@struktoai/mirage-node 0.0.7 → 0.0.8

package/dist/io/gateway.js

@@ -0,0 +1,357 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { liveEgress, opened } from '@struktoai/mirage-core/io/gateway';
+import { networkRoute } from '@struktoai/mirage-core/io/network';
+import { PolicyDenied } from '@struktoai/mirage-core/policy/errors';
+import { postNetworkGate, preNetworkGate, } from '@struktoai/mirage-core/policy/policies';
+import { runLanding } from '@struktoai/mirage-core/context/session_context';
+import { runDetached } from '@struktoai/mirage-core/utils/async_context';
+import { AsyncResource } from 'node:async_hooks';
+import dns from 'node:dns/promises';
+import net from 'node:net';
+import { relayAt, watchNetwork } from "./network.js";
+// The loopback address the gateway listens on.
+const LOOPBACK = '127.0.0.1';
+/** Abort a socket so its peer reads a reset, never a clean end. */
+function reset(socket) {
+    if (!socket.destroyed)
+        socket.resetAndDestroy();
+}
+/**
+ * Copy both ways until both sides end, counting each, and cut the
+ * connection with a reset once it passes `limit`'s bytes or the deadline
+ * its seconds set as the attempt began. Mirrors Python's `_relay`.
+ */
+function relay(client, server, limit, counts, deadline) {
+    const cap = limit?.maxBytes ?? null;
+    return new Promise((resolve) => {
+        let ended = 0;
+        let settled = false;
+        const timer = deadline === null
+            ? null
+            : setTimeout(() => {
+                finish('limit');
+            }, Math.max(deadline - Date.now(), 0));
+        const finish = (how) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer !== null)
+                clearTimeout(timer);
+            if (how === 'closed') {
+                client.end();
+                server.end();
+            }
+            else {
+                reset(client);
+                reset(server);
+            }
+            resolve(how);
+        };
+        const pump = (src, dst, side) => {
+            src.on('data', (chunk) => {
+                if (cap !== null && counts[0] + counts[1] + chunk.length > cap) {
+                    const left = Math.max(cap - counts[0] - counts[1], 0);
+                    counts[side] += left;
+                    dst.write(chunk.subarray(0, left));
+                    finish('limit');
+                    return;
+                }
+                counts[side] += chunk.length;
+                if (!dst.write(chunk)) {
+                    src.pause();
+                    dst.once('drain', () => src.resume());
+                }
+            });
+            src.on('end', () => {
+                dst.end();
+                ended += 1;
+                if (ended === 2)
+                    finish('closed');
+            });
+            src.on('error', () => {
+                finish('error');
+            });
+            src.on('close', () => {
+                finish(ended === 0 ? 'error' : 'closed');
+            });
+        };
+        pump(client, server, 0);
+        pump(server, client, 1);
+    });
+}
+/**
+ * The one relay each judged connection of the process passes: a loopback
+ * listener, started apart from any line so its own connections carry no
+ * egress. A connection is matched to its ticket by the port it comes from.
+ * Mirrors Python's `_Gateway`.
+ */
+class Gateway {
+    // The listener on its way up, which every connection before it waits for.
+    static starting = null;
+    server;
+    port = 0;
+    tickets = new Map();
+    waiting = new Map();
+    constructor() {
+        this.server = net.createServer((socket) => {
+            void this.serve(socket);
+        });
+        this.server.unref();
+    }
+    listen() {
+        return new Promise((resolve) => {
+            this.server.listen(0, LOOPBACK, () => {
+                this.port = this.server.address().port;
+                relayAt(LOOPBACK, this.port);
+                resolve();
+            });
+        });
+    }
+    expect(local, ticket) {
+        const waiter = this.waiting.get(local);
+        this.waiting.delete(local);
+        if (waiter !== undefined)
+            waiter(ticket);
+        else
+            this.tickets.set(local, ticket);
+    }
+    claimed(peer) {
+        const ticket = this.tickets.get(peer);
+        this.tickets.delete(peer);
+        if (ticket !== undefined)
+            return Promise.resolve(ticket);
+        return new Promise((resolve) => this.waiting.set(peer, resolve));
+    }
+    async serve(client) {
+        client.on('error', (err) => {
+            console.debug('gateway: program side failed:', err);
+        });
+        client.pause();
+        const ticket = await this.claimed(client.remotePort ?? 0);
+        try {
+            await this.pass(ticket, client);
+        }
+        catch (err) {
+            console.debug('gateway: connection failed:', err);
+            reset(client);
+        }
+    }
+    /**
+     * The addresses a connection to `host` may reach, in the order its lookup
+     * (the program's own, else the system's) gives them, each the rule lets;
+     * the address itself for a bare one.
+     */
+    async reach(ticket) {
+        const { host, port, egress } = ticket;
+        const rule = egress.rule;
+        if (net.isIP(host) !== 0)
+            return ['', rule === null || rule.lets('', host, port) ? [host] : []];
+        const lookup = ticket.lookup;
+        const found = lookup === null
+            ? (await dns.lookup(host, { all: true, verbatim: true })).map((entry) => entry.address)
+            : await new Promise((resolve, reject) => {
+                lookup(host, { all: true }, (err, address) => {
+                    if (err !== null)
+                        reject(err);
+                    else
+                        resolve(Array.isArray(address) ? address.map((entry) => entry.address) : [address]);
+                });
+            });
+        return [host, found.filter((address) => rule === null || rule.lets(host, address, port))];
+    }
+    /**
+     * One address tried and, once it answers, relayed under `limit`, whose
+     * seconds count from the attempt; postNetwork hears how it went either
+     * way. Mirrors Python's `_Gateway._attempt`.
+     */
+    async attempt(ticket, policies, ctx, passed, limit, client) {
+        const started = Date.now();
+        const deadline = limit?.timeoutSeconds == null ? null : started + limit.timeoutSeconds * 1000;
+        const counts = [0, 0];
+        let ended = 'error';
+        let reached = false;
+        try {
+            const server = net.connect({ host: ctx.address, port: ctx.port });
+            const opened = await new Promise((resolve) => {
+                const timer = deadline === null
+                    ? null
+                    : setTimeout(() => {
+                        resolve('late');
+                    }, Math.max(deadline - Date.now(), 0));
+                server.once('connect', () => {
+                    if (timer !== null)
+                        clearTimeout(timer);
+                    resolve('open');
+                });
+                server.once('error', () => {
+                    if (timer !== null)
+                        clearTimeout(timer);
+                    resolve('failed');
+                });
+            });
+            if (opened !== 'open') {
+                server.destroy();
+                if (opened === 'late') {
+                    ended = 'limit';
+                    reached = true;
+                    reset(client);
+                }
+                return reached;
+            }
+            reached = true;
+            client.resume();
+            ended = await relay(client, server, limit, counts, deadline);
+        }
+        finally {
+            const [sent, received] = counts;
+            await ticket
+                .run(() => runLanding(() => postNetworkGate(policies, {
+                ...ctx,
+                bytesSent: sent,
+                bytesReceived: received,
+                seconds: (Date.now() - started) / 1000,
+                ended,
+            }, passed)))
+                .catch((err) => {
+                console.debug('gateway: postNetwork failed:', err);
+            });
+        }
+        return reached;
+    }
+    /**
+     * Each address the connection may reach is a connection of its own:
+     * judged before it is tried, and told how it went, the one reached or the
+     * ones that failed on the way to it. Mirrors Python's `_Gateway._pass`.
+     */
+    async pass(ticket, client) {
+        const policies = ticket.egress.policies;
+        if (policies === null)
+            return;
+        const [host, addresses] = await this.reach(ticket);
+        for (const address of addresses) {
+            const ctx = await ticket.run(() => Promise.resolve(opened(host, address, ticket.port)));
+            let passed;
+            try {
+                passed = await ticket.run(() => preNetworkGate(policies, ctx));
+            }
+            catch (err) {
+                if (!(err instanceof PolicyDenied))
+                    throw err;
+                console.debug(`gateway: ${address} refused:`, err.message);
+                continue;
+            }
+            if (await this.attempt(ticket, policies, ctx, passed[0], passed[1], client))
+                return;
+        }
+        reset(client);
+    }
+}
+let gateway = null;
+function started() {
+    Gateway.starting ??= Promise.resolve(runDetached(async () => {
+        const made = new Gateway();
+        await made.listen();
+        gateway = made;
+        return made;
+    }));
+    return Gateway.starting;
+}
+/**
+ * The egress a socket's connection answers to when a policy may listen for
+ * it, null to connect as asked. Mirrors Python's `_through`.
+ */
+function through(options) {
+    if (options.path !== undefined)
+        return null;
+    const egress = liveEgress().at(-1);
+    if (egress?.policies == null || egress.listening === false)
+        return null;
+    return egress;
+}
+// The connect the gateway hands a connection on to: the network rule's,
+// taken as the gateway starts watching.
+let connect = Reflect.get(net.Socket.prototype, 'connect');
+let watching = false;
+function connecting(...args) {
+    // net.connect hands over [options, callback] already normalized; a direct
+    // call passes (options, callback) or (port, host, callback).
+    const normalized = Array.isArray(args[0]) ? args[0] : null;
+    const first = normalized !== null ? normalized[0] : args[0];
+    const callback = (normalized ?? args).find((arg) => typeof arg === 'function');
+    let options;
+    if (typeof first === 'object' && first !== null) {
+        options = first;
+    }
+    else if (typeof first === 'number' || (typeof first === 'string' && /^\d+$/.test(first))) {
+        options = { port: Number(first), ...(typeof args[1] === 'string' ? { host: args[1] } : {}) };
+    }
+    else {
+        return Reflect.apply(connect, this, args);
+    }
+    const egress = through(options);
+    if (egress === null)
+        return Reflect.apply(connect, this, args);
+    // undici hands the port over as text.
+    const port = Number(options.port);
+    // A routed connection goes, and is judged, where its route names, its end
+    // looked up as the system looks it up.
+    const routed = networkRoute(options.host ?? 'localhost', port);
+    const ticket = {
+        host: routed?.[0] ?? options.host ?? 'localhost',
+        port: routed?.[1] ?? port,
+        egress,
+        lookup: routed === null ? (options.lookup ?? null) : null,
+        run: AsyncResource.bind((fn) => fn()),
+    };
+    const redirect = (made) => {
+        this.once('connect', () => {
+            made.expect(this.localPort ?? 0, ticket);
+        });
+        const redirected = {
+            ...options,
+            host: LOOPBACK,
+            port: made.port,
+            family: 4,
+            autoSelectFamily: false,
+        };
+        delete redirected.lookup;
+        return Reflect.apply(connect, this, typeof callback === 'function' ? [redirected, callback] : [redirected]);
+    };
+    if (gateway !== null && egress.listening === true)
+        return redirect(gateway);
+    // A connection opened before the gateway listens, or before the egress
+    // knows whether a policy listens, waits for both; its writes queue as a
+    // connecting socket's do.
+    Reflect.set(this, 'connecting', true);
+    void egress.hooked
+        .then((hooked) => (hooked ? started().then(redirect) : Reflect.apply(connect, this, args)))
+        .catch((err) => {
+        this.destroy(err instanceof Error ? err : new Error(String(err)));
+    });
+    return this;
+}
+/**
+ * Send every connection the process opens through `through`, once; one with
+ * no egress bound connects as asked. Mirrors Python's `_watch`.
+ */
+export function watch() {
+    if (watching)
+        return;
+    watching = true;
+    watchNetwork();
+    connect = Reflect.get(net.Socket.prototype, 'connect');
+    net.Socket.prototype.connect = connecting;
+}
+//# sourceMappingURL=gateway.js.map

package/dist/io/gateway.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway.js","sourceRoot":"","sources":["../../src/io/gateway.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAe,UAAU,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAA;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAA;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,sCAAsC,CAAA;AAEnE,OAAO,EAEL,eAAe,EACf,cAAc,GACf,MAAM,wCAAwC,CAAA;AAG/C,OAAO,EAAE,UAAU,EAAE,MAAM,gDAAgD,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,MAAM,4CAA4C,CAAA;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,GAAG,MAAM,mBAAmB,CAAA;AACnC,OAAO,GAAG,MAAM,UAAU,CAAA;AAC1B,OAAO,EAAuB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAEzE,+CAA+C;AAC/C,MAAM,QAAQ,GAAG,WAAW,CAAA;AAa5B,mEAAmE;AACnE,SAAS,KAAK,CAAC,MAAkB;IAC/B,IAAI,CAAC,MAAM,CAAC,SAAS;QAAE,MAAM,CAAC,eAAe,EAAE,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,KAAK,CACZ,MAAkB,EAClB,MAAkB,EAClB,KAAmB,EACnB,MAAwB,EACxB,QAAuB;IAEvB,MAAM,GAAG,GAAG,KAAK,EAAE,QAAQ,IAAI,IAAI,CAAA;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,KAAK,GAAG,CAAC,CAAA;QACb,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;YACf,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,UAAU,CACR,GAAG,EAAE;gBACH,MAAM,CAAC,OAAO,CAAC,CAAA;YACjB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CACnC,CAAA;QACP,MAAM,MAAM,GAAG,CAAC,GAAe,EAAQ,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,IAAI,KAAK,KAAK,IAAI;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;YACvC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,CAAC,GAAG,EAAE,CAAA;gBACZ,MAAM,CAAC,GAAG,EAAE,CAAA;YACd,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,MAAM,CAAC,CAAA;gBACb,KAAK,CAAC,MAAM,CAAC,CAAA;YACf,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,CAAA;QACd,CAAC,CAAA;QACD,MAAM,IAAI,GAAG,CAAC,GAAe,EAAE,GAAe,EAAE,IAAW,EAAQ,EAAE;YACnE,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;oBACrD,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAA;oBACpB,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;oBAClC,MAAM,CAAC,OAAO,CAAC,CAAA;oBACf,OAAM;gBACR,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,CAAA;gBAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,KAAK,EAAE,CAAA;oBACX,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;gBACvC,CAAC;YACH,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,GAAG,CAAC,GAAG,EAAE,CAAA;gBACT,KAAK,IAAI,CAAC,CAAA;gBACV,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnC,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,MAAM,CAAC,OAAO,CAAC,CAAA;YACjB,CAAC,CAAC,CAAA;YACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACnB,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;YAC1C,CAAC,CAAC,CAAA;QACJ,CAAC,CAAA;QACD,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;QACvB,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,OAAO;IACX,0EAA0E;IAC1E,MAAM,CAAC,QAAQ,GAA4B,IAAI,CAAA;IACtC,MAAM,CAAY;IAC3B,IAAI,GAAG,CAAC,CAAA;IACS,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAA;IACnC,OAAO,GAAG,IAAI,GAAG,EAAoC,CAAA;IAEtE;QACE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,EAAE;YACxC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACzB,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAA;IACrB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE;gBACnC,IAAI,CAAC,IAAI,GAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAsB,CAAC,IAAI,CAAA;gBAC3D,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC5B,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAa,EAAE,MAAc;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,CAAA;;YACnC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAA;IAClE,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,MAAkB;QACpC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAA;QACrD,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,KAAK,EAAE,CAAA;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,CAAA;QACzD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAA;YACjD,KAAK,CAAC,MAAM,CAAC,CAAA;QACf,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,KAAK,CAAC,MAAc;QAChC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;QACrC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACxB,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,EAAE,EAAE,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC/F,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;QAC5B,MAAM,KAAK,GACT,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;YACvF,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACpC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE;oBAC3C,IAAI,GAAG,KAAK,IAAI;wBAAE,MAAM,CAAC,GAAG,CAAC,CAAA;;wBAE3B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAA;gBACvF,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;QACR,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3F,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,QAAkB,EAClB,GAAmB,EACnB,MAAgC,EAChC,KAAmB,EACnB,MAAkB;QAElB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC1B,MAAM,QAAQ,GAAG,KAAK,EAAE,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,CAAC,cAAc,GAAG,IAAI,CAAA;QAC7F,MAAM,MAAM,GAAqB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACvC,IAAI,KAAK,GAAe,OAAO,CAAA;QAC/B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;YACjE,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAA6B,CAAC,OAAO,EAAE,EAAE;gBACvE,MAAM,KAAK,GACT,QAAQ,KAAK,IAAI;oBACf,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,UAAU,CACR,GAAG,EAAE;wBACH,OAAO,CAAC,MAAM,CAAC,CAAA;oBACjB,CAAC,EACD,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CACnC,CAAA;gBACP,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;oBAC1B,IAAI,KAAK,KAAK,IAAI;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBACvC,OAAO,CAAC,MAAM,CAAC,CAAA;gBACjB,CAAC,CAAC,CAAA;gBACF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;oBACxB,IAAI,KAAK,KAAK,IAAI;wBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;oBACvC,OAAO,CAAC,QAAQ,CAAC,CAAA;gBACnB,CAAC,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YACF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtB,MAAM,CAAC,OAAO,EAAE,CAAA;gBAChB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;oBACtB,KAAK,GAAG,OAAO,CAAA;oBACf,OAAO,GAAG,IAAI,CAAA;oBACd,KAAK,CAAC,MAAM,CAAC,CAAA;gBACf,CAAC;gBACD,OAAO,OAAO,CAAA;YAChB,CAAC;YACD,OAAO,GAAG,IAAI,CAAA;YACd,MAAM,CAAC,MAAM,EAAE,CAAA;YACf,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC9D,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,MAAM,CAAA;YAC/B,MAAM,MAAM;iBACT,GAAG,CAAC,GAAG,EAAE,CACR,UAAU,CAAC,GAAG,EAAE,CACd,eAAe,CACb,QAAQ,EACR;gBACE,GAAG,GAAG;gBACN,SAAS,EAAE,IAAI;gBACf,aAAa,EAAE,QAAQ;gBACvB,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI;gBACtC,KAAK;aACN,EACD,MAAM,CACP,CACF,CACF;iBACA,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACtB,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;YACpD,CAAC,CAAC,CAAA;QACN,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,MAAkB;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAA;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAM;QAC7B,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAClD,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,GAAG,GAAmB,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAChD,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CACpD,CAAA;YACD,IAAI,MAAkD,CAAA;YACtD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;YAChE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC;oBAAE,MAAM,GAAG,CAAA;gBAC7C,OAAO,CAAC,KAAK,CAAC,YAAY,OAAO,WAAW,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;gBAC1D,SAAQ;YACV,CAAC;YACD,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;gBAAE,OAAM;QACrF,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,CAAA;IACf,CAAC;;AAGH,IAAI,OAAO,GAAmB,IAAI,CAAA;AAElC,SAAS,OAAO;IACd,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,CAClC,WAAW,CAAC,KAAK,IAAI,EAAE;QACrB,MAAM,IAAI,GAAG,IAAI,OAAO,EAAE,CAAA;QAC1B,MAAM,IAAI,CAAC,MAAM,EAAE,CAAA;QACnB,OAAO,GAAG,IAAI,CAAA;QACd,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CACH,CAAA;IACD,OAAO,OAAO,CAAC,QAAQ,CAAA;AACzB,CAAC;AAED;;;GAGG;AACH,SAAS,OAAO,CAAC,OAAuB;IACtC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IAClC,IAAI,MAAM,EAAE,QAAQ,IAAI,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IACvE,OAAO,MAAM,CAAA;AACf,CAAC;AAGD,wEAAwE;AACxE,wCAAwC;AACxC,IAAI,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAY,CAAA;AACrE,IAAI,QAAQ,GAAG,KAAK,CAAA;AAEpB,SAAS,UAAU,CAAmB,GAAG,IAAe;IACtD,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3D,MAAM,QAAQ,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,CAAC,CAAA;IAC9E,IAAI,OAAuB,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,GAAG,KAAuB,CAAA;IACnC,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;IAC9F,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAC9D,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,IAAuB,CAAC,CAAA;IACpD,0EAA0E;IAC1E,uCAAuC;IACvC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,IAAI,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAW;QACrB,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW;QAChD,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;QACzB,MAAM;QACN,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;QACzD,GAAG,EAAE,aAAa,CAAC,IAAI,CAAC,CAAI,EAAoB,EAAc,EAAE,CAAC,EAAE,EAAE,CAAC;KACvE,CAAA;IACD,MAAM,QAAQ,GAAG,CAAC,IAAa,EAAc,EAAE;QAC7C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;YACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,EAAE,MAAM,CAAC,CAAA;QAC1C,CAAC,CAAC,CAAA;QACF,MAAM,UAAU,GAAmB;YACjC,GAAG,OAAO;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,CAAC;YACT,gBAAgB,EAAE,KAAK;SACxB,CAAA;QACD,OAAO,UAAU,CAAC,MAAM,CAAA;QACxB,OAAO,OAAO,CAAC,KAAK,CAClB,OAAO,EACP,IAAI,EACJ,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CACvE,CAAA;IACH,CAAC,CAAA;IACD,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAA;IAC3E,uEAAuE;IACvE,wEAAwE;IACxE,0BAA0B;IAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,CAAA;IACrC,KAAK,MAAM,CAAC,MAAM;SACf,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;SAC1F,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;QACtB,IAAI,CAAC,OAAO,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IACJ,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,KAAK;IACnB,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,YAAY,EAAE,CAAA;IACd,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAY,CAAA;IACjE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,UAAiD,CAAA;AAClF,CAAC"}

package/dist/io/network.d.ts

@@ -0,0 +1,35 @@
+import { type NetworkRule } from '@struktoai/mirage-core/io/network';
+import { Policies } from '@struktoai/mirage-core/policy/policies';
+import net from 'node:net';
+import { Agent } from 'undici';
+export type ConnectOptions = net.TcpSocketConnectOpts & {
+    path?: string;
+};
+/**
+ * Let connections to a gateway listener through the connect hook, which
+ * judges each one behind it. Mirrors Python's `relay_at`.
+ */
+export declare function relayAt(host: string, port: number): void;
+/**
+ * The pool a fetch under `key` (a rule, or a workspace's policies) takes,
+ * built on first use; `unverified` for curl's -k.
+ */
+export declare function rulePool(key: NetworkRule | Policies, unverified?: boolean): Agent;
+/**
+ * What a fetch's pooled sockets are kept apart by: the policies of a
+ * workspace that may judge its connections, else the rule of the call
+ * making it, so no socket one workspace opened carries another's request
+ * past its rule or its policies; null to share the process's pool.
+ */
+export declare function poolOwner(): NetworkRule | Policies | null;
+/** Close the pools a rule or a workspace's policies hold, as the workspace closes. */
+export declare function releaseNetwork(key: NetworkRule | Policies): Promise<void>;
+/**
+ * Start judging every connection the process opens, once: each socket's
+ * connect asks the rule of the workspace whose line or op opens it, and
+ * fetch keeps one pool per rule. Called as the first workspace with a rule
+ * is built; a connection with no rule bound goes on at once. Mirrors
+ * Python's `watch_network`.
+ */
+export declare function watchNetwork(): void;
+//# sourceMappingURL=network.d.ts.map

package/dist/io/network.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/io/network.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,KAAK,WAAW,EAIjB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AAGjE,OAAO,GAAG,MAAM,UAAU,CAAA;AAE1B,OAAO,EAAE,KAAK,EAA4C,MAAM,QAAQ,CAAA;AAKxE,MAAM,MAAM,cAAc,GAAG,GAAG,CAAC,oBAAoB,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAA;AAWzE;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAExD;AA0FD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,EAAE,UAAU,UAAQ,GAAG,KAAK,CAW/E;AAED;;;;;GAKG;AACH,wBAAgB,SAAS,IAAI,WAAW,GAAG,QAAQ,GAAG,IAAI,CAKzD;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/E;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,IAAI,CAWnC"}

package/dist/io/network.js

@@ -0,0 +1,187 @@
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+// ========= Copyright 2026 @ Strukto.AI All Rights Reserved. =========
+import { liveEgress } from '@struktoai/mirage-core/io/gateway';
+import { networkBound, networkLets, networkRoute, } from '@struktoai/mirage-core/io/network';
+import { Policies } from '@struktoai/mirage-core/policy/policies';
+import { AsyncResource } from 'node:async_hooks';
+import dns, {} from 'node:dns';
+import net from 'node:net';
+import { constants } from 'node:os';
+import { Agent, getGlobalDispatcher, setGlobalDispatcher } from 'undici';
+const connect = Reflect.get(net.Socket.prototype, 'connect');
+let watching = false;
+// The listeners the gateway relays from, which a connect may always reach:
+// the gateway judges what is behind them.
+const relays = new Set();
+/**
+ * Let connections to a gateway listener through the connect hook, which
+ * judges each one behind it. Mirrors Python's `relay_at`.
+ */
+export function relayAt(host, port) {
+    relays.add(`${host}:${String(port)}`);
+}
+/** What a refused connection fails with, as Node's own connect errors read. */
+function refusal(host, port) {
+    return Object.assign(new Error(`connect EACCES ${host}:${String(port)}`), {
+        code: 'EACCES',
+        errno: -constants.errno.EACCES,
+        syscall: 'connect',
+        address: host,
+        port,
+    });
+}
+/**
+ * `options` with a lookup that drops each address the rule refuses for the
+ * name it was resolved for, and fails when none is left.
+ */
+function judged(options, lets) {
+    const lookup = options.lookup ?? dns.lookup;
+    const port = options.port;
+    const judge = (hostname, given, callback) => {
+        lookup(hostname, given, (err, address, family) => {
+            if (err !== null) {
+                callback(err, address, family);
+            }
+            else if (Array.isArray(address)) {
+                const left = address.filter((entry) => lets(hostname, entry.address, port));
+                if (left.length === 0)
+                    callback(refusal(hostname, port), []);
+                else
+                    callback(null, left);
+            }
+            else if (lets(hostname, address, port)) {
+                callback(null, address, family);
+            }
+            else {
+                callback(refusal(hostname, port), address, family);
+            }
+        });
+    };
+    return { ...options, lookup: judge };
+}
+function connecting(...args) {
+    if (networkBound() === null)
+        return Reflect.apply(connect, this, args);
+    // net.connect hands over [options, callback] already normalized; a
+    // direct call passes (options, callback) or (port, host, callback).
+    const normalized = Array.isArray(args[0]) ? args[0] : null;
+    const first = normalized !== null ? normalized[0] : args[0];
+    let options;
+    if (typeof first === 'object' && first !== null) {
+        options = first;
+    }
+    else if (typeof first === 'number' || (typeof first === 'string' && /^\d+$/.test(first))) {
+        options = { port: Number(first), ...(typeof args[1] === 'string' ? { host: args[1] } : {}) };
+        args = [options, args.find((arg) => typeof arg === 'function')];
+    }
+    else {
+        return Reflect.apply(connect, this, args);
+    }
+    if (options.path !== undefined)
+        return Reflect.apply(connect, this, args);
+    // Bound here, so a lookup a resolver answers on another context still
+    // asks the rule of the call that opened the connection.
+    const lets = AsyncResource.bind(networkLets);
+    if (relays.has(`${options.host ?? 'localhost'}:${String(options.port)}`)) {
+        return Reflect.apply(connect, this, args);
+    }
+    // A routed connection goes, and is judged, where its route names, its end
+    // looked up as the system looks it up; undici hands the port over as text.
+    const routed = networkRoute(options.host ?? 'localhost', Number(options.port));
+    if (routed !== null) {
+        options = { ...options, host: routed[0], port: routed[1] };
+        delete options.lookup;
+        if (normalized !== null)
+            normalized[0] = options;
+        else
+            args[0] = options;
+    }
+    const host = options.host ?? 'localhost';
+    if (net.isIP(host) !== 0) {
+        if (lets('', host, options.port))
+            return Reflect.apply(connect, this, args);
+        process.nextTick(() => this.destroy(refusal(host, options.port)));
+        return this;
+    }
+    const replaced = judged(options, lets);
+    if (normalized !== null)
+        normalized[0] = replaced;
+    else
+        args[0] = replaced;
+    return Reflect.apply(connect, this, args);
+}
+// The pools fetch keeps for each rule, and for each workspace whose policies
+// listen for connections, verified and unverified (curl's -k), so a socket a
+// workspace opened is never reused for a request another workspace's rule
+// never let through or its policies never saw. A policies pool keeps no
+// socket alive: preNetwork judges each line's connections, and a socket an
+// earlier line opened would carry a later one past it, as Python opens a
+// client per request.
+const pools = new WeakMap();
+/**
+ * The pool a fetch under `key` (a rule, or a workspace's policies) takes,
+ * built on first use; `unverified` for curl's -k.
+ */
+export function rulePool(key, unverified = false) {
+    let held = pools.get(key);
+    if (held === undefined) {
+        held = {};
+        pools.set(key, held);
+    }
+    const reuse = key instanceof Policies ? { pipelining: 0 } : {};
+    if (unverified) {
+        return (held.unverified ??= new Agent({ ...reuse, connect: { rejectUnauthorized: false } }));
+    }
+    return (held.verified ??= new Agent(reuse));
+}
+/**
+ * What a fetch's pooled sockets are kept apart by: the policies of a
+ * workspace that may judge its connections, else the rule of the call
+ * making it, so no socket one workspace opened carries another's request
+ * past its rule or its policies; null to share the process's pool.
+ */
+export function poolOwner() {
+    const bound = liveEgress().at(-1);
+    if (bound === undefined)
+        return networkBound();
+    if (bound.policies !== null && bound.listening !== false)
+        return bound.policies;
+    return bound.rule;
+}
+/** Close the pools a rule or a workspace's policies hold, as the workspace closes. */
+export async function releaseNetwork(key) {
+    const held = pools.get(key);
+    pools.delete(key);
+    await Promise.all([held?.verified?.close(), held?.unverified?.close()]);
+}
+/**
+ * Start judging every connection the process opens, once: each socket's
+ * connect asks the rule of the workspace whose line or op opens it, and
+ * fetch keeps one pool per rule. Called as the first workspace with a rule
+ * is built; a connection with no rule bound goes on at once. Mirrors
+ * Python's `watch_network`.
+ */
+export function watchNetwork() {
+    if (watching)
+        return;
+    watching = true;
+    net.Socket.prototype.connect = connecting;
+    setGlobalDispatcher(getGlobalDispatcher().compose((dispatch) => (options, handler) => {
+        const key = poolOwner();
+        if (key === null)
+            return dispatch(options, handler);
+        return rulePool(key).dispatch(options, handler);
+    }));
+}
+//# sourceMappingURL=network.js.map

package/dist/io/network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/io/network.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,kEAAkE;AAClE,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,iDAAiD;AACjD,EAAE;AACF,sEAAsE;AACtE,oEAAoE;AACpE,2EAA2E;AAC3E,sEAAsE;AACtE,iCAAiC;AACjC,uEAAuE;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAC9D,OAAO,EAEL,YAAY,EACZ,WAAW,EACX,YAAY,GACb,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,wCAAwC,CAAA;AACjE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,GAAG,EAAE,EAA0C,MAAM,UAAU,CAAA;AACtE,OAAO,GAAG,MAAM,UAAU,CAAA;AAC1B,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,QAAQ,CAAA;AAOxE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAG5C,CAAA;AACf,IAAI,QAAQ,GAAG,KAAK,CAAA;AACpB,2EAA2E;AAC3E,0CAA0C;AAC1C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;AAEhC;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,IAAY;IAChD,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACvC,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QACxE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM;QAC9B,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,IAAI;QACb,IAAI;KACL,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,OAAuB,EAAE,IAAwB;IAC/D,MAAM,MAAM,GAAY,OAAO,CAAC,MAA6B,IAAK,GAAG,CAAC,MAAiB,CAAA;IACvF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;IACzB,MAAM,KAAK,GAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE;QAClD,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YAC/C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;gBACjB,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YAChC,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;gBAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;oBAAE,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;;oBACvD,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC3B,CAAC;iBAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzC,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACjC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAA;YACpD,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,KAA2B,EAAE,CAAA;AAC5D,CAAC;AAED,SAAS,UAAU,CAAmB,GAAG,IAAe;IACtD,IAAI,YAAY,EAAE,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IACtE,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAe,CAAC,CAAC,CAAC,IAAI,CAAA;IACzE,MAAM,KAAK,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC3D,IAAI,OAAuB,CAAA;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,GAAG,KAAuB,CAAA;IACnC,CAAC;SAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC5F,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,UAAU,CAAC,CAAC,CAAA;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IACzE,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;IAC3C,CAAC;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,IAAuB,CAAC,CAAC,CAAA;IACjG,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1D,OAAO,OAAO,CAAC,MAAM,CAAA;QACrB,IAAI,UAAU,KAAK,IAAI;YAAE,UAAU,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;;YAC3C,IAAI,CAAC,CAAC,CAAC,GAAG,OAAO,CAAA;IACxB,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAA;IACxC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;QAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACjE,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;IACtC,IAAI,UAAU,KAAK,IAAI;QAAE,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAA;;QAC5C,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAA;IACvB,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AAC3C,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,wEAAwE;AACxE,2EAA2E;AAC3E,yEAAyE;AACzE,sBAAsB;AACtB,MAAM,KAAK,GAAG,IAAI,OAAO,EAAoE,CAAA;AAE7F;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,GAA2B,EAAE,UAAU,GAAG,KAAK;IACtE,IAAI,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,GAAG,EAAE,CAAA;QACT,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,YAAY,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,IAAI,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;IACjC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,EAAE,CAAA;IAC9C,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAA;IAC/E,OAAO,KAAK,CAAC,IAAI,CAAA;AACnB,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAA2B;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACjB,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,QAAQ;QAAE,OAAM;IACpB,QAAQ,GAAG,IAAI,CAAA;IACf,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,GAAG,UAAiD,CAAA;IAChF,mBAAmB,CACjB,mBAAmB,EAAE,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;QAC/D,MAAM,GAAG,GAAG,SAAS,EAAE,CAAA;QACvB,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjD,CAAC,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/io/spool.js

@@ -9,14 +9,14 @@ async function createStore() {
         const file = await open(join(directory, 'data'), 'w+');
         let length = 0;
         return {
-            async append(data) {
+            async write(at, data) {
                 let offset = 0;
                 while (offset < data.length) {
-                    const { bytesWritten } = await file.write(data, offset, data.length - offset, length);
+                    const { bytesWritten } = await file.write(data, offset, data.length - offset, at + offset);
                     if (bytesWritten === 0)
                         throw new Error('spool write made no progress');
                     offset += bytesWritten;
-                    length += bytesWritten;
+                    length = Math.max(length, at + offset);
                 }
             },
             async read(offset, size) {

package/dist/io/spool.js.map

@@ -1 +1 @@
-{"version":3,"file":"spool.js","sourceRoot":"","sources":["../../src/io/spool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAmB,MAAM,iCAAiC,CAAA;AAElF,KAAK,UAAU,WAAW;IACxB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACtD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO;YACL,KAAK,CAAC,MAAM,CAAC,IAAI;gBACf,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC5B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,MAAM,CAAC,CAAA;oBACrF,IAAI,YAAY,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;oBACvE,MAAM,IAAI,YAAY,CAAA;oBACtB,MAAM,IAAI,YAAY,CAAA;gBACxB,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI;gBACrB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC3E,IAAI,KAAK,GAAG,CAAC,CAAA;gBACb,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,MAAM,EACN,KAAK,EACL,MAAM,CAAC,MAAM,GAAG,KAAK,EACrB,MAAM,GAAG,KAAK,CACf,CAAA;oBACD,IAAI,SAAS,KAAK,CAAC;wBAAE,MAAK;oBAC1B,KAAK,IAAI,SAAS,CAAA;gBACpB,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,OAAO,IAAI,KAAK,OAAO;oBACrB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3D,CAAC;YACD,KAAK,CAAC,KAAK;gBACT,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;wBAAS,CAAC;oBACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC;SACF,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,eAAe,CAAC,WAAW,CAAC,CAAA"}
+{"version":3,"file":"spool.js","sourceRoot":"","sources":["../../src/io/spool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,eAAe,EAAmB,MAAM,iCAAiC,CAAA;AAElF,KAAK,UAAU,WAAW;IACxB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAA;IAChE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;QACtD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,OAAO;YACL,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI;gBAClB,IAAI,MAAM,GAAG,CAAC,CAAA;gBACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;oBAC5B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,CAAA;oBAC1F,IAAI,YAAY,KAAK,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;oBACvE,MAAM,IAAI,YAAY,CAAA;oBACtB,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,CAAA;gBACxC,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI;gBACrB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;gBAC3E,IAAI,KAAK,GAAG,CAAC,CAAA;gBACb,OAAO,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;oBAC7B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CACnC,MAAM,EACN,KAAK,EACL,MAAM,CAAC,MAAM,GAAG,KAAK,EACrB,MAAM,GAAG,KAAK,CACf,CAAA;oBACD,IAAI,SAAS,KAAK,CAAC;wBAAE,MAAK;oBAC1B,KAAK,IAAI,SAAS,CAAA;gBACpB,CAAC;gBACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;YAClC,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,IAAI;gBACb,OAAO,IAAI,KAAK,OAAO;oBACrB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;oBACrC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAA;YAC3D,CAAC;YACD,KAAK,CAAC,KAAK;gBACT,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;gBACpB,CAAC;wBAAS,CAAC;oBACT,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC;SACF,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACrD,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,eAAe,CAAC,WAAW,CAAC,CAAA"}