@namzu/sandbox 15.0.0 → 17.0.0

package/dist/backends/aci-standby-pool/index.js

@@ -39,8 +39,8 @@
  *    a pool-side knob, not a backend knob — the backend never
  *    chooses; it just PUTs against whichever pool the caller named.
  */
-import { generateSandboxId, walkFilesViaExec } from '@namzu/sdk';
-import { HttpWorkerClient } from '../http-worker-client.js';
+import { generateSandboxId, walkFilesViaExec, withHint } from '@namzu/sdk';
+import { HttpWorkerClient, STANDBY_POOL_UNAUTHORIZED_HINT } from '../http-worker-client.js';
 import { OperationDeadline, OperationDeadlineExpired, probeHttpHealth, resolveReadinessOptions, runFailureCleanup, } from '../readiness.js';
 import { RemoteCancellationUnknownError, RemoteProtocolError, } from '../remote-execution-controller.js';
 const DEFAULT_READY_POLL_MS = 500;
@@ -226,10 +226,28 @@ export function assertEnforceable(options) {
  * so nothing looks wrong. A caller who never heard of `subnetId` gets a
  * working sandbox on the internet and no signal at all.
  *
- * What is on that address matters: `worker/server.js` states "Authn: none"
- * in its own docblock and binds every interface. Inside a private network
- * that is the boundary doing the work. With a public address there is no
- * boundary left, and the worker's `/execute` is reachable by anyone.
+ * What is on that address matters: `worker/server.js` binds every interface
+ * and, inside a private network, that was the boundary doing the work — the
+ * worker authenticated nobody. With a public address there is no boundary
+ * left, and the worker's `/execute` is reachable by anyone.
+ *
+ * The worker now requires a per-instance `Authorization: Bearer` token on
+ * every route but `/healthz`, and REFUSES TO START on a routable bind when
+ * it has none. This backend cannot supply one, and the reason this comment
+ * used to give for that was wrong: it said the claim API's single admitted
+ * override — a config map — is no channel into the container group. It is
+ * one, on Linux a file mount under `/mnt/configmap/<containername>/<key>`
+ * carrying caller-supplied per-claim values. The credential is declined
+ * anyway, for two reasons that survive their source: the worker reads its
+ * token from `process.env` at startup and never looks for a file, so a
+ * mounted value is not read; and Microsoft's own guidance is that config
+ * map values are not validated by the runtime and that values affecting
+ * application security "should be made available to the container using
+ * environment variables". The full answer, and the change that would close
+ * the gap, is in `docs/sdk/container-sandbox-worker.md`. What that means
+ * for an operator is written down there too, rather than left to be
+ * discovered at startup; this refusal is unchanged, and now stands in
+ * front of a worker that would refuse the routable case itself.
  *
  * Defaulting to refusal rather than to a warning, because a warning on a
  * path that otherwise succeeds is read once and never again.
@@ -239,7 +257,7 @@ export function assertNotPubliclyAddressed(config) {
         return;
     if (config.allowPublicAddress)
         return;
-    throw new Error('The standby-pool sandbox backend will not claim a container group without `subnetId`: with no subnet the platform assigns a public address, and the worker on it has no authentication of any kind, so its execute endpoint would be reachable from the internet. Supply `subnetId` to inject the group into a private network, or set `allowPublicAddress: true` if this is a benchmark and you mean it.');
+    throw new Error('The standby-pool sandbox backend will not claim a container group without `subnetId`: with no subnet the platform assigns a public address, so the group is reachable by anything that can route to it, and this backend has no credential to put in front of that. A worker with no token refuses to start on a routable bind at all, and a worker that has one is only as strong as its transport — plain HTTP, where a bearer token is replayable by anything on the path. Supply `subnetId` to inject the group into a private network, or set `allowPublicAddress: true` if this is a benchmark and you mean it.');
 }
 async function spawnAciSandbox(config, options, readiness) {
     options.signal?.throwIfAborted();
@@ -407,6 +425,9 @@ async function spawnAciSandbox(config, options, readiness) {
                         encoding: 'base64',
                     }),
                 });
+                if (res.status === 401) {
+                    throw withHint(new Error(`write-file failed: HTTP 401 ${await res.text()}`), STANDBY_POOL_UNAUTHORIZED_HINT);
+                }
                 if (!res.ok) {
                     throw new Error(`write-file failed: HTTP ${res.status} ${await res.text()}`);
                 }
@@ -430,6 +451,9 @@ async function spawnAciSandbox(config, options, readiness) {
                     body: JSON.stringify({ path, encoding: 'base64' }),
                     signal: options?.signal,
                 });
+                if (res.status === 401) {
+                    throw withHint(new Error(`read-file failed: HTTP 401 ${await res.text()}`), STANDBY_POOL_UNAUTHORIZED_HINT);
+                }
                 if (!res.ok) {
                     throw new Error(`read-file failed: HTTP ${res.status} ${await res.text()}`);
                 }

package/dist/backends/aci-standby-pool/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAeH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAA;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,2YAA2Y,CAC3Y,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED;;;;;;;eAOG;YACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgC;gBAC5D,YAAY,EAAE,CAAA;gBACd,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACd,qJAAqJ,CACrJ,CAAA;gBACF,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAClD,MAAM,EAAE,OAAO,EAAE,MAAM;iBACvB,CAAC,CAAA;gBACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/backends/aci-standby-pool/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAeH,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAG1E,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAA;AAC3F,OAAO,EACN,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,iBAAiB,GACjB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,mBAAmB,GACnB,MAAM,mCAAmC,CAAA;AA+E1C,MAAM,qBAAqB,GAAG,GAAG,CAAA;AACjC,MAAM,wBAAwB,GAAG,MAAM,CAAA;AACvC,MAAM,mBAAmB,GAAG,IAAI,CAAA;AAChC,MAAM,uBAAuB,GAAG,oBAAoB,CAAA;AACpD,MAAM,QAAQ,GAAG,8BAA8B,CAAA;AAC/C,MAAM,6BAA6B,GAAG,YAAY,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACzC,MAA2C;IAE3C,MAAM,SAAS,GAAG,uBAAuB,CACxC,kBAAkB,EAClB,MAAM,CAAC,cAAc,EACrB,MAAM,CAAC,mBAAmB,EAC1B;QACC,SAAS,EAAE,wBAAwB;QACnC,cAAc,EAAE,qBAAqB;KACrC,CACD,CAAA;IACD,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,kBAAkB;QACxB,KAAK,CAAC,MAAM,CAAC,OAA8B;YAC1C,OAAO,MAAM,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;QACzD,CAAC;KACD,CAAA;AACF,CAAC;AAQD;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CACvB,MAAmC,EACnC,KAAa;IAEb,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACtC,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE;gBACP,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;aAC3C;SACD,CAAA;IACF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,IAAI,KAAK,CACd,6DAA6D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,8FAA8F,CACnM,CAAA;AACF,CAAC;AAmBD,SAAS,+BAA+B,CAAC,MAAsC;IAC9E,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,YAAY,GAAiC,EAAE,CAAA;IACrD,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,SAAS,GAAG,CACX,KAGC,EACD,KAAa,EACb,QAAiB;QAEjB,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QACxD,6DAA6D;QAC7D,6DAA6D;QAC7D,IAAI,WAAW,CAAC,IAAI,KAAK,SAAS;YAAE,OAAM;QAC1C,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAA;QACjC,MAAM,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,EAAE,EAAE,CAAA;QACxC,OAAO,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;gBAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ;aACR;SACD,CAAC,CAAA;QACF,YAAY,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,SAAS,EAAE,KAAK,CAAC,aAAa;YAC9B,QAAQ;SACR,CAAC,CAAA;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACrC,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAA;IACzD,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,WAAW;QAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,aAAa,EAAE,IAAI,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACnC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;QAC7F,CAAC;IACF,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;AACjC,CAAC;AAED,SAAS,iBAAiB;IACzB,iEAAiE;IACjE,gEAAgE;IAChE,kEAAkE;IAClE,UAAU;IACV,OAAO,iBAAiB,CAAA;AACzB,CAAC;AAED,KAAK,UAAU,OAAO,CACrB,GAAW,EACX,MAAgC,EAChC,QAA0B,EAC1B,IAAc,EACd,MAAoB,EACpB,mBAAsC,EAAE;IAExC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAA;IAC9B,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,IAAI,GAAgB;QACzB,MAAM;QACN,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;KACD,CAAA;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,IAAI,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IAClC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;YAChB,MAAM,EAAE,cAAc,EAAE,CAAA;YACxB,OAAO,SAAS,CAAA;QACjB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAA;QAC7B,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,MAAM,IAAI,KAAK,CAAC,OAAO,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAS,CAAA;IAC9D,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAA;IAChD,IAAI,EAAE,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAA;QACpC,MAAM,EAAE,cAAc,EAAE,CAAA;QACxB,OAAO,IAAI,CAAA;IACZ,CAAC;IACD,OAAO,SAAS,CAAA;AACjB,CAAC;AAcD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,gCAAgC,GAAG;IACxC,CAAC,QAAQ,EAAE,uBAAuB,CAAC;IACnC,CAAC,eAAe,EAAE,cAAc,CAAC;IACjC,CAAC,cAAc,EAAE,eAAe,CAAC;IACjC,CAAC,KAAK,EAAE,uBAAuB,CAAC;CACvB,CAAA;AAEV,MAAM,UAAU,iBAAiB,CAAC,OAA8B;IAC/D,MAAM,aAAa,GAAG,gCAAgC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE;QACvE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,OAAO,KAAK,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IACF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAEtC,MAAM,IAAI,KAAK,CACd,+DAA+D,aAAa;SAC1E,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;SACzB,IAAI,CACJ,IAAI,CACJ,8SAA8S,CAChT,CAAA;AACF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAG1C;IACA,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAM;IAC3B,IAAI,MAAM,CAAC,kBAAkB;QAAE,OAAM;IAErC,MAAM,IAAI,KAAK,CACd,ulBAAulB,CACvlB,CAAA;AACF,CAAC;AAED,KAAK,UAAU,eAAe,CAC7B,MAA2C,EAC3C,OAA8B,EAC9B,SAA0E;IAE1E,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAA;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC1B,0BAA0B,CAAC,MAAM,CAAC,CAAA;IAClC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,mBAAmB,IAAI,6BAA6B,CAAA;IAC1E,MAAM,MAAM,GAAG,GAAG,MAAM,IAAI,EAAE;SAC5B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IAChB,MAAM,UAAU,GAAG,MAAM,CAAC,aAAa,IAAI,uBAAuB,CAAA;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAA;IAC3D,MAAM,MAAM,GAAG,GAAG,QAAQ,kBAAkB,MAAM,CAAC,cAAc,mBAAmB,MAAM,CAAC,aAAa,0DAA0D,MAAM,gBAAgB,UAAU,EAAE,CAAA;IAEpM,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,+BAA+B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAEhF,gEAAgE;IAChE,iEAAiE;IACjE,iEAAiE;IACjE,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,iEAAiE;IACjE,qDAAqD;IACrD,MAAM,UAAU,GAA4B;QAC3C,qBAAqB,EAAE;YACtB,EAAE,EAAE,MAAM,CAAC,+BAA+B;YAC1C,QAAQ,EAAE,MAAM,CAAC,6BAA6B,IAAI,CAAC;SACnD;QACD,kBAAkB,EAAE;YACnB,EAAE,EAAE,MAAM,CAAC,qBAAqB;SAChC;QACD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,UAAU,CAAC,OAAO,GAAG,OAAO,CAAA;QAC5B,UAAU,CAAC,UAAU,GAAG;YACvB;gBACC,IAAI,EAAE,GAAG,MAAM,SAAS;gBACxB,UAAU,EAAE,EAAE,YAAY,EAAE;aAC5B;SACD,CAAA;IACF,CAAC;IAED,MAAM,IAAI,GAA4B;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU;KACV,CAAA;IAED,IAAI,OAAsC,CAAA;IAC1C,IAAI,CAAC;QACJ,OAAO,GAAG,MAAM,OAAO,CACtB,MAAM,EACN,KAAK,EACL,MAAM,CAAC,WAAW,EAClB,IAAI,EACJ,OAAO,CAAC,MAAM,CACd,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,oEAAoE;QACpE,oEAAoE;QACpE,uEAAuE;QACvE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;YACvE,CAAC,CAAC,CAAA;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CACd,iDAAiD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACnG,CAAA;IACF,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;IACpD,IAAI,EAAE,GAAG,SAAS,CAAA;IAClB,MAAM,iBAAiB,GAAG,IAAI,iBAAiB,CAC9C,SAAS,CAAC,SAAS,EACnB,4BAA4B,EAC5B,OAAO,CAAC,MAAM,CACd,CAAA;IACD,IAAI,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,CAAC;YACT,EAAE,GAAG,MAAM,gBAAgB,CAC1B,MAAM,EACN,MAAM,CAAC,WAAW,EAClB,iBAAiB,EACjB,SAAS,CAAC,cAAc,EACxB,SAAS,CAAC,SAAS,CACnB,CAAA;QACF,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,EAAE,IAAI,UAAU,EAAE,CAAA;QAC5C,MAAM,kBAAkB,CACvB,OAAO,EACP,iBAAiB,EACjB,SAAS,CAAC,SAAS,EACnB,SAAS,CAAC,cAAc,CACxB,CAAA;QAGD,IAAI,gBAAgB,GAAG,CAAC,CAAA;QACxB,IAAI,SAAS,GAAc,QAAQ,CAAA;QACnC,IAAI,iBAEQ,CAAA;QACZ,IAAI,eAA0C,CAAA;QAC9C,IAAI,gBAAgB,GAAG,KAAK,CAAA;QAC5B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAA;QACnD,MAAM,YAAY,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;QAClD,MAAM,YAAY,GAAG,GAAS,EAAE;YAC/B,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,IAAI,KAAK,CAAC,WAAW,EAAE,OAAO,SAAS,2CAA2C,CAAC,CAAA;YAC1F,CAAC;QACF,CAAC,CAAA;QACD,MAAM,eAAe,GAAG,CAAC,MAAoB,EAAiB,EAAE;YAC/D,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,gBAAgB;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;YAC9C,IAAI,eAAe;gBAAE,OAAO,eAAe,CAAA;YAC3C,MAAM,OAAO,GAAG,OAAO,CACtB,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,WAAW,EAClB,SAAS,EACT,MAAM,EACN,CAAC,GAAG,EAAE,GAAG,CAAC,CACV,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACvB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAC1B,GAAG,EAAE;gBACJ,gBAAgB,GAAG,IAAI,CAAA;gBACvB,SAAS,GAAG,WAAW,CAAA;YACxB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;gBAClB,IAAI,eAAe,KAAK,MAAM;oBAAE,eAAe,GAAG,SAAS,CAAA;gBAC3D,MAAM,KAAK,CAAA;YACZ,CAAC,CACD,CAAA;YACD,eAAe,GAAG,MAAM,CAAA;YACxB,OAAO,MAAM,CAAA;QACd,CAAC,CAAA;QACD,MAAM,MAAM,GAAG,GAGZ,EAAE;YACJ,SAAS,GAAG,UAAU,CAAA;YACtB,IAAI,iBAAiB;gBAAE,OAAO,iBAAiB,CAAA;YAC/C,MAAM,QAAQ,GAAG,IAAI,iBAAiB,CAAC,KAAK,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;YAC7E,iBAAiB,GAAG,QAAQ;iBAC1B,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBACrB,MAAM,qBAAqB,GAAG,eAAe,KAAK,SAAS,CAAA;gBAC3D,IAAI,CAAC;oBACJ,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,CAAC,qBAAqB,IAAI,MAAM,CAAC,OAAO;wBAAE,MAAM,KAAK,CAAA;oBACzD,MAAM,eAAe,CAAC,MAAM,CAAC,CAAA;gBAC9B,CAAC;YACF,CAAC,CAAC;iBACD,IAAI,CAAC,GAAG,EAAE;gBACV,OAAO,EAAE,QAAQ,EAAE,IAAa,EAAE,CAAA;YACnC,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC;gBAC3B,QAAQ,EAAE,KAAc;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;aAChE,CAAC,CAAC,CAAA;YACJ,OAAO,iBAAiB,CAAA;QACzB,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,KAAK,EAAK,SAA2B,EAAc,EAAE;YACzE,YAAY,EAAE,CAAA;YACd,gBAAgB,IAAI,CAAC,CAAA;YACrB,IAAI,CAAC;gBACJ,OAAO,MAAM,SAAS,EAAE,CAAA;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;oBACrD,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;gBAClC,CAAC;gBACD,MAAM,KAAK,CAAA;YACZ,CAAC;oBAAS,CAAC;gBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;YACrD,CAAC;QACF,CAAC,CAAA;QAED,OAAO;YACN,EAAE;YACF,IAAI,MAAM;gBACT,IAAI,SAAS,KAAK,QAAQ;oBAAE,OAAO,WAAW,CAAA;gBAC9C,OAAO,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;YAC/C,CAAC;YACD,OAAO;YACP,WAAW,EAAE,iBAAiB,EAAE;YAEhC,KAAK,CAAC,IAAI,CACT,OAAe,EACf,IAAe,EACf,IAAyB;gBAEzB,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;YACpF,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,IAAY,EAAE,OAAwB;gBACrD,YAAY,EAAE,CAAA;gBACd,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;gBAC7E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACpB,IAAI;wBACJ,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;wBAC/B,QAAQ,EAAE,QAAQ;qBAClB,CAAC;iBACF,CAAC,CAAA;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,QAAQ,CACb,IAAI,KAAK,CAAC,+BAA+B,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,EAC5D,8BAA8B,CAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC7E,CAAC;YACF,CAAC;YAED;;;;;;;eAOG;YACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,OAAgC;gBAC5D,YAAY,EAAE,CAAA;gBACd,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,IAAI,OAAO,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,IAAI,KAAK,CACd,qJAAqJ,CACrJ,CAAA;gBACF,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;oBAC/C,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;oBAClD,MAAM,EAAE,OAAO,EAAE,MAAM;iBACvB,CAAC,CAAA;gBACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACxB,MAAM,QAAQ,CACb,IAAI,KAAK,CAAC,8BAA8B,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,EAC3D,8BAA8B,CAC9B,CAAA;gBACF,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;oBACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;gBAC5E,CAAC;gBACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAA;gBACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAClD,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,uBAAuB,CAAC,CAAA;gBACvD,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YAC3C,CAAC;YAED,KAAK,CAAC,SAAS,CAAC,QAAgB;gBAC/B,OAAO,MAAM,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACxF,CAAC;YAED,KAAK,CAAC,CAAC,SAAS,CACf,QAAgB,EAChB,OAAgC;gBAEhC,YAAY,EAAE,CAAA;gBACd,gBAAgB,IAAI,CAAC,CAAA;gBACrB,IAAI,CAAC;oBACJ,2EAA2E;oBAC3E,KAAK,CAAC,CAAC,gBAAgB,CACtB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAC/D,QAAQ,EACR,OAAO,CACP,CAAA;gBACF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAChB,IAAI,KAAK,YAAY,8BAA8B;wBAAE,KAAK,CAAC,UAAU,GAAG,MAAM,MAAM,EAAE,CAAA;oBACtF,MAAM,KAAK,CAAA;gBACZ,CAAC;wBAAS,CAAC;oBACV,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAA;gBACrD,CAAC;YACF,CAAC;YAED,KAAK,CAAC,OAAO,CAAC,OAA+B;gBAC5C,IAAI,iBAAiB,EAAE,CAAC;oBACvB,MAAM,WAAW,GAAG,MAAM,iBAAiB,CAAA;oBAC3C,IAAI,WAAW,CAAC,QAAQ;wBAAE,OAAM;oBAChC,iBAAiB,GAAG,SAAS,CAAA;gBAC9B,CAAC;gBACD,uDAAuD;gBACvD,0DAA0D;gBAC1D,sDAAsD;gBACtD,yDAAyD;gBACzD,2DAA2D;gBAC3D,uDAAuD;gBACvD,2DAA2D;gBAC3D,4BAA4B;gBAC5B,MAAM,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YACvC,CAAC;SACD,CAAA;IACF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC,CAAC,CAAA;QACF,MAAM,GAAG,CAAA;IACV,CAAC;AACF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC9B,MAAc,EACd,QAA0B,EAC1B,QAA2B,EAC3B,cAAsB,EACtB,SAAiB;IAEjB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,EAAiC,CAAA;QACrC,IAAI,CAAC;YACJ,EAAE,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClC,OAAO,CAAoB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CACtE,CAAA;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;QACD,MAAM,KAAK,GAAG,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAA;QAC/C,MAAM,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,CAAA;QACxC,IAAI,KAAK,KAAK,WAAW,IAAI,EAAE;YAAE,OAAO,EAAE,CAAA;QAC1C,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;QACzE,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,KAAK,CAAC,CAAA;AAC/F,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,OAAe,EACf,QAA2B,EAC3B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,OAAO,UAAU,EAAE,MAAM,CAAC,CAAC,CAAA;YAC5F,IAAI,MAAM,CAAC,EAAE;gBAAE,OAAM;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,IAAI,GAAG,YAAY,mBAAmB;gBAAE,MAAM,GAAG,CAAA;YACjD,oCAAoC;QACrC,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QACrC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,wBAAwB;gBAAE,MAAK;YAClD,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sDAAsD,SAAS,KAAK,CAAC,CAAA;AACtF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB,CAChC,YAA8B,EAC9B,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CACrC,MAAM,EACN,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,EAC/C,SAAS,CACT,CAAA;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAuB,EAAE,CAAA;IACtC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,SAAQ;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QACjC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAQ;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AACf,CAAC"}

package/dist/backends/docker/index.d.ts

@@ -14,15 +14,35 @@
  * Trust model:
  *  - Container is the trust boundary; everything inside is treated
  *    as untrusted code.
- *  - Worker only listens on loopback inside its own netns; the
- *    host adapter reaches it via Docker's port-forward.
- *  - Outbound network from the worker is restricted by host-side
- *    firewall config (see {@link DockerBackendConfig.network}) plus
- *    the egress proxy when one is configured (P3.2).
+ *  - Every call to the worker's control API carries the per-instance
+ *    `NAMZU_SANDBOX_TOKEN` this backend mints at create time and
+ *    injects into the container's environment; a worker the host did
+ *    not create must be provisioned with its own. The worker requires
+ *    it on every route but `/healthz`, and refuses to start at all if
+ *    it has none and is bound to anything routable.
+ *  - Outbound network from the worker is restricted by the network
+ *    it is attached to (see {@link DockerBackendConfig.network}) and,
+ *    for a host allowlist, by an egress proxy running as a sibling
+ *    container on that same network — the only way its traffic reaches
+ *    the internet, because the network is `--internal` and has no route
+ *    off it. The proxy is a container on that subnet like any other, so
+ *    it is not the sandbox's only reachable destination. The proxy
+ *    environment the sandbox is given directs traffic; the topology is
+ *    what confines it. See {@link assertNetworkCarriesThePolicy} and
+ *    #398.
+ *
+ * The credential above is what a previous version of this docblock
+ * claimed network placement alone provided. It said the worker "only
+ * listens on loopback inside its own netns", which is false — the worker
+ * binds every interface by default and has to, because a published
+ * container port forwards to the container's interface address rather
+ * than to its loopback, so a loopback-bound worker is unreachable through
+ * the port this backend publishes. The boundary was the network the
+ * container is attached to, and wanted a credential behind it.
  */
 import { type ContainerSandboxLayout, type ResolvedContainerSandboxLayout } from '@namzu/sdk';
-import type { BrokeredCredential, EgressProxyOptions } from '../../egress/index.js';
-import { type EgressPolicy, type SandboxBackend } from '../../index.js';
+import type { BrokeredCredential } from '../../egress/index.js';
+import { type EgressPolicy, type SandboxBackend, type SandboxBackendOptions } from '../../index.js';
 /**
  * Backend-specific tuning. Most hosts use the defaults; advanced
  * deployments override `image` to point at their own pre-built
@@ -47,13 +67,66 @@ export interface DockerBackendInternalConfig {
     /**
      * `--user` value for the container, e.g. `'1000:1000'` or `'nobody'`.
      *
-     * Left unset by default because the correct uid depends on the image's
-     * own filesystem ownership, and forcing one would break every image
-     * that expects root at startup. Set it whenever the image supports a
-     * non-root user — a container running as root is one bind-mount
-     * misconfiguration away from writing the host.
+     * Left unset by default because `--user` does not ADD a non-root user, it
+     * OVERRIDES the image's own choice of one. The reference image ends with
+     * `USER namzu` (uid 1001, its `/workspace` chowned to match), so this
+     * backend's default is already non-root for the image it ships — a
+     * hard-coded uid here would replace that with a guess, and the guess is
+     * wrong for any image whose files are owned by someone else, which
+     * surfaces as `EACCES` on a path the workload was told it could write.
+     * Set it when the image does not declare a user of its own, or when the
+     * host wants a different one than it declares.
      */
     readonly runAsUser?: string;
+    /**
+     * CPU cores the container may use, rendered as `--cpus`. Unset by default.
+     *
+     * `--memory` and `--pids-limit` bound what a workload can take from the
+     * host, and CPU had no equivalent at all — no default, no knob — which
+     * reads as an oversight rather than a decision. It stays unset for the
+     * same reason neither of those two has a numeric default: the right value
+     * is a property of the host's machine and of what the workload is for, and
+     * any number this backend picked would silently throttle a run that
+     * finishes inside its timeout today. A host that wants the bound says what
+     * it is; the value is a decimal (`--cpus 1.5` is one and a half cores'
+     * worth of time, not a rounding).
+     *
+     * It lives on this config rather than beside `memoryLimitMb` on the
+     * per-call options because the documented deployment constructs one
+     * provider per task, so construction time IS per-task — and a control
+     * added to the tier-agnostic per-call shape would have to be refused by
+     * the ACI and kubernetes backends, which cannot apply a per-sandbox CPU
+     * limit any more than they can apply the memory and process ones.
+     */
+    readonly cpuLimit?: number;
+    /**
+     * Mount the container's root filesystem read-only. Default `true`.
+     *
+     * See {@link HARDENING_ARGS} for why the default is on and
+     * {@link renderWritableRootfsArgs} for the paths that stay writable while
+     * it is. Set it to `false` to make every path inside the container
+     * writable again, which is what a host whose image writes somewhere the
+     * writable set cannot describe needs, and which is why the switch exists
+     * instead of an unwritten rule that the baseline is absolute. It turns off
+     * that one control and nothing else: `--cap-drop=ALL`,
+     * `--security-opt=no-new-privileges` and `--ipc private` are applied
+     * whatever this says. It is a config field rather than an argument so that
+     * turning it off is a line somebody wrote on purpose, and not the default
+     * anyone gets by not looking.
+     */
+    readonly readOnlyRootfs?: boolean;
+    /**
+     * Extra paths to keep writable under `--read-only`, each mounted `--tmpfs`.
+     *
+     * The default set ({@link DEFAULT_WRITABLE_ROOTFS_PATHS}) is the reference
+     * image's needs, read off its Dockerfile; this is how a host that points
+     * `image` somewhere else says what ITS image needs, because the backend
+     * cannot read that out of an image and guessing is what these paths would
+     * otherwise be. A path the layout already mounts is refused rather than
+     * mounted twice (`Duplicate mount point`), and setting this at all beside
+     * `readOnlyRootfs: false` is refused as a contradiction.
+     */
+    readonly writableRootfsPaths?: readonly string[];
     /**
      * Credentials the egress proxy stamps on, per host.
      *
@@ -80,6 +153,53 @@ export interface DockerBackendInternalConfig {
      * is the hole the screen exists to close.
      */
     readonly allowInwardFor?: readonly string[];
+    /**
+     * Image the egress proxy runs as, when the policy needs one.
+     *
+     * A host allowlist (`static` or `resolver`) is enforced by a proxy, and
+     * this backend no longer runs that proxy in its own process: it runs it as
+     * a sibling container, dual-homed between the sandbox's `--internal`
+     * network (where the sandbox can reach it, and nothing else) and an
+     * ordinary bridge (where it reaches the internet). See
+     * {@link renderEgressProxyRunArgs} for the argv and
+     * `egress-proxy/Dockerfile` for the image to build.
+     *
+     * It is a second image rather than a reuse of `image` on purpose, and the
+     * reason is deployment-shaped rather than hygienic: the sandbox image is a
+     * host-supplied string that this backend cannot read, so there is no way to
+     * know whether the image named there has the proxy module in it, and the
+     * bind-mount alternative breaks exactly on the remote-daemon deployment
+     * (`hostReachability: 'container-network'`) where the SDK's own filesystem
+     * is not the daemon's.
+     *
+     * Unset, an allowlist policy is REFUSED at `create()` rather than
+     * downgraded — the same rule the rest of this file applies to a policy it
+     * cannot enforce. `deny-all` and `allow-all` need no image.
+     */
+    readonly egressProxyImage?: string;
+    /**
+     * Network the egress proxy joins for its route to the internet. Default
+     * `'bridge'`, docker's own default bridge.
+     *
+     * This is the proxy's second leg, and it exists because the internal
+     * network the sandbox sits on has no route out by design. `'bridge'` is
+     * the default because it always exists and always has NAT, which keeps a
+     * host's first allowlist policy working without a second network to
+     * create.
+     *
+     * **The default is also the one wart of this topology, and a host that
+     * shares a docker daemon should know it.** The proxy listens on every
+     * interface inside its own container, so any other container attached to
+     * the same network reaches it too — and this proxy enforces its allowlist
+     * for whoever asks and stamps brokered credentials on the requests it
+     * forwards. On `'bridge'` that means every container on the host's default
+     * bridge. Name a dedicated network here (one only this deployment's
+     * containers join) to decide who that is. There is deliberately no switch
+     * that narrows the listener instead: the container has no way to know
+     * which of its own interfaces is which, and a listener bound to the wrong
+     * one is a sandbox with no route out at all.
+     */
+    readonly egressProxyUpstreamNetwork?: string;
     readonly network?: 'none' | 'bridge' | string;
     readonly readyPollIntervalMs?: number;
     readonly readyTimeoutMs?: number;
@@ -120,6 +240,12 @@ export interface DockerBackendInternalConfig {
      * monitoring filters) via `docker ps --filter label=…`. Keys
      * containing `=` or empty names throw at spawn time — the docker
      * CLI accepts them but the resulting label split is ambiguous.
+     *
+     * They are applied to the egress proxy's container too, when one runs.
+     * That is deliberate in both directions: a reaper that collects a
+     * sandbox's containers should collect the proxy with them, and a proxy
+     * left running by a sandbox that died is a container holding real
+     * credentials with a route to the internet.
      */
     readonly labels?: Readonly<Record<string, string>>;
 }
@@ -145,6 +271,14 @@ export declare function buildDockerBackend(config: DockerBackendInternalConfig):
  * just the way out. It now keeps the configured network, and
  * {@link assertNetworkCarriesThePolicy} is what makes that network a
  * boundary.
+ *
+ * Every policy that returns the configured network depends on that same
+ * assertion, which is why the two live side by side: this function says which
+ * network the container joins, and that one refuses the network if it cannot
+ * do what the policy asks of it (#398). An allowlist used to answer the
+ * configured network and get a proxy environment variable pointed at a
+ * host-side listener — enforcement by convention, which an uncooperative
+ * process simply ignores.
  */
 export declare function resolveNetwork(configured: string, egress: EgressPolicy | undefined, hasProxy?: boolean): string;
 /**
@@ -171,9 +305,9 @@ export declare function isInternalNetwork(inspectedInternalFlag: string): boolea
 /**
  * Refuse a container whose network cannot do what was asked of it.
  *
- * Two requirements meet on the same object here, and both were previously
- * unstated — which is how the backend came to ship a default configuration
- * that could not create a sandbox at all:
+ * Three requirements meet on the same object here, and the first two were
+ * previously unstated — which is how the backend came to ship a default
+ * configuration that could not create a sandbox at all:
  *
  *  - **A published host port needs a route out.** Docker binds the port by
  *    NAT to the container's address, so a container with no address gets no
@@ -189,24 +323,272 @@ export declare function isInternalNetwork(inspectedInternalFlag: string): boolea
  *    nothing. `deny-all` pointed at the default bridge would be full egress
  *    under a policy object claiming none — the "accepted and silently
  *    ignored" failure the rest of this file exists to refuse.
+ *  - **A host allowlist needs one too, for the same reason and with one
+ *    addition.** Until #398 the allowlist tier answered the configured
+ *    network and pointed the sandbox at a proxy running on the host's
+ *    loopback, and the only thing making traffic go through it was
+ *    `HTTP_PROXY`. That is a request, not a boundary: anything inside the
+ *    container that opens a socket directly reaches the network with the
+ *    allowlist unconsulted, and untrusted code is the caller least likely to
+ *    honour a convention. With the proxy as a sibling container on an
+ *    `--internal` network, the only way the sandbox's traffic reaches the
+ *    internet is that container, and it cannot change that because
+ *    `--cap-drop=ALL` took `NET_ADMIN` away (see {@link HARDENING_ARGS}). The
+ *    environment variables stay and now DIRECT traffic rather than permit it.
+ *    On a network that is not internal there is no such route to remove, and
+ *    the policy is back to being advisory — which is what this refuses.
  *
- * They are exact opposites, so `deny-all` over a published host port is
- * impossible rather than merely unsupported: no arrangement of docker
+ * The first two are exact opposites, so `deny-all` over a published host port
+ * is impossible rather than merely unsupported: no arrangement of docker
  * networking both denies all egress and lets the host reach the worker over
- * TCP. Closing that needs the control channel moved off TCP — see #398 —
- * and is not a flag this function could accept.
+ * TCP. Closing that needs the control channel moved off TCP — see #398 — and
+ * is not a flag this function could accept. The same opposition now reaches
+ * an allowlist policy, which is new: an allowlist on an internal network must
+ * be reached by container name, so a host that used a published port with a
+ * host allowlist has to move that consumer onto the internal network. That is
+ * a consequence of the boundary existing at all and not a gap in this
+ * function; the refusal below names the mode to move to.
  */
 export declare function assertNetworkCarriesThePolicy(network: string, reachability: 'host-port' | 'container-network', egress: EgressPolicy | undefined, inspectedInternalFlag: string): void;
 /**
- * The options the boundary is built from, as a value.
+ * What the proxy container is told, as a value.
+ *
+ * The boundary's whole configuration. It is a value for the reason
+ * {@link resolveNetwork} is one: everything downstream of here needs a running
+ * Docker daemon, so a credential that failed to reach the boundary could only
+ * be caught by an operator noticing their requests arrive unauthenticated in
+ * production. A knob a host sets and the boundary never receives is the
+ * failure this shape exists to make testable.
+ *
+ * `parseProxyConfig` in `egress-proxy/server.mjs` refuses every shape in here
+ * it cannot read — and this function's own output is fed to that parser by
+ * `__tests__/hardening.test.ts`, so the two ends are pinned against each other
+ * rather than each against its own idea of the shape. A field renamed on one
+ * side alone fails a test rather than starting a boundary that enforces
+ * something nobody wrote.
+ */
+export interface EgressProxyContainerConfig {
+    readonly port: number;
+    readonly allowedHosts: readonly string[];
+    readonly credentials: readonly BrokeredCredential[];
+    readonly allowInwardFor?: readonly string[];
+    /**
+     * Names that denote the proxy itself, for its loop guard. The container's
+     * own hostname is added to this by the entrypoint; this field carries the
+     * network alias, which is the name the sandbox actually dials.
+     */
+    readonly selfNames?: readonly string[];
+}
+/**
+ * Build the proxy container's configuration.
+ *
+ * `allowedHosts` is already resolved here rather than passed as a policy, and
+ * that is the one behavioural difference this change carries into the
+ * boundary: the in-process proxy called the host's resolver per request, and
+ * the container cannot. A `resolver` policy that rotates is honoured at
+ * `create()` and again at every `setNetworkPolicy()` — the container has no
+ * channel back to the host's resolver, and a channel the container CAN reach
+ * is one the sandbox can reach too, which would let the sandbox ask for its
+ * own allowlist to be widened. See `docs/sdk/sandbox-egress.md`.
+ */
+export declare function egressProxyContainerConfig(config: Pick<DockerBackendInternalConfig, 'brokeredCredentials' | 'allowInwardFor'>, allowedHosts: readonly string[], port: number): EgressProxyContainerConfig;
+/** Everything {@link renderEgressProxyRunArgs} renders, as a value. */
+export interface EgressProxyArgvInput {
+    readonly config: DockerBackendInternalConfig;
+    readonly containerName: string;
+    /** Network the proxy reaches the internet through. See `egressProxyUpstreamNetwork`. */
+    readonly upstreamNetwork: string;
+    /** The internal network the sandbox is on, which the proxy is also joined to. */
+    readonly internalNetwork: string;
+}
+/**
+ * The `docker run` argv for the egress proxy container, as a value.
+ *
+ * Extracted for the reason every other argv in this file is: nothing
+ * downstream of it can run without a docker daemon, so a flag that never
+ * reached it — or a `--network` that named the wrong side of a dual-homed
+ * container — could only be caught by an operator in production, where the
+ * symptom is a sandbox that reaches nothing.
+ *
+ * The two networks are the whole topology and they are two calls:
+ * `docker run --network <upstream>` gives the container a default route, and
+ * {@link renderEgressProxyAttachArgs}'s `docker network connect` adds the
+ * internal network afterwards. The order is load-bearing. Attached to the
+ * internal network FIRST it would come up with no default route and no way to
+ * acquire one, and the proxy would be a boundary in front of nothing.
+ *
+ * The hardening baseline is the sandbox's, minus the parts that describe a
+ * filesystem. `--cap-drop=ALL`, `--no-new-privileges` and `--ipc private` are
+ * applied exactly as {@link HARDENING_ARGS} defines them, because this
+ * container sits between untrusted code and the internet and is the last one in
+ * the deployment that should be holding a capability. `--read-only` is the
+ * sandbox's too, with one tmpfs: the proxy writes nothing, and the tmpfs is
+ * there so that a Node process which one day wants a temp file fails at a
+ * filesystem boundary rather than at a mysterious `EROFS`.
+ *
+ * The image is last, so nothing after it is read as a flag — the same rule the
+ * sandbox argv follows, and here it also means the image's own `CMD` starts the
+ * proxy rather than this argv naming an entrypoint.
+ */
+export declare function renderEgressProxyRunArgs(input: EgressProxyArgvInput): string[];
+/**
+ * The `docker network connect` argv that makes the proxy dual-homed.
+ *
+ * `--alias` is what puts `namzu-egress` in the internal network's DNS, which
+ * is the name {@link buildDockerRunArgs} hands the sandbox in its proxy
+ * environment. The alias rather than the container name because the alias is
+ * the constant: a container named `namzu-egress-<sandbox-id>` would otherwise
+ * make the sandbox's `HTTP_PROXY` value depend on a generated id, and the two
+ * would have to be kept in step by hand.
+ */
+export declare function renderEgressProxyAttachArgs(input: EgressProxyArgvInput): string[];
+/** The backend config the hardening flags are rendered from. */
+export type DockerHardeningConfig = Pick<DockerBackendInternalConfig, 'cpuLimit' | 'layout' | 'readOnlyRootfs' | 'writableRootfsPaths'>;
+/**
+ * Refuse rootfs options that cannot both be honoured.
+ *
+ * `writableRootfsPaths` beside `readOnlyRootfs: false` is a contradiction: with
+ * a writable root filesystem every path is already writable, so the tmpfs
+ * mounts would either be dropped (a control accepted and not applied) or take a
+ * directory off the image for no reason. Refusing is the honest answer, and it
+ * is the same one the sibling backends give a per-sandbox control they cannot
+ * express.
+ *
+ * Called at construction and again where the argv is built, so a config that
+ * reaches `create()` by some path other than `buildDockerBackend` is refused
+ * too.
+ */
+export declare function assertRootfsOptionsAreCoherent(config: DockerHardeningConfig): void;
+/**
+ * Refuse a `--cpus` value that cannot mean what it says.
+ *
+ * This covers non-finite and non-positive values and does NOT claim to cover
+ * every bound the daemon would refuse. The difference is worth stating, because
+ * the two classes fail in different places and only one of them is decidable
+ * here. A negative, `NaN` or `Infinity` renders into the argv as text the
+ * daemon either rejects or turns into a bound nobody asked for, and `0` is the
+ * opposite of a bound (`NanoCPUs` of zero is how a container says "no CPU
+ * limit"), so a host that wrote one of those hears about it during wiring
+ * rather than as a container that never came up.
+ *
+ * The upper bound is not ours to check. Moby's `verifyPlatformContainerResources`
+ * refuses `NanoCPUs` above the DAEMON host's CPU count (`"range of CPUs is from
+ * 0.01 to N.00, as there are only N CPUs available"`), and the same function
+ * deliberately sets no floor of its own on Linux, leaving that to the kernel.
+ * Neither number is knowable from here: the `docker` binary this backend drives
+ * can be pointed at a daemon on another machine (`DOCKER_HOST`), and even
+ * locally `os.cpus().length` is this machine's view rather than the daemon's
+ * own `runtime.NumCPU()`. Refusing on a guess at it would break a host whose
+ * daemon has more cores than the process driving it, which is a worse failure
+ * than the one it would catch — those arrive from the daemon with its own
+ * message, at spawn, where every other daemon-side refusal arrives too.
+ */
+export declare function assertCpuLimitIsRenderable(cpuLimit: number | undefined): void;
+/**
+ * `--tmpfs` flags for the paths that stay writable under `--read-only`.
+ *
+ * See {@link DEFAULT_WRITABLE_ROOTFS_PATHS} for the paths themselves and why
+ * each is there. Returns nothing when the read-only root filesystem is off, and
+ * the two ways a host names paths that cannot be mounted — a contradiction with
+ * `readOnlyRootfs: false`, or a path the layout already mounts — are refusals
+ * rather than a silently shorter list.
+ */
+export declare function renderWritableRootfsArgs(config: DockerHardeningConfig): string[];
+/**
+ * The confinement preamble for one container, in argv order.
+ *
+ * A function rather than a bare constant because `--read-only` is switchable
+ * and the flags that follow it describe what stays writable while it is on:
+ * `readOnlyRootfs: false` removes both the flag and the mounts. That is the only
+ * thing it removes. Everything in {@link HARDENING_ARGS} is applied
+ * unconditionally and no field can turn one of those off, so the argv for
+ * `readOnlyRootfs: false` is the argv this backend produced before any of this
+ * existed PLUS `--ipc private` — those two flags are the whole previous argv,
+ * and `--ipc private` is now unconditional. `--ipc` is not folded under this
+ * switch, because the field names the root filesystem: a host that turned the
+ * read-only rootfs off would be turning IPC isolation off as well, silently,
+ * for a reason the name of the field does not say. A switch has to mean one
+ * thing.
+ */
+export declare function renderHardeningArgs(config: DockerHardeningConfig): string[];
+/**
+ * Everything {@link buildDockerRunArgs} renders, as a value.
+ *
+ * The pieces that come from the daemon or from the host are inputs rather than
+ * lookups: which network the container attaches to, and whether an egress proxy
+ * is listening and on which port. Both are already resolved by the caller, and
+ * reading them here would put a daemon call back inside the function whose
+ * whole point is that it needs none.
+ */
+export interface DockerRunArgvInput {
+    readonly config: DockerBackendInternalConfig;
+    readonly options: SandboxBackendOptions;
+    readonly containerName: string;
+    readonly network: string;
+    readonly hostReachability: 'host-port' | 'container-network';
+    /**
+     * Port the egress proxy listens on, when one is running. Absent means no
+     * proxy, and no proxy environment is passed in — which is not the same
+     * fact as a proxy that was configured and is unreachable.
+     *
+     * It is the proxy CONTAINER's port, on the internal network the two
+     * containers share; nothing is published on the host any more.
+     */
+    readonly egressProxyPort?: number;
+}
+/**
+ * The complete `docker run` argv, as a value.
+ *
+ * Extracted for the same reason {@link resolveNetwork} and
+ * {@link egressProxyContainerConfig} were: everything downstream of it needs a running
+ * Docker daemon, so a confinement flag that never reached the argv — or one
+ * that reached it in an order that cancels another — could only be caught by an
+ * operator noticing its effect missing in production. Spawning a fake `docker`
+ * and reading back what it was handed proves what the fake was told and nothing
+ * about the container the daemon would build. Here the whole baseline is one
+ * array, and an edit that drops a flag fails a test rather than a deployment.
+ *
+ * Order matters in exactly two places, and both are asserted by the test that
+ * pins this: the image is the last argument, because everything after it is a
+ * command for the container rather than a flag for docker; and every flag that
+ * takes a value is pushed as two argv entries rather than one string, so no
+ * value is ever re-split by anything downstream.
+ */
+export declare function buildDockerRunArgs(input: DockerRunArgvInput): string[];
+/**
+ * The argv as it may appear in an error message: the KEYS of every env
+ * entry, with the values replaced.
+ *
+ * A rendered argv is the last place a secret should survive. A non-zero
+ * `docker run` is a routine outcome — a missing image, a name conflict, a
+ * daemon hiccup, ENOSPC — and its message goes wherever the sandbox
+ * package's errors go: a log line, a telemetry batch, a CI transcript, a
+ * pasted bug report. The env flags carry the worker's credential and every
+ * value the host put in `options.env` (an API key, a broker token), and
+ * none of them are needed to explain an exit code. The keys are kept
+ * because they are what distinguishes "the image could not be pulled" from
+ * "the environment was rejected".
+ *
+ * EVERY SPELLING docker accepts for that flag, not the one this backend
+ * happens to emit today. `-e` IS `--env`, separated or `=`-attached, and
+ * this function used to compare each element to the literal `'--env'`: the
+ * long separated form this builder writes was redacted and `-e K=V`,
+ * `--env=K=V` and `-e=K=V` were printed in full. A future caller writing
+ * any of the three would have put a credential in a log line behind a
+ * docblock that promised it would not. The covered forms are `--env K=V`,
+ * `--env=K=V`, `-e K=V`, `-e=K=V` and the attached short form `-eK=V`; the
+ * one shape it does not read is a value attached to an `-e` bundled into a
+ * group of other short flags (`-iteK=V`), which no caller here writes and
+ * which no rule short of matching `-e` anywhere inside an option could
+ * catch. A valueless entry in any form (`--env K`) is passed through: it
+ * resolves from the CLI's own environment and carries no value to redact.
  *
- * Extracted for the same reason {@link resolveNetwork} is: everything
- * downstream of here needs a running Docker daemon, so a policy that never
- * reached the proxy could only be caught by an operator noticing their
- * traffic denied in production. A knob a host sets and the boundary never
- * receives is the failure this shape exists to make testable.
+ * That redacts the workspace paths the layout is rendered from as well,
+ * which are not secrets. They are also not what an exit code is about, and
+ * a rule with exceptions is a rule that leaks the first time someone's
+ * credential does not look like one.
  */
-export declare function egressProxyOptions(config: Pick<DockerBackendInternalConfig, 'brokeredCredentials' | 'allowInwardFor'>, policy: EgressPolicy): EgressProxyOptions;
+export declare function redactDockerArgv(args: readonly string[]): string[];
 /**
  * Validate and resolve a {@link ContainerSandboxLayout}. Returns a
  * {@link ResolvedContainerSandboxLayout} with every container path