@namzu/sandbox 1.1.0

package/dist/backends/aci-standby-pool/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA4EH,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC9C,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAAuF,EACvF,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,IAAI,iBAAiB,GAAG,CAAC,CAAA;AACzB,SAAS,iBAAiB;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,iBAAiB,IAAI,CAAC,CAAA;IACtB,OAAO,OAAO,EAAE,IAAI,IAAI,IAAI,iBAAiB,EAAe,CAAA;AAC7D,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc;IAEd,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;IAC/B,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,QAA+B;IAE/B,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACpF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,EACnD,MAAM,CAAC,cAAc,IAAI,wBAAwB,CACjD,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,MAAM,CAAC,cAAc,IAAI,wBAAwB,EACjD,MAAM,CAAC,mBAAmB,IAAI,qBAAqB,CACnD,CAAA;QAED,IAAI,MAAM,GAAkB,OAAO,CAAA;QACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QAEnD,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,OAAO,MAAM,CAAA;YACd,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,MAAM,GAAG,MAAM,CAAA;gBACf,IAAI,CAAC;oBACJ,OAAO,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;gBACzD,CAAC;wBAAS,CAAC;oBACV,MAAM,GAAG,OAAO,CAAA;gBACjB,CAAC;YACF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAY;gBAC1B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsD,CAAA;gBACpF,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,kBAAkB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACnD,CAAC;YAED,KAAK,CAAC,OAAO;gBACZ,MAAM,GAAG,WAAW,CAAA;gBACpB,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YACpD,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,CAAC;YACJ,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACR,2DAA2D;YAC3D,6DAA6D;YAC7D,4DAA4D;QAC7D,CAAC;QACD,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,cAAsB,EACtB,SAAiB;IAEjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,SAAiB,EACjB,cAAsB;IAEtB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IACvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;aACjC,CAAC,CAAA;YACF,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAM;QACnB,CAAC;QAAC,MAAM,CAAC;YACR,oCAAoC;QACrC,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,CAAA;IACxD,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,OAAe,EACf,OAAe,EACf,IAA0B,EAC1B,IAAoC;IAEpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;QAC7C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,EAAE;YAChB,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,GAAG,EAAE,IAAI,EAAE,GAAG;YACd,SAAS,EAAE,IAAI,EAAE,OAAO;SACxB,CAAC;KACF,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAA;IACjB,IAAI,QAAQ,GAAG,KAAK,CAAA;IAEpB,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAA;IACnC,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,SAAS,CAAC;QACT,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI;YAAE,MAAK;QACf,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QACnD,IAAI,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACvC,OAAO,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACzC,IAAI,IAAI,EAAE,CAAC;gBACV,IAAI,CAAC;oBACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAIM,CAAA;oBACnC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBAClD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;wBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,CAAA;yBACvD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;wBAClC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;wBACzB,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAA;oBAC1B,CAAC;yBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;wBACnC,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;oBAC7B,CAAC;gBACF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACd,IAAI,CAAC,CAAC,GAAG,YAAY,WAAW,CAAC;wBAAE,MAAM,GAAG,CAAA;gBAC7C,CAAC;YACF,CAAC;YACD,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACF,CAAC;IAED,OAAO;QACN,MAAM;QACN,MAAM;QACN,QAAQ;QACR,QAAQ;QACR,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KACT,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,aAAa,CACjC,OAAO,EACP,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Docker smoke test — leaf-mount permission semantics.
+ *
+ * Concern Codex flagged: the Dockerfile pre-creates only the parent
+ * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
+ * The runtime claim is that:
+ *
+ *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
+ *      into it.
+ *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
+ *      the path simply does not exist — `stat` returns ENOENT, NOT
+ *      a writable empty dir.
+ *
+ * Both of those are kernel-level mount-namespace properties, not
+ * unit-testable. This file exercises them against a real docker
+ * daemon. Run via:
+ *
+ *   pnpm --filter @namzu/sandbox test:smoke
+ *   # or, from the monorepo root:
+ *   pnpm sandbox:smoke
+ *
+ * Excluded from the default `pnpm test` run by `vitest.config.ts`.
+ *
+ * Pre-requisites:
+ *   - `docker` CLI on PATH.
+ *   - A pre-built reference image. By default this test looks for
+ *     `namzu-sandbox-worker:smoke`. Override with the
+ *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
+ *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
+ *   - A host-side scratch directory the test creates and tears down.
+ *
+ * On a developer machine without docker the test self-skips with a
+ * clear message. On CI (`process.env.CI === 'true'`) the same
+ * pre-conditions FAIL FAST instead of skipping, so a CI
+ * misconfiguration cannot silently mask a regression — see the
+ * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
+ * always run with docker available.
+ */
+export {};
+//# sourceMappingURL=leaf-permissions.smoke.test.d.ts.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaf-permissions.smoke.test.d.ts","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG"}

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js

@@ -0,0 +1,157 @@
+/**
+ * Docker smoke test — leaf-mount permission semantics.
+ *
+ * Concern Codex flagged: the Dockerfile pre-creates only the parent
+ * dirs (`/mnt`, `/mnt/user-data`, `/mnt/skills`) as root-owned 0555.
+ * The runtime claim is that:
+ *
+ *   1. When `outputs` IS bound, uid 1001 (the worker user) can write
+ *      into it.
+ *   2. When a leaf path (e.g. `/mnt/user-data/uploads`) is NOT bound,
+ *      the path simply does not exist — `stat` returns ENOENT, NOT
+ *      a writable empty dir.
+ *
+ * Both of those are kernel-level mount-namespace properties, not
+ * unit-testable. This file exercises them against a real docker
+ * daemon. Run via:
+ *
+ *   pnpm --filter @namzu/sandbox test:smoke
+ *   # or, from the monorepo root:
+ *   pnpm sandbox:smoke
+ *
+ * Excluded from the default `pnpm test` run by `vitest.config.ts`.
+ *
+ * Pre-requisites:
+ *   - `docker` CLI on PATH.
+ *   - A pre-built reference image. By default this test looks for
+ *     `namzu-sandbox-worker:smoke`. Override with the
+ *     `NAMZU_SANDBOX_SMOKE_IMAGE` env. Build the image once with:
+ *       `docker build -t namzu-sandbox-worker:smoke -f packages/sandbox/worker/Dockerfile packages/sandbox`
+ *   - A host-side scratch directory the test creates and tears down.
+ *
+ * On a developer machine without docker the test self-skips with a
+ * clear message. On CI (`process.env.CI === 'true'`) the same
+ * pre-conditions FAIL FAST instead of skipping, so a CI
+ * misconfiguration cannot silently mask a regression — see the
+ * `.github/workflows/sandbox-smoke.yml` workflow which is meant to
+ * always run with docker available.
+ */
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+import { createSandboxProvider } from '../../../index.js';
+const IMAGE = process.env.NAMZU_SANDBOX_SMOKE_IMAGE ?? 'namzu-sandbox-worker:smoke';
+const IS_CI = process.env.CI === 'true';
+function dockerAvailable() {
+    const probe = spawnSync('docker', ['version', '--format', '{{.Server.Version}}'], {
+        stdio: 'ignore',
+    });
+    return probe.status === 0;
+}
+function imagePresent(image) {
+    const probe = spawnSync('docker', ['image', 'inspect', image], { stdio: 'ignore' });
+    return probe.status === 0;
+}
+const skipReason = !dockerAvailable()
+    ? 'docker daemon not reachable — skipping smoke test'
+    : !imagePresent(IMAGE)
+        ? `image ${IMAGE} not present — build it with \`docker build -t ${IMAGE} -f packages/sandbox/worker/Dockerfile packages/sandbox\` and re-run`
+        : null;
+// CI fail-fast: the smoke workflow is meant to always have docker +
+// the reference image. Skipping silently in that environment would
+// let a regression land without the test even attempting to run.
+// Locally (no `CI=true`) skipping with a hint is the right behaviour
+// for a developer who hasn't built the image yet.
+if (IS_CI && skipReason) {
+    throw new Error(`smoke test pre-condition not satisfied on CI: ${skipReason}. Configure the workflow to install docker and build the reference image before running.`);
+}
+describe.skipIf(skipReason !== null)('docker smoke — leaf permissions', () => {
+    let outputsHost;
+    beforeAll(() => {
+        outputsHost = mkdtempSync(join(tmpdir(), 'namzu-sandbox-smoke-out-'));
+    });
+    afterAll(() => {
+        if (outputsHost) {
+            rmSync(outputsHost, { recursive: true, force: true });
+        }
+    });
+    it('uid 1001 can write to the outputs bind, and the host sees the file', async () => {
+        const provider = createSandboxProvider({
+            backend: { tier: 'container', image: IMAGE },
+            layout: {
+                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
+            },
+        });
+        const sandbox = await provider.create();
+        try {
+            const result = await sandbox.exec('sh', [
+                '-c',
+                'id -u && echo "smoke" > /mnt/user-data/outputs/hello.txt',
+            ]);
+            expect(result.exitCode).toBe(0);
+            expect(result.stdout.trim()).toBe('1001');
+            // Host-side read confirms the bind round-trips.
+            const hostContent = readFileSync(join(outputsHost, 'hello.txt'), 'utf8');
+            expect(hostContent.trim()).toBe('smoke');
+        }
+        finally {
+            await sandbox.destroy();
+        }
+    }, 60_000);
+    it('unbound leaves do not exist — uploads/transcripts/tool_results are ENOENT, not empty', async () => {
+        const provider = createSandboxProvider({
+            backend: { tier: 'container', image: IMAGE },
+            layout: {
+                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
+                // Intentionally leave uploads / toolResults / transcripts
+                // unbound. The Dockerfile pre-creates only the parents
+                // (`/mnt/user-data`, `/mnt/skills`); leaves should not
+                // exist and `stat` should fail.
+            },
+        });
+        const sandbox = await provider.create();
+        try {
+            for (const leafPath of [
+                '/mnt/user-data/uploads',
+                '/mnt/user-data/tool_results',
+                '/mnt/transcripts',
+            ]) {
+                const result = await sandbox.exec('sh', ['-c', `stat ${leafPath} 2>&1; echo --rc=$?`]);
+                // `stat` returns non-zero on ENOENT; the rc line carries
+                // the failure. Either is the contract; we accept either
+                // "No such file" or "cannot stat" wording across distros.
+                expect(result.stdout).toMatch(/--rc=[1-9]/);
+                expect(result.stdout.toLowerCase()).toMatch(/no such file|cannot stat|does not exist/);
+            }
+        }
+        finally {
+            await sandbox.destroy();
+        }
+    }, 60_000);
+    it('uid 1001 cannot mkdir into the root-owned 0555 parent /mnt/user-data', async () => {
+        const provider = createSandboxProvider({
+            backend: { tier: 'container', image: IMAGE },
+            layout: {
+                outputs: { source: { type: 'hostDir', hostPath: outputsHost } },
+            },
+        });
+        const sandbox = await provider.create();
+        try {
+            // The model trying to "create the missing leaf dir" hits
+            // the 0555 root-owned parent and is denied — exactly what
+            // distinguishes "not bound" from "writable empty dir".
+            const result = await sandbox.exec('sh', [
+                '-c',
+                'mkdir /mnt/user-data/fake 2>&1; echo --rc=$?',
+            ]);
+            expect(result.stdout).toMatch(/--rc=[1-9]/);
+            expect(result.stdout.toLowerCase()).toMatch(/permission denied/);
+        }
+        finally {
+            await sandbox.destroy();
+        }
+    }, 60_000);
+});
+//# sourceMappingURL=leaf-permissions.smoke.test.js.map

package/dist/backends/docker/__tests__/leaf-permissions.smoke.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"leaf-permissions.smoke.test.js","sourceRoot":"","sources":["../../../../src/backends/docker/__tests__/leaf-permissions.smoke.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA;AAEzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,4BAA4B,CAAA;AACnF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM,CAAA;AAEvC,SAAS,eAAe;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;QACjF,KAAK,EAAE,QAAQ;KACf,CAAC,CAAA;IACF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAA;AAC1B,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE;IACpC,CAAC,CAAC,mDAAmD;IACrD,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC,SAAS,KAAK,kDAAkD,KAAK,sEAAsE;QAC7I,CAAC,CAAC,IAAI,CAAA;AAER,oEAAoE;AACpE,mEAAmE;AACnE,iEAAiE;AACjE,qEAAqE;AACrE,kDAAkD;AAClD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,KAAK,CACd,iDAAiD,UAAU,0FAA0F,CACrJ,CAAA;AACF,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC5E,IAAI,WAAmB,CAAA;IAEvB,SAAS,CAAC,GAAG,EAAE;QACd,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,GAAG,EAAE;QACb,IAAI,WAAW,EAAE,CAAC;YACjB,MAAM,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,CAAC;IACF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,0DAA0D;aAC1D,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC/B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YACzC,gDAAgD;YAChD,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAA;YACxE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzC,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;gBAC/D,0DAA0D;gBAC1D,uDAAuD;gBACvD,uDAAuD;gBACvD,gCAAgC;aAChC;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,KAAK,MAAM,QAAQ,IAAI;gBACtB,wBAAwB;gBACxB,6BAA6B;gBAC7B,kBAAkB;aAClB,EAAE,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,QAAQ,QAAQ,qBAAqB,CAAC,CAAC,CAAA;gBACtF,yDAAyD;gBACzD,wDAAwD;gBACxD,0DAA0D;gBAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;gBAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAA;YACvF,CAAC;QACF,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;IAEV,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,QAAQ,GAAG,qBAAqB,CAAC;YACtC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;YAC5C,MAAM,EAAE;gBACP,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE;aAC/D;SACD,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,CAAA;QACvC,IAAI,CAAC;YACJ,yDAAyD;YACzD,0DAA0D;YAC1D,uDAAuD;YACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;gBACvC,IAAI;gBACJ,8CAA8C;aAC9C,CAAC,CAAA;YACF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;YAC3C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAA;QACjE,CAAC;gBAAS,CAAC;YACV,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;QACxB,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAA;AACX,CAAC,CAAC,CAAA"}

package/dist/backends/docker/index.d.ts

@@ -0,0 +1,118 @@
+/**
+ * `container:docker` backend.
+ *
+ * Spawns one Docker container per `Sandbox` instance via the
+ * `docker` CLI (no node-docker SDK dependency — keeps the package
+ * thin). The container runs the small HTTP worker shipped under
+ * `packages/sandbox/worker/server.js`; the host adapter talks to
+ * it on `127.0.0.1:<random-port>`.
+ *
+ * One container per sandbox, not one per `exec` call: keeps cold-
+ * start out of the hot path. The container goes away in
+ * `destroy()`.
+ *
+ * Trust model:
+ *  - Container is the trust boundary; everything inside is treated
+ *    as untrusted code.
+ *  - Worker only listens on loopback inside its own netns; the
+ *    host adapter reaches it via Docker's port-forward.
+ *  - Outbound network from the worker is restricted by host-side
+ *    firewall config (see {@link DockerBackendConfig.network}) plus
+ *    the egress proxy when one is configured (P3.2).
+ */
+import { type ContainerSandboxLayout, type ResolvedContainerSandboxLayout } from '@namzu/sdk';
+import { type SandboxBackend } from '../../index.js';
+/**
+ * Backend-specific tuning. Most hosts use the defaults; advanced
+ * deployments override `image` to point at their own pre-built
+ * image, or pin `dockerBinary` for non-standard installs.
+ *
+ * The container's mount layout is baked in at provider construction
+ * via {@link DockerBackendInternalConfig.layout} — every `create()`
+ * call inherits the same layout. This is by design: per-task hosts
+ * call `createSandboxProvider` once per task, with that task's
+ * layout. There is no per-call layout argument, so the SDK runtime
+ * cannot accidentally call a docker provider without one.
+ */
+export interface DockerBackendInternalConfig {
+    readonly image: string;
+    /**
+     * Pre-resolved layout. Construction-time `resolveLayout` validates
+     * and applies defaults; the docker backend renders mount flags
+     * directly from this without re-validating.
+     */
+    readonly layout: ResolvedContainerSandboxLayout;
+    readonly dockerBinary?: string;
+    readonly network?: 'none' | 'bridge' | string;
+    readonly readyPollIntervalMs?: number;
+    readonly readyTimeoutMs?: number;
+    /**
+     * Docker runtime to launch the container under. Default `runc`
+     * (vanilla Docker namespaces, what Docker Desktop ships). Linux
+     * production deployments that have registered gVisor on the host
+     * daemon can pass `runsc` to upgrade to a userspace-kernel trust
+     * boundary — same primitive Modal Labs and OpenAI Code Interpreter
+     * ship. Hosts can also pass a custom runtime name registered in
+     * `daemon.json`. macOS Docker Desktop has no `runsc` runtime, so
+     * the default `runc` is the only option there; that's documented
+     * as the local-dev tier in the package README.
+     */
+    readonly runtime?: 'runc' | 'runsc' | string;
+    /**
+     * How the SDK consumer reaches the in-container worker:
+     *
+     *  - `'host-port'` (default): publish the worker port on the
+     *    host loopback (`127.0.0.1::<random>`) and connect by host
+     *    port. Works when the SDK runs ON the docker host (CLI,
+     *    direct dev). Backward-compatible — the original behaviour.
+     *
+     *  - `'container-network'`: skip `--publish` entirely, attach
+     *    the spawned container to a shared docker bridge that the
+     *    SDK consumer is also on, and connect by container DNS name
+     *    (`http://<containerName>:2024`). Required when the SDK
+     *    runs INSIDE a container (e.g. Vandal's app container
+     *    spawning sibling sandbox containers via the host's Docker
+     *    daemon — `127.0.0.1` inside the app is the app, not the
+     *    sandbox). The shared bridge name comes from `config.network`.
+     */
+    readonly hostReachability?: 'host-port' | 'container-network';
+    /**
+     * Optional `--label key=value` pairs applied to the spawned
+     * container at `docker run` time. Used by hosts that need to
+     * find their containers from out-of-band code paths (reaper jobs,
+     * monitoring filters) via `docker ps --filter label=…`. Keys
+     * containing `=` or empty names throw at spawn time — the docker
+     * CLI accepts them but the resulting label split is ambiguous.
+     */
+    readonly labels?: Readonly<Record<string, string>>;
+}
+/**
+ * Build a {@link SandboxBackend} backed by Docker. Construction is
+ * synchronous; the actual container spawns on the first
+ * `create()` call.
+ */
+export declare function buildDockerBackend(config: DockerBackendInternalConfig): SandboxBackend;
+/**
+ * Validate and resolve a {@link ContainerSandboxLayout}. Returns a
+ * {@link ResolvedContainerSandboxLayout} with every container path
+ * filled in; throws {@link ContainerSandboxLayoutValidationError}
+ * collecting every violation in one pass.
+ *
+ * Called once at provider construction (`createSandboxProvider`).
+ * Validation surfaces synchronously during host wiring; nothing
+ * downstream re-validates per `provider.create()` call.
+ *
+ * Exported for tests so the validation rules are pinned by golden-
+ * value assertions rather than only exercised through the spawn path.
+ */
+export declare function resolveLayout(layout: ContainerSandboxLayout): ResolvedContainerSandboxLayout;
+export declare function renderLayoutMountArgs(layout: ResolvedContainerSandboxLayout): string[];
+export declare function renderLayoutReadRootsEnv(layout: ResolvedContainerSandboxLayout): string;
+/**
+ * Writable container roots. Only the RW mounts go here — uploads,
+ * tool-results, transcripts, and skills are read-only and must stay
+ * out of WRITE_ROOTS or the agent's `write`/`append` could clobber
+ * source files the host considers immutable.
+ */
+export declare function renderLayoutWriteRootsEnv(layout: ResolvedContainerSandboxLayout): string;
+//# sourceMappingURL=index.d.ts.map

package/dist/backends/docker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,8BAA8B,EAcnC,MAAM,YAAY,CAAA;AAEnB,OAAO,EAEN,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAA;AAEvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC5C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,GAAG,cAAc,CAQtF;AA0cD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAmI5F;AAkCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,EAAE,CA+BtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAUvF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAKxF"}