@open-everywhere/core 0.1.0

package/dist/agent/access/domain-credentials.js

@@ -0,0 +1,78 @@
+// A domain with NO binding falls back to the org default — absence is the ordinary state, not a misconfiguration. A binding that names a MISSING credential never falls back: it is refused at boot, because serving the org credential there would hand a bound domain the exact key it was bound away from.
+/** Undefined means this domain has no override, which every caller reads as "use the org default". */
+export function credentialOverrideFor(domain, connector, credential) {
+    return (domain?.credentials ?? []).find((c) => c.connector === connector && c.credential === credential);
+}
+/** The credential id this domain uses — the override's `use`, else `credential` itself — so every domain resolves to some id and an unbound one resolves to the org default. */
+export function domainCredentialId(domain, connector, credential) {
+    return credentialOverrideFor(domain, connector, credential)?.use ?? credential;
+}
+/** The org default is always present and always FIRST, which makes an unbound domain work with no config and keeps the trial order stable. Entries repeating a (credentialId, inboundSecret) pair are dropped, so the gate never verifies one key twice. */
+export function connectorIntegrations(domains, connector, credential, defaultInboundSecret) {
+    const out = [{ credentialId: credential, inboundSecret: defaultInboundSecret }];
+    const seen = new Set([`${credential}\u0000${defaultInboundSecret}`]);
+    for (const d of domains) {
+        const override = credentialOverrideFor(d, connector, credential);
+        if (!override)
+            continue;
+        const inboundSecret = override.inboundSecret ?? defaultInboundSecret;
+        const key = `${override.use}\u0000${inboundSecret}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ credentialId: override.use, inboundSecret, domain: d.name });
+    }
+    return out;
+}
+/** The SHAPE half of validation, called from assertDomainsValid so a malformed binding fails at config load rather than at the first webhook. Whether the named credentials EXIST is a separate question, answered by assertDomainCredentialsResolvable at boot. */
+export function domainCredentialProblems(domain) {
+    const bad = [];
+    const name = domain.name ?? "(unnamed)";
+    const seen = new Set();
+    for (const c of domain.credentials ?? []) {
+        const where = `  "${name}" credential override ${JSON.stringify(`${c.connector ?? ""}/${c.credential ?? ""}`)}`;
+        for (const [field, value] of [["connector", c.connector], ["credential", c.credential], ["use", c.use]]) {
+            if (typeof value !== "string" || value.trim().length === 0) {
+                bad.push(`${where}: \`${field}\` must be a non-empty string`);
+            }
+        }
+        if (c.inboundSecret !== undefined && (typeof c.inboundSecret !== "string" || c.inboundSecret.trim().length === 0)) {
+            bad.push(`${where}: \`inboundSecret\` must be a non-empty operator-secret name when present (omit it to share the deployment default)`);
+        }
+        if (typeof c.connector !== "string" || typeof c.credential !== "string")
+            continue;
+        const key = `${c.connector}\u0000${c.credential}`;
+        if (seen.has(key)) {
+            bad.push(`${where}: declared more than once — a domain overrides each (connector, credential) at most once, so two entries are a contradiction rather than a precedence question`);
+        }
+        seen.add(key);
+        if (typeof c.use === "string" && c.use === c.credential) {
+            bad.push(`${where}: \`use\` names the credential it replaces, so the override does nothing — delete it (an unbound domain already uses the org default)`);
+        }
+    }
+    return bad;
+}
+/** Fails LOUD at boot when an override names a credential no connector catalogue carries. This is what keeps the no-silent-fallback rule from ever being felt at runtime. */
+export function assertDomainCredentialsResolvable(domains, catalogues) {
+    const bad = [];
+    for (const d of domains) {
+        for (const c of d.credentials ?? []) {
+            const cfg = catalogues.find((p) => p.connector === c.connector);
+            if (!cfg) {
+                bad.push(`  "${d.name}" overrides credential "${c.credential}" on connector "${c.connector}", which has no credential catalogue (agent/access/connector-credentials.ts)`);
+                continue;
+            }
+            if (!cfg.credentials.some((pc) => pc.id === c.credential)) {
+                bad.push(`  "${d.name}" overrides credential "${c.credential}" on connector "${c.connector}", which declares no such credential — name the ORG-DEFAULT credential the override replaces (one of: ${cfg.credentials.map((pc) => pc.id).join(", ")})`);
+            }
+            if (!cfg.credentials.some((pc) => pc.id === c.use)) {
+                bad.push(`  "${d.name}" binds connector "${c.connector}" to credential "${c.use}", which that connector does not declare — add it to agent/access/connector-credentials.ts with its own secretRef + broker (one of the declared ids: ${cfg.credentials.map((pc) => pc.id).join(", ")})`);
+            }
+        }
+    }
+    if (bad.length > 0) {
+        throw new Error(`invalid per-domain credential override(s):\n${bad.join("\n")}\n` +
+            `A bound domain NEVER falls back to the org credential — that would hand it the exact key it was bound away from — so an unresolvable binding is refused at boot.`);
+    }
+}
+//# sourceMappingURL=domain-credentials.js.map

package/dist/agent/access/domain-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain-credentials.js","sourceRoot":"","sources":["../../../agent/access/domain-credentials.ts"],"names":[],"mappings":"AAAA,8SAA8S;AAoB9S,sGAAsG;AACtG,MAAM,UAAU,qBAAqB,CACnC,MAAyC,EACzC,SAAiB,EACjB,UAAkB;IAElB,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;AAC3G,CAAC;AAED,gLAAgL;AAChL,MAAM,UAAU,kBAAkB,CAAC,MAAyC,EAAE,SAAiB,EAAE,UAAkB;IACjH,OAAO,qBAAqB,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,GAAG,IAAI,UAAU,CAAC;AACjF,CAAC;AASD,4PAA4P;AAC5P,MAAM,UAAU,qBAAqB,CACnC,OAA0B,EAC1B,SAAiB,EACjB,UAAkB,EAClB,oBAA4B;IAE5B,MAAM,GAAG,GAA2B,CAAC,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,UAAU,SAAS,oBAAoB,EAAE,CAAC,CAAC,CAAC;IAC7E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,IAAI,oBAAoB,CAAC;QACrE,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,GAAG,SAAS,aAAa,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oQAAoQ;AACpQ,MAAM,UAAU,wBAAwB,CAAC,MAA6B;IACpE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,IAAI,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,IAAI,CAAC,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAU,EAAE,CAAC;YACjH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,OAAO,KAAK,+BAA+B,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClH,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,qHAAqH,CAAC,CAAC;QAC1I,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,SAAS;QAClF,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,SAAS,CAAC,CAAC,UAAU,EAAE,CAAC;QAClD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,gKAAgK,CAAC,CAAC;QACrL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,UAAU,EAAE,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,uIAAuI,CAAC,CAAC;QAC5J,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6KAA6K;AAC7K,MAAM,UAAU,iCAAiC,CAAC,OAA0B,EAAE,UAA2C;IACvH,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;YACpC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;YAChE,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,UAAU,mBAAmB,CAAC,CAAC,SAAS,8EAA8E,CAAC,CAAC;gBAC1K,SAAS;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,2BAA2B,CAAC,CAAC,UAAU,mBAAmB,CAAC,CAAC,SAAS,yGAAyG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvP,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,sBAAsB,CAAC,CAAC,SAAS,oBAAoB,CAAC,CAAC,GAAG,wJAAwJ,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3R,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,+CAA+C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC/D,kKAAkK,CACrK,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/agent/access/egress-denial-log.d.ts

@@ -0,0 +1,28 @@
+export interface DeniedHostCount {
+    readonly host: string;
+    readonly count: number;
+}
+/** The result of reducing one chunk of access log. Deliberately has nowhere to put a path. */
+export interface DenialScan {
+    /** Denied hosts, count-desc then host-asc — the same ordering every counted list in the
+     *  permission-evidence family uses, so a reader never has to ask how a list is sorted. */
+    readonly hosts: readonly DeniedHostCount[];
+    readonly linesRead: number;
+    readonly denials: number;
+    /** Denial lines whose host could not be reduced to something safe to record. Non-zero means this parser and this Squid build disagree about the log format. */
+    readonly unparsed: number;
+}
+/** The ORDER of operations is the security property: the path, query and fragment are cut FIRST, then the `user:pass@` userinfo, before anything else interprets the value. Single-label tokens are dropped, so a stray log field can never be mistaken for a host. */
+export declare function normaliseDenialHost(token: string): string | undefined;
+/** Squid spells every refusal `*_DENIED*`, so matching the suffix still counts a build that spells it differently. Outage tags such as `TAG_NONE/503` and `TCP_MISS_ABORTED` carry no `_DENIED` and must never be read as evidence that a grant is too narrow. */
+export declare function isDenialTag(tag: string): boolean;
+/** Reads both log formats by finding the result tag and taking the first later token that reduces to a valid host; positional indexing would silently read the WRONG field, which on this path means recording a URL. A line with no result tag is skipped silently. */
+export declare function reduceDenialLog(chunk: string): DenialScan;
+export interface TailPlan {
+    readonly from: number;
+    readonly to: number;
+    readonly rotated: boolean;
+}
+/** A COLD START seeks to the END, so denials logged while nothing was watching are lost rather than replayed on every restart. A file smaller than the last offset is a ROTATION and is re-read from 0. */
+export declare function planTailRead(size: number, lastOffset: number | undefined): TailPlan;
+//# sourceMappingURL=egress-denial-log.d.ts.map

package/dist/agent/access/egress-denial-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-denial-log.d.ts","sourceRoot":"","sources":["../../../agent/access/egress-denial-log.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,8FAA8F;AAC9F,MAAM,WAAW,UAAU;IACzB;8FAC0F;IAC1F,QAAQ,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+JAA+J;IAC/J,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAaD,uQAAuQ;AACvQ,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CA0BrE;AAED,kQAAkQ;AAClQ,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED,wQAAwQ;AACxQ,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAiCzD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,2MAA2M;AAC3M,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAInF"}

package/dist/agent/access/egress-denial-log.js

@@ -0,0 +1,96 @@
+// Reduces a Squid access log to HOSTS AND INTEGER COUNTS only: no method, URL, query string, client address or byte count may reach the append-only audit plane. A token that fails the strict host checks is DROPPED rather than passed through, and the module is pure — no I/O, no clock, no env.
+/** Squid's `%Ss` result tag followed by `%03>Hs`, e.g. `TCP_DENIED/403` — the ONE field that is
+ *  present, in this exact shape, in both the conventional `squid` logformat and the minimal
+ *  `oe_deny` one this deployment writes. Anchoring on it is what lets one parser read both. */
+const RESULT_TAG = /^([A-Z][A-Z0-9_]*)\/(\d{3})$/u;
+/** A hostname (at least one dot — see {@link normaliseDenialHost} for why single labels are
+ *  dropped) or a bracketed IPv6 literal. Deliberately strict: this is the last thing standing
+ *  between an arbitrary log token and an append-only audit row. */
+const HOSTNAME = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+\.?$/u;
+const IPV6_LITERAL = /^\[[0-9a-f:.]+\]$/u;
+/** The ORDER of operations is the security property: the path, query and fragment are cut FIRST, then the `user:pass@` userinfo, before anything else interprets the value. Single-label tokens are dropped, so a stray log field can never be mistaken for a host. */
+export function normaliseDenialHost(token) {
+    let v = token.trim();
+    if (v.length === 0 || v === "-")
+        return undefined;
+    const scheme = v.indexOf("://");
+    if (scheme >= 0)
+        v = v.slice(scheme + 3);
+    // 2. 🔴 PATH / QUERY / FRAGMENT — cut before anything else looks at the value.
+    for (const cut of ["/", "?", "#"]) {
+        const at = v.indexOf(cut);
+        if (at >= 0)
+            v = v.slice(0, at);
+    }
+    // 3. 🔴 USERINFO — `user:pass@host` → `host`. A credential in a URL is a credential.
+    const at = v.lastIndexOf("@");
+    if (at >= 0)
+        v = v.slice(at + 1);
+    // 4. Port. Bracketed IPv6 keeps its brackets; everything else splits on the LAST colon so a
+    //    bare (unbracketed) IPv6 literal fails the charset check below rather than being mangled.
+    if (v.startsWith("[")) {
+        const close = v.indexOf("]");
+        if (close >= 0)
+            v = v.slice(0, close + 1);
+    }
+    else {
+        const colon = v.lastIndexOf(":");
+        if (colon >= 0)
+            v = v.slice(0, colon);
+    }
+    v = v.toLowerCase();
+    if (v.length === 0 || v.length > 253)
+        return undefined;
+    if (IPV6_LITERAL.test(v))
+        return v;
+    return HOSTNAME.test(v) ? v : undefined;
+}
+/** Squid spells every refusal `*_DENIED*`, so matching the suffix still counts a build that spells it differently. Outage tags such as `TAG_NONE/503` and `TCP_MISS_ABORTED` carry no `_DENIED` and must never be read as evidence that a grant is too narrow. */
+export function isDenialTag(tag) {
+    return tag.includes("_DENIED");
+}
+/** Reads both log formats by finding the result tag and taking the first later token that reduces to a valid host; positional indexing would silently read the WRONG field, which on this path means recording a URL. A line with no result tag is skipped silently. */
+export function reduceDenialLog(chunk) {
+    const counts = new Map();
+    let linesRead = 0;
+    let denials = 0;
+    let unparsed = 0;
+    for (const raw of chunk.split("\n")) {
+        const line = raw.trim();
+        if (line.length === 0)
+            continue;
+        linesRead++;
+        const tokens = line.split(/\s+/u);
+        const tagAt = tokens.findIndex((t) => RESULT_TAG.test(t));
+        if (tagAt < 0)
+            continue;
+        const tag = RESULT_TAG.exec(tokens[tagAt])[1];
+        if (!isDenialTag(tag))
+            continue;
+        denials++;
+        let host;
+        for (let i = tagAt + 1; i < tokens.length; i++) {
+            host = normaliseDenialHost(tokens[i]);
+            if (host !== undefined)
+                break;
+        }
+        if (host === undefined) {
+            unparsed++;
+            continue;
+        }
+        counts.set(host, (counts.get(host) ?? 0) + 1);
+    }
+    const hosts = [...counts.entries()]
+        .map(([host, count]) => ({ host, count }))
+        .sort((a, b) => b.count - a.count || a.host.localeCompare(b.host));
+    return { hosts, linesRead, denials, unparsed };
+}
+/** A COLD START seeks to the END, so denials logged while nothing was watching are lost rather than replayed on every restart. A file smaller than the last offset is a ROTATION and is re-read from 0. */
+export function planTailRead(size, lastOffset) {
+    if (lastOffset === undefined)
+        return { from: size, to: size, rotated: false };
+    if (size < lastOffset)
+        return { from: 0, to: size, rotated: true };
+    return { from: lastOffset, to: size, rotated: false };
+}
+//# sourceMappingURL=egress-denial-log.js.map

package/dist/agent/access/egress-denial-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-denial-log.js","sourceRoot":"","sources":["../../../agent/access/egress-denial-log.ts"],"names":[],"mappings":"AAAA,qSAAqS;AAkBrS;;+FAE+F;AAC/F,MAAM,UAAU,GAAG,+BAA+B,CAAC;AAEnD;;mEAEmE;AACnE,MAAM,QAAQ,GAAG,6EAA6E,CAAC;AAC/F,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C,uQAAuQ;AACvQ,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,SAAS,CAAC;IAClD,MAAM,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzC,+EAA+E;IAC/E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAClC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,EAAE,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,qFAAqF;IACrF,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,EAAE,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACjC,4FAA4F;IAC5F,8FAA8F;IAC9F,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,KAAK,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACpB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,kQAAkQ;AAClQ,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACjC,CAAC;AAED,wQAAwQ;AACxQ,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IAEjB,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAChC,SAAS,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1D,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAE,CAAE,CAAC,CAAC,CAAE,CAAC;QACjD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YAAE,SAAS;QAChC,OAAO,EAAE,CAAC;QACV,IAAI,IAAwB,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC/C,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;YACvC,IAAI,IAAI,KAAK,SAAS;gBAAE,MAAM;QAChC,CAAC;QACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,QAAQ,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAQD,2MAA2M;AAC3M,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,UAA8B;IACvE,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9E,IAAI,IAAI,GAAG,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACxD,CAAC"}

package/dist/agent/access/egress-denial-poller.d.ts

@@ -0,0 +1,56 @@
+import { type AuditInput } from "../audit/audit.js";
+import { type DenialScan } from "./egress-denial-log.js";
+export declare const DEFAULT_POLL_MS = 60000;
+/** Floor, so a mistyped env cannot turn this into a spin loop against a shared volume. */
+export declare const MIN_POLL_MS = 5000;
+/** Per-pass cap on the number of DISTINCT hosts that become rows. A worker enumerating hosts (a
+ *  scan, a crash-loop through a package registry's mirrors) must not be able to write an unbounded
+ *  number of audit rows per minute. The hosts are already sorted count-desc, so the cap keeps the
+ *  evidence that matters and drops the tail; the drop is recorded on the rows that do get written. */
+export declare const MAX_HOSTS_PER_PASS = 20;
+export interface EgressAttribution {
+    readonly org: string;
+    readonly platform: string;
+    readonly workspace: string;
+    readonly surface?: string;
+    /** The fingerprint of the policy generation in force — the same value the `egress.policy` audit
+     *  row and `egress/STATUS.json` carry, so a denial and the policy that produced it name the same
+     *  generation. */
+    readonly policyFingerprint: string;
+}
+/** Record the scope and policy generation a later denial is attributed to. Called only on a pass that ESTABLISHED what is in force, never on a skipped-unchanged turn and never on an apply that threw. */
+export declare function rememberEgressAttribution(next: EgressAttribution): void;
+/** The current attribution, or undefined if no policy has been applied in this process yet. */
+export declare function currentEgressAttribution(): EgressAttribution | undefined;
+export declare function resetEgressAttribution(): void;
+/** Configured denial-log path, or undefined (⇒ the poller does not run). */
+export declare function egressDenialLogPath(env?: NodeJS.ProcessEnv): string | undefined;
+export declare function egressDenialPollMs(env?: NodeJS.ProcessEnv): number;
+export interface DenialPollDeps {
+    /** Byte size of the log, or undefined if it cannot be stated (missing, unreadable, not a file). */
+    readonly size: () => Promise<number | undefined>;
+    /** Read `[from, to)` as text. May throw; the caller degrades. */
+    readonly read: (from: number, to: number) => Promise<string>;
+    readonly attribution: () => EgressAttribution | undefined;
+    readonly audit: (entry: AuditInput) => Promise<void>;
+    /** Emit a diagnostic AT MOST ONCE per distinct reason, for the lifetime of the process. */
+    readonly warnOnce: (reason: string, message: string) => void;
+    /** Milliseconds this pass aggregates over — carried onto the row so a count is interpretable. */
+    readonly windowMs: number;
+}
+export interface DenialPollResult {
+    readonly offset: number | undefined;
+    readonly rowsWritten: number;
+    readonly scan?: DenialScan;
+    readonly skipped?: "no-file" | "no-growth" | "unreadable" | "no-attribution" | "no-denials";
+}
+/** One poll pass; it never throws. The aggregation contract is one row per (host, policy generation) per pass carrying a count, so a worker denied a thousand times a minute writes one row a minute. */
+export declare function pollEgressDenials(deps: DenialPollDeps, lastOffset: number | undefined): Promise<DenialPollResult>;
+export interface DenialPoller {
+    stop(): void;
+}
+/** Starts the poller only when a denial log is configured, and returns undefined otherwise, which is every Vercel deployment and every self-host that has not mounted the volume. The timer is `unref`'d, because diagnostics must never keep the process alive. */
+export declare function startEgressDenialPoller(options?: {
+    readonly env?: NodeJS.ProcessEnv;
+}): DenialPoller | undefined;
+//# sourceMappingURL=egress-denial-poller.d.ts.map

package/dist/agent/access/egress-denial-poller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-denial-poller.d.ts","sourceRoot":"","sources":["../../../agent/access/egress-denial-poller.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAiC,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIxF,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,0FAA0F;AAC1F,eAAO,MAAM,WAAW,OAAQ,CAAC;AAEjC;;;sGAGsG;AACtG,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAOrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;sBAEkB;IAClB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAID,2MAA2M;AAC3M,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAEvE;AAED,+FAA+F;AAC/F,wBAAgB,wBAAwB,IAAI,iBAAiB,GAAG,SAAS,CAExE;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,4EAA4E;AAC5E,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAG5F;AAED,wBAAgB,kBAAkB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAI/E;AAED,MAAM,WAAW,cAAc;IAC7B,mGAAmG;IACnG,QAAQ,CAAC,IAAI,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAC1D,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7D,iGAAiG;IACjG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,YAAY,CAAC;CAC7F;AAED,yMAAyM;AACzM,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyFvH;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,IAAI,CAAC;CACd;AAED,oQAAoQ;AACpQ,wBAAgB,uBAAuB,CAAC,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG,YAAY,GAAG,SAAS,CA0DhH"}

package/dist/agent/access/egress-denial-poller.js

@@ -0,0 +1,184 @@
+// Tails the egress proxy's denial log and appends aggregated `egress.denied` audit rows; the reduction and the host-only invariant live in egress-denial-log.ts.
+// Fail-quiet by requirement: a missing, rotated, unreadable or truncated log degrades to doing nothing. Rows carry the scope of the MOST RECENT policy push, which is exact to org grain only while one process serves one org.
+import { open, stat } from "node:fs/promises";
+import { appendAudit } from "../audit/audit.js";
+import { planTailRead, reduceDenialLog } from "./egress-denial-log.js";
+const EGRESS_DENIED_ACTION = "egress.denied";
+export const DEFAULT_POLL_MS = 60_000;
+/** Floor, so a mistyped env cannot turn this into a spin loop against a shared volume. */
+export const MIN_POLL_MS = 5_000;
+/** Per-pass cap on the number of DISTINCT hosts that become rows. A worker enumerating hosts (a
+ *  scan, a crash-loop through a package registry's mirrors) must not be able to write an unbounded
+ *  number of audit rows per minute. The hosts are already sorted count-desc, so the cap keeps the
+ *  evidence that matters and drops the tail; the drop is recorded on the rows that do get written. */
+export const MAX_HOSTS_PER_PASS = 20;
+/** Ceiling on how many bytes one pass will read. A log that grew by more than this since the last
+ *  pass is read from its TAIL — the newest bytes are the ones worth having, and holding an
+ *  arbitrarily large file in memory is exactly the failure this plane must not cause. */
+const MAX_READ_BYTES = 4 * 1024 * 1024;
+let attribution;
+/** Record the scope and policy generation a later denial is attributed to. Called only on a pass that ESTABLISHED what is in force, never on a skipped-unchanged turn and never on an apply that threw. */
+export function rememberEgressAttribution(next) {
+    attribution = next;
+}
+/** The current attribution, or undefined if no policy has been applied in this process yet. */
+export function currentEgressAttribution() {
+    return attribution;
+}
+export function resetEgressAttribution() {
+    attribution = undefined;
+}
+/** Configured denial-log path, or undefined (⇒ the poller does not run). */
+export function egressDenialLogPath(env = process.env) {
+    const raw = env.OE_EGRESS_DENIAL_LOG?.trim();
+    return raw ? raw : undefined;
+}
+export function egressDenialPollMs(env = process.env) {
+    const raw = Number(env.OE_EGRESS_DENIAL_POLL_MS ?? "");
+    if (!Number.isFinite(raw) || raw <= 0)
+        return DEFAULT_POLL_MS;
+    return Math.max(MIN_POLL_MS, Math.trunc(raw));
+}
+/** One poll pass; it never throws. The aggregation contract is one row per (host, policy generation) per pass carrying a count, so a worker denied a thousand times a minute writes one row a minute. */
+export async function pollEgressDenials(deps, lastOffset) {
+    let size;
+    try {
+        size = await deps.size();
+    }
+    catch {
+        size = undefined;
+    }
+    if (size === undefined) {
+        // Missing or unreadable. This is the NORMAL state on a deployment whose proxy predates the
+        // denial log, and on every deployment for the first moments after boot — so it is a one-time
+        // note, not a recurring warning, and the offset is left untouched so a file that appears later
+        // is picked up from its end like any other cold start.
+        deps.warnOnce("no-file", "[open-everywhere:egress] denial log not readable — egress denials will not reach the audit log (the plane stays as dark as it is on the Vercel tier). Check OE_EGRESS_DENIAL_LOG and the shared volume.");
+        return { offset: lastOffset, rowsWritten: 0, skipped: "no-file" };
+    }
+    const plan = planTailRead(size, lastOffset);
+    if (plan.rotated) {
+        deps.warnOnce("rotated", "[open-everywhere:egress] denial log rotated — resuming from the start of the new file.");
+    }
+    if (plan.to <= plan.from)
+        return { offset: plan.to, rowsWritten: 0, skipped: "no-growth" };
+    // Bound the read. A gap larger than the cap keeps the NEWEST bytes: the first line will usually be
+    // a partial one, which the reducer drops on its own (no result tag, or a token that is not a host).
+    const from = plan.to - plan.from > MAX_READ_BYTES ? plan.to - MAX_READ_BYTES : plan.from;
+    let chunk;
+    try {
+        chunk = await deps.read(from, plan.to);
+    }
+    catch (err) {
+        deps.warnOnce("unreadable", `[open-everywhere:egress] denial log read failed — egress denials are not being recorded: ${String(err)}`);
+        // Advance anyway: a read that fails repeatedly at the same offset would otherwise retry the same
+        // bytes forever, and the alternative to losing this chunk is never reading any later one.
+        return { offset: plan.to, rowsWritten: 0, skipped: "unreadable" };
+    }
+    const scan = reduceDenialLog(chunk);
+    if (scan.unparsed > 0) {
+        deps.warnOnce("unparsed", `[open-everywhere:egress] ${scan.unparsed} denial line(s) did not yield a host — this parser and this Squid build disagree about the log format. No half-parsed value is ever recorded; see agent/access/egress-denial-log.ts.`);
+    }
+    if (scan.hosts.length === 0)
+        return { offset: plan.to, rowsWritten: 0, scan, skipped: "no-denials" };
+    const scope = deps.attribution();
+    if (scope === undefined) {
+        // Denials before this process ever applied a policy. There is no org to stamp and none may be
+        // invented, so the rows are dropped and the offset still advances — replaying them after the
+        // first push would attribute them to a generation that provably was not in force when they
+        // happened.
+        deps.warnOnce("no-attribution", "[open-everywhere:egress] egress denials observed before any policy was applied in this process — dropped, because nothing can say which org or policy generation they belong to.");
+        return { offset: plan.to, rowsWritten: 0, scan, skipped: "no-attribution" };
+    }
+    const kept = scan.hosts.slice(0, MAX_HOSTS_PER_PASS);
+    const dropped = scan.hosts.length - kept.length;
+    let rowsWritten = 0;
+    for (const { host, count } of kept) {
+        try {
+            await deps.audit({
+                org: scope.org,
+                platform: scope.platform,
+                workspace: scope.workspace,
+                ...(scope.surface !== undefined ? { surface: scope.surface } : {}),
+                action: EGRESS_DENIED_ACTION,
+                // 🔴 HOST + FINGERPRINT + COUNT. Nothing else may be added to this object — see the
+                // invariant in egress-denial-log.ts. `windowMs` makes the count interpretable and
+                // `distinctHostsDropped` keeps the per-pass cap honest rather than silent.
+                detail: {
+                    host,
+                    count,
+                    policyFingerprint: scope.policyFingerprint,
+                    windowMs: deps.windowMs,
+                    ...(dropped > 0 ? { distinctHostsDropped: dropped } : {}),
+                },
+            });
+            rowsWritten++;
+        }
+        catch {
+            // appendAudit is best-effort by contract and already swallows its own failures; this catch is
+            // for the injected seam, and it must not stop the remaining hosts being recorded.
+        }
+    }
+    return { offset: plan.to, rowsWritten, scan };
+}
+/** Starts the poller only when a denial log is configured, and returns undefined otherwise, which is every Vercel deployment and every self-host that has not mounted the volume. The timer is `unref`'d, because diagnostics must never keep the process alive. */
+export function startEgressDenialPoller(options) {
+    const env = options?.env ?? process.env;
+    const path = egressDenialLogPath(env);
+    if (path === undefined)
+        return undefined;
+    const intervalMs = egressDenialPollMs(env);
+    const warned = new Set();
+    const warnOnce = (reason, message) => {
+        if (warned.has(reason))
+            return;
+        warned.add(reason);
+        console.warn(message);
+    };
+    const deps = {
+        size: async () => {
+            const s = await stat(path);
+            return s.isFile() ? s.size : undefined;
+        },
+        read: async (from, to) => {
+            const fh = await open(path, "r");
+            try {
+                const length = to - from;
+                const buf = Buffer.alloc(length);
+                const { bytesRead } = await fh.read(buf, 0, length, from);
+                return buf.subarray(0, bytesRead).toString("utf8");
+            }
+            finally {
+                await fh.close();
+            }
+        },
+        attribution: currentEgressAttribution,
+        audit: appendAudit,
+        warnOnce,
+        windowMs: intervalMs,
+    };
+    let offset;
+    let running = false;
+    const tick = async () => {
+        if (running)
+            return; // a slow store must never let two passes overlap and double-count
+        running = true;
+        try {
+            const result = await pollEgressDenials(deps, offset);
+            offset = result.offset;
+        }
+        catch (err) {
+            warnOnce("pass-threw", `[open-everywhere:egress] denial poll pass failed — continuing: ${String(err)}`);
+        }
+        finally {
+            running = false;
+        }
+    };
+    const timer = setInterval(() => void tick(), intervalMs);
+    timer.unref?.();
+    console.info(`[open-everywhere:egress] denial poller watching ${path} every ${Math.round(intervalMs / 1000)}s — TCP_DENIED lines become aggregated \`egress.denied\` audit rows (host + policy fingerprint + count, nothing else), which permission_fit_report reads as widening evidence.`);
+    return {
+        stop: () => clearInterval(timer),
+    };
+}
+//# sourceMappingURL=egress-denial-poller.js.map

package/dist/agent/access/egress-denial-poller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-denial-poller.js","sourceRoot":"","sources":["../../../agent/access/egress-denial-poller.ts"],"names":[],"mappings":"AAAA,iKAAiK;AACjK,gOAAgO;AAEhO,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAmB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,eAAe,EAAmB,MAAM,wBAAwB,CAAC;AAExF,MAAM,oBAAoB,GAAG,eAAe,CAAC;AAE7C,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,0FAA0F;AAC1F,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC;AAEjC;;;sGAGsG;AACtG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;yFAEyF;AACzF,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAavC,IAAI,WAA0C,CAAC;AAE/C,2MAA2M;AAC3M,MAAM,UAAU,yBAAyB,CAAC,IAAuB;IAC/D,WAAW,GAAG,IAAI,CAAC;AACrB,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,wBAAwB;IACtC,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,WAAW,GAAG,SAAS,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACtE,MAAM,GAAG,GAAG,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,eAAe,CAAC;IAC9D,OAAO,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAChD,CAAC;AAsBD,yMAAyM;AACzM,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoB,EAAE,UAA8B;IAC1F,IAAI,IAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,uDAAuD;QACvD,IAAI,CAAC,QAAQ,CACX,SAAS,EACT,yMAAyM,CAC1M,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,wFAAwF,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAE3F,mGAAmG;IACnG,oGAAoG;IACpG,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACzF,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,4FAA4F,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACvI,iGAAiG;QACjG,0FAA0F;QAC1F,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CACX,UAAU,EACV,4BAA4B,IAAI,CAAC,QAAQ,sLAAsL,CAChO,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAErG,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,8FAA8F;QAC9F,6FAA6F;QAC7F,2FAA2F;QAC3F,YAAY;QACZ,IAAI,CAAC,QAAQ,CACX,gBAAgB,EAChB,kLAAkL,CACnL,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAChD,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,MAAM,EAAE,oBAAoB;gBAC5B,oFAAoF;gBACpF,kFAAkF;gBAClF,2EAA2E;gBAC3E,MAAM,EAAE;oBACN,IAAI;oBACJ,KAAK;oBACL,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1D;aACF,CAAC,CAAC;YACH,WAAW,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,8FAA8F;YAC9F,kFAAkF;QACpF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChD,CAAC;AAMD,oQAAoQ;AACpQ,MAAM,UAAU,uBAAuB,CAAC,OAA8C;IACpF,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,OAAe,EAAQ,EAAE;QACzD,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,IAAI,GAAmB;QAC3B,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACzC,CAAC;QACD,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE;YACvB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,CAAC;gBACzB,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACjC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC1D,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACrD,CAAC;oBAAS,CAAC;gBACT,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;QACH,CAAC;QACD,WAAW,EAAE,wBAAwB;QACrC,KAAK,EAAE,WAAW;QAClB,QAAQ;QACR,QAAQ,EAAE,UAAU;KACrB,CAAC;IAEF,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;QACrC,IAAI,OAAO;YAAE,OAAO,CAAC,kEAAkE;QACvF,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,YAAY,EAAE,kEAAkE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1G,CAAC;gBAAS,CAAC;YACT,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC;IACzD,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,OAAO,CAAC,IAAI,CACV,mDAAmD,IAAI,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,gLAAgL,CAC/Q,CAAC;IACF,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/agent/access/egress-status.d.ts

@@ -0,0 +1,61 @@
+import type { SandboxNetworkPolicy } from "eve/sandbox";
+export declare const EGRESS_STATUS_PATH = "egress/STATUS.json";
+export declare const EGRESS_README_PATH = "egress/README.md";
+/** What the last apply established about enforcement. Three values rather than a boolean: `dry-run` (the policy was computed and nothing was applied) and `unenforced` (the backend refused it and the operator accepted that) are different facts. */
+export type EgressEnforcementState = "enforced" | "dry-run" | "unenforced";
+/** One allowed host, as the FIREWALL sees it — narrowing included, credential value excluded. */
+export interface EgressAllowEntry {
+    readonly host: string;
+    /** Union of the HTTP methods across this host's rules; absent when no rule narrows by method. */
+    readonly methods?: readonly string[];
+    /** Union of the path prefixes across this host's rules; absent when no rule narrows by path. */
+    readonly pathPrefixes?: readonly string[];
+    /** True iff the firewall injects an auth header on requests to this host. The VALUE is never
+     *  disclosed — this flag exists so the agent stops trying to authenticate a call itself. */
+    readonly credentialInjected: boolean;
+}
+export interface EgressPolicySummary {
+    /** Always `"deny"` for a compiled OE policy; `"allow"` only if something ever hands us the
+     *  runtime's allow-all string, which would be a bug worth seeing in the file rather than hiding. */
+    readonly defaultAction: "deny" | "allow";
+    readonly allow: readonly EgressAllowEntry[];
+}
+export interface EgressStatusInput {
+    readonly policy: SandboxNetworkPolicy;
+    readonly state: EgressEnforcementState;
+    /** The sha-256 of the applied policy — the same value the `egress.policy` audit row carries, so a
+     *  worker's report and the operator's audit trail name the same generation. */
+    readonly fingerprint: string;
+    /** True iff the policy is a fail-closed deny-all produced by a COMPILE failure rather than by a
+     *  deliberately-empty grant. The message is withheld (see the header). */
+    readonly compileError: boolean;
+}
+/** Reduce a compiled policy to its DISCLOSABLE shape. Pure, and it reads a closed set of fields rather than mapping over the object, because it is the one function allowed to turn a credential-bearing policy into sandbox-visible bytes. */
+export declare function summariseEgressPolicy(policy: SandboxNetworkPolicy): EgressPolicySummary;
+/** The status file's bytes, DETERMINISTIC — no clock and no counter — so two sessions on one policy produce byte-identical files. The *when* lives in the audit row. */
+export declare function renderEgressStatus(input: EgressStatusInput): string;
+/** The self-help README: STATIC and pinned byte-for-byte by `egress-status-test.ts`, because every load-bearing sentence is a claim about how this deployment behaves. It must state BOTH tiers — a self-host proxy logs each denial as an `egress.denied` row, the Vercel sandbox host logs none. */
+export declare const EGRESS_README = "# Egress from this sandbox\n\nNetwork access out of this sandbox is **default-deny**. Only the hosts listed in\n`STATUS.json` are reachable; everything else fails at the firewall.\n\nRead `STATUS.json` first. It carries the enforcement state, every allowed host with any\nmethod/path narrowing on it, and `policyFingerprint`.\n\n## If a request was blocked\n\n**Do not retry it, and do not try to route around it.** A denial here is policy, not an\noutage: a retry, a mirror, a proxy, a different port and a different DNS name all fail the\nsame way, and the only thing they cost is your turn.\n\n**Report it instead**, in your answer, naming the host you needed and what you needed it\nfor. The policy that denied you is on the record \u2014 an `egress.policy` audit row carries the\n`policyFingerprint` above \u2014 but whether **the individual blocked request** is depends on the\ntier. Where the proxy is ours (self-host) each denial becomes an `egress.denied` row \u2014 host,\nthat fingerprint, a count, nothing else \u2014 which `permission_fit_report` reads as widening\nevidence. On the Vercel sandbox host the deny is out of band and no row exists at all. You\ncannot tell which from in here, so report either way: yours is the only signal that always\nexists, and the only one that says what you wanted the host **for**.\n\nWidening is deliberately not something either of us can do at runtime: a reachable host is\nconfig-as-code, and it changes by reviewed pull request against the bundle that grants it \u2014\na `domains` entry for an uncredentialed host, or a connection's `allowedWebsites` for a\ncredentialed one. It then lands on the session's next turn.\n\n## Three things that will save you a wrong guess\n\n**Never add an `Authorization` header yourself.** Where `credentialInjected` is true in\n`STATUS.json`, the firewall stamps the credential onto the request as it leaves. You do not\nhold that secret and cannot read it. A 401 from such a host means the credential is wrong or\nexpired upstream, so report it; do not go looking for a key.\n\n**This route cannot use anyone's own account.** One credential per host per session, so an\nown-account ask withholds that vendor's hosts from `STATUS.json`. A worker never holds them.\nA seat is covered from the ask onward, and this file was written when the turn began \u2014 so for\nthe rest of THAT turn the host can still be listed here, on the team key. Do not use it: the\nteam key is never the answer to \"act as me\". A host missing for that reason is\nnot a config gap: say so, and send the person to their DM with me, where a personal grant is\nminted.\n\n**`web_fetch` and `web_search` do not run in here.** They execute host-side, outside this\nsandbox. That changes WHO enforces, not WHAT is allowed: `web_fetch` is fenced against this\nsame allow-list before it dispatches, so a host absent from `STATUS.json` is refused there\ntoo \u2014 audibly, naming the host, unlike the silent failure you get in here. `web_search` runs\ninside the model call and is bounded by neither. `github.com` is the exception: a repo grant\nlists it for `git`, not for `web_fetch`. This file is about what **you** run in here:\n`curl`, `git`, `npm`.\n\n## If `enforcement` is not \"enforced\"\n\n`dry-run` means the intended policy was computed but not applied (`egress.enforce: false`);\n`unenforced` means the backend refused it and the operator accepted that. In both cases the\nlist is what the operator INTENDS you to reach. Stay inside it, and say so if you notice you\ndid not have to.\n";
+/** The narrow slice of a sandbox session this module needs — injected so the publish is testable
+ *  against a fake, and so nothing here can reach the rest of the sandbox surface. */
+export interface EgressStatusSandbox {
+    writeTextFile(options: {
+        path: string;
+        content: string;
+    }): PromiseLike<unknown>;
+    run(options: {
+        command: string;
+    }): PromiseLike<unknown>;
+}
+/** Materialise both files, then chmod the dir read-only: this is the agent's own account of what it may reach, and a file it could rewrite is one it could talk itself into believing. Best-effort — a failure here must never block the policy that was just applied. */
+/** The read half of {@link EgressStatusSandbox} — separate because only ONE caller needs it (the
+ *  OPE-393 subagent invariant) and the publish path must stay unable to read anything. */
+export interface EgressStatusReadableSandbox {
+    readTextFile(options: {
+        path: string;
+    }): PromiseLike<string | null>;
+}
+/** The `policyFingerprint` currently published in this sandbox, or `undefined` when there is none to read. TOTAL and fail-soft by contract: `undefined` means "cannot assert", never "violated" — this is a tripwire on a bug, not a control against the child. */
+export declare function readPublishedEgressFingerprint(sandbox: EgressStatusReadableSandbox): Promise<string | undefined>;
+export declare function publishEgressStatus(sandbox: EgressStatusSandbox, input: EgressStatusInput): Promise<void>;
+//# sourceMappingURL=egress-status.d.ts.map

package/dist/agent/access/egress-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-status.d.ts","sourceRoot":"","sources":["../../../agent/access/egress-status.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAMxD,eAAO,MAAM,kBAAkB,uBAA8B,CAAC;AAC9D,eAAO,MAAM,kBAAkB,qBAA4B,CAAC;AAE5D,uPAAuP;AACvP,MAAM,MAAM,sBAAsB,GAAG,UAAU,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3E,iGAAiG;AACjG,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iGAAiG;IACjG,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gGAAgG;IAChG,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C;gGAC4F;IAC5F,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC;wGACoG;IACpG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;IACvC;mFAC+E;IAC/E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;8EAC0E;IAC1E,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AASD,+OAA+O;AAC/O,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CA0BvF;AAED,wKAAwK;AACxK,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAcnE;AAED,sSAAsS;AACtS,eAAO,MAAM,aAAa,2+GAyDzB,CAAC;AAEF;qFACqF;AACrF,MAAM,WAAW,mBAAmB;IAGlC,aAAa,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAChF,GAAG,CAAC,OAAO,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;CACzD;AAED,0QAA0Q;AAC1Q;0FAC0F;AAC1F,MAAM,WAAW,2BAA2B;IAI1C,YAAY,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,WAAW,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACrE;AAED,mQAAmQ;AACnQ,wBAAsB,8BAA8B,CAAC,OAAO,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAUtH;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/G"}