@intutic/cli 1.10.1 → 2.1.0

package/dist/lib/onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AAEjC;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,wBAAwB,CAAA;IAC9C,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACnF,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS;QAAE,GAAG,EAAE,CAAA;IAC/D,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,cAAc,CAAC,eAAe,OAAO,KAAK,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAC/D,cAAc,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAmB,EAAE,aAAsB,EAAE,OAAO,GAAG,KAAK;IAC/F,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,8CAA8C;IAC9C,KAAK,OAAO,CAAA;IACZ,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,uBAAuB,CAAC,CAAA;IAC/F,MAAM,QAAQ,GAAG,GAAG,SAAS,KAAK,CAAA;IAElC,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAA;IACxD,cAAc,CAAC,gFAAgF,CAAC,CAAA;IAChG,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,cAAc,CAAC,4BAA4B,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,CAAC,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACvE,cAAc,CAAC,kDAAkD,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;QACtF,cAAc,CAAC,gEAAgE,CAAC,CAAA;QAChF,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;QACtE,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3F,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,QAAQ;gBACX,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAChE,cAAc,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,+BAA+B,CAAC,CAAA;gBACtF,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAA;gBAClF,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,sDAAsD,CAAC,CAAA;gBACtE,MAAK;YAEP,KAAK,aAAa;gBAChB,cAAc,CAAC,+DAA+D,CAAC,CAAA;gBAC/E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAA;gBAC3D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACxE,WAAW,CAAC,mBAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAC5D,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAA;gBAChF,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,qCAAqC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;gBACnG,cAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;gBACnD,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAA;gBACvF,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBACxC,cAAc,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;gBAC/C,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;gBAC3C,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACrE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBAC3E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,2BAA2B,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;gBACxE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAA;gBAC3F,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBACpD,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAA;gBAC9D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,mCAAmC,CAAC,CAAA;gBACnD,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACjE,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAA;gBAC9F,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,cAAc,CAAC,oBAAoB,CAAC,CAAA;gBACpC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,4BAA4B,QAAQ,IAAI,CAAC,CAAA;gBACxD,cAAc,CAAC,8BAA8B,gBAAgB,IAAI,CAAC,CAAA;gBAClE,cAAc,CAAC,2CAA2C,CAAC,CAAA;gBAC3D,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,YAAY,CAAC,CAAA;gBAC5B,cAAc,CAAC,UAAU,CAAC,CAAA;gBAC1B,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;gBACzF,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACvC,cAAc,CAAC,iCAAiC,CAAC,CAAA;gBACjD,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,oBAAoB,QAAQ,GAAG,CAAC,CAAA;gBAC/C,cAAc,CAAC,kCAAkC,CAAC,CAAA;gBAClD,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACvE,cAAc,CAAC,oBAAoB,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAA;gBAC/D,MAAK;YAEP,KAAK,gBAAgB;gBACnB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,mEAAmE,CAAC,CAAA;gBACnF,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,MAAK;YAEP,KAAK,YAAY;gBACf,cAAc,CAAC,oEAAoE,CAAC,CAAA;gBACpF,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,cAAc,CAAC,sBAAsB,KAAK,KAAK,gBAAgB,GAAG,CAAC,CAAA;gBACnE,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,oCAAoC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC7E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,qEAAqE,CAAC,CAAA;gBACrF,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;gBAClH,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,qDAAqD,CAAC,CAAA;gBAC5G,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;gBAClF,cAAc,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,CAAA;gBACzG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,+EAA+E,CAAC,CAAA;gBAC/F,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,MAAK;YAEP,KAAK,MAAM;gBACT,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,8CAA8C;gBAC9C,cAAc,CAAC,yEAAyE,CAAC,CAAA;gBACzF,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,8EAA8E,CAAC,CAAA;gBAC9F,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAA;gBACrE,MAAK;YAEP,KAAK,UAAU;gBACb,sEAAsE;gBACtE,mDAAmD;gBACnD,cAAc,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,sBAAsB,CAAC,CAAA;gBAC5G,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,gDAAgD,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAC3F,cAAc,CAAC,wDAAwD,QAAQ,SAAS,CAAC,CAAA;gBACzF,cAAc,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;gBACtI,MAAK;YAEP,KAAK,sBAAsB;gBACzB,iEAAiE;gBACjE,qEAAqE;gBACrE,mEAAmE;gBACnE,kBAAkB;gBAClB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,8DAA8D,CAAC,CAAA;gBAC9E,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAA;gBACrF,MAAK;YAEP;gBACE,cAAc,CAAC,qDAAqD,CAAC,CAAA;gBACrE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;gBACzE,cAAc,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChF,MAAK;QACT,CAAC;IACH,CAAC;IAED,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpB,CAAC"}
+{"version":3,"file":"onboarding.js","sourceRoot":"","sources":["../../src/lib/onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,YAAY,CAAA;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE;;;;;GAKG;AACH,SAAS,aAAa,CAAC,QAAiB;IACtC,IAAI,CAAC,QAAQ;QAAE,OAAO,yBAAyB,CAAA;IAC/C,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAA;AACnF,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,EAAE,MAAc;IAClD,cAAc,CAAC,eAAe,OAAO,KAAK,MAAM,GAAG,CAAC,CAAA;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,MAAc,EAAE,MAAM,GAAG,CAAC;IAC/D,cAAc,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,OAAO,KAAK,MAAM,EAAE,CAAC,CAAA;AAC9D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,SAAmB,EAAE,aAAsB;IAC9E,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAA;IACrD,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,8CAA8C;IAC9C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IACjE,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;IAE7D,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,MAAM,CAAC,4CAA4C,CAAC,CAAA;IACxD,cAAc,CAAC,gFAAgF,CAAC,CAAA;IAChG,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,aAAa,EAAE,CAAC;QAClB,cAAc,CAAC,4BAA4B,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uCAAuC;QACvC,cAAc,CAAC,kFAAkF,CAAC,CAAA;IACpG,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,cAAc,CAAC,EAAE,CAAC,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAA;QACvE,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,EAAE,CAAC,CAAA;QACpG,cAAc,CAAC,gEAAgE,CAAC,CAAA;QAChF,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;QACtE,OAAM;IACR,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,cAAc,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;QAE3F,QAAQ,CAAC,EAAE,CAAC;YACV,KAAK,QAAQ;gBACX,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAChE,cAAc,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAA;gBAC9E,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,mBAAmB,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,UAAU,CAAC,CAAA;gBAClF,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,sDAAsD,CAAC,CAAA;gBACtE,MAAK;YAEP,KAAK,aAAa;gBAChB,cAAc,CAAC,+DAA+D,CAAC,CAAA;gBAC/E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAA;gBAC3D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,mCAAmC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACxE,WAAW,CAAC,mBAAmB,EAAE,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAA;gBAC5D,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,6CAA6C,CAAC,EAAE,CAAC,CAAA;gBAChF,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,qCAAqC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAA;gBACnG,cAAc,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAA;gBACnD,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,kCAAkC,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAA;gBACvF,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,2BAA2B,CAAC,CAAA;gBAC3C,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBACxC,cAAc,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;gBAC/C,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAA;gBAC3C,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;gBACrE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;gBAC3E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAA;gBACjE,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAA;gBACxE,cAAc,CAAC,yCAAyC,CAAC,CAAA;gBACzD,cAAc,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAA;gBAC3F,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC1E,cAAc,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;gBACpD,cAAc,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAA;gBACpD,cAAc,CAAC,wDAAwD,CAAC,CAAA;gBACxE,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,yDAAyD,CAAC,CAAA;gBACzE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC,CAAA;gBAC9D,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,mCAAmC,CAAC,CAAA;gBACnD,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;gBACjE,WAAW,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAA;gBAC/C,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAA;gBAC9F,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,cAAc,CAAC,oBAAoB,CAAC,CAAA;gBACpC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,yBAAyB,CAAC,CAAA;gBACzC,cAAc,CAAC,4BAA4B,QAAQ,IAAI,CAAC,CAAA;gBACxD,cAAc,CAAC,8BAA8B,gBAAgB,IAAI,CAAC,CAAA;gBAClE,cAAc,CAAC,2CAA2C,CAAC,CAAA;gBAC3D,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,cAAc,CAAC,CAAA;gBAC9B,cAAc,CAAC,YAAY,CAAC,CAAA;gBAC5B,cAAc,CAAC,UAAU,CAAC,CAAA;gBAC1B,cAAc,CAAC,QAAQ,CAAC,CAAA;gBACxB,MAAK;YAEP,KAAK,OAAO;gBACV,cAAc,CAAC,uCAAuC,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAA;gBACzF,cAAc,CAAC,uBAAuB,CAAC,CAAA;gBACvC,cAAc,CAAC,iCAAiC,CAAC,CAAA;gBACjD,cAAc,CAAC,gCAAgC,CAAC,CAAA;gBAChD,cAAc,CAAC,+BAA+B,CAAC,CAAA;gBAC/C,cAAc,CAAC,oBAAoB,QAAQ,GAAG,CAAC,CAAA;gBAC/C,cAAc,CAAC,kCAAkC,CAAC,CAAA;gBAClD,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4BAA4B,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBACvE,cAAc,CAAC,oBAAoB,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAA;gBAC/D,MAAK;YAEP,KAAK,gBAAgB;gBACnB,cAAc,CAAC,iDAAiD,CAAC,CAAA;gBACjE,cAAc,CAAC,mEAAmE,CAAC,CAAA;gBACnF,cAAc,CAAC,sEAAsE,CAAC,CAAA;gBACtF,MAAK;YAEP,KAAK,YAAY;gBACf,cAAc,CAAC,oEAAoE,CAAC,CAAA;gBACpF,cAAc,CAAC,gCAAgC,QAAQ,GAAG,CAAC,CAAA;gBAC3D,cAAc,CAAC,sBAAsB,KAAK,KAAK,gBAAgB,GAAG,CAAC,CAAA;gBACnE,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,8CAA8C,CAAC,CAAA;gBAC9D,cAAc,CAAC,oCAAoC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAA;gBAC7E,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;gBAC3C,cAAc,CAAC,kEAAkE,CAAC,CAAA;gBAClF,MAAK;YAEP,KAAK,UAAU;gBACb,cAAc,CAAC,gFAAgF,CAAC,CAAA;gBAChG,cAAc,CAAC,+EAA+E,CAAC,CAAA;gBAC/F,MAAK;YAEP,KAAK,KAAK;gBACR,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,+BAA+B,CAAC,CAAA;gBAClH,cAAc,CAAC,yCAAyC,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAA;gBACtG,cAAc,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,iDAAiD,CAAC,CAAA;gBACjG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,4EAA4E,CAAC,CAAA;gBAC5F,cAAc,CAAC,+CAA+C,CAAC,CAAA;gBAC/D,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,+CAA+C,CAAC,EAAE,CAAC,CAAA;gBAClF,cAAc,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC,iDAAiD,CAAC,CAAA;gBACzG,cAAc,CAAC,IAAI,CAAC,CAAA;gBACpB,cAAc,CAAC,+EAA+E,CAAC,CAAA;gBAC/F,cAAc,CAAC,6BAA6B,CAAC,CAAA;gBAC7C,MAAK;YAEP,KAAK,MAAM;gBACT,mEAAmE;gBACnE,gEAAgE;gBAChE,8DAA8D;gBAC9D,gEAAgE;gBAChE,8CAA8C;gBAC9C,cAAc,CAAC,yEAAyE,CAAC,CAAA;gBACzF,cAAc,CAAC,2EAA2E,CAAC,CAAA;gBAC3F,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,8EAA8E,CAAC,CAAA;gBAC9F,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gCAAgC,CAAC,EAAE,CAAC,CAAA;gBACrE,MAAK;YAEP,KAAK,UAAU;gBACb,sEAAsE;gBACtE,mDAAmD;gBACnD,cAAc,CAAC,oBAAoB,EAAE,CAAC,IAAI,CAAC,yCAAyC,CAAC,sBAAsB,CAAC,CAAA;gBAC5G,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,gDAAgD,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;gBAC3F,cAAc,CAAC,wDAAwD,QAAQ,SAAS,CAAC,CAAA;gBACzF,cAAc,CAAC,0BAA0B,EAAE,CAAC,IAAI,CAAC,yBAAyB,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAA;gBACtI,MAAK;YAEP,KAAK,sBAAsB;gBACzB,iEAAiE;gBACjE,qEAAqE;gBACrE,mEAAmE;gBACnE,kBAAkB;gBAClB,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,wEAAwE,CAAC,CAAA;gBACxF,cAAc,CAAC,6EAA6E,CAAC,CAAA;gBAC7F,cAAc,CAAC,0EAA0E,CAAC,CAAA;gBAC1F,cAAc,CAAC,8DAA8D,CAAC,CAAA;gBAC9E,cAAc,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,gDAAgD,CAAC,EAAE,CAAC,CAAA;gBACrF,MAAK;YAEP;gBACE,cAAc,CAAC,qDAAqD,CAAC,CAAA;gBACrE,cAAc,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAA;gBACzE,cAAc,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;gBAChF,MAAK;QACT,CAAC;IACH,CAAC;IAED,cAAc,CAAC,EAAE,CAAC,CAAA;IAClB,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAA;IACtE,cAAc,CAAC,EAAE,CAAC,CAAA;AACpB,CAAC"}

package/dist/lib/sandbox/image.d.ts

@@ -0,0 +1,27 @@
+/**
+ * The default sandbox image, built locally from the Dockerfile the CLI ships.
+ *
+ * There is no registry copy to pull: the default used to be
+ * `intutic/sandbox:latest`, a name nothing publishes, so `intutic exec
+ * --sandbox` failed on the pull for everyone who did not pass
+ * `--sandbox-image`. The image is small and built from `resources/sandbox`,
+ * which is in the npm package, so the first sandboxed run builds it and tags it
+ * with the CLI version; later runs, and upgrades to the same version, reuse it.
+ *
+ * @module
+ */
+/** The image `--sandbox-image` defaults to: built locally, tagged with this CLI's version. */
+export declare const DEFAULT_SANDBOX_IMAGE: string;
+/** Directory holding the shipped Dockerfile and entrypoint. */
+export declare function sandboxBuildContext(): string;
+/** Runs a container-runtime command; resolves with its exit code. */
+export type RuntimeRunner = (runtime: string, args: string[], inheritOutput: boolean) => Promise<number>;
+/**
+ * Make sure `image` can be run. Only the default image is built here; any
+ * other name is the user's own and the runtime pulls it as usual.
+ *
+ * Throws with a message for the user when the default image is missing and
+ * cannot be built.
+ */
+export declare function ensureSandboxImage(runtime: string, image: string, run?: RuntimeRunner, context?: string): Promise<void>;
+//# sourceMappingURL=image.d.ts.map

package/dist/lib/sandbox/image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,8FAA8F;AAC9F,eAAO,MAAM,qBAAqB,QAA+B,CAAA;AAEjE,+DAA+D;AAC/D,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED,qEAAqE;AACrE,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;AASxG;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,aAA4B,EACjC,OAAO,GAAE,MAA8B,GACtC,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/lib/sandbox/image.js

@@ -0,0 +1,54 @@
+/**
+ * The default sandbox image, built locally from the Dockerfile the CLI ships.
+ *
+ * There is no registry copy to pull: the default used to be
+ * `intutic/sandbox:latest`, a name nothing publishes, so `intutic exec
+ * --sandbox` failed on the pull for everyone who did not pass
+ * `--sandbox-image`. The image is small and built from `resources/sandbox`,
+ * which is in the npm package, so the first sandboxed run builds it and tags it
+ * with the CLI version; later runs, and upgrades to the same version, reuse it.
+ *
+ * @module
+ */
+import { spawn } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { log } from '../logger.js';
+const { version } = createRequire(import.meta.url)('../../../package.json');
+/** The image `--sandbox-image` defaults to: built locally, tagged with this CLI's version. */
+export const DEFAULT_SANDBOX_IMAGE = `intutic/sandbox:${version}`;
+/** Directory holding the shipped Dockerfile and entrypoint. */
+export function sandboxBuildContext() {
+    // src/lib/sandbox/image.ts and dist/lib/sandbox/image.js are the same depth.
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    return path.resolve(here, '../../../resources/sandbox');
+}
+const spawnRuntime = (runtime, args, inheritOutput) => new Promise((resolve) => {
+    const child = spawn(runtime, args, { stdio: inheritOutput ? 'inherit' : 'ignore' });
+    child.on('error', () => resolve(127));
+    child.on('exit', (code) => resolve(code ?? 1));
+});
+/**
+ * Make sure `image` can be run. Only the default image is built here; any
+ * other name is the user's own and the runtime pulls it as usual.
+ *
+ * Throws with a message for the user when the default image is missing and
+ * cannot be built.
+ */
+export async function ensureSandboxImage(runtime, image, run = spawnRuntime, context = sandboxBuildContext()) {
+    if (image !== DEFAULT_SANDBOX_IMAGE)
+        return;
+    if ((await run(runtime, ['image', 'inspect', image], false)) === 0)
+        return;
+    if (!existsSync(path.join(context, 'Dockerfile'))) {
+        throw new Error(`the sandbox Dockerfile is not part of this installation (${context}). ` +
+            'Install the CLI from npm, or pass --sandbox-image with your own image.');
+    }
+    log.info(`Building the sandbox image ${image} (first sandboxed run with this CLI version)…`);
+    if ((await run(runtime, ['build', '-t', image, context], true)) !== 0) {
+        throw new Error(`${runtime} build of ${image} failed; see the output above`);
+    }
+}
+//# sourceMappingURL=image.js.map

package/dist/lib/sandbox/image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/lib/sandbox/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,uBAAuB,CAAwB,CAAA;AAElG,8FAA8F;AAC9F,MAAM,CAAC,MAAM,qBAAqB,GAAG,mBAAmB,OAAO,EAAE,CAAA;AAEjE,+DAA+D;AAC/D,MAAM,UAAU,mBAAmB;IACjC,6EAA6E;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,4BAA4B,CAAC,CAAA;AACzD,CAAC;AAKD,MAAM,YAAY,GAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,CACnE,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IACnF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACrC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC,CAAC,CAAA;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,KAAa,EACb,MAAqB,YAAY,EACjC,UAAkB,mBAAmB,EAAE;IAEvC,IAAI,KAAK,KAAK,qBAAqB;QAAE,OAAM;IAC3C,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC;QAAE,OAAM;IAE1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,4DAA4D,OAAO,KAAK;YACtE,wEAAwE,CAC3E,CAAA;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,8BAA8B,KAAK,+CAA+C,CAAC,CAAA;IAC5F,IAAI,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,aAAa,KAAK,+BAA+B,CAAC,CAAA;IAC9E,CAAC;AACH,CAAC"}

package/dist/lib/sandbox/oci.d.ts

@@ -33,6 +33,7 @@ export declare class OciBackend implements SandboxBackend {
     private readonly env;
     constructor(runtime: OciRuntime, env: Record<string, string>);
     health(): Promise<SandboxHealth>;
+    prepare(image: string): Promise<void>;
     run(spec: SandboxSpec): Promise<number>;
 }
 //# sourceMappingURL=oci.d.ts.map

package/dist/lib/sandbox/oci.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE5C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAoC7E;AAED,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAMtD,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAgBhC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAuB9C"}
+{"version":3,"file":"oci.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE5E,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAE5C;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,EAAE,CAoC7E;AAED,qBAAa,UAAW,YAAW,cAAc;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAY;IACpC,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAMtD,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC;IAgBhC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;CAuB9C"}

package/dist/lib/sandbox/oci.js

@@ -20,6 +20,7 @@
  */
 import { spawn } from 'node:child_process';
 import { log } from '../logger.js';
+import { ensureSandboxImage } from './image.js';
 /**
  * Build the container runtime argv for a spec. Pure and exported so the
  * envelope can be asserted without launching anything — the isolation flags are
@@ -78,6 +79,9 @@ export class OciBackend {
                 : resolve({ available: false, detail: `${this.runtime} daemon not reachable` }));
         });
     }
+    async prepare(image) {
+        await ensureSandboxImage(this.runtime, image);
+    }
     async run(spec) {
         const args = buildOciArgs(this.runtime, spec);
         log.dim(`sandbox: ${this.runtime} ${args.slice(0, 12).join(' ')} …`);

package/dist/lib/sandbox/oci.js.map

@@ -1 +1 @@
-{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAKlC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,IAAiB;IACjE,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElC,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAE7C,0CAA0C;IAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAE1E,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAEhC,+BAA+B;IAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,eAAe,CAAC,CAAA;IAE3D,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAEvD,8EAA8E;IAC9E,8BAA8B;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,IAAI,CAAQ;IACJ,OAAO,CAAY;IACpC,2EAA2E;IAC1D,GAAG,CAAwB;IAE5C,YAAY,OAAmB,EAAE,GAA2B;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;gBAC5E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAC3E,CAAA;YACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE,CAAC,CAClF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;gBACtC,KAAK,EAAE,SAAS;gBAChB,iEAAiE;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,wCAAwC,CAAC,CAAA;gBACrF,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,IAAI,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAA;;oBACnB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}
+{"version":3,"file":"oci.js","sourceRoot":"","sources":["../../../src/lib/sandbox/oci.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAK/C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,OAAmB,EAAE,IAAiB;IACjE,MAAM,IAAI,GAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACtC,gEAAgE;IAChE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IAElC,0EAA0E;IAC1E,oDAAoD;IACpD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,IAAI,CAAC,aAAa,GAAG,EAAE,CAAC,CAAA;IAC/B,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;IAE7C,0CAA0C;IAC1C,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC;QAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IAE1E,mBAAmB;IACnB,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3C,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IAEhC,+BAA+B;IAC/B,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,cAAc,eAAe,CAAC,CAAA;IAE3D,uDAAuD;IACvD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAEvD,8EAA8E;IAC9E,8BAA8B;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAEvD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACrB,8DAA8D;IAC9D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;IAChC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,OAAO,UAAU;IACZ,IAAI,CAAQ;IACJ,OAAO,CAAY;IACpC,2EAA2E;IAC1D,GAAG,CAAwB;IAE5C,YAAY,OAAmB,EAAE,GAA2B;QAC1D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;QACtB,IAAI,CAAC,IAAI,GAAG,OAAO,CAAA;QACnB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,MAAM;QACV,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,oBAAoB,CAAC,EAAE;gBAC5E,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC;aACtC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CACrB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,oBAAoB,EAAE,CAAC,CAC3E,CAAA;YACD,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CACxB,IAAI,KAAK,CAAC;gBACR,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,mBAAmB,EAAE,CAAC;gBAC1E,CAAC,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE,CAAC,CAClF,CAAA;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,KAAa;QACzB,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAiB;QACzB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QAC7C,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE;gBACtC,KAAK,EAAE,SAAS;gBAChB,iEAAiE;gBACjE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE;aACrC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;gBAC/C,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC1B,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,OAAO,wCAAwC,CAAC,CAAA;gBACrF,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,KAAK,CAAC,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;gBACtD,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,CAAA;YACd,CAAC,CAAC,CAAA;YACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;gBAChC,IAAI,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,CAAA;;oBACnB,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/lib/sandbox/types.d.ts

@@ -42,6 +42,11 @@ export interface SandboxBackend {
     readonly name: string;
     /** Whether this backend can run here (e.g. docker reachable, KVM present). */
     health(): Promise<SandboxHealth>;
+    /**
+     * Get `image` ready to run, before `run` (the OCI backend builds the
+     * default image here). Throws with a message for the user when it cannot.
+     */
+    prepare?(image: string): Promise<void>;
     /** Launch the spec; resolves with the process exit code. */
     run(spec: SandboxSpec): Promise<number>;
 }

package/dist/lib/sandbox/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAChC,4DAA4D;IAC5D,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACxC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/lib/sandbox/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,WAAW;IAC1B,2EAA2E;IAC3E,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,qEAAqE;IACrE,OAAO,EAAE,MAAM,CAAA;IACf,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAA;IACb;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,8EAA8E;IAC9E,cAAc,EAAE,MAAM,CAAA;IACtB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,2CAA2C;IAC3C,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAC,aAAa,CAAC,CAAA;IAChC;;;OAGG;IACH,OAAO,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,4DAA4D;IAC5D,GAAG,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACxC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "1.10.1",
+  "version": "2.1.0",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -11,6 +11,7 @@
   },
   "files": [
     "dist/",
+    "resources/sandbox/",
     "README.md"
   ],
   "repository": {
@@ -37,10 +38,10 @@
     "commander": "^13",
     "ioredis": "^5.11.1",
     "picocolors": "^1",
-    "@intutic/shared-types": "1.10.1",
-    "@intutic/id": "1.10.1",
-    "@intutic/logger": "1.10.1",
-    "@intutic/sync-daemon": "1.10.1"
+    "@intutic/shared-types": "2.1.0",
+    "@intutic/logger": "2.1.0",
+    "@intutic/id": "2.1.0",
+    "@intutic/sync-daemon": "2.1.0"
   },
   "devDependencies": {
     "typescript": "^5.5",

package/resources/sandbox/Dockerfile

@@ -0,0 +1,30 @@
+# Intutic sandbox base image (LLD #63 §6).
+#
+# A minimal, genuinely-isolating runtime for `intutic exec --sandbox`. It ships
+# only what the entrypoint needs to install the egress firewall and drop
+# privilege: nftables, libcap (capsh), and a resolver. `intutic exec --sandbox`
+# builds it from this directory on first use, tagged intutic/sandbox:<CLI
+# version>. Bring your agent by extending that tag (`FROM intutic/sandbox:<ver>`)
+# and installing your harness, or pass `--sandbox-image` with your own image
+# that includes nftables + capsh.
+#
+# The image is intentionally not a place to run the agent as root: the
+# entrypoint switches to the unprivileged `sandbox` user after applying the
+# firewall.
+FROM alpine:3.20
+
+# nftables: the egress firewall. libcap: capsh, to drop NET_ADMIN. iproute2 +
+# bash: entrypoint plumbing. curl + ca-certificates: so a sandboxed agent (and
+# our own verification) can actually make governed calls through the proxy.
+RUN apk add --no-cache nftables libcap iproute2 bash ca-certificates curl
+
+# Unprivileged user the agent actually runs as.
+RUN adduser -D -h /home/sandbox -s /bin/bash sandbox
+
+COPY entrypoint.sh /usr/local/bin/intutic-sandbox-entrypoint
+RUN chmod 0555 /usr/local/bin/intutic-sandbox-entrypoint
+
+# The working directory the launcher bind-mounts the project into.
+WORKDIR /work
+
+ENTRYPOINT ["/usr/local/bin/intutic-sandbox-entrypoint"]

package/resources/sandbox/entrypoint.sh

@@ -0,0 +1,108 @@
+#!/bin/sh
+# Intutic sandbox entrypoint (LLD #63 §6).
+#
+# The container starts as root with NET_ADMIN so this script can install a
+# firewall; the agent must NOT keep that power. So, in order:
+#   1. Resolve the governing proxy's address (written into /etc/hosts by the
+#      launcher via --add-host).
+#   2. Apply a default-DROP egress firewall permitting outbound only to the
+#      proxy, DNS, loopback, and established return traffic — the same shape as
+#      the host-level L2 rules, scoped to this container's network namespace.
+#   3. Drop NET_ADMIN/NET_RAW and switch to the unprivileged `sandbox` user, so
+#      the agent cannot alter or remove the firewall it now runs behind.
+#   4. exec the agent command.
+#
+# Honesty rule (LLD #63 §6): if the firewall cannot be applied, we refuse to run
+# rather than run ungoverned. A sandbox that silently fails open is worse than
+# no sandbox, because the caller believes it is protected.
+set -eu
+
+PROXY_HOST="${INTUTIC_SANDBOX_PROXY_HOST:-host.docker.internal}"
+
+# Resolve the proxy host. --add-host writes it to /etc/hosts, which is the most
+# reliable source inside a minimal image (busybox has no getent).
+PROXY_IP="$(awk -v h="$PROXY_HOST" '$2==h || $3==h {print $1; exit}' /etc/hosts 2>/dev/null || true)"
+if [ -z "$PROXY_IP" ]; then
+  PROXY_IP="$(getent hosts "$PROXY_HOST" 2>/dev/null | awk '{print $1; exit}' || true)"
+fi
+if [ -z "$PROXY_IP" ]; then
+  echo "intutic-sandbox: cannot resolve proxy host '$PROXY_HOST' — refusing to run ungoverned" >&2
+  exit 91
+fi
+
+# Extra operator-allowed destinations (comma-separated CIDRs), e.g. a package
+# registry the build step needs. Rendered as additional accept rules.
+EXTRA_RULES=""
+if [ -n "${INTUTIC_SANDBOX_ALLOW:-}" ]; then
+  OLDIFS="$IFS"; IFS=','
+  for cidr in $INTUTIC_SANDBOX_ALLOW; do
+    [ -z "$cidr" ] && continue
+    case "$cidr" in
+      *:*) EXTRA_RULES="$EXTRA_RULES
+    ip6 daddr $cidr accept" ;;
+      *)   EXTRA_RULES="$EXTRA_RULES
+    ip daddr $cidr accept" ;;
+    esac
+  done
+  IFS="$OLDIFS"
+fi
+
+if ! nft -f - <<EOF
+table inet intutic_egress {
+  chain output {
+    type filter hook output priority 0; policy drop;
+    oif "lo" accept
+    ct state established,related accept
+    meta l4proto { tcp, udp } th dport 53 accept
+    ip daddr $PROXY_IP accept$EXTRA_RULES
+  }
+}
+EOF
+then
+  echo "intutic-sandbox: FAILED to apply egress firewall — refusing to run ungoverned" >&2
+  exit 90
+fi
+
+# Strip the `--` separator the launcher inserts before the command.
+if [ "${1:-}" = "--" ]; then shift; fi
+if [ "$#" -eq 0 ]; then
+  echo "intutic-sandbox: no command given" >&2
+  exit 2
+fi
+
+# Drop every capability we needed as root — the network-admin caps used for the
+# firewall, and the setpcap/setuid/setgid caps used for this very transition —
+# from the bounding set, then run as the unprivileged sandbox user. capsh still
+# holds these in its permitted set long enough to perform the user switch; the
+# bounding-set drop only stops them being *re-acquired*, so the agent process
+# ends up with an empty capability set and no path back to any of them. The
+# firewall above is therefore immutable from inside the sandbox.
+#
+# Attest, then exec — in that order, inside the SAME post-drop shell, so the
+# attestation call itself only has the locked-down firewall to route through
+# (LLD #63 §6, TD-333). Before this, `executionMode: 'SANDBOX'` on a session
+# was set entirely by the host-side `intutic exec` CLI, before this container
+# even started — a claim with nothing behind it. This callback can only
+# succeed from a process that got this far: firewall installed, capabilities
+# dropped. It does NOT prove entrypoint.sh itself ran unmodified — a
+# `--sandbox-image` deliberately built to skip the firewall/capsh steps above
+# but still make this call would still attest; closing that needs
+# measured/attested boot, which nothing here has. Best-effort like
+# openSandboxSession/closeSandboxSession on the host side: a failed call is
+# logged and the agent runs anyway — attestation adds visibility, it is not
+# itself a new gate (that's what sandboxRequirement='require' is for,
+# enforced client-side before this container is even launched).
+export PROXY_IP
+exec capsh \
+  --drop=cap_net_admin,cap_net_raw,cap_setpcap,cap_setuid,cap_setgid \
+  --user=sandbox -- -c '
+    if [ -n "${INTUTIC_SESSION_ID:-}" ] && [ -n "${INTUTIC_API_KEY:-}" ]; then
+      curl -sf -m 3 -X POST "http://'"$PROXY_IP"':${INTUTIC_SANDBOX_PROXY_PORT:-4000}/intutic/attest-sandbox" \
+        -H "Authorization: Bearer ${INTUTIC_API_KEY}" \
+        -H "Content-Type: application/json" \
+        -d "{\"sessionId\":\"${INTUTIC_SESSION_ID}\"}" \
+        >/dev/null 2>&1 \
+      || echo "intutic-sandbox: attestation call failed (non-fatal, session stays unattested)" >&2
+    fi
+    exec "$@"
+  ' intutic-sandbox "$@"

package/resources/sandbox/firecracker-launch.sh

@@ -0,0 +1,120 @@
+#!/bin/bash
+# Firecracker microVM launch (LLD #63 §6, Increment 4).
+#
+# This is the boot sequence validated on a real KVM host (GCE nested-virt,
+# Intel): it sets up the tap link, installs a host-side default-deny egress
+# firewall scoped to the guest so the microVM's only route out is the proxy,
+# boots the microVM via the Firecracker API, runs the agent command inside the
+# guest, and tears everything down.
+#
+# Verification status: PROVEN end-to-end on a GCE nested-virt Intel host — the
+# microVM boots to userspace, an agent runs inside it over ssh, and the
+# host-side firewall below blocks its egress to everything except the proxy
+# (reached the proxy stand-in = 200; external 1.1.1.1 = blocked).
+#
+# The kernel+rootfs are operator-supplied (the rootfs must contain the agent and
+# an sshd), but a matched pair matters: the Firecracker CI `vmlinux-6.1.102`
+# does NOT enumerate the virtio-blk root device under Firecracker (the guest
+# panics "Cannot open root device vda" despite CONFIG_VIRTIO_BLK=y — an
+# ACPI/MMIO discovery quirk), while `vmlinux-5.10.223` + `ubuntu-22.04.ext4`
+# from the same CI bucket boot cleanly. Defaulted below; override with
+# --kernel/--rootfs.
+#
+#   kernel: https://s3.amazonaws.com/spec.ccfc.min/firecracker-ci/v1.10/x86_64/vmlinux-5.10.223
+#   rootfs: https://s3.amazonaws.com/spec.ccfc.min/firecracker-ci/v1.10/x86_64/ubuntu-22.04.ext4
+#
+# Privileged: tap + nft + firecracker need root.
+set -uo pipefail
+
+KERNEL="" ROOTFS="" TAP="tap-intutic" GUEST_IP="172.16.0.2" HOST_IP="172.16.0.1"
+PREFIX="30" VCPUS="1" MEM="512" ALLOW="" GUEST_KEY="${INTUTIC_FC_GUEST_KEY:-}"
+CMD=()
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --kernel) KERNEL="$2"; shift 2;;
+    --rootfs) ROOTFS="$2"; shift 2;;
+    --tap) TAP="$2"; shift 2;;
+    --guest-ip) GUEST_IP="$2"; shift 2;;
+    --host-ip) HOST_IP="$2"; shift 2;;
+    --prefix) PREFIX="$2"; shift 2;;
+    --vcpus) VCPUS="$2"; shift 2;;
+    --mem) MEM="$2"; shift 2;;
+    --allow) ALLOW="$2"; shift 2;;
+    --) shift; CMD=("$@"); break;;
+    *) echo "firecracker-launch: unknown arg '$1'" >&2; exit 2;;
+  esac
+done
+[ -n "$KERNEL" ] && [ -n "$ROOTFS" ] || { echo "firecracker-launch: --kernel and --rootfs are required" >&2; exit 2; }
+
+NFT="$(command -v nft || echo /usr/sbin/nft)"
+SOCK="$(mktemp -u /tmp/intutic-fc-XXXX.sock)"
+CONSOLE="$(mktemp /tmp/intutic-fc-console-XXXX.log)"
+FCPID=""
+
+cleanup() {
+  [ -n "$FCPID" ] && sudo kill "$FCPID" 2>/dev/null
+  sudo ip link del "$TAP" 2>/dev/null || true
+  sudo "$NFT" delete table inet intutic_vm_egress 2>/dev/null || true
+  rm -f "$SOCK"
+}
+trap cleanup EXIT
+
+echo "firecracker-launch: tap $TAP ($HOST_IP/$PREFIX) + host-side default-deny egress for guest $GUEST_IP"
+sudo ip link del "$TAP" 2>/dev/null || true
+sudo ip tuntap add "$TAP" mode tap
+sudo ip addr add "${HOST_IP}/${PREFIX}" dev "$TAP"
+sudo ip link set "$TAP" up
+sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null
+
+# Host-side default-deny egress for the guest: allow the proxy (host) + DNS +
+# operator --allow CIDRs and established return traffic; drop the rest. The
+# agent inside the guest cannot alter this — it lives on the host.
+EXTRA=""
+if [ -n "$ALLOW" ]; then
+  OLDIFS="$IFS"; IFS=','
+  for c in $ALLOW; do [ -n "$c" ] && EXTRA="$EXTRA
+    ip saddr ${GUEST_IP} ip daddr ${c} accept"; done
+  IFS="$OLDIFS"
+fi
+sudo "$NFT" -f - <<EOF
+table inet intutic_vm_egress {
+  chain forward {
+    type filter hook forward priority 0; policy accept;
+    ip saddr ${GUEST_IP} ct state established,related accept
+    ip saddr ${GUEST_IP} ip daddr ${HOST_IP} accept
+    ip saddr ${GUEST_IP} udp dport 53 accept
+    ip saddr ${GUEST_IP} tcp dport 53 accept$EXTRA
+    ip saddr ${GUEST_IP} drop
+  }
+}
+EOF
+
+NETMASK="$(python3 -c "import ipaddress;print(ipaddress.IPv4Network('0.0.0.0/${PREFIX}').netmask)" 2>/dev/null || echo 255.255.255.252)"
+BOOT_ARGS="console=ttyS0 reboot=k panic=1 pci=off root=/dev/vda rw ip=${GUEST_IP}::${HOST_IP}:${NETMASK}::eth0:off"
+
+echo "firecracker-launch: booting microVM (${VCPUS} vcpu, ${MEM} MiB)"
+sudo firecracker --api-sock "$SOCK" >"$CONSOLE" 2>&1 &
+FCPID=$!
+sleep 1
+api() { sudo curl -s --unix-socket "$SOCK" -X PUT "http://localhost/$1" -H 'Content-Type: application/json' -d "$2" >/dev/null; }
+api "boot-source" "{\"kernel_image_path\":\"${KERNEL}\",\"boot_args\":\"${BOOT_ARGS}\"}"
+api "drives/rootfs" "{\"drive_id\":\"rootfs\",\"path_on_host\":\"${ROOTFS}\",\"is_root_device\":true,\"is_read_only\":false}"
+api "network-interfaces/eth0" "{\"iface_id\":\"eth0\",\"host_dev_name\":\"${TAP}\"}"
+api "machine-config" "{\"vcpu_count\":${VCPUS},\"mem_size_mib\":${MEM}}"
+api "actions" '{"action_type":"InstanceStart"}'
+
+# Wait for the guest to reach sshd, then run the agent command inside it. This
+# requires an sshd-enabled rootfs and INTUTIC_FC_GUEST_KEY (the guest ssh key).
+if [ -z "$GUEST_KEY" ]; then
+  echo "firecracker-launch: microVM booted. Set INTUTIC_FC_GUEST_KEY to run the agent in-guest over ssh." >&2
+  echo "  guest console: $CONSOLE" >&2
+  sleep 3
+  exit 0
+fi
+SSH="ssh -i ${GUEST_KEY} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=8"
+for _ in $(seq 1 20); do
+  if $SSH "root@${GUEST_IP}" true 2>/dev/null; then break; fi
+  sleep 1
+done
+$SSH "root@${GUEST_IP}" -- "${CMD[@]}"
+exit $?

package/dist/harness/vscodeSettingsWriter.d.ts

@@ -1,40 +0,0 @@
-/**
- * vscodeSettingsWriter.ts — VS Code settings.json proxy injection.
- *
- * Shared by the Cline and Roo Code adapters. Merges Intutic proxy
- * API base URL keys into:
- *   - macOS: ~/Library/Application Support/Code/User/settings.json
- *   - Linux: ~/.config/Code/User/settings.json
- *   - Workspace: <workspaceRoot>/.vscode/settings.json
- *
- * Also writes ~/.intutic/.env.intutic with exported env vars for
- * shells that source it before launching VS Code.
- *
- * LLD #14 — Phase 3 cross-harness defence
- * HLD §3.14 — Three-Tier Defense Cascade
- *
- * @module
- */
-/**
- * Settings keys injected for each harness.
- * These are checked during drift detection and restored on tamper.
- */
-export declare const CLINE_PROXY_KEYS: readonly ["cline.apiBase", "cline.openAiBaseUrl"];
-export declare const ROO_CODE_PROXY_KEYS: readonly ["roo-cline.openAiBaseUrl", "roo-cline.apiBase"];
-/**
- * Merge Intutic proxy URL into VS Code user + workspace settings.json
- * for the Cline extension.
- */
-export declare function injectClineProxySettings(workspaceRoot: string, proxyUrl: string): Promise<void>;
-/**
- * Merge Intutic proxy URL into VS Code user + workspace settings.json
- * for the Roo Code extension.
- */
-export declare function injectRooCodeProxySettings(workspaceRoot: string, proxyUrl: string): Promise<void>;
-/**
- * Write (or update) ~/.intutic/.env.intutic with proxy env vars.
- * Users/CI pipelines can `source ~/.intutic/.env.intutic` to get proxy routing
- * for any harness that respects OPENAI_BASE_URL / ANTHROPIC_BASE_URL.
- */
-export declare function writeEnvSidecar(proxyUrl: string): Promise<void>;
-//# sourceMappingURL=vscodeSettingsWriter.d.ts.map

package/dist/harness/vscodeSettingsWriter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vscodeSettingsWriter.d.ts","sourceRoot":"","sources":["../../src/harness/vscodeSettingsWriter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAsBH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,mDAAoD,CAAA;AACjF,eAAO,MAAM,mBAAmB,2DAA4D,CAAA;AAE5F;;;GAGG;AACH,wBAAsB,wBAAwB,CAC5C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CASf;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAwBrE"}