@namzu/sandbox 13.0.0 → 15.0.0

package/README.md

@@ -76,6 +76,22 @@ microVM; a confirmed stop with an incomplete terminal stream is reported
 separately so callers do not mistake partial output for an unknown process
 outcome.
 
+**One exception, and it is the only object here that is not disposable.** A
+persistent Kubernetes workspace is not retired on an unconfirmed stop: the
+retirement there is the `operatingMode: Suspended` patch, which makes the
+controller delete the pod, and a workspace is held by more than one process by
+design. Nothing is written, the handle goes on serving, the rejection carries
+`retirement: { accepted: false, reason: 'workspace-kept' }`, and a bounded
+health probe reports through `onCancellationUnconfirmed` whether the guest
+agent is serving, has fenced itself, or could not be reached — so the host
+decides when the live sessions in that pod go down. Because such a workspace
+is held by more than one process, the writes that DO still go to it — suspend,
+resume, adopt, delete — take an optional monotonic holder epoch, stored on the
+object and tested in the same request that writes, so a superseded process's
+late suspend or late delete is refused by the cluster rather than applied.
+A call that passes no epoch sends exactly the requests it always sent. See
+`docs/sdk/kubernetes-sandbox.md`.
+
 Remote peers retain terminal ids briefly for idempotent cancellation, but evict
 the oldest terminal history before refusing new work. If a command leader exits
 while descendants remain, the peer fences itself and retires the whole sandbox
@@ -84,6 +100,132 @@ Concurrent destroy and automatic-retirement calls share one checked teardown;
 Docker removal is never reported as accepted after a non-zero or aborted
 `docker rm -f`.
 
+**The SIGTERM → SIGKILL grace window.** Both peers implement the same
+mechanism, deliberately kept textually parallel so a future reader sees they
+are one design, not two: `SIGTERM` the owned process group, wait for it to go
+quiet, and escalate to `SIGKILL` only if it is still alive at the end of a
+grace window — with nothing checking that a quiet group went quiet BECAUSE of
+the signal rather than by finishing on its own. A command that ignores
+`SIGTERM` but happens to complete within the window therefore runs to
+completion untouched and reports back as a clean, unaborted-looking success.
+The container worker's `NAMZU_SANDBOX_CANCEL_GRACE_MS` and the Firecracker/
+kubernetes guest agent's `NAMZU_AGENT_CANCEL_GRACE_MS` both default to `250`
+(previously `2000` on both — issue #469's kind conformance run caught this on
+the agent transport first; the identical worker-side race was fixed in the
+same change once found). 250ms is comfortably under the shared conformance
+suite's adversarial fixture (a command that finishes on its own in ~400ms)
+while still enough for a fast, well-behaved `SIGTERM` handler's own cleanup;
+a deployment that genuinely needs a longer cooperative-shutdown window sets
+either variable explicitly.
+
+**Retained output, and a command that outlives its connection.** On the
+kubernetes workspace tier a command can be started with a caller-chosen
+`executionId` and `retainOutput`, and then followed — or picked up by a
+different host process — through the additive `attach-execution` op. There is
+ONE retained-output primitive in the guest and every consumer reads it: an
+ordered, size-bounded log of stdout and stderr in a single monotonically
+increasing byte-offset space, so a reader resumes with one number and sees the
+interleaving the command produced. Its bound is bytes, not chunks — a chunk
+larger than the whole budget has its head sliced off rather than being kept
+whole — and eviction advances the log's start offset, so a read from before it
+is answered with a `droppedBytes` count. A gap is reported; output is never
+silently skipped, and offsets are absolute so a stale cursor is always
+answerable. Every delta frame of a retained command carries the byte range it
+occupies — on the `execute` stream as well as on an attach — because a host
+must never derive an offset from what it received: output crosses the wire as
+decoded text, and a chunk that ends inside a multi-byte character does not
+decode to its own byte length. `attach-execution` replays from the requested
+offset, follows the live command, and ends with one terminal frame; it never
+signals the process, and closing an attach connection is a no-op. Ending a
+command stays `cancel-execution`'s job alone. Reserving an id the guest still
+holds reports what it holds rather than minting a second reservation, so a
+retried start runs the command once — a guarantee that ends where the record
+does, at the retention window (`NAMZU_AGENT_EXECUTION_RETAINED_TTL_MS`,
+10 min) and at pod replacement. The cost is bounded twice over, per execution
+(`NAMZU_AGENT_EXECUTION_LOG_BYTES`, 1 MiB) and by how many executions may
+retain at once (`NAMZU_AGENT_MAX_RETAINED_OUTPUT_LOGS`, 32), and only a
+command that asked for retention is kept at all. The guest advertises
+`execution-attach` in `healthz` and a host that asks for a detachable command
+against an image without it is refused before the command is admitted.
+
+**Sessions: a terminal or a program that outlives the host process.** On the
+kubernetes workspace tier a terminal can be opened with a caller-chosen
+`sessionId` and `persistent: true`, and a program can be started with no
+terminal at all through the additive `start-detached` op. Both then belong to
+the guest's session registry rather than to the connection that started them:
+closing the connection DETACHES and sends no signal, `attach-session` replays
+from a byte offset and then follows live, `list-sessions` names what is
+running, and `kill-session` ends one. The registry holds the SAME retained-output
+primitive described above — one ring per session, one monotonic offset space,
+eviction reported as `droppedBytes` — rather than a second one, and output is
+read into it whether or not anybody is attached, so a program with no reader
+never blocks on a full PTY. At most one attachment exists per session: a second
+attach ends the first with a named `detached` frame, so two host processes
+cannot interleave keystrokes into one shell. The registry is in memory only,
+so a replaced pod comes back with none. **A teardown now reaches the whole
+session.** The agent's own comment claimed a process-group kill reached "the
+shell and every descendant"; it did not, because util-linux `script` starts the
+shell in a new session, so a job backgrounded with `&` survived every terminal
+teardown and ran until the pod stopped. Both `kill-session` and a
+non-persistent terminal's teardown now signal every process still in that
+kernel session, found through `/proc`. The cost is bounded per session
+(`NAMZU_AGENT_SESSION_LOG_BYTES`, 1 MiB) and by how many may exist
+(`NAMZU_AGENT_MAX_SESSIONS`, 16), with an exited session's record kept for
+`NAMZU_AGENT_SESSION_TERMINAL_TTL_MS` (10 min). The guest advertises `sessions`
+in `healthz` and a host asking for any of it against an image without the
+string is refused rather than served a connection-bound terminal.
+
+**Quiesce: stop everything the guest is running, and keep serving.** A
+workspace host that takes a final capture of the disk could not make it exact.
+`suspend()` reaches the terminals THAT handle returned and an execution
+somebody cancelled by id; a terminal another host process opened, a command
+already in flight, and above all a program that moved into a session of its own
+with `setsid` and was then reparented away from the agent all kept running, and
+kept writing, until the pod stopped — and once the pod has stopped there is no
+agent left to read the disk through. The additive `quiesce` op is where a host
+stands instead: it marks every running execution BEFORE it signals anything
+(without that mark, a group leader dying before the rest of its group makes an
+execution's close handler fence the agent, and a fenced agent refuses the
+capture the quiesce was performed for), scans `/proc` rather than its own
+children, skips PID 1, itself and its own kernel session, then signals in
+rounds — `SIGTERM`, `graceMs`, `SIGKILL` on what is left — until a pass finds
+nothing. A process still present after `SIGKILL` FAILS the call and names its
+pid; it never resolves optimistically. Afterwards `execute`, `read-file` and
+`write-file` all still work, which is the whole point. While it runs, every op
+that would start a process answers `quiesce_in_progress`; the reads do not. The
+general scan covers the guest's PID namespace, which in a pod is the container
+and nothing else, and the agent performs it only when it is the init of that
+namespace or was started by it (`k8s/entrypoint.sh` makes `tini` PID 1 and the
+agent its child); anywhere else it narrows itself to the kernel sessions its own
+registries own and reports `scope: "owned-sessions"` rather than being silently
+weaker. The guest advertises `quiesce` in `healthz` and a host asking an image
+without it is refused by name.
+
+**A workspace's writes reach its disk on purpose.** Nothing in the agent ever
+called `sync`, `syncfs` or `fsync`: a `write-file` answered `ok` as soon as the
+bytes were in the page cache, and a `suspend()` took the pod away as soon as it
+had stopped — which says nothing is writing any more, not that what was written
+arrived. Both halves are closed. A `write-file` now goes through a temp
+sibling, an `fsync`, a rename and a directory `fsync` before it answers, so the
+reply means the bytes are on the device and a write that fails leaves the
+previous contents rather than a truncated file; one `fsync` per part sequence,
+on the last part, covers the whole file. And the additive `flush` op runs
+`syncfs(2)` over the workspace mount, which is the only thing that can reach
+what a COMMAND wrote — the Kubernetes backend sends it and waits for the reply
+before it patches a workspace to `Suspended`, and the agent runs it itself on
+`SIGTERM`, after stopping every process it owns through the same routine
+`quiesce` uses and before exiting 0. The guest advertises `flush` in `healthz`
+**only if it can run one** — the flush runs `sync -f`, and an image that
+strips coreutils has this code and no `sync` — so a host that does not see the
+string is told the image cannot flush rather than being left to read an
+`unknown_op`, or a refusal it can never get past, as a flush that happened.
+
+**The command timeout ceiling is configurable.** The guest agent reads its
+maximum `timeoutMs` from `NAMZU_SANDBOX_MAX_TIMEOUT_MS` — the same variable
+the container worker has always read for the same limit — defaulting to the
+unchanged 30 minutes, and names the variable when it refuses. A request above
+the ceiling is refused, not silently shortened.
+
 Every worker and microVM guest publishes its wire-protocol version in the
 readiness response. The host admits only the exact version implemented by its
 release; missing, older, and newer versions fail before a sandbox handle or
@@ -101,6 +243,285 @@ previous host and golden-image pair available together for rollback. Rolling
 back only one side is intentionally rejected at readiness, so a mismatched
 guest never accepts work under an unverified wire contract.
 
+## Guest agent transports and the per-instance token
+
+The microVM guest agent picks its listen socket from the environment, in a
+fixed order: `NAMZU_AGENT_UNIX_PATH` for a unix-domain socket, then an
+inherited descriptor for the vsock bridge named by `NAMZU_AGENT_VSOCK_PORT`,
+then `NAMZU_AGENT_TCP_PORT` for a TCP listener on `0.0.0.0`. The third mode is
+for a deployment that reaches the guest over a routed network — one sandbox per
+pod on a container orchestrator — instead of over a host-local socket. Framing,
+ops, execution leases, terminals, loopback TCP and file IO are identical on all
+three; only the listen address differs. A guest whose environment configures
+none of them still refuses to start, naming all three. `NAMZU_AGENT_TCP_PORT=0`
+binds an ephemeral port, which is what the suites use; a deployment names a
+fixed port, because nothing in front of the guest can be configured to reach a
+port that is only chosen at startup.
+
+A routed listener is reachable by whatever the network admits, so that
+deployment also gives the agent a per-instance credential. With
+`NAMZU_AGENT_BIND_TOKEN` set, every op except `healthz` must present exactly
+that token in its request envelope, from the first frame of the connection; a
+missing, empty or different token is answered `unauthorized` and the connection
+is closed before any handler runs. The token is compared in constant time
+against a fixed-width digest, so neither its value nor its length is learnable
+by probing. `NAMZU_AGENT_REQUIRE_TOKEN` is the fallback for a deployment that
+cannot inject a token: the agent binds to the first token it is shown and
+refuses every other one for the life of the process. With neither variable set
+the agent authenticates nothing, which is what the host-local vsock and unix
+transports have always done and what they keep doing. `healthz` never requires
+a token and never echoes one, so readiness probing needs no secret and leaks
+nothing beyond liveness and the protocol version.
+
+The TCP mode fails closed. `NAMZU_AGENT_TCP_PORT` set with neither
+`NAMZU_AGENT_BIND_TOKEN` nor `NAMZU_AGENT_REQUIRE_TOKEN` is refused at startup,
+naming both, rather than binding an unauthenticated listener on `0.0.0.0`; the
+unix and inherited-descriptor modes keep requiring no token, because their
+control channel is host↔guest only. `NAMZU_AGENT_BIND_TOKEN` set to the empty
+string is refused at startup in **every** mode: that is the shape a
+downward-API injection takes when it resolved to nothing, and honouring it
+would open precisely the hole the variable was set to close.
+
+Neither the framed wire nor its version changes when the agent grows a
+capability. `healthz` carries a `features` list instead, and a host uses an op
+or a field only when it sees the string there: `write-file-parts` for a body
+written to a temporary sibling in parts and finished with an atomic rename,
+`flush` for the `syncfs` over the workspace mount, `stream-heartbeat` for the
+per-stream liveness frame, and `guest-boot-id` for the agent process's own
+identity.
+
+`guest-boot-id` is a field rather than an op. The agent mints one opaque id at
+startup and stamps it on every reply a caller has already authenticated —
+`reserve-execution`, `cancel-execution` including its `unknown_execution`
+refusal, `read-file`, `write-file`, and the `ready` frame that opens a terminal,
+a session attachment or a `tcp-connect` stream. `healthz`, which is
+unauthenticated, carries only the feature string and no id. It exists because a
+per-instance token cannot answer "is this the same agent": on a container
+orchestrator the token is the pod's uid, and a container restarted in place
+keeps its pod — so the token still works, every call still succeeds, and every
+process the caller started is gone with nothing on the wire saying so. An agent
+that predates the field sends none and a host must read that as "this guest
+cannot tell me", never as a change. A heartbeat is negotiated
+per stream and in both directions — the `terminal` or `tcp-connect` open body
+carries the interval, the agent echoes the interval it will use in its `ready`
+event and only then starts sending, and the host only starts once that echo
+arrived. An agent that predates the field ignores it and echoes nothing, so its
+host behaves exactly as it did; a host that predates it never asks, so it is
+never sent a frame type it would treat as a protocol error. Once negotiated,
+three consecutive intervals with nothing at all arriving end the stream on both
+sides — the same cleanup a closed socket already runs. Both sides count bytes
+rather than whole frames, so a large frame still on its way is proof of life
+like any other; silence while a side has paused reading for backpressure does
+not count; and the echoed interval is honoured only between 100 ms and four
+times what was asked, since each side does its own watchdog arithmetic with
+a number the other sent.
+
+Because the credential rides inside the request envelope, the gate cannot run
+until a whole frame has been parsed — so what an unauthenticated peer may spend
+in that window is bounded rather than trusted, and in the token modes only:
+
+| Variable | Default | What it bounds |
+|---|---|---|
+| `NAMZU_AGENT_MAX_FRAME_BYTES` | 256 MiB | The largest length any frame header may announce, on every listen mode. The 8-hex prefix otherwise permits 4 GiB, which the reader used to honour. Sized for the largest frame the host legitimately writes: a `write-file` carries the whole base64 body in one envelope when it fits. |
+| `NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES` | 8 MiB | The same ceiling for a connection that has not yet presented the token, clamped to the one above. Token modes only. It is the ceiling on one `write-file` FRAME on a token path, no longer on a file — see below. |
+| `NAMZU_AGENT_MAX_PREAUTH_CONNECTIONS` | 64 | How many connections may be unauthenticated at once. Token modes only. Every bound above is per connection, so without this one they could be paid again on the next connection. A full pool evicts its **oldest** unauthenticated member and serves the arrival — see below for why that direction. |
+| `NAMZU_AGENT_MAX_PREAUTH_BUFFER_BYTES` | 32 MiB | What all unauthenticated connections may buffer **between them**, never less than one pre-auth frame. Token modes only. The count above bounds sockets; this bounds the heap behind them, and the heap is what runs out first. |
+| `NAMZU_AGENT_PREAUTH_IDLE_TIMEOUT_MS` | 10000 | How long a connection may stay unauthenticated while **quiet**. Every byte received resets it, so it retires the connection that says nothing, not the one that says too little. Token modes only, cleared the moment a connection authenticates. |
+| `NAMZU_AGENT_PREAUTH_DEADLINE_MS` | 10000 | How long a connection may stay unauthenticated **at all**, measured from accept and reset by nothing. Token modes only, cleared the moment a connection authenticates, so no long-lived terminal, `tcp-connect` or streaming `execute` is ever measured against it. |
+| `NAMZU_AGENT_REFUSAL_FLUSH_GRACE_MS` | 1000 | How long a refusal frame may take to reach the wire before the socket is destroyed anyway. Every listen mode. A backstop against a peer that has stopped reading, not a budget anything normally spends. |
+
+The `quiesce` op has four bounds and one scope of its own, on every listen mode:
+
+| Variable | Default | What it bounds |
+|---|---|---|
+| `NAMZU_AGENT_QUIESCE_GRACE_MS` | 1000 | How long one round waits after `SIGTERM` before escalating to `SIGKILL`. Clamped below `NAMZU_AGENT_CANCEL_CONFIRM_TIMEOUT_MS`, and a caller-supplied `graceMs` at or above that bound is refused: a marked execution's close handler stops waiting there, so a later escalation would fence the agent mid-quiesce. Not the pod's `terminationGracePeriodSeconds`. |
+| `NAMZU_AGENT_QUIESCE_DEADLINE_MS` | 20000 | The whole op, across every round. Kept well under the host transport's 60s read-idle timeout, because nothing is written on the wire while a quiesce runs — so raise it only up to that timeout (itself configurable on the host), never past it: beyond it the host tears down a quiesce that is working and cannot learn that it did. |
+| `NAMZU_AGENT_QUIESCE_MAX_ROUNDS` | 8 | Scan-and-signal passes before the call reports failure. Rounds exist because a process can be forked while a pass is in flight; a workload forking faster than it can be killed is a failure to report, not a loop to run out the deadline. |
+| `NAMZU_AGENT_QUIESCE_SETTLE_MS` | 1000 | How long the op waits, after everything is gone, for a killed child's `close` event to move its session to `exited` and settle its execution. Bookkeeping only — the processes are already gone, so running out of it does not fail the call. |
+| `NAMZU_AGENT_QUIESCE_SCOPE` | derived | `owned-sessions` narrows the scan to the kernel sessions the agent's own registries own. The only accepted value: the general PID-namespace scan is derived from whether this agent is the init of its own PID namespace or was started by it, and there is deliberately no way to force it on. |
+
+Termination and the flush have two more, on every listen mode:
+
+| Variable | Default | What it bounds |
+|---|---|---|
+| `NAMZU_AGENT_FLUSH_TIMEOUT_MS` | 10000 | One `sync -f` over the workspace mount, whether a host asked for it or the `SIGTERM` handler is running it. Reported unconfirmed rather than abandoned quietly when it expires, because a caller that asked for a flush is usually about to take the pod away. |
+| `NAMZU_AGENT_SHUTDOWN_DEADLINE_MS` | 15000 | The WHOLE `SIGTERM` handler: stop accepting connections, stop every process the guest is running, flush, exit. The agent exits when it expires whatever is still in flight — a process in uninterruptible IO outlives a `SIGKILL` and a `syncfs` takes as long as the device takes, and a handler with no bound would hold the pod open until the kubelet's own `SIGKILL`. Keep it well below the pod's `terminationGracePeriodSeconds`. It is the only bound: a repeat `SIGTERM` is logged and ignored, because in a stopping pod the second one is the kubelet's own (sent as soon as the `preStop` hook returns) rather than anybody asking for a shorter wait. The hook's wait is derived from this number so it outlives it. |
+
+So the most an unauthenticated peer can make the agent hold is
+`NAMZU_AGENT_MAX_PREAUTH_BUFFER_BYTES`, spread over at most
+`NAMZU_AGENT_MAX_PREAUTH_CONNECTIONS` sockets, and both are tunable against the
+pod's memory limit. Resident memory settles somewhat above that while the
+allocator catches up; what it does not do is keep climbing. Note what a shared
+budget means when it is exhausted: the connection refused is whichever one asks
+next, which may be a legitimate caller rather than the peer holding the budget.
+That is the trade a global bound makes — a refused request is recoverable, an
+exhausted pod is not.
+
+A header above either ceiling is answered `frame_too_large`, naming the
+announced length, the limit, and the variable that governs it, because a caller
+told only a number cannot tell which of the two ceilings it hit. A fourth bound
+needs no variable: a frame header is exactly nine bytes, eight hex digits and a
+newline, so a peer streaming bytes that contain no newline at all is refused on
+the ninth of them rather than buffered against a newline that is never coming.
+A refused connection — for any of these, or for `unauthorized` — is
+**destroyed**, not `end()`ed: ending a socket closes only its writable half, so
+a refused peer used to be able to keep streaming into the agent's frame buffer
+for as long as it liked.
+
+Two of those bounds exist because the others do not answer a slow loris, and in
+one earlier shape made each other worse. An idle timeout is reset by every
+byte, so a peer that trickles one byte every few seconds stays unauthenticated
+for as long as it cares to; `NAMZU_AGENT_PREAUTH_DEADLINE_MS` is what bounds
+it, because it runs from accept and nothing resets it. And a full pool that
+refused the **newest** connection handed exactly those peers the power to
+decide who else got served: enough of them locked out every later caller,
+including the credential-exempt `healthz` probe that a readiness check cannot
+do without. So a full pool evicts its oldest unauthenticated member instead,
+answers it `too_many_unauthenticated_connections`, and serves the arrival — the
+oldest unauthenticated connection being, by construction, the one that has had
+the longest to present a token and has not.
+
+What none of this does is stop a peer that can reach the port from causing
+churn. It can still open connections, hold slots until the deadline, and make
+the agent evict and re-accept; what it cannot do is hold a slot indefinitely or
+starve a probe. That residual is deliberate, and it is the division of labour
+this design rests on: the NetworkPolicy ingress rule in front of the agent port
+is the boundary that decides who may reach it at all, and the token and these
+bounds are defence in depth behind it, for a peer already inside that rule.
+
+One consequence used to be worth naming as a limit, because it is the price of
+putting the credential in the envelope rather than in a handshake: a
+`write-file` body travels in the same first frame as the token, so in a token
+mode the pre-auth cap bounds that body — about 6 MiB of file content at the
+default, since the body travels base64-encoded. It is still the bound on one
+frame. It is no longer the bound on a **file**.
+
+`write-file` takes an optional `part` object, and a body too large for one
+frame arrives as a sequence of them:
+
+```jsonc
+// Every part is an ordinary write-file. `path` names a TEMPORARY sibling of
+// the target for the whole sequence, never the target itself.
+{ "op": "write-file", "token": "…", "body": {
+    "path": "seed/.namzu-write-<uuid>-repo.tar.part",
+    "content": "<base64 of this slice>", "encoding": "base64",
+    "part": { "offset": 0, "final": false } } }
+
+// …and the last one renames onto the target.
+{ "op": "write-file", "token": "…", "body": {
+    "path": "seed/.namzu-write-<uuid>-repo.tar.part",
+    "content": "<base64 of the tail>", "encoding": "base64",
+    "part": { "offset": 12582912, "final": true, "renameTo": "seed/repo.tar" } } }
+```
+
+`offset` must equal the temp file's CURRENT size (`0` creates or truncates
+it), so a part that went missing, arrived twice or arrived out of order is
+refused — `write_part_offset_mismatch` — rather than written in the wrong
+place; a per-temp-path lock refuses an overlapping writer outright
+(`write_part_in_flight`). A part whose bytes did not all reach the disk is
+refused too (`write_part_short_write`): one `pwrite` answers a write that
+crosses the volume's free space or an `RLIMIT_FSIZE` with a short count and
+no error, so the agent checks the count it got and the temp file's size
+against what the part claimed before it renames anything. The temp path and
+`renameTo` go through the same workspace jail every other write does, and the
+target changes exactly once, in the final `rename`: a reader never sees a
+half-written file, and a sequence that dies partway leaves the target exactly
+as it was. A host that abandons a sequence removes what it left behind with
+`part: { "discard": true }`, which is idempotent — a path that is not there,
+in a directory that was never created, answers `discarded` and creates
+nothing on the way — and refuses (`write_part_not_a_temp_file`) any path
+whose name, or whose RESOLVED name, is not one of these part files:
+`write-file` removes an abandoned part, never an arbitrary file. A `part`
+that is present but is not an object is refused outright
+(`write_part_invalid_shape`) rather than served as the plain whole-file write
+it resembles.
+
+The guest opts in. `healthz` answers with `features` alongside `ok` and
+`protocolVersion` — `write-file-parts` among them — and a host sends a part
+only to a guest that advertised it: an agent that predates the field would
+ignore `part` and write that slice as a whole file. A deployment that would
+rather send one big frame than several small ones can still raise
+`NAMZU_AGENT_MAX_PREAUTH_FRAME_BYTES`, trading pre-auth buffer budget for
+frame size. Nothing on the Firecracker path is affected either way: no token
+mode is active there, so no pre-auth cap applies and a `write-file` frame of
+any size up to `NAMZU_AGENT_MAX_FRAME_BYTES` is accepted exactly as before.
+
+`read-file` has the mirror-image arrangement, for a problem that was never a
+refusal — it just cost more the bigger the file got, until it stopped working.
+The whole-file reply held the file buffer, its base64 string, the JSON string
+and two frame buffers at once, about 7.7x the file: measured against this
+agent over loopback TCP, a 64 MiB read grew it by 405 MiB, and a file of about
+384 MiB or more could not be answered at all because its base64 string is
+longer than V8 permits a string to be. So `read-file` now takes optional
+`offset` and `length` and `pread`s one bounded slice, answering with the WHOLE
+file's `sizeBytes` beside it and with the bytes that exist when the range runs
+past the end; and a new `read-file-stream` op opens the fd once and sends
+`meta`, then base64 `data` frames, then `end`, then the zero-length
+terminator, reusing one read buffer and waiting for the socket to drain
+between chunks. A 1 GiB read grows the agent by about 12 MiB on the same
+measurement.
+
+```jsonc
+// One slice, one reply frame. Capped by NAMZU_AGENT_READ_FILE_RANGE_BYTES
+// (1 MiB): a larger range is REFUSED, not shortened.
+{ "op": "read-file", "token": "…", "body": {
+    "path": "out/report.bin", "encoding": "base64",
+    "offset": 1048576, "length": 262144 } }
+
+// The whole file, as an ordered multi-frame reply.
+{ "op": "read-file-stream", "token": "…", "body": { "path": "out/report.bin" } }
+```
+
+The guest opts into both together: `healthz`'s `features` list carries both
+strings, `write-file-parts` and `read-file-stream` — one entry for the two
+read shapes, because they ship in the same file and no guest can have one
+without the other. A host that does not see it keeps to the single whole-file
+reply and sends neither — an agent that predates them would ignore
+`offset`/`length` and answer with the whole file, which the caller would read
+as its slice, so the
+host throws `AgentReadFileStreamUnsupportedError` instead. Both new shapes go
+through the same workspace jail the old op used.
+
+Two rules a host writing to this wire has to know. A range must ask for
+`base64`: a `utf8` slice taken at an arbitrary offset can begin or end inside
+a multi-byte character, so the guest refuses one with
+`read_file_range_requires_base64`, while a whole-file read still serves `utf8`
+because its boundaries are the file's own. And `read-file-stream` serves
+regular files only, refusing a directory, a fifo or a device node with
+`read_file_stream_not_a_regular_file` — a regular file that `stat` reports as
+zero bytes and that still has content, the procfs shape, is read to EOF by
+both new shapes rather than answered as empty.
+
+None of this is a wire change. `token`, `part`, `offset` and `length` are
+optional envelope and body fields, `read-file-stream` is a new op nobody is
+obliged to call, and `features` is an additive `healthz` field, so the guest
+protocol version is deliberately unchanged and no host and no golden image
+has to roll together with this release.
+
+What the token is not: a boundary against the sandbox's own workload. Once the
+image entrypoint deprivileges, the agent and the workload share a uid, so a
+workload process can read the agent's own `/proc/<pid>/environ`. It is
+per-instance for exactly that reason — a workload that steals its own
+instance's token gains nothing it does not already have inside that instance,
+and there is no shared pool secret whose theft would reach the other instances.
+The boundary that keeps other tenants out is the network rule in front of the
+agent port; the token is defence in depth behind it. What the guest does
+guarantee is narrower and exact: every process it starts to serve a request —
+an `execute` command, a `terminal` shell, the resize helper behind that
+terminal — is handed an environment stripped of every `NAMZU_AGENT_*` and
+`NAMZU_SANDBOX_*` variable, so the token and the agent's own configuration
+never enter the workload's environment through the environment it is given.
+Reading them out of `/proc` is the exposure above, and it is why the token is
+per-instance.
+
+That scrub is a **behaviour change** for the `terminal` op, not only a new
+guarantee. A terminal shell used to be handed the agent's whole `process.env`;
+it now gets the scrubbed environment an `execute` child has always had, and so
+does the `stty` resize helper behind it. A terminal session therefore no longer
+sees the agent's own settings — `NAMZU_SANDBOX_WORKSPACE` among them. A
+workload that needs a value in its terminal passes it in `env` on the
+`openTerminal` call, which still wins over everything else, `TERM` included.
+
 ## Firecracker workspace channels
 
 The Firecracker backend exposes two optional same-sandbox channels. Call
@@ -131,6 +552,32 @@ that can change egress after admission. A backend must throw when it cannot
 enforce a requested live policy; accepting without applying it would erase the
 security boundary the host relied on.
 
+## Kubernetes per-sandbox egress
+
+The kubernetes backend serves that contract when — and only when —
+`egress.perSandbox` is configured: the method is PRESENT on a task handle
+then and absent otherwise, which is the same omit-rather-than-ignore rule read
+from the other side. A `KubernetesWorkspace` handle never carries it, and
+`createKubernetesWorkspace` refuses a config that sets the option (with
+`KubernetesWorkspacePerSandboxEgressConfigError`, before the first request)
+rather than omitting a method the config asked for. Configured, each
+`setNetworkPolicy` call writes one
+`CiliumNetworkPolicy` for that sandbox alone, named after the claim's uid,
+selecting one per-sandbox pod label, owned by the claim so the cluster
+collects it on `destroy()`, and resolving only once a read-back deep-equals
+what was sent. An empty list deletes that object and leaves the configured
+baseline in force — which is a narrowing only when that baseline denies,
+because cluster policies union.
+
+It has two operator prerequisites, and a host that enables the option without
+them is refused by design rather than by accident: an applied
+`ValidatingAdmissionPolicy` and its binding, which the backend proves before
+its first write and which bound what the host may write, and a separate RBAC
+file granting the policy-write verbs the default Role deliberately withholds.
+Whether such a policy is ENFORCED is a property of the cluster's CNI and is
+not measured anywhere in this repository. See
+`docs/sdk/kubernetes-sandbox.md`.
+
 ## Documentation
 
 - [Namzu docs](https://github.com/cogitave/namzu/tree/main/docs)

package/dist/backends/aci-standby-pool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAS9B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAc3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAiBhB;AAoMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,IAAI,CAOP"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,KAAK,EAEX,8BAA8B,EAU9B,MAAM,YAAY,CAAA;AAGnB,OAAO,KAAK,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAA;AAc3E;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAEpD,MAAM,WAAW,mCAAmC;IACnD,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAA;IACtC;;;OAGG;IACH,QAAQ,CAAC,+BAA+B,EAAE,MAAM,CAAA;IAChD;;;OAGG;IACH,QAAQ,CAAC,6BAA6B,CAAC,EAAE,MAAM,CAAA;IAC/C;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C;;OAEG;IACH,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAA;IACtC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAA;IACrC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;CACrC;AASD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,mCAAmC,GACzC,cAAc,CAiBhB;AAoMD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,qBAAqB,GAAG,IAAI,CActE;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,kBAAkB,CAAC,EAAE,OAAO,CAAA;CAC5B,GAAG,IAAI,CAOP"}

package/dist/backends/aci-standby-pool/index.js

@@ -411,12 +411,24 @@ async function spawnAciSandbox(config, options, readiness) {
                     throw new Error(`write-file failed: HTTP ${res.status} ${await res.text()}`);
                 }
             },
-            async readFile(path) {
+            /**
+             * Refused rather than answered whole when a range is asked for —
+             * the worker has no range op, and {@link Sandbox.readFile} says a
+             * backend that takes `offset`/`length` and hands back everything
+             * has given a wrong answer, not a degraded one. `options.signal`
+             * is honoured — one HTTP request is the whole read, so the signal
+             * goes to `fetch`.
+             */
+            async readFile(path, options) {
                 assertActive();
+                if (options?.offset !== undefined || options?.length !== undefined) {
+                    throw new Error('readFile: the standby-pool worker serves whole files only, so offset/length cannot be honoured. Read the file whole, or use a backend that streams.');
+                }
                 const res = await fetch(`${baseUrl}/read-file`, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
                     body: JSON.stringify({ path, encoding: 'base64' }),
+                    signal: options?.signal,
                 });
                 if (!res.ok) {
                     throw new Error(`read-file failed: HTTP ${res.status} ${await res.text()}`);

package/dist/backends/aci-standby-pool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAcH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED,KAAK,CAAC,QAAQ,CAAC,IAAY;gBAC1B,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBAClD,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAeH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED;;;;;;;eAOG;YACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgC;gBAC5D,YAAY,EAAE,CAAA;gBACd,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACd,qJAAqJ,CACrJ,CAAA;gBACF,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAClD,MAAM,EAAE,OAAO,EAAE,MAAM;iBACvB,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/backends/docker/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,8BAA8B,EAkBnC,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EACX,kBAAkB,EAClB,kBAAkB,EAElB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAA;AAcvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAE9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAE3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAE5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC5C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,GAAG,cAAc,CAiBtF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,QAAQ,UAAQ,GACd,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM1F;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,WAAW,GAAG,mBAAmB,EAC/C,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,qBAAqB,EAAE,MAAM,GAC3B,IAAI,CAcN;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,EACnF,MAAM,EAAE,YAAY,GAClB,kBAAkB,CASpB;AAirBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAmI5F;AAkCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,EAAE,CA+BtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAUvF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAKxF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/backends/docker/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EACN,KAAK,sBAAsB,EAE3B,KAAK,8BAA8B,EAmBnC,MAAM,YAAY,CAAA;AAEnB,OAAO,KAAK,EACX,kBAAkB,EAClB,kBAAkB,EAElB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,EAEN,KAAK,YAAY,EACjB,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAA;AAcvB;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;IAC/C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAE9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAE3B;;;;;;;;;OASG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAA;IAE5D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAE3C,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;IAC5C;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,WAAW,GAAG,mBAAmB,CAAA;IAC7D;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CAClD;AAOD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,2BAA2B,GAAG,cAAc,CAiBtF;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAC7B,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,QAAQ,UAAQ,GACd,MAAM,CAkBR;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,CAM1F;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,OAAO,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,qBAAqB,EAAE,MAAM,GAAG,OAAO,CAExE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,6BAA6B,CAC5C,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,WAAW,GAAG,mBAAmB,EAC/C,MAAM,EAAE,YAAY,GAAG,SAAS,EAChC,qBAAqB,EAAE,MAAM,GAC3B,IAAI,CAcN;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,IAAI,CAAC,2BAA2B,EAAE,qBAAqB,GAAG,gBAAgB,CAAC,EACnF,MAAM,EAAE,YAAY,GAClB,kBAAkB,CASpB;AAqsBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,8BAA8B,CAmI5F;AAkCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,EAAE,CA+BtF;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAUvF;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,8BAA8B,GAAG,MAAM,CAKxF"}

package/dist/backends/docker/index.js

@@ -528,12 +528,30 @@ async function spawnDockerSandbox(config, options, readiness) {
                 throw new Error(`write-file failed: HTTP ${res.status} ${await res.text()}`);
             }
         },
-        async readFile(path) {
+        /**
+         * The worker's `/read-file` has no range, so a caller asking for one
+         * is REFUSED rather than handed the whole file.
+         *
+         * {@link Sandbox.readFile} draws that line: a backend that takes
+         * `offset`/`length` and answers with everything has given a wrong
+         * answer, not a degraded one, and the caller stops looking. Declaring
+         * the one-parameter form would not close it — through the `Sandbox`
+         * type a caller can still pass options — so the refusal is explicit.
+         *
+         * `options.signal` IS honoured: the contract says it aborts the read,
+         * and one HTTP request is the whole read here, so it is handed to
+         * `fetch`.
+         */
+        async readFile(path, options) {
             assertActive();
+            if (options?.offset !== undefined || options?.length !== undefined) {
+                throw new Error('readFile: the docker worker serves whole files only, so offset/length cannot be honoured. Read the file whole, or use a backend that streams.');
+            }
             const res = await fetch(`${baseUrl}/read-file`, {
                 method: 'POST',
                 headers: { 'content-type': 'application/json' },
                 body: JSON.stringify({ path, encoding: 'base64' }),
+                signal: options?.signal,
             });
             if (!res.ok) {
                 throw new Error(`read-file failed: HTTP ${res.status} ${await res.text()}`);