@dharma-ai-labs/agent-fabric 0.2.133 → 0.2.135

package/dist/containerRelayLifecycle.test.js

@@ -0,0 +1,502 @@
+import assert from 'node:assert/strict';
+import { chmod, copyFile, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import { spawn } from 'node:child_process';
+import * as lifecycle from './containerRelayLifecycle.js';
+import { enableRelayAutostart, relayAutostartStatus, startRelayAutostart, stopRelayAutostart, disableRelayAutostart } from './relayAutostart.js';
+// The filesystem and lifecycle receipts are real. Only PID1 identity and the OS
+// command boundary are injected: a unit test must never signal host PID1.
+async function fixture() {
+    const root = await mkdtemp(join(tmpdir(), 'dharma-container-lifecycle-'));
+    const home = join(root, 'device');
+    const workspace = join(root, 'checkout');
+    await mkdir(join(home, 'relay'), { recursive: true, mode: 0o700 });
+    await mkdir(join(workspace, '.dharma'), { recursive: true, mode: 0o700 });
+    const uid = process.getuid?.() ?? 1000;
+    const identity = { pid: 1, uid, startTicks: '12345',
+        argv: ['/usr/bin/node', '/fixture/cli/dist/bin.js', 'relay', 'container-entrypoint'] };
+    const marker = { schema: 'dharma.container-entrypoint/v1', home, pid: 1, uid,
+        startTicks: identity.startTicks };
+    await writeFile(join(home, 'relay', 'container-entrypoint.json'), JSON.stringify(marker), { mode: 0o600 });
+    await writeFile(join(workspace, '.dharma', 'approved-policy.json'), '{}', { mode: 0o600 });
+    const calls = [];
+    const options = { platform: 'linux', uid, userHome: root, home, workspace,
+        launcher: join(workspace, '.dharma', 'bin', 'dharma'),
+        policy: join(workspace, '.dharma', 'approved-policy.json'), version: '0.2.134',
+        containerRuntime: { identity: async () => identity, canonicalEntrypoint: identity.argv[1], runtimeVersion: '0.2.134',
+            childIdentity: async (pid) => {
+                const actual = await lifecycle.readContainerChildIdentity(pid);
+                // A process fixture is parented by this test, not the container's PID1.
+                assert.equal(actual.parentPid, process.pid);
+                return { ...actual, parentPid: 1 };
+            } },
+        run: async (file, args) => { calls.push([file, ...args]); return { stdout: 'enabled\n' }; } };
+    return { root, home, marker, identity, calls, options };
+}
+// Container PID1 and child identity are Linux /proc contracts. Other hosts
+// qualify rejection/schema behavior through the public command tests.
+const posix = { skip: process.platform !== 'linux' };
+test('owned container PID1 enables startup without claiming or modifying the OS-user systemd slot', posix, async () => {
+    const f = await fixture();
+    const friday = join(f.root, '.config', 'systemd', 'user', 'dharma-agent-fabric.service');
+    await mkdir(join(f.root, '.config', 'systemd', 'user'), { recursive: true });
+    await writeFile(friday, 'foreign Friday service', { mode: 0o600 });
+    const state = await enableRelayAutostart(f.options);
+    assert.equal(state.backend, 'container-entrypoint');
+    assert.equal(state.state, 'enabled');
+    assert.equal(await readFile(friday, 'utf8'), 'foreign Friday service');
+    assert.deepEqual(f.calls, []);
+    assert.equal((await relayAutostartStatus(f.options)).state, 'enabled');
+});
+test('container lifecycle start stop and disable only change its owned control receipt', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    await stopRelayAutostart(f.options);
+    const control = join(f.home, 'relay', 'container-control.json');
+    assert.equal(JSON.parse(await readFile(control, 'utf8')).running, false);
+    await startRelayAutostart(f.options);
+    assert.equal(JSON.parse(await readFile(control, 'utf8')).running, true);
+    assert.equal((await disableRelayAutostart(f.options)).state, 'disabled');
+    assert.equal((await relayAutostartStatus(f.options)).state, 'disabled');
+    assert.deepEqual(f.calls, []);
+});
+test('a sleep PID1 cannot assert owned container startup and cannot fall through to systemd', posix, async () => {
+    const f = await fixture();
+    f.identity.argv = ['sleep', 'infinity'];
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+    assert.deepEqual(f.calls, []);
+});
+test('stale marker after a different container boot is rejected until the actual entrypoint renews it', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    f.identity.startTicks = '99999';
+    assert.equal((await relayAutostartStatus(f.options)).state, 'unavailable');
+    await assert.rejects(startRelayAutostart(f.options), /owned startup|container_startup_unavailable/);
+    assert.deepEqual(f.calls, []);
+});
+test('foreign home marker cannot claim ownership', posix, async () => {
+    const f = await fixture();
+    await writeFile(join(f.home, 'relay', 'container-entrypoint.json'), JSON.stringify({ ...f.marker, home: '/foreign' }));
+    await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+    assert.deepEqual(f.calls, []);
+});
+function entrypoint() {
+    const run = lifecycle.runOwnedContainerEntrypoint;
+    assert.equal(typeof run, 'function', 'released container lifecycle has no owned entrypoint loop');
+    return run;
+}
+async function until(condition, milliseconds = 3000) {
+    const deadline = Date.now() + milliseconds;
+    while (!condition()) {
+        if (Date.now() >= deadline)
+            throw new Error('owned child fixture did not reach its expected state');
+        await new Promise(resolve => setTimeout(resolve, 10));
+    }
+}
+const exited = (child) => child.exitCode !== null || child.signalCode !== null;
+test('entrypoint starts only its owned supervisor, stops it, and reconnects after an explicit start', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    const controller = new AbortController();
+    const children = [];
+    const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: registration => {
+            assert.equal(registration.policy, f.options.policy);
+            const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+            children.push(child);
+            return child;
+        } });
+    const watchdog = setTimeout(() => controller.abort(), 5000);
+    try {
+        await enableRelayAutostart(f.options);
+        await until(() => children.length === 1);
+        await stopRelayAutostart(f.options);
+        await until(() => exited(children[0]));
+        await startRelayAutostart(f.options);
+        await until(() => children.length === 2);
+    }
+    finally {
+        clearTimeout(watchdog);
+        controller.abort();
+    }
+    assert.equal((await result).stopped, true);
+    assert.equal(children.every(exited), true);
+    assert.deepEqual(f.calls, []);
+});
+test('entrypoint relaunches a failed owned child and renews boot identity while retaining startup configuration', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const children = [];
+    async function boot() {
+        const controller = new AbortController();
+        const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+            containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+            spawnRelay: () => {
+                const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+                children.push(child);
+                return child;
+            } });
+        return { controller, result };
+    }
+    const first = await boot();
+    try {
+        await until(() => children.length === 1);
+        children[0].kill('SIGTERM');
+        await until(() => children.length === 2);
+    }
+    finally {
+        first.controller.abort();
+    }
+    assert.equal((await first.result).restarts, 1);
+    f.identity.startTicks = '54321';
+    const second = await boot();
+    try {
+        await until(() => children.length === 3);
+        assert.equal((await relayAutostartStatus(f.options)).state, 'enabled');
+        const marker = JSON.parse(await readFile(join(f.home, 'relay', 'container-entrypoint.json'), 'utf8'));
+        assert.equal(marker.startTicks, '54321');
+    }
+    finally {
+        second.controller.abort();
+    }
+    await second.result;
+    assert.equal(children.every(exited), true);
+});
+test('unconfigured entrypoint waits without enrolling, calling a provider, or launching a relay', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    const controller = new AbortController();
+    let launches = 0;
+    const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => { launches++; throw new Error('must not launch'); } });
+    await new Promise(resolve => setTimeout(resolve, 40));
+    controller.abort();
+    await result;
+    assert.equal(launches, 0);
+});
+test('corrupt startup authority fails closed and reaps the owned child without leaking raw input', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const controller = new AbortController();
+    let child;
+    const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' }) });
+    const failure = assert.rejects(result, error => {
+        assert.match(String(error), /container_startup_unavailable/);
+        assert.doesNotMatch(String(error), /CANARY_PRIVATE_INPUT/);
+        return true;
+    });
+    await until(() => Boolean(child));
+    await writeFile(join(f.home, 'relay', 'autostart.json'), 'CANARY_PRIVATE_INPUT');
+    await failure;
+    assert.equal(exited(child), true);
+});
+test('locked protected consumer blocks startup without launching a relay until explicitly unlocked', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const controller = new AbortController();
+    let ready = false;
+    const children = [];
+    const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, pollMs: 10, restartDelayMs: 10,
+        consumerStoreReady: async () => ready,
+        spawnRelay: () => {
+            const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+            children.push(child);
+            return child;
+        } });
+    try {
+        await until(() => false, 50).catch(() => { });
+        assert.equal(children.length, 0);
+        const heartbeat = JSON.parse(await readFile(join(f.home, 'relay', 'container-heartbeat.json'), 'utf8'));
+        assert.equal(heartbeat.lifecycle, 'blocked');
+        assert.equal(heartbeat.reason, 'consumer_store_locked_or_unavailable');
+        ready = true;
+        await until(() => children.length === 1);
+    }
+    finally {
+        controller.abort();
+    }
+    await result;
+    assert.equal(children.every(exited), true);
+});
+test('duplicate owned entrypoint cannot take over a live lifecycle lease', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    const controller = new AbortController();
+    const options = { home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => { throw new Error('unconfigured'); } };
+    const first = run(options);
+    try {
+        await until(() => false, 40).catch(() => { });
+        await assert.rejects(run(options), /container_entrypoint_busy/);
+    }
+    finally {
+        controller.abort();
+    }
+    await first;
+});
+test('configured entrypoint cannot claim running startup from a nonexistent child heartbeat', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const control = JSON.parse(await readFile(join(f.home, 'relay', 'container-control.json'), 'utf8'));
+    await writeFile(join(f.home, 'relay', 'container-heartbeat.json'), JSON.stringify({
+        schema: 'dharma.container-relay-heartbeat/v1', home: f.home, startTicks: f.identity.startTicks,
+        polledAt: Date.now(), lifecycle: 'running', reason: null, registrationHash: control.registrationHash,
+        childPid: 999999999, childStartTicks: '12345',
+    }), { mode: 0o600 });
+    assert.notEqual((await relayAutostartStatus(f.options)).lifecycle, 'running');
+});
+test('PID1 must use the exact canonical CLI entrypoint and non-root owner', posix, async () => {
+    for (const change of ['script', 'uid', 'extra-argument', 'ticks']) {
+        const f = await fixture();
+        if (change === 'script')
+            f.identity.argv[1] = '/foreign/cli/dist/bin.js';
+        if (change === 'uid')
+            f.identity.uid++;
+        if (change === 'extra-argument')
+            f.identity.argv.push('--grant');
+        if (change === 'ticks')
+            f.identity.startTicks = 'invalid';
+        await assert.rejects(enableRelayAutostart(f.options), /container_startup_unavailable/);
+        assert.deepEqual(f.calls, []);
+    }
+});
+test('private lifecycle marker and control reject unsafe files and malformed contents without reflecting input', posix, async () => {
+    for (const name of ['container-entrypoint.json', 'container-control.json']) {
+        for (const kind of ['symlink', 'world-writable', 'oversize', 'malformed', 'foreign-uid']) {
+            const f = await fixture();
+            await enableRelayAutostart(f.options);
+            const path = join(f.home, 'relay', name);
+            if (kind === 'symlink') {
+                const target = join(f.root, 'foreign-canary.json');
+                await writeFile(target, 'CANARY_PRIVATE_INPUT', { mode: 0o600 });
+                await rm(path);
+                await symlink(target, path);
+            }
+            else if (kind === 'world-writable')
+                await chmod(path, 0o666);
+            else if (kind === 'oversize')
+                await writeFile(path, 'CANARY_PRIVATE_INPUT'.repeat(4096));
+            else if (kind === 'malformed')
+                await writeFile(path, 'CANARY_PRIVATE_INPUT');
+            else
+                f.options.uid++;
+            const status = await relayAutostartStatus(f.options);
+            assert.equal(status.state, 'unavailable', `${name}/${kind}`);
+            assert.doesNotMatch(JSON.stringify(status), /CANARY_PRIVATE_INPUT/);
+            await assert.rejects(startRelayAutostart(f.options), /owned startup|container_startup_unavailable/);
+            assert.deepEqual(f.calls, []);
+        }
+    }
+});
+test('entrypoint does not launch a registration from a different installed runtime version', posix, async () => {
+    const run = entrypoint();
+    const f = await fixture();
+    await enableRelayAutostart({ ...f.options, version: '0.0.1' });
+    const controller = new AbortController();
+    let launches = 0;
+    const result = run({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => { launches++; return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' }); } });
+    await new Promise(resolve => setTimeout(resolve, 50));
+    controller.abort();
+    await result;
+    assert.equal(launches, 0);
+});
+test('stale heartbeat and reused or foreign child identity cannot assert live startup', posix, async () => {
+    for (const kind of ['stale', 'reused', 'foreign-parent', 'foreign-owner']) {
+        const f = await fixture();
+        await enableRelayAutostart(f.options);
+        const control = JSON.parse(await readFile(join(f.home, 'relay', 'container-control.json'), 'utf8'));
+        const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+        try {
+            const identity = await lifecycle.readContainerChildIdentity(child.pid);
+            if (kind === 'foreign-parent' || kind === 'foreign-owner') {
+                f.options.containerRuntime.childIdentity = async () => ({ ...identity,
+                    uid: kind === 'foreign-owner' ? identity.uid + 1 : identity.uid,
+                    parentPid: kind === 'foreign-parent' ? process.pid : 1 });
+            }
+            await writeFile(join(f.home, 'relay', 'container-heartbeat.json'), JSON.stringify({
+                schema: 'dharma.container-relay-heartbeat/v1', home: f.home, startTicks: f.identity.startTicks,
+                polledAt: Date.now() - (kind === 'stale' ? 20_000 : 0), lifecycle: 'running', reason: null,
+                registrationHash: control.registrationHash, childPid: child.pid,
+                childStartTicks: kind === 'reused' ? String(BigInt(identity.startTicks) + 1n) : identity.startTicks,
+            }), { mode: 0o600 });
+            const status = await relayAutostartStatus(f.options);
+            assert.equal(status.state, 'unavailable', kind);
+            assert.equal(status.reason, 'container_startup_unavailable', kind);
+        }
+        finally {
+            child.kill('SIGTERM');
+            await until(() => exited(child));
+        }
+    }
+});
+test('concurrent owned controls are atomic and disabling reaps interrupted owned work', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const controller = new AbortController();
+    const children = [];
+    const result = entrypoint()({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => {
+            const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+            children.push(child);
+            return child;
+        } });
+    try {
+        await until(() => children.length === 1);
+        const registration = await lifecycle.readContainerRegistration(f.options);
+        assert.ok(registration);
+        await Promise.all(Array.from({ length: 12 }, (_, index) => lifecycle.containerStartupControl(f.options, registration, index % 2 === 0)));
+        assert.equal(typeof JSON.parse(await readFile(join(f.home, 'relay', 'container-control.json'), 'utf8')).running, 'boolean');
+        // No subsequent writer; disable is terminal for this registration.
+        await disableRelayAutostart(f.options);
+        await until(() => children.every(exited));
+        assert.equal((await relayAutostartStatus(f.options)).state, 'disabled');
+    }
+    finally {
+        controller.abort();
+    }
+    await result;
+});
+test('SIGTERM to an owned process fixture shuts down and reaps its child normally', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const program = `
+    import { spawn } from 'node:child_process';
+    import { runOwnedContainerEntrypoint, readContainerChildIdentity } from ${JSON.stringify(new URL('./containerRelayLifecycle.js', import.meta.url).href)};
+    const controller = new AbortController();
+    process.once('SIGTERM', () => controller.abort());
+    await runOwnedContainerEntrypoint({ home: ${JSON.stringify(f.home)}, uid: process.getuid(), signal: controller.signal,
+      containerRuntime: { identity: async () => (${JSON.stringify(f.identity)}), canonicalEntrypoint: ${JSON.stringify(f.identity.argv[1])}, runtimeVersion: '0.2.134',
+        childIdentity: async pid => { const actual = await readContainerChildIdentity(pid);
+          if (actual.parentPid !== process.pid) throw new Error('foreign fixture child'); return { ...actual, parentPid: 1 }; } },
+      consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+      spawnRelay: () => { const child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+        process.stdout.write(JSON.stringify({ childPid: child.pid }) + '\\n'); return child; } });
+  `;
+    const runner = spawn(process.execPath, ['--input-type=module', '-e', program], { stdio: ['ignore', 'pipe', 'pipe'] });
+    let output = '';
+    let errorOutput = '';
+    let childPid = 0;
+    runner.stdout.on('data', data => { output += String(data); if (output.includes('\n'))
+        childPid = JSON.parse(output.trim()).childPid; });
+    runner.stderr.on('data', data => { errorOutput += String(data); });
+    try {
+        await until(() => childPid > 1 || exited(runner));
+        assert.ok(childPid > 1, errorOutput || output || 'fixture exited without a child');
+        runner.kill('SIGTERM');
+        await until(() => exited(runner));
+        assert.equal(runner.exitCode, 0, errorOutput);
+        assert.throws(() => process.kill(childPid, 0), /ESRCH/);
+        assert.equal((await relayAutostartStatus(f.options)).state, 'unavailable');
+        assert.ok(await readFile(join(f.home, 'relay', 'autostart.json'), 'utf8'));
+    }
+    finally {
+        if (!exited(runner)) {
+            runner.kill('SIGTERM');
+            await until(() => exited(runner));
+        }
+    }
+});
+test('the normal npm client recognizes a separate identical qualified CLI image but rejects changed executable bytes', posix, async () => {
+    const f = await fixture();
+    const runtime = join(f.root, 'qualified-cli');
+    await mkdir(join(runtime, 'dist'), { recursive: true, mode: 0o700 });
+    for (const name of ['bin.js', 'index.js', 'containerRelayLifecycle.js']) {
+        await copyFile(new URL(`./${name}`, import.meta.url), join(runtime, 'dist', name));
+        await chmod(join(runtime, 'dist', name), 0o644);
+    }
+    await copyFile(new URL('../package.json', import.meta.url), join(runtime, 'package.json'));
+    await chmod(join(runtime, 'package.json'), 0o644);
+    f.identity.argv[1] = join(runtime, 'dist', 'bin.js');
+    const runtimeOptions = { home: f.home, uid: f.options.uid,
+        containerRuntime: { identity: async () => f.identity } };
+    assert.equal(await lifecycle.containerEntrypointAvailable(runtimeOptions), true);
+    await writeFile(join(runtime, 'dist', 'index.js'), 'CANARY_CHANGED_RUNTIME');
+    await assert.rejects(lifecycle.containerEntrypointAvailable(runtimeOptions), error => {
+        assert.match(String(error), /container_startup_unavailable/);
+        assert.doesNotMatch(String(error), /CANARY_CHANGED_RUNTIME/);
+        return true;
+    });
+});
+test('malformed entrypoint leases cannot be silently discarded as an earlier boot', posix, async () => {
+    for (const startTicks of [null, 'CANARY_PRIVATE_INPUT']) {
+        const f = await fixture();
+        await writeFile(join(f.home, 'relay', 'container-entrypoint.lock'), JSON.stringify({ ...f.marker, startTicks }), { mode: 0o600 });
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), 100);
+        try {
+            await assert.rejects(entrypoint()({ home: f.home, uid: f.options.uid, signal: controller.signal,
+                containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+                spawnRelay: () => { throw new Error('must not launch'); } }), error => {
+                assert.match(String(error), /container_startup_unavailable/);
+                assert.doesNotMatch(String(error), /CANARY_PRIVATE_INPUT/);
+                return true;
+            });
+            assert.equal(JSON.parse(await readFile(join(f.home, 'relay', 'container-entrypoint.lock'), 'utf8')).startTicks, startTicks);
+        }
+        finally {
+            clearTimeout(timeout);
+            controller.abort();
+        }
+    }
+});
+test('entrypoint never starts an owned child after shutdown arrives during consumer preflight', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const controller = new AbortController();
+    let checking = false;
+    let launches = 0;
+    let release;
+    const consumer = new Promise(resolveReady => { release = () => resolveReady(true); });
+    const result = entrypoint()({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: f.options.containerRuntime, consumerStoreReady: async () => { checking = true; return consumer; },
+        pollMs: 10, restartDelayMs: 10, spawnRelay: () => {
+            launches++;
+            return spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' });
+        } });
+    await until(() => checking);
+    controller.abort();
+    release();
+    await result;
+    assert.equal(launches, 0);
+});
+test('unverifiable freshly spawned child fails closed and is reaped through its owned process handle', posix, async () => {
+    const f = await fixture();
+    await enableRelayAutostart(f.options);
+    const controller = new AbortController();
+    let child;
+    const result = entrypoint()({ home: f.home, uid: f.options.uid, signal: controller.signal,
+        containerRuntime: { ...f.options.containerRuntime, childIdentity: async () => { throw new Error('CANARY_PROC_FAILURE'); } },
+        consumerStoreReady: async () => true, pollMs: 10, restartDelayMs: 10,
+        spawnRelay: () => child = spawn(process.execPath, ['-e', 'setInterval(() => {}, 1000)'], { stdio: 'ignore' }) });
+    try {
+        await assert.rejects(result, error => {
+            assert.match(String(error), /container_startup_unavailable/);
+            assert.doesNotMatch(String(error), /CANARY_PROC_FAILURE/);
+            return true;
+        });
+        assert.ok(child);
+        await until(() => exited(child), 100);
+    }
+    finally {
+        controller.abort();
+        if (child && !exited(child)) {
+            child.kill('SIGTERM');
+            await until(() => exited(child));
+        }
+    }
+});
+//# sourceMappingURL=containerRelayLifecycle.test.js.map

package/dist/containerRelayLifecycle.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRelayLifecycle.test.js","sourceRoot":"","sources":["../src/containerRelayLifecycle.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,SAAS,MAAM,8BAA8B,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EACtE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEzE,gFAAgF;AAChF,0EAA0E;AAC1E,KAAK,UAAU,OAAO;IACpB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO;QACjD,IAAI,EAAE,CAAC,eAAe,EAAE,0BAA0B,EAAE,OAAO,EAAE,sBAAsB,CAAC,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG;QAC1E,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;IACpC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3G,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,EAAE,QAAQ,EAAE,OAAgB,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS;QAChF,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC;QACrD,MAAM,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,sBAAsB,CAAC,EAAE,OAAO,EAAE,SAAS;QAC9E,gBAAgB,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS;YAClH,aAAa,EAAE,KAAK,EAAE,GAAW,EAAE,EAAE;gBACnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC;gBAC/D,wEAAwE;gBACxE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;gBAC5C,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;YACrC,CAAC,EAAE;QACL,GAAG,EAAE,KAAK,EAAE,IAAY,EAAE,IAAc,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;AAErD,IAAI,CAAC,6FAA6F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACpH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC;IACzF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,MAAM,SAAS,CAAC,MAAM,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACvE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACzE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACzG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACzE,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACxE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxC,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACvF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iGAAiG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACxH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IAC3E,MAAM,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,6CAA6C,CAAC,CAAC;IACpG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4CAA4C,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;IACvH,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;IACvF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAOH,SAAS,UAAU;IACjB,MAAM,GAAG,GAAI,SAA6E,CAAC,2BAA2B,CAAC;IACvH,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,2DAA2D,CAAC,CAAC;IAClG,OAAO,GAAI,CAAC;AACd,CAAC;AACD,KAAK,UAAU,KAAK,CAAC,SAAwB,EAAE,YAAY,GAAG,IAAI;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;IAC3C,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QACpG,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AACD,MAAM,MAAM,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;AAE7F,IAAI,CAAC,+FAA+F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAClH,UAAU,EAAE,YAAY,CAAC,EAAE;YACzB,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QACrC,CAAC,EAAE,CAAC,CAAC;IACP,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC;QACxC,MAAM,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACzD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAClI,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,UAAU,IAAI;QACjB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;YAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;YAClH,UAAU,EAAE,GAAG,EAAE;gBACf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBAClG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAAC,OAAO,KAAK,CAAC;YACrC,CAAC,EAAE,CAAC,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAChC,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACzC,QAAQ,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QAAC,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACvC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACtG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACxC,MAAM,MAAM,CAAC,MAAM,CAAC;IACpB,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2FAA2F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAClH,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAClH,UAAU,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACtD,UAAU,CAAC,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,4FAA4F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACnH,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAA+B,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAClH,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACnH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAClC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,sBAAsB,CAAC,CAAC;IACjF,MAAM,OAAO,CAAC;IACd,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACrC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,8FAA8F,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACrH,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAC5E,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QACrC,UAAU,EAAE,GAAG,EAAE;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAClG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QACrC,CAAC,EAAE,CAAC,CAAC;IACP,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,sCAAsC,CAAC,CAAC;QACvE,KAAK,GAAG,IAAI,CAAC;QACb,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;IAC3C,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACjC,MAAM,MAAM,CAAC;IACb,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oEAAoE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC3F,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC3E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAC5E,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAClE,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACjC,MAAM,KAAK,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC9G,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACpG,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;QAChF,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU;QAC9F,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QACpG,QAAQ,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO;KAC9C,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrB,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAChF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qEAAqE,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC5F,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE,CAAC;QAClE,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,IAAI,MAAM,KAAK,QAAQ;YAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,0BAA0B,CAAC;QACzE,IAAI,MAAM,KAAK,KAAK;YAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,gBAAgB;YAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,OAAO;YAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,SAAS,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC,CAAC;QACvF,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChC,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACjI,KAAK,MAAM,IAAI,IAAI,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC3E,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;YACzF,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;YAC1B,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;gBACnD,MAAM,SAAS,CAAC,MAAM,EAAE,sBAAsB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACjE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,CAAC;iBAAM,IAAI,IAAI,KAAK,gBAAgB;gBAAE,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;iBAC1D,IAAI,IAAI,KAAK,UAAU;gBAAE,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;iBACpF,IAAI,IAAI,KAAK,WAAW;gBAAE,MAAM,SAAS,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;;gBACxE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC,CAAC;YACpE,MAAM,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,6CAA6C,CAAC,CAAC;YACpG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,sFAAsF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAC7G,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAAC,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IACpD,MAAM,oBAAoB,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QAC9E,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAClH,UAAU,EAAE,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnI,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,MAAM,MAAM,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACxG,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,eAAe,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClG,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,0BAA0B,CAAC,KAAK,CAAC,GAAI,CAAC,CAAC;YACxE,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC1D,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ;oBACnE,GAAG,EAAE,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG;oBAC/D,SAAS,EAAE,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,0BAA0B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC;gBAChF,MAAM,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU;gBAC9F,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI;gBAC1F,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG;gBAC/D,eAAe,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU;aACpG,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YACrD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC;QACrE,CAAC;gBAAS,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAAC,CAAC;IACxE,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACxG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QAClH,UAAU,EAAE,GAAG,EAAE;YAAG,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACpH,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QACzC,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC1E,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC;QACxB,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACzI,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC5H,mEAAmE;QACnE,MAAM,qBAAqB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC1E,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACjC,MAAM,MAAM,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACpG,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG;;8EAE4D,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;;;gDAG3G,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;mDACnB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,2BAA2B,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;;;;;GAMvI,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IACtH,IAAI,MAAM,GAAG,EAAE,CAAC;IAAC,IAAI,WAAW,GAAG,EAAE,CAAC;IAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACxD,MAAM,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACzI,MAAM,CAAC,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,WAAW,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,EAAE,CAAC,QAAQ,GAAG,CAAC,EAAE,WAAW,IAAI,MAAM,IAAI,gCAAgC,CAAC,CAAC;QACnF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC3E,MAAM,CAAC,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;AACnG,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,gHAAgH,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvI,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;IAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpH,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,4BAA4B,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;IAC3F,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,cAAc,GAAwC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG;QAC5F,gBAAgB,EAAE,EAAE,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IACjF,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,wBAAwB,CAAC,CAAC;IAC7E,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,4BAA4B,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,EAAE;QACnF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;QAC7D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,6EAA6E,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACpG,KAAK,MAAM,UAAU,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClI,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACpG,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;gBAC7F,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;gBAClH,UAAU,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,EAAE;gBACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;gBAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;gBAAC,OAAO,IAAI,CAAC;YACxI,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,2BAA2B,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC9H,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IAC1D,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,yFAAyF,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IAChH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjF,IAAI,OAAiC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAU,YAAY,CAAC,EAAE,GAAG,OAAO,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QACvF,gBAAgB,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,KAAK,IAAI,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC;QACnH,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;YAAG,QAAQ,EAAE,CAAC;YAC7D,OAAO,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,CAAC,EAAE,CAAC,CAAC;IACrG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAAC,OAAQ,EAAE,CAAC;IAAC,MAAM,MAAM,CAAC;IAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC5B,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,gGAAgG,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE;IACvH,MAAM,CAAC,GAAG,MAAM,OAAO,EAAE,CAAC;IAAC,MAAM,oBAAoB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAAC,IAAI,KAA+B,CAAC;IAC9E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM;QACvF,gBAAgB,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE;QAC3H,kBAAkB,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE;QACpE,UAAU,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,6BAA6B,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;IACnH,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC,CAAC;YACnG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,qBAAqB,CAAC,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAM,CAAC,CAAC,CAAC;QAAC,CAAC;IAAC,CAAC;AAC9H,CAAC,CAAC,CAAC"}

package/dist/containerRelayPublicCommand.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=containerRelayPublicCommand.test.d.ts.map

package/dist/containerRelayPublicCommand.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRelayPublicCommand.test.d.ts","sourceRoot":"","sources":["../src/containerRelayPublicCommand.test.ts"],"names":[],"mappings":""}

package/dist/containerRelayPublicCommand.test.js

@@ -0,0 +1,25 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { run } from './index.js';
+test('public container entrypoint command rejects a normal host process before storage or startup mutation', async () => {
+    await assert.rejects(run(['relay', 'container-entrypoint']), /container_entrypoint_requires_pid1/);
+});
+test('container entrypoint rejects grant and policy arguments without reflecting private input', async () => {
+    for (const flag of ['grant', 'policy', 'organization-id', 'no-relay-daemon']) {
+        await assert.rejects(run(['relay', 'container-entrypoint', `--${flag}`, 'CANARY_PRIVATE_INPUT']), error => {
+            assert.match(String(error), /container_entrypoint_options_forbidden/);
+            assert.doesNotMatch(String(error), /CANARY_PRIVATE_INPUT/);
+            return true;
+        });
+    }
+});
+test('container entrypoint dry-run describes its bounded prerequisite plan without starting a runtime', async () => {
+    const value = await run(['relay', 'container-entrypoint', '--dry-run']);
+    assert.equal(typeof value, 'object');
+    const plan = value;
+    assert.equal(plan.stage, 'container_entrypoint_plan');
+    assert.equal(plan.started, false);
+    assert.equal(plan.requiresPrivateSecretService, true);
+    assert.equal(plan.restartCoverage, 'container-entrypoint-only');
+});
+//# sourceMappingURL=containerRelayPublicCommand.test.js.map

package/dist/containerRelayPublicCommand.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRelayPublicCommand.test.js","sourceRoot":"","sources":["../src/containerRelayPublicCommand.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAEjC,IAAI,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,EAAE,oCAAoC,CAAC,CAAC;AACrG,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;IAC1G,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,KAAK,IAAI,EAAE,EAAE,sBAAsB,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE;YACxG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,wCAAwC,CAAC,CAAC;YACtE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,sBAAsB,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAGH,IAAI,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;IACjH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,KAAK,CAAC,OAAO,KAAK,EAAE,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAgC,CAAC;IAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,2BAA2B,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC"}

package/dist/containerRelaySchema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=containerRelaySchema.test.d.ts.map

package/dist/containerRelaySchema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"containerRelaySchema.test.d.ts","sourceRoot":"","sources":["../src/containerRelaySchema.test.ts"],"names":[],"mappings":""}

package/dist/containerRelaySchema.test.js

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import { readFile } from 'node:fs/promises';
+import { Ajv2020 } from 'ajv/dist/2020.js';
+import test from 'node:test';
+async function validator(name) {
+    const schema = JSON.parse(await readFile(new URL(`./schemas/${name}.schema.json`, import.meta.url), 'utf8'));
+    return new Ajv2020({ strict: true, strictRequired: false }).compile(schema);
+}
+test('container startup schema rejects credentials, arbitrary backends and malformed authority paths', async () => {
+    const validate = await validator('relay-autostart.v3');
+    const value = { schema: 'dharma.relay-autostart/v3', backend: 'container-entrypoint', launcher: '/repo/.dharma/bin/dharma',
+        workspace: '/repo', policy: '/repo/.dharma/approved-policy.json', version: '0.2.134', taskName: null };
+    assert.equal(validate(value), true);
+    for (const change of [{ grant: 'CANARY_PRIVATE_INPUT' }, { backend: 'systemd-user' }, { taskName: 'other' },
+        { policy: '../foreign' }, { launcher: '/repo\ncommand' }, { version: 'unpublished arbitrary value' }]) {
+        assert.equal(validate({ ...value, ...change }), false);
+    }
+});
+test('container lifecycle schema separates configuration from live-child receipt and forbids secret fields', async () => {
+    const validate = await validator('container-relay-lifecycle.v1');
+    const marker = { schema: 'dharma.container-entrypoint/v1', home: '/private/device', pid: 1, uid: 1000, startTicks: '1234' };
+    const control = { schema: 'dharma.container-relay-control/v1', home: '/private/device', registrationHash: 'a'.repeat(64), running: true };
+    const running = { schema: 'dharma.container-relay-heartbeat/v1', home: '/private/device', startTicks: '1234', polledAt: 1000,
+        lifecycle: 'running', reason: null, registrationHash: 'a'.repeat(64), childPid: 42, childStartTicks: '1235' };
+    for (const value of [marker, control, running, { ...running, lifecycle: 'blocked', reason: 'consumer_store_locked_or_unavailable', childPid: null, childStartTicks: null }]) {
+        assert.equal(validate(value), true, JSON.stringify(validate.errors));
+        assert.equal(validate({ ...value, grant: 'CANARY_PRIVATE_INPUT' }), false);
+    }
+    for (const change of [{ childStartTicks: null }, { childPid: null }, { lifecycle: 'ready' }, { reason: 'CANARY_PRIVATE_INPUT' },
+        { startTicks: 'invalid' }, { polledAt: -1 }])
+        assert.equal(validate({ ...running, ...change }), false);
+    assert.equal(validate({ ...marker, uid: 0 }), false);
+    assert.equal(validate({ ...control, registrationHash: 'foreign' }), false);
+});
+//# sourceMappingURL=containerRelaySchema.test.js.map