@zenera/cli 1.1.0 → 1.1.3

package/dist/keys.js

@@ -1,6 +1,7 @@
-import { chmodSync, copyFileSync, existsSync, statSync } from 'node:fs';
-import { join, resolve } from 'node:path';
 import { EXA_API_KEY_ENV } from '@zenera/neo';
+import { chmodSync, copyFileSync, existsSync, statSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
 import { assertPrivate, ensureDir, paths, readJson, writeJson } from "./home.js";
 import { CliError, EXIT, credentialError, usageError } from "./term.js";
 // ---------------------------------------------------------------------------
@@ -33,55 +34,108 @@ export const SERVICES = ['exa'];
 /** Anything the keyring can hold a credential for. */
 export const OWNERS = [...PROVIDERS, ...SERVICES];
 /**
- * Vertex is the odd one. The GenAI SDK resolves Application Default
- * Credentials itself, so what is stored is a service-account *file* and what is
- * exported is a path — not a key. Pretending otherwise would mean inventing a
- * credential shape Google does not have.
+ * Vertex is the odd one, and it is odd twice.
+ *
+ * Its usual credential is not a key at all: the GenAI SDK resolves Application
+ * Default Credentials itself, so what is stored is a service-account *file* and
+ * what is exported is a path. But it also accepts an express-mode api key,
+ * which is an ordinary secret under an entirely different variable. The two are
+ * alternatives — express mode addresses no project — so which form a credential
+ * is gets decided per entry rather than per provider.
  */
 export const SHAPES = {
     openai: {
         kind: 'model',
-        env: 'OPENAI_API_KEY',
-        holds: 'secret',
         label: 'OpenAI',
-        where: 'https://platform.openai.com/api-keys',
+        forms: [
+            {
+                holds: 'secret',
+                env: 'OPENAI_API_KEY',
+                where: 'https://platform.openai.com/api-keys',
+            },
+        ],
     },
     anthropic: {
         kind: 'model',
-        env: 'ANTHROPIC_API_KEY',
-        holds: 'secret',
         label: 'Anthropic',
-        where: 'https://console.anthropic.com/settings/keys',
+        forms: [
+            {
+                holds: 'secret',
+                env: 'ANTHROPIC_API_KEY',
+                where: 'https://console.anthropic.com/settings/keys',
+            },
+        ],
     },
     google: {
         kind: 'model',
-        env: 'GEMINI_API_KEY',
-        holds: 'secret',
         label: 'Google AI Studio',
-        where: 'https://aistudio.google.com/apikey',
+        forms: [
+            {
+                holds: 'secret',
+                env: 'GEMINI_API_KEY',
+                where: 'https://aistudio.google.com/apikey',
+            },
+        ],
     },
     vertex: {
         kind: 'model',
-        env: 'GOOGLE_APPLICATION_CREDENTIALS',
-        holds: 'file',
         label: 'Vertex AI',
-        where: 'a service-account JSON key from the GCP console',
+        forms: [
+            {
+                holds: 'file',
+                env: 'GOOGLE_APPLICATION_CREDENTIALS',
+                where: 'a service-account JSON key from the GCP console',
+            },
+            {
+                holds: 'secret',
+                env: 'VERTEX_API_KEY',
+                where: 'an express-mode key from https://console.cloud.google.com/vertex-ai',
+            },
+        ],
     },
     openrouter: {
         kind: 'model',
-        env: 'OPENROUTER_API_KEY',
-        holds: 'secret',
         label: 'OpenRouter',
-        where: 'https://openrouter.ai/settings/keys',
+        forms: [
+            {
+                holds: 'secret',
+                env: 'OPENROUTER_API_KEY',
+                where: 'https://openrouter.ai/settings/keys',
+            },
+        ],
     },
     exa: {
         kind: 'service',
-        env: EXA_API_KEY_ENV,
-        holds: 'secret',
         label: 'Exa',
-        where: 'https://dashboard.exa.ai/api-keys',
+        forms: [
+            {
+                holds: 'secret',
+                env: EXA_API_KEY_ENV,
+                where: 'https://dashboard.exa.ai/api-keys',
+            },
+        ],
     },
 };
+/**
+ * The form a provider is usually reached by — for the questions that have to
+ * have one answer, like which variable to name when nothing is set yet.
+ */
+export function form(provider) {
+    return SHAPES[provider].forms[0];
+}
+/** Every variable a provider's credential could arrive in, usual one first. */
+export function envNames(provider) {
+    return SHAPES[provider].forms.map((f) => f.env);
+}
+/** The variable this particular credential occupies. */
+export function envOf(entry) {
+    if (entry.env) {
+        return entry.env;
+    }
+    // Entries written before a provider had two forms carry no `env` of their own.
+    const forms = SHAPES[entry.provider].forms;
+    return (forms.find((f) => f.holds === entry.holds) ?? forms[0]).env;
+}
 export function isProvider(name) {
     return PROVIDERS.includes(name);
 }
@@ -114,6 +168,15 @@ export function parseRef(ref) {
     }
     return { provider, name };
 }
+/** Which of a provider's forms a raw value is, decided by the value itself. */
+function formOf(provider, raw) {
+    const { forms } = SHAPES[provider];
+    if (forms.length === 1) {
+        return forms[0];
+    }
+    const wanted = raw.length < 4096 && existsSync(resolve(raw)) ? 'file' : 'secret';
+    return forms.find((f) => f.holds === wanted) ?? forms[0];
+}
 // ---------------------------------------------------------------------------
 // Store
 // ---------------------------------------------------------------------------
@@ -160,17 +223,27 @@ export class KeyStore {
      * directory: the point of a store is that the credential survives the
      * original being moved, renamed or cleaned up, and a stored path that
      * silently stops resolving is worse than no store at all.
+     *
+     * Which form a value is, when the provider accepts two, is read off the
+     * value: a path that is there is a credentials file, and anything else is a
+     * secret. Asking would be a flag to get wrong, and a service-account key
+     * and an api key are not mistakable for one another.
      */
-    add(provider, name, raw) {
+    add(provider, name, raw, meta = {}) {
         if (!NAME.test(name)) {
             throw usageError(`"${name}" is not a usable key name`, 'letters, digits, - and _ only');
         }
-        const shape = SHAPES[provider];
+        const form = formOf(provider, raw);
         const entry = {
             provider,
             name,
-            holds: shape.holds,
-            value: shape.holds === 'file' ? this.#absorb(provider, name, raw) : raw,
+            holds: form.holds,
+            value: form.holds === 'file' ? this.#absorb(provider, name, raw) : raw,
+            env: form.env,
+            // Express mode addresses no project, so carrying one would only ever
+            // be a way to build the combination the service refuses.
+            ...(form.holds === 'file' && meta.project ? { project: meta.project } : {}),
+            ...(form.holds === 'file' && meta.location ? { location: meta.location } : {}),
             addedAt: new Date().toISOString(),
         };
         const at = this.#file.entries.findIndex((e) => e.provider === provider && e.name === name);
@@ -216,9 +289,12 @@ export class KeyStore {
         ensureDir(paths.home());
         writeJson(paths.keys(), this.#file);
     }
-    /** Absolute path behind a file-shaped entry. */
+    /**
+     * Absolute path behind a file-shaped entry. Stored entries name a file in
+     * the key directory; an ambient one already knows where it is.
+     */
     fileOf(entry) {
-        return join(paths.keyDir(), entry.value);
+        return isAbsolute(entry.value) ? entry.value : join(paths.keyDir(), entry.value);
     }
     /** The plaintext an entry stands for — the only way out of the store. */
     reveal(entry) {
@@ -239,11 +315,18 @@ export class KeyStore {
             if (!entry) {
                 continue;
             }
-            const { env: name } = SHAPES[provider];
-            if (process.env[name]) {
+            // Either variable being set means this provider is already answered
+            // for, so the stored alternative must not be exported alongside it.
+            if (envNames(provider).some((name) => process.env[name])) {
                 continue;
             }
-            env[name] = this.reveal(entry);
+            env[envOf(entry)] = this.reveal(entry);
+            if (entry.project && !process.env.GOOGLE_CLOUD_PROJECT) {
+                env.GOOGLE_CLOUD_PROJECT = entry.project;
+            }
+            if (entry.location && !process.env.GOOGLE_CLOUD_LOCATION) {
+                env.GOOGLE_CLOUD_LOCATION = entry.location;
+            }
         }
         return env;
     }
@@ -284,6 +367,64 @@ export function mask(secret) {
 export function describe(store, entry) {
     return entry.holds === 'file' ? store.fileOf(entry) : mask(entry.value);
 }
+/** How an ambient credential is named on the command line: it has no key name. */
+export function ambientId(cred) {
+    return cred.env ? `${cred.provider}/$${cred.env}` : `${cred.provider}/adc`;
+}
+/**
+ * Where `gcloud auth application-default login` leaves its credentials. The
+ * GenAI SDK reads this without being told to, so it counts even though nothing
+ * in the environment mentions it.
+ */
+export function gcloudAdc() {
+    const dir = process.env.CLOUDSDK_CONFIG ?? join(homedir(), '.config', 'gcloud');
+    const path = join(dir, 'application_default_credentials.json');
+    return existsSync(path) ? path : undefined;
+}
+export function ambient(store, only) {
+    const found = [];
+    for (const provider of only ?? OWNERS) {
+        for (const form of SHAPES[provider].forms) {
+            const value = process.env[form.env];
+            if (!value) {
+                continue;
+            }
+            // `materialize()` puts the store's own entries here. Reporting one
+            // of those as ambient would double-count it, and would claim the
+            // environment as a source that would survive removing the entry.
+            const active = store.active(provider);
+            if (active && envOf(active) === form.env && store.reveal(active) === value) {
+                continue;
+            }
+            found.push({ provider, env: form.env, holds: form.holds, value });
+        }
+    }
+    const adc = (only ?? OWNERS).includes('vertex') ? gcloudAdc() : undefined;
+    if (adc && !process.env.GOOGLE_APPLICATION_CREDENTIALS) {
+        found.push({ provider: 'vertex', holds: 'file', value: adc });
+    }
+    return found;
+}
+/**
+ * Every credential variable this process is carrying, whatever put it there.
+ *
+ * Read off the environment rather than off the store, and deliberately: by the
+ * time anyone asks, `materialize()` has already run, so the environment is the
+ * union of the keyring and whatever the shell brought — which is exactly the
+ * set of credentials the run is actually using.
+ */
+export function credentials() {
+    const found = [];
+    for (const provider of OWNERS) {
+        for (const form of SHAPES[provider].forms) {
+            const value = process.env[form.env];
+            if (value) {
+                found.push({ env: form.env, holds: form.holds, value });
+            }
+        }
+    }
+    return found;
+}
 // ---------------------------------------------------------------------------
 // Gate
 // ---------------------------------------------------------------------------
@@ -296,7 +437,7 @@ export function describe(store, entry) {
  * one clear error here for an obscure one on the first turn.
  */
 export function assertUsable(store) {
-    const reachable = PROVIDERS.filter((p) => process.env[SHAPES[p].env] || store.active(p) !== undefined);
+    const reachable = PROVIDERS.filter((p) => envNames(p).some((name) => process.env[name]) || store.active(p) !== undefined);
     if (reachable.length === 0) {
         throw credentialError('no credentials for any provider', 'add one with: zen key add openai');
     }

package/dist/lib.d.ts

@@ -2,8 +2,8 @@ export { extract, invokedAs, one, parse, split, type Parsed, type Split } from '
 export { printBanner, type BannerText } from './banner.ts';
 export type { Command, Context } from './command.ts';
 export { assertPrivate, ensureDir, ensureHome, home, paths, readJson, writeJson } from './home.ts';
-export { assertNotEmpty, assertOwner, assertUsable, describe, isOwner, isProvider, keyId, KeyStore, mask, OWNERS, parseRef, PROVIDERS, SERVICES, SHAPES, type KeyCheck, type KeyEntry, type KeyOwner, type Liveness, type Provider, type Service, } from './keys.ts';
+export { assertNotEmpty, assertOwner, assertUsable, describe, envNames, envOf, form, isOwner, isProvider, keyId, KeyStore, mask, OWNERS, parseRef, PROVIDERS, SERVICES, SHAPES, type CredentialForm, type KeyCheck, type KeyEntry, type KeyOwner, type Liveness, type Provider, type Service, } from './keys.ts';
 export { probe, probeAll } from './liveness.ts';
-export { ensurePodmanReady, ownedContainers, podmanStatus, removeContainers, type OwnedContainer, type PodmanOptions, type PodmanStatus, } from './podman.ts';
+export { engineDisk, ensurePodmanReady, ownedContainers, podmanStatus, removeContainers, type DiskLine, type EngineDisk, type OwnedContainer, type PodmanOptions, type PodmanStatus, } from './podman.ts';
 export { ago, bold, CliError, count, credentialError, cyan, dim, EXIT, fail, green, invalidError, isInteractive, json, note, pad, red, table, usageError, warn, write, writeAll, yellow, type ExitCode, } from './term.ts';
 //# sourceMappingURL=lib.d.ts.map

package/dist/lib.js

@@ -24,8 +24,8 @@
 export { extract, invokedAs, one, parse, split } from "./args.js";
 export { printBanner } from "./banner.js";
 export { assertPrivate, ensureDir, ensureHome, home, paths, readJson, writeJson } from "./home.js";
-export { assertNotEmpty, assertOwner, assertUsable, describe, isOwner, isProvider, keyId, KeyStore, mask, OWNERS, parseRef, PROVIDERS, SERVICES, SHAPES, } from "./keys.js";
+export { assertNotEmpty, assertOwner, assertUsable, describe, envNames, envOf, form, isOwner, isProvider, keyId, KeyStore, mask, OWNERS, parseRef, PROVIDERS, SERVICES, SHAPES, } from "./keys.js";
 export { probe, probeAll } from "./liveness.js";
-export { ensurePodmanReady, ownedContainers, podmanStatus, removeContainers, } from "./podman.js";
+export { engineDisk, ensurePodmanReady, ownedContainers, podmanStatus, removeContainers, } from "./podman.js";
 export { ago, bold, CliError, count, credentialError, cyan, dim, EXIT, fail, green, invalidError, isInteractive, json, note, pad, red, table, usageError, warn, write, writeAll, yellow, } from "./term.js";
 //# sourceMappingURL=lib.js.map

package/dist/liveness.d.ts

@@ -6,18 +6,28 @@ import { type KeyCheck, type KeyEntry, type KeyStore } from './keys.ts';
  * The client is built through the library's own registry rather than by
  * requiring the SDKs directly, so a missing optional dependency produces the
  * library's "run: npm i openai" message instead of a raw MODULE_NOT_FOUND.
+ *
+ * A secret is handed to the registry as a value rather than exported first,
+ * which is what lets several of these run at once: two probes sharing
+ * `process.env` would each read the other's key.
  */
 export declare function probe(store: KeyStore, entry: KeyEntry): Promise<KeyCheck>;
 /**
- * Probes many entries, one at a time. In flight together would be quicker, but
- * `probe` reaches the SDKs the only way they can be reached — through
- * `process.env` — and two probes sharing that variable would each read the
- * other's key. One at a time is also what makes progress reportable: there is
- * exactly one answer being waited on, and `onProbe` can name it.
+ * Probes many entries together, because they are independent questions asked
+ * of different vendors and the answer is a round trip apiece: in sequence,
+ * five keys is five deadlines end to end, and `zen init` spends them all
+ * before it writes a file.
+ *
+ * The exception is a credential the SDK can only be given through the
+ * environment — the vertex service-account file — since two of those in flight
+ * would each read the other's path. Those go one at a time, after the rest.
+ *
+ * `onProbe` therefore reports what has *finished* rather than what is being
+ * waited on; with several in the air there is no single one to name.
  *
  * Pairs rather than a map, because the caller needs the entry itself to record
  * the result against, and a map keyed by a string would only have to be
  * un-joined again.
  */
-export declare function probeAll(store: KeyStore, entries: readonly KeyEntry[], onProbe?: (entry: KeyEntry, index: number, total: number) => void): Promise<[KeyEntry, KeyCheck][]>;
+export declare function probeAll(store: KeyStore, entries: readonly KeyEntry[], onProbe?: (entry: KeyEntry, done: number, total: number) => void): Promise<[KeyEntry, KeyCheck][]>;
 //# sourceMappingURL=liveness.d.ts.map

package/dist/liveness.js

@@ -1,5 +1,5 @@
 import { EXA_BASE_URL, ModelRegistry } from '@zenera/neo';
-import { SHAPES, } from "./keys.js";
+import { envOf, SHAPES, } from "./keys.js";
 // ---------------------------------------------------------------------------
 // Liveness
 //
@@ -94,18 +94,61 @@ async function within(work) {
  * The client is built through the library's own registry rather than by
  * requiring the SDKs directly, so a missing optional dependency produces the
  * library's "run: npm i openai" message instead of a raw MODULE_NOT_FOUND.
+ *
+ * A secret is handed to the registry as a value rather than exported first,
+ * which is what lets several of these run at once: two probes sharing
+ * `process.env` would each read the other's key.
  */
 export async function probe(store, entry) {
     const shape = SHAPES[entry.provider];
     if (shape.kind === 'service') {
         return probeService(entry.provider, store.reveal(entry));
     }
-    const previous = process.env[shape.env];
-    process.env[shape.env] = store.reveal(entry);
+    const provider = entry.provider;
+    const credential = store.reveal(entry);
+    // What the entry holds, not what its provider usually holds: a Vertex
+    // express key is a secret like any other, and passing it as a value is what
+    // lets it be asked at the same time as the rest.
+    if (entry.holds !== 'file') {
+        return ask(provider, { kind: provider, apiKey: credential });
+    }
+    // A service-account file is the exception, and `probeAll` knows it:
+    // Application Default Credentials are found through the environment or not
+    // at all. So this one is exported, asked, and put back — alone.
+    const name = envOf(entry);
+    const restore = exportTemporarily({
+        [name]: credential,
+        ...(entry.project ? { GOOGLE_CLOUD_PROJECT: entry.project } : {}),
+        ...(entry.location ? { GOOGLE_CLOUD_LOCATION: entry.location } : {}),
+    });
+    try {
+        return await ask(provider, { kind: provider });
+    }
+    finally {
+        restore();
+    }
+}
+/** Sets variables, and hands back the undo. */
+function exportTemporarily(vars) {
+    const previous = new Map(Object.keys(vars).map((name) => [name, process.env[name]]));
+    Object.assign(process.env, vars);
+    return () => {
+        for (const [name, value] of previous) {
+            if (value === undefined) {
+                delete process.env[name];
+            }
+            else {
+                process.env[name] = value;
+            }
+        }
+    };
+}
+/** One authenticated round trip, and what its silence or refusal means. */
+async function ask(provider, spec) {
     try {
         const registry = new ModelRegistry();
-        registry.provider('probe', { kind: entry.provider });
-        await within(authenticate(entry.provider, registry.client('probe')));
+        registry.provider('probe', spec);
+        await within(authenticate(provider, registry.client('probe')));
         return { state: 'live', at: new Date().toISOString() };
     }
     catch (err) {
@@ -118,14 +161,6 @@ export async function probe(store, entry) {
         }
         return classify(err);
     }
-    finally {
-        if (previous === undefined) {
-            delete process.env[shape.env];
-        }
-        else {
-            process.env[shape.env] = previous;
-        }
-    }
 }
 /**
  * A service has no model catalog to list, and its cheapest endpoint is one that
@@ -200,22 +235,38 @@ async function authenticate(provider, client) {
     void result;
 }
 /**
- * Probes many entries, one at a time. In flight together would be quicker, but
- * `probe` reaches the SDKs the only way they can be reached — through
- * `process.env` — and two probes sharing that variable would each read the
- * other's key. One at a time is also what makes progress reportable: there is
- * exactly one answer being waited on, and `onProbe` can name it.
+ * Probes many entries together, because they are independent questions asked
+ * of different vendors and the answer is a round trip apiece: in sequence,
+ * five keys is five deadlines end to end, and `zen init` spends them all
+ * before it writes a file.
+ *
+ * The exception is a credential the SDK can only be given through the
+ * environment — the vertex service-account file — since two of those in flight
+ * would each read the other's path. Those go one at a time, after the rest.
+ *
+ * `onProbe` therefore reports what has *finished* rather than what is being
+ * waited on; with several in the air there is no single one to name.
  *
  * Pairs rather than a map, because the caller needs the entry itself to record
  * the result against, and a map keyed by a string would only have to be
  * un-joined again.
  */
 export async function probeAll(store, entries, onProbe) {
-    const out = [];
-    for (const [index, entry] of entries.entries()) {
-        onProbe?.(entry, index, entries.length);
-        out.push([entry, await probe(store, entry)]);
+    const exclusive = (entry) => entry.holds === 'file';
+    const results = new Map();
+    let done = 0;
+    const record = (entry, check) => {
+        results.set(entry, check);
+        onProbe?.(entry, ++done, entries.length);
+    };
+    await Promise.all(entries
+        .filter((entry) => !exclusive(entry))
+        .map(async (entry) => record(entry, await probe(store, entry))));
+    for (const entry of entries.filter(exclusive)) {
+        record(entry, await probe(store, entry));
     }
-    return out;
+    // Back into the caller's order: which one answered first is an accident of
+    // the network, and a list that reshuffles itself between runs is unreadable.
+    return entries.map((entry) => [entry, results.get(entry)]);
 }
 //# sourceMappingURL=liveness.js.map

package/dist/podman.d.ts

@@ -1,7 +1,13 @@
 import { runProcess } from '@zenera/neo';
+import type { ResolvedBuild } from './image.ts';
+import { CliError } from './term.ts';
 export interface PodmanOptions {
     /** the image the project needs on disk before the first run */
     image?: string;
+    /** a Dockerfile to build into `image`, instead of a registry to pull it from */
+    build?: ResolvedBuild;
+    /** build even when the tag is already on disk; `zen sandbox pull` */
+    rebuild?: boolean;
     /** machine size, when one has to be created */
     cpus?: number;
     /** MiB */
@@ -28,12 +34,36 @@ export interface PodmanStatus {
     imagePresent?: boolean;
 }
 export declare function ensurePodmanReady(opts?: PodmanOptions): Promise<void>;
+/**
+ * Builds the project's Dockerfile under its tag.
+ *
+ * Run every time rather than skipped when the tag already exists, because the
+ * tag is a hash of the Dockerfile and its context and the engine's layer cache
+ * is a hash of the same thing plus the base image. Asking it is cheap, and it
+ * is the only thing that notices when `FROM node:24` starts meaning a different
+ * node:24.
+ */
+/**
+ * A build that ran and failed, rather than a host that could not be asked.
+ *
+ * The difference is invisible at the command line — both stop the run and
+ * print why — but it decides everything for `zen check`: a Dockerfile that
+ * does not build is a broken project, and a laptop without podman on it is
+ * not. Only one of them is an error.
+ */
+export declare class BuildError extends CliError {
+}
 /** What `zn sandbox status` prints. Changes nothing, and never throws. */
 export declare function podmanStatus(opts?: PodmanOptions): Promise<PodmanStatus>;
 export interface OwnedContainer {
     name: string;
     /** podman's own word: `running`, `exited`, `created`, `paused` */
     state: string;
+    /** the session that owns it, from the `zenera.key` label */
+    key?: string;
+    createdAt?: string;
+    /** bytes written on top of the image; only present when `sizes` is asked for */
+    size?: number;
 }
 /**
  * Containers this CLI created, whatever session they belong to, and whether
@@ -41,6 +71,32 @@ export interface OwnedContainer {
  * *stopped* container behind, and a listing that only showed running ones
  * would say nothing is there while the disk says otherwise.
  */
-export declare function ownedContainers(engine?: string, exec?: import("@zenera/neo").Runner): Promise<OwnedContainer[]>;
+export declare function ownedContainers(engine?: string, exec?: import("@zenera/neo").Runner, opts?: {
+    sizes?: boolean;
+}): Promise<OwnedContainer[]>;
 export declare function removeContainers(names: readonly string[], engine?: string, exec?: import("@zenera/neo").Runner): Promise<void>;
+export interface DiskLine {
+    count: number;
+    active: number;
+    size: number;
+    reclaimable: number;
+}
+export interface EngineDisk {
+    images: DiskLine;
+    containers: DiskLine;
+    volumes: DiskLine;
+    /** the filesystem images and layers are kept on — inside the machine, if there is one */
+    store?: {
+        used: number;
+        capacity: number;
+    };
+    /** the machine's disk image, as it costs this host; absent on Linux */
+    image?: {
+        name: string;
+        path: string;
+        allocated: number;
+    };
+}
+/** What the engine is using. Never throws: a disk report is not worth a crash. */
+export declare function engineDisk(engine?: string, exec?: import("@zenera/neo").Runner): Promise<EngineDisk | undefined>;
 //# sourceMappingURL=podman.d.ts.map