,CAAA;QACf,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;QAC1B,KAAK,CAAC,EAAE,OAAO,CAAA;KACf;CAQD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAA;CACvC;AA4BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,sBAAsB,CAE1E"}

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAazE,qEAAqE;AACrE,2DAA2D;AAC3D,iEAAiE;AACjE,6DAA6D;AAC7D,oEAAoE;AACpE,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAUnB,OAAO,EAGN,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AA6Q5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAmH1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,mBAAmB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;IACjE,OAAO;QACN,EAAE;QACF,IAAI;QACJ,WAAW,EAAE,OAAO;QACpB,KAAK,CAAC,MAAM,CAAC,OAA6B;YACzC,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;gBAC3B,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,YAAY;gBAC3D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAClC,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;wBACtC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;oBAC1C,CAAC,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;oBACxC,CAAC,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,mBAAmB,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChF,0DAA0D;QAC1D,yDAAyD;QACzD,aAAa;QACb,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,gEAAgE;QAChE,6DAA6D;QAC7D,mDAAmD;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,IACC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC3B,OAA2C,CAAC,OAAO,KAAK,kBAAkB,EAC1E,CAAC;QACF,MAAM,UAAU,GAAG,OAAiD,CAAA;QACpE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,0BAA0B,CAAC;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;YACvD,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;YAC3E,GAAG,CAAC,UAAU,CAAC,6BAA6B,KAAK,SAAS;gBACzD,CAAC,CAAC,EAAE,6BAA6B,EAAE,UAAU,CAAC,6BAA6B,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,6DAA6D;IAC7D,IACC,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,OAAO,CAAC,OAAO,KAAK,aAAa;QACjC,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;QACF,OAAO,uBAAuB,CAAC;YAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,MAAM,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,aAAa,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAA;AACjD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAG/B;IAFV,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAA4B,OAAe;QAC1C,KAAK,CACJ,oBAAoB,OAAO,2FAA2F,CACtH,CAAA;QAH0B,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAI9C;IAHC,IAAI,GAAG,uCAAuC,CAAA;IAEhE,YACiB,OAA0B,EAC1C,OAA6B;QAE7B,KAAK,CACJ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvD,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAA;QANe,YAAO,GAAP,OAAO,CAAmB;IAO3C,CAAC;IAED,MAAM;QAML,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAA;IACF,CAAC;CACD;AAsDD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACpD,CAAC;IACD,6DAA6D;IAC7D,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAY;IACjD,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAqB;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,8DAA8D;IAC9D,iDAAiD;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;YAC9E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEb,MAAM,GAAG,GAML;QACH,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;KACpB,CAAA;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;IAClD,IAAI,GAAG,YAAY,qCAAqC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;IAC1B,CAAC;IACD,gEAAgE;IAChE,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACF,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AASH,OAAO,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAazE,qEAAqE;AACrE,2DAA2D;AAC3D,iEAAiE;AACjE,6DAA6D;AAC7D,oEAAoE;AACpE,OAAO,EACN,4BAA4B,EAC5B,6BAA6B,EAC7B,iCAAiC,EACjC,gCAAgC,EAChC,4BAA4B,GAC5B,MAAM,YAAY,CAAA;AAUnB,OAAO,EAGN,mBAAmB,GACnB,MAAM,qCAAqC,CAAA;AAqR5C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EACN,WAAW,EACX,aAAa,EACb,cAAc,GACd,MAAM,mBAAmB,CAAA;AAmH1B;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IAClE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;IACnC,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;IAClD,MAAM,IAAI,GAAG,mBAAmB,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAA;IACjE,OAAO;QACN,EAAE;QACF,IAAI;QACJ,WAAW,EAAE,OAAO;QACpB,KAAK,CAAC,MAAM,CAAC,OAA6B;YACzC,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC;gBAC3B,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,IAAI,YAAY;gBAC3D,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS;oBACnC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oBAClC,CAAC,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;wBACtC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,EAAE;wBACxC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;oBAC1C,CAAC,CAAC,MAAM,CAAC,oBAAoB,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,oBAAoB,EAAE;wBAChD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,YAAY,KAAK,SAAS;oBACtC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;oBACxC,CAAC,CAAC,MAAM,CAAC,mBAAmB,KAAK,SAAS;wBACzC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,mBAAmB,EAAE;wBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC,CAAA;QACH,CAAC;KACD,CAAA;AACF,CAAC;AAED,SAAS,WAAW,CAAC,MAA6B;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAA;IAC9B,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChF,0DAA0D;QAC1D,yDAAyD;QACzD,aAAa;QACb,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,gEAAgE;QAChE,6DAA6D;QAC7D,mDAAmD;QACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,IACC,OAAO,CAAC,IAAI,KAAK,WAAW;QAC3B,OAA2C,CAAC,OAAO,KAAK,kBAAkB,EAC1E,CAAC;QACF,MAAM,UAAU,GAAG,OAAiD,CAAA;QACpE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,0BAA0B,CAAC;YACjC,cAAc,EAAE,UAAU,CAAC,cAAc;YACzC,aAAa,EAAE,UAAU,CAAC,aAAa;YACvC,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,qBAAqB,EAAE,UAAU,CAAC,qBAAqB;YACvD,+BAA+B,EAAE,UAAU,CAAC,+BAA+B;YAC3E,GAAG,CAAC,UAAU,CAAC,6BAA6B,KAAK,SAAS;gBACzD,CAAC,CAAC,EAAE,6BAA6B,EAAE,UAAU,CAAC,6BAA6B,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,QAAQ;YAChB,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,GAAG,CAAC,UAAU,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,cAAc,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,cAAc,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,GAAG,CAAC,UAAU,CAAC,aAAa,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE;gBAC7C,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,UAAU,CAAC,mBAAmB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE,mBAAmB,EAAE,UAAU,CAAC,mBAAmB,EAAE;gBACzD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjE,MAAM,MAAM,GAAI,MAA6E;aAC3F,MAAM,CAAA;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,kBAAkB,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,OAAO;YAChB,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC,CAAA;IACH,CAAC;IACD,8DAA8D;IAC9D,mEAAmE;IACnE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,6DAA6D;IAC7D,IACC,OAAO,CAAC,IAAI,KAAK,SAAS;QAC1B,OAAO,CAAC,OAAO,KAAK,aAAa;QACjC,OAAO,CAAC,oBAAoB,KAAK,SAAS;QAC1C,OAAO,CAAC,QAAQ,KAAK,SAAS,EAC7B,CAAC;QACF,OAAO,uBAAuB,CAAC;YAC9B,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;YAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxF,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE;gBACtD,CAAC,CAAC,EAAE,CAAC;YACN,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,OAAO,CAAC,gBAAgB,KAAK,SAAS;gBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACN,CAAC,CAAA;IACH,CAAC;IACD,MAAM,IAAI,iCAAiC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAA;AACtE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAA4B;IACpD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,WAAW,MAAM,CAAC,OAAO,EAAE,CAAA;IACjE,OAAO,aAAa,MAAM,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAA;AACjD,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAG/B;IAFV,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAA4B,OAAe;QAC1C,KAAK,CACJ,oBAAoB,OAAO,2FAA2F,CACtH,CAAA;QAH0B,YAAO,GAAP,OAAO,CAAQ;IAI3C,CAAC;CACD;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,qCAAsC,SAAQ,KAAK;IAI9C;IAHC,IAAI,GAAG,uCAAuC,CAAA;IAEhE,YACiB,OAA0B,EAC1C,OAA6B;QAE7B,KAAK,CACJ,mCAAmC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACvD,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CACnE,CAAA;QANe,YAAO,GAAP,OAAO,CAAmB;IAO3C,CAAC;IAED,MAAM;QAML,OAAO;YACN,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,CAAA;IACF,CAAC;CACD;AAsDD;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,KAAc;IAC7C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;IAChE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAA;IACnF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAC1E,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;IACpD,CAAC;IACD,6DAA6D;IAC7D,gEAAgE;IAChE,gDAAgD;IAChD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAY;IACjD,OAAO,kBAAkB,CAAC,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC,CAAA;AAC9C,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAY,EAAE,IAAqB;IAC9D,iEAAiE;IACjE,gEAAgE;IAChE,8DAA8D;IAC9D,iDAAiD;IACjD,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;YAC9E,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACd,CAAC;QACD,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;IAED,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;IAC5D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAEb,MAAM,GAAG,GAML;QACH,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO;KACpB,CAAA;IACD,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAA;IAClD,IAAI,GAAG,YAAY,qCAAqC,EAAE,CAAC;QAC1D,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAA;IAC1B,CAAC;IACD,gEAAgE;IAChE,8DAA8D;IAC9D,kEAAkE;IAClE,IAAI,OAAO,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/C,GAAG,CAAC,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACpC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;AACF,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@namzu/sandbox",
-  "version": "3.0.0",
-  "description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + JWT-authenticated egress proxy) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
+  "version": "5.0.0",
+  "description": "Pluggable sandbox provider for @namzu/sdk. Process-level isolation (bubblewrap on Linux, Seatbelt on macOS, via @anthropic-ai/sandbox-runtime) for developer dev loops; container-level isolation (HTTP worker + a loopback-bound egress proxy that allows by resolved address and brokers outbound credentials so they never enter the sandbox) for multi-tenant production. Backend selected at construction time; the SDK consumes both through the same SandboxProvider interface.",
   "license": "FSL-1.1-MIT",
   "type": "module",
   "homepage": "https://github.com/cogitave/namzu#readme",
@@ -50,7 +50,7 @@
     "@types/node": "^22.19.17",
     "typescript": "^5.5.0",
     "vitest": "^3.2.6",
-    "@namzu/sdk": "^25.0.0"
+    "@namzu/sdk": "^27.1.0"
   },
   "scripts": {
     "build": "tsc --build",
@@ -59,7 +59,7 @@
     "lint:fix": "biome check --write src/",
     "format": "biome format --write src/",
     "test": "vitest run --passWithNoTests",
-    "test:smoke": "vitest run --passWithNoTests src/**/*.smoke.test.ts",
+    "test:smoke": "vitest run --config vitest.smoke.config.ts",
     "typecheck": "tsc --noEmit"
   }
 }

package/src/backends/aci-standby-pool/index.ts

@@ -29,8 +29,12 @@
  *  - ACI runs the container in a Microsoft-owned isolation host;
  *    inside, the worker is a non-root user (image's `USER namzu`).
  *  - The container group can be subnet-injected (no public IP) when
- *    `subnetId` is supplied. Without it the IP is public — fine for
- *    benchmarking, NOT acceptable for production. Caller decides.
+ *    `subnetId` is supplied. Without it the address is public — fine for
+ *    benchmarking, NOT acceptable for production. The caller decides,
+ *    but has to say so: with neither `subnetId` nor `allowPublicAddress`
+ *    the backend refuses to claim. This line used to end "Caller
+ *    decides", and nothing asked them — omitting a field they had never
+ *    heard of chose the public address silently.
  *  - The Confidential variant of Standby Pools (AMD SEV-SNP TEE) is
  *    a pool-side knob, not a backend knob — the backend never
  *    chooses; it just PUTs against whichever pool the caller named.
@@ -88,11 +92,28 @@ export interface ACIStandbyPoolBackendInternalConfig {
 	 */
 	readonly getArmToken: ArmTokenProvider
 	/**
-	 * Optional subnet to inject the container group into (no public IP).
-	 * Strongly recommended for production. When omitted, ACI assigns a
-	 * public IP — fine for benchmarks, attack-surface for prod.
+	 * Subnet to inject the container group into, so it has no public
+	 * address. Omitting it means the platform assigns a public one, which
+	 * the backend now refuses unless {@link allowPublicAddress} says
+	 * otherwise — so this is optional in the type and required in practice
+	 * for anything but a benchmark.
 	 */
 	readonly subnetId?: string
+	/**
+	 * Claim a container group on a public address anyway, with no subnet.
+	 *
+	 * Off by default, and the default is the whole point. The worker this
+	 * backend dials has no authentication of any kind — its own docblock
+	 * says so — so a public address puts an unauthenticated control API on
+	 * the internet. That is a fine trade for a benchmark and never for
+	 * production, and the difference between the two is a decision an
+	 * operator makes rather than one a missing field makes for them.
+	 *
+	 * Named for what it grants rather than what it disables: an operator
+	 * reading `allowPublicAddress: true` in a config review knows what they
+	 * are looking at.
+	 */
+	readonly allowPublicAddress?: boolean
 	readonly readyPollIntervalMs?: number
 	readonly readyTimeoutMs?: number
 	/**
@@ -335,11 +356,41 @@ export function assertEnforceable(options: SandboxBackendOptions): void {
 	)
 }
 
+/**
+ * Refuse to claim a container group that will answer on a public address.
+ *
+ * The sibling above refuses controls this backend cannot enforce. This
+ * refuses one it *can* enforce and would otherwise skip by omission —
+ * which is the more dangerous shape, because nothing is being dropped and
+ * so nothing looks wrong. A caller who never heard of `subnetId` gets a
+ * working sandbox on the internet and no signal at all.
+ *
+ * What is on that address matters: `worker/server.js` states "Authn: none"
+ * in its own docblock and binds every interface. Inside a private network
+ * that is the boundary doing the work. With a public address there is no
+ * boundary left, and the worker's `/execute` is reachable by anyone.
+ *
+ * Defaulting to refusal rather than to a warning, because a warning on a
+ * path that otherwise succeeds is read once and never again.
+ */
+export function assertNotPubliclyAddressed(config: {
+	subnetId?: string
+	allowPublicAddress?: boolean
+}): void {
+	if (config.subnetId) return
+	if (config.allowPublicAddress) return
+
+	throw new Error(
+		'The standby-pool sandbox backend will not claim a container group without `subnetId`: with no subnet the platform assigns a public address, and the worker on it has no authentication of any kind, so its execute endpoint would be reachable from the internet. Supply `subnetId` to inject the group into a private network, or set `allowPublicAddress: true` if this is a benchmark and you mean it.',
+	)
+}
+
 async function spawnAciSandbox(
 	config: ACIStandbyPoolBackendInternalConfig,
 	options: SandboxBackendOptions,
 ): Promise<Sandbox> {
 	assertEnforceable(options)
+	assertNotPubliclyAddressed(config)
 	const id = generateSandboxId()
 	const prefix = config.containerNamePrefix ?? DEFAULT_CONTAINER_NAME_PREFIX
 	const cgName = `${prefix}-${id
@@ -583,9 +634,13 @@ async function execViaWorker(
 						| { type: 'stderr_delta'; data: string }
 						| { type: 'result'; exitCode: number; timedOut: boolean }
 						| { type: 'error'; error: string }
-					if (event.type === 'stdout_delta') stdout += event.data
-					else if (event.type === 'stderr_delta') stderr += event.data
-					else if (event.type === 'result') {
+					if (event.type === 'stdout_delta') {
+						stdout += event.data
+						opts?.onOutput?.({ stream: 'stdout', data: event.data })
+					} else if (event.type === 'stderr_delta') {
+						stderr += event.data
+						opts?.onOutput?.({ stream: 'stderr', data: event.data })
+					} else if (event.type === 'result') {
 						exitCode = event.exitCode
 						timedOut = event.timedOut
 					} else if (event.type === 'error') {

package/src/backends/docker/index.ts

@@ -186,10 +186,17 @@ export function buildDockerBackend(config: DockerBackendInternalConfig): Sandbox
  *
  * The policy used to be accepted and silently ignored, which is worse than
  * not supporting it: a host that set `deny-all` believed the container had
- * no network and it had the configured one. Docker can enforce `deny-all`
- * natively (`--network none`); it cannot enforce a host allowlist without
- * a proxy this backend does not have, so those policies are REFUSED rather
- * than quietly downgraded to "allow everything".
+ * no network and it had the configured one. It cannot enforce a host
+ * allowlist without a proxy this backend does not have, so those policies
+ * are REFUSED rather than quietly downgraded to "allow everything".
+ *
+ * `deny-all` used to answer `'none'`, which reads as the strictest possible
+ * answer and produced a sandbox nobody could reach. `--network none`
+ * removes every interface, and this backend's control channel is inbound
+ * TCP to the worker — so removing the interfaces removes the way IN, not
+ * just the way out. It now keeps the configured network, and
+ * {@link assertNetworkCarriesThePolicy} is what makes that network a
+ * boundary.
  */
 export function resolveNetwork(
 	configured: string,
@@ -200,7 +207,6 @@ export function resolveNetwork(
 
 	switch (egress.kind) {
 		case 'deny-all':
-			return 'none'
 		case 'allow-all':
 			return configured
 		default:
@@ -237,6 +243,68 @@ export function needsEgressProxy(egress: EgressPolicy | undefined): boolean {
 	return egress?.kind === 'static' || egress?.kind === 'resolver'
 }
 
+/**
+ * Whether the daemon says a network has no route out.
+ *
+ * Takes the raw `docker network inspect --format '{{.Internal}}'` output
+ * rather than reading it, so every decision below is testable without a
+ * daemon and the daemon call stays one line. Anything other than a literal
+ * `true` counts as "not internal": an unreadable answer is not evidence of
+ * a boundary.
+ */
+export function isInternalNetwork(inspectedInternalFlag: string): boolean {
+	return inspectedInternalFlag.trim() === 'true'
+}
+
+/**
+ * Refuse a container whose network cannot do what was asked of it.
+ *
+ * Two requirements meet on the same object here, and both were previously
+ * unstated — which is how the backend came to ship a default configuration
+ * that could not create a sandbox at all:
+ *
+ *  - **A published host port needs a route out.** Docker binds the port by
+ *    NAT to the container's address, so a container with no address gets no
+ *    binding. Measured against Docker 29.6: `--network none --publish
+ *    127.0.0.1::2024` is *accepted*, `NetworkSettings.Ports` comes back
+ *    `{"2024/tcp":[]}`, and `docker port` prints nothing. An `--internal`
+ *    network behaves the same way. The port readback then failed with
+ *    `index of untyped nil` and reported it as "the container exited
+ *    immediately" — blaming a container that was alive and well.
+ *  - **`deny-all` needs a network with no route out.** Since it no longer
+ *    answers `--network none`, the configured name is all that stands
+ *    between the policy and ordinary outbound networking, and a name says
+ *    nothing. `deny-all` pointed at the default bridge would be full egress
+ *    under a policy object claiming none — the "accepted and silently
+ *    ignored" failure the rest of this file exists to refuse.
+ *
+ * They are exact opposites, so `deny-all` over a published host port is
+ * impossible rather than merely unsupported: no arrangement of docker
+ * networking both denies all egress and lets the host reach the worker over
+ * TCP. Closing that needs the control channel moved off TCP — see #398 —
+ * and is not a flag this function could accept.
+ */
+export function assertNetworkCarriesThePolicy(
+	network: string,
+	reachability: 'host-port' | 'container-network',
+	egress: EgressPolicy | undefined,
+	inspectedInternalFlag: string,
+): void {
+	const internal = isInternalNetwork(inspectedInternalFlag)
+
+	if (reachability === 'host-port' && (network === 'none' || internal)) {
+		throw new Error(
+			`The docker sandbox backend cannot publish the worker's port on network '${network}': docker binds a published port to the container's address, and a container with no route out has no address to bind to, so nothing is published and the sandbox is unreachable. Either give config.network a bridge that has one, or set hostReachability: 'container-network' and reach the worker by container name. Refusing rather than starting a container nobody can reach.`,
+		)
+	}
+
+	if (egress?.kind === 'deny-all' && !internal) {
+		throw new Error(
+			`The docker sandbox backend was asked for an egress policy of 'deny-all' on network '${network}', but that network is not internal, so the container can still reach the world. Create it with 'docker network create --internal ${network}' — an internal bridge denies egress in the kernel, rather than through an environment variable a workload may decline to read, while sibling containers still reach the worker by name. Refusing rather than reporting a boundary that is not there.`,
+		)
+	}
+}
+
 /**
  * The options the boundary is built from, as a value.
  *
@@ -273,6 +341,30 @@ export function egressProxyOptions(
  * `--cap-drop=ALL` is deliberately not softened by a re-add list: a
  * workload that genuinely needs a capability should say so through
  * `extraRunArgs` and be visible in review.
+ *
+ * **It carries a second, independent load, and this is the one that would
+ * survive being forgotten.** An egress policy of `deny-all` is enforced by
+ * the container's network being `--internal`, which gives it no route out.
+ * Measured against Docker 29.6: a container on such a network has only its
+ * own subnet in `ip route` and no default, and `ip route add default via
+ * <a sibling>` answers `RTNETLINK answers: Operation not permitted` —
+ * already, with docker's DEFAULT capability set, before this flag is
+ * applied. `NET_ADMIN` is what would lift that, and dropping every
+ * capability is what guarantees the workload does not have it.
+ *
+ * So the internal network removes the route and this flag removes the
+ * ability to put one back. Both are needed. Measured on a container given
+ * `--cap-add=NET_ADMIN`, adding the route and reaching a sibling attached
+ * to an external bridge produces `download timed out` rather than
+ * `Network unreachable` — the route existed, the packet left, and the
+ * dual-homed sibling forwarded it (`net.ipv4.ip_forward` is `1` inside a
+ * container). Nothing masquerades the internal subnet so no reply finds its
+ * way back and no connection establishes, **but that is not a security
+ * property**: one-way egress is sufficient for exfiltration, and what was
+ * measured is that the handshake fails, not that the packet was dropped.
+ *
+ * Recorded here because the first justification above would survive
+ * softening this flag and the second would not.
  */
 const HARDENING_ARGS: readonly string[] = ['--cap-drop=ALL', '--security-opt=no-new-privileges']
 
@@ -297,13 +389,33 @@ async function spawnDockerSandbox(
 		egressProxy = await new EgressProxy(egressProxyOptions(config, policy)).listen()
 	}
 
+	const hostReachability = config.hostReachability ?? 'host-port'
 	const network = resolveNetwork(
 		config.network ?? 'none',
 		options.egress,
 		egressProxy !== undefined,
 	)
+	// Whether this network can carry the reachability mode and the policy is
+	// a fact about the network, so it is checked against the daemon rather
+	// than inferred from its name. Before the container starts on purpose: a
+	// refusal here is a wiring mistake and must not arrive dressed as a
+	// container that failed to come up, which is exactly how it used to
+	// arrive.
+	try {
+		assertNetworkCarriesThePolicy(
+			network,
+			hostReachability,
+			options.egress,
+			await inspectNetworkInternalFlag(docker, network),
+		)
+	} catch (err) {
+		// The allowlist kinds start a proxy above, and this is outside the
+		// try/catch that owns teardown — so without this the refusal would
+		// leave a listening server on loopback stamping real credentials.
+		await egressProxy?.close().catch(() => undefined)
+		throw err
+	}
 	const runtime = config.runtime
-	const hostReachability = config.hostReachability ?? 'host-port'
 	const containerName = `namzu-sandbox-${id}`
 
 	// All bind sources come from the consumer-supplied layout. The
@@ -671,9 +783,13 @@ async function execViaWorker(
 								durationMs: number
 						  }
 						| { type: 'error'; error: string }
-					if (event.type === 'stdout_delta') stdout += event.data
-					else if (event.type === 'stderr_delta') stderr += event.data
-					else if (event.type === 'result') {
+					if (event.type === 'stdout_delta') {
+						stdout += event.data
+						opts?.onOutput?.({ stream: 'stdout', data: event.data })
+					} else if (event.type === 'stderr_delta') {
+						stderr += event.data
+						opts?.onOutput?.({ stream: 'stderr', data: event.data })
+					} else if (event.type === 'result') {
 						exitCode = event.exitCode
 						timedOut = event.timedOut
 					} else if (event.type === 'error') {
@@ -802,6 +918,23 @@ function runOnce(binary: string, args: string[]): Promise<string> {
 	})
 }
 
+/**
+ * Read a network's `Internal` flag from the daemon.
+ *
+ * A network that does not exist, or a daemon that is down, comes back as the
+ * empty string rather than throwing, so {@link assertNetworkCarriesThePolicy}
+ * refuses it for the reason the caller actually cares about — "this is not
+ * a boundary" — instead of surfacing a docker CLI error that says nothing
+ * about the egress policy that prompted the lookup.
+ */
+async function inspectNetworkInternalFlag(docker: string, network: string): Promise<string> {
+	try {
+		return await runOnce(docker, ['network', 'inspect', '--format', '{{.Internal}}', network])
+	} catch {
+		return ''
+	}
+}
+
 function runOnceQuiet(binary: string, args: string[]): Promise<void> {
 	return new Promise((resolve) => {
 		const child = spawn(binary, args, { stdio: 'ignore' })

package/src/index.ts

@@ -203,11 +203,19 @@ export interface ContainerBackendConfig {
 	readonly hostReachability?: 'host-port' | 'container-network'
 	/**
 	 * Docker network the spawned container attaches to. Default
-	 * `'none'` (no inbound or outbound network). Set to a docker
-	 * bridge name when `hostReachability='container-network'` so the
-	 * SDK consumer (also on that bridge) can reach the worker by
-	 * container DNS name. Egress from the sandbox is governed
-	 * separately by `EgressPolicy`.
+	 * `'none'` (no inbound or outbound network).
+	 *
+	 * **The default does not work with the default `hostReachability`,
+	 * and `create()` refuses rather than starting a container nobody can
+	 * reach.** Docker binds a published port to the container's address,
+	 * so a container with no route out has no address to bind to and
+	 * nothing is published. Name a bridge here to reach the worker by host
+	 * port, or set `hostReachability: 'container-network'` and reach it by
+	 * container name — that mode works on an `--internal` network, which
+	 * is also the only way to get `deny-all` enforced.
+	 *
+	 * Egress from the sandbox is governed separately by `EgressPolicy`,
+	 * which is checked against this network rather than trusted.
 	 */
 	readonly network?: 'none' | 'bridge' | string
 	/**