niceeval 0.13.1 → 0.13.2

package/dist/sandbox/docker-profile/schema.cjs

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema = exports.createDockerExecutionProfileV1 = exports.decodeDockerExecutionProfileV1 = exports.parseDockerExecutionProfile = exports.dockerProfileDigestOf = exports.dockerProfileSemanticPolicyRevisionOf = exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS = exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = exports.DOCKER_PROFILE_SCHEMA_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = void 0;
+exports.dockerProfileDigestOf = exports.createDockerExecutionProfileV1 = exports.decodeDockerExecutionProfileV1 = exports.parseDockerExecutionProfile = exports.dockerProfileSemanticPolicyRevisionOf = exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema = exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS = exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = exports.DOCKER_PROFILE_SCHEMA_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = void 0;
 exports.dockerExecutionProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;
-exports.dockerExecutionProfileV1Digest = dockerExecutionProfileV1Digest;
 exports.parseDockerExecutionProfileV1 = parseDockerExecutionProfileV1;
 exports.makeDockerExecutionProfileV1 = makeDockerExecutionProfileV1;
 exports.isDockerExecutionProfileV1 = isDockerExecutionProfileV1;
+exports.dockerExecutionProfileV1Digest = dockerExecutionProfileV1Digest;
 exports.dockerProfilePublicSummaryOf = dockerProfilePublicSummaryOf;
 const effect_1 = require("effect");
 const node_net_1 = require("node:net");
@@ -16,229 +16,39 @@ exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = 1;
 exports.DOCKER_PROFILE_SCHEMA_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;
 exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = 1;
 exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS = Object.freeze([
-    "0.0.0.0/8",
-    "10.0.0.0/8",
-    "100.64.0.0/10",
-    "127.0.0.0/8",
-    "169.254.0.0/16",
-    "172.16.0.0/12",
-    "192.0.0.0/24",
-    "192.0.2.0/24",
-    "192.168.0.0/16",
-    "198.18.0.0/15",
-    "198.51.100.0/24",
-    "203.0.113.0/24",
-    "224.0.0.0/4",
-    "240.0.0.0/4",
-    "::/0",
+    "0.0.0.0/8", "10.0.0.0/8", "100.64.0.0/10", "127.0.0.0/8", "169.254.0.0/16",
+    "172.16.0.0/12", "192.0.0.0/24", "192.0.2.0/24", "192.168.0.0/16",
+    "198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4",
+    "240.0.0.0/4", "::/0",
 ]);
 const NETWORK_ALLOWED_PROTOCOLS = Object.freeze(["dns", "https"]);
-const PROFILE_CONTROLLERS = Object.freeze(["cpu", "memory", "pids"]);
-const ZERO_SWAP = 0;
-function frozenNonEmptyStrings(values) {
-    const [first, ...rest] = values;
-    if (first === undefined)
-        throw new Error("expected a non-empty string tuple");
-    return Object.freeze([first, ...rest]);
-}
-function isRecord(value) {
-    if (value === null || typeof value !== "object" || Array.isArray(value))
+const PROFILE_CONTROLLERS = Object.freeze([
+    "cpu", "memory", "pids",
+]);
+const ParseOptions = Object.freeze({
+    errors: "all",
+    exact: true,
+    onExcessProperty: "error",
+});
+const PlainObjectSchema = effect_1.Schema.declare((value) => {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
         return false;
     const prototype = Object.getPrototypeOf(value);
     return prototype === Object.prototype || prototype === null;
-}
-function fail(code, message, path) {
-    throw (0, errors_ts_1.dockerProfileError)({ code, message, ...(path === undefined ? {} : { path }) });
-}
-function objectAt(value, path) {
-    if (!isRecord(value))
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be a plain object`, path);
-    return value;
-}
-function onlyKeys(value, allowed, path) {
-    const known = new Set(allowed);
-    const unsupported = Object.keys(value).find((key) => !known.has(key));
-    if (unsupported !== undefined) {
-        fail("sandbox.docker-profile-schema-invalid", `${path}.${unsupported} is not supported by Docker execution profile v1`, `${path}.${unsupported}`);
-    }
-}
-function requiredString(value, path) {
-    if (typeof value !== "string" || value.trim() === "") {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be a non-empty string`, path);
-    }
-    if (value.includes("\u0000")) {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must not contain NUL`, path);
-    }
-    return value;
-}
-function absolutePath(value, path) {
-    const result = requiredString(value, path);
-    if (!(0, node_path_1.isAbsolute)(result)) {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be an absolute path`, path);
-    }
-    return result;
-}
-function nonNegativeSafeInteger(value, path) {
-    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0) {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be a non-negative safe integer`, path);
-    }
-    return value;
-}
-function positiveSafeInteger(value, path) {
-    if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be a positive safe integer`, path);
-    }
-    return value;
-}
-function positiveFinite(value, path) {
-    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
-        fail("sandbox.docker-profile-schema-invalid", `${path} must be a positive finite number`, path);
-    }
-    return value;
-}
-function endpoint(value, path) {
-    const record = objectAt(value, path);
-    onlyKeys(record, ["path", "peerUid"], path);
-    return Object.freeze({
-        path: absolutePath(record.path, `${path}.path`),
-        peerUid: nonNegativeSafeInteger(record.peerUid, `${path}.peerUid`),
-    });
-}
-function semanticPolicyJson(input) {
-    return {
-        schemaVersion: exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,
-        securityLevel: input.securityLevel,
-        backend: {
-            kind: input.backend.kind,
-            cgroup: {
-                policyRevision: input.backend.cgroup.policyRevision,
-                controllers: [...input.backend.cgroup.controllers],
-            },
-        },
-        policy: {
-            hostLoopback: input.policy.hostLoopback,
-            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,
-            outerSocketInjection: input.policy.outerSocketInjection,
-            privilegedTranslation: input.policy.privilegedTranslation,
-            writableRoot: input.policy.writableRoot,
-            network: {
-                version: input.policy.network.version,
-                dns: {
-                    mode: input.policy.network.dns.mode,
-                    servers: [...input.policy.network.dns.servers],
-                },
-                egress: {
-                    mode: input.policy.network.egress.mode,
-                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],
-                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,
-                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,
-                    denyCidrs: [...input.policy.network.egress.denyCidrs],
-                    ipv6: input.policy.network.egress.ipv6,
-                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,
-                    portDriver: input.policy.network.egress.portDriver,
-                    daemonBridge: input.policy.network.egress.daemonBridge,
-                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,
-                    icc: input.policy.network.egress.icc,
-                },
-            },
-        },
-    };
-}
-/** 从受信 schema 字段重新计算语义 policy revision；profileId、alias、socket 与容量不参与。 */
-function dockerExecutionProfileSemanticPolicyRevisionOf(input) {
-    return (0, identity_ts_1.digestOf)(semanticPolicyJson(input)).slice(0, 8);
-}
-exports.dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;
-function canonicalJson(profile) {
-    return {
-        schemaVersion: profile.schemaVersion,
-        profileId: profile.profileId,
-        securityLevel: profile.securityLevel,
-        semanticPolicyRevision: profile.semanticPolicyRevision,
-        transport: {
-            kind: profile.transport.kind,
-            hostMachineIdentity: profile.transport.hostMachineIdentity,
-            dockerSocket: {
-                path: profile.transport.dockerSocket.path,
-                peerUid: profile.transport.dockerSocket.peerUid,
-            },
-            controlSocket: {
-                path: profile.transport.controlSocket.path,
-                peerUid: profile.transport.controlSocket.peerUid,
-                protocol: profile.transport.controlSocket.protocol,
-            },
-        },
-        backend: {
-            kind: profile.backend.kind,
-            machineIdentity: profile.backend.machineIdentity,
-            owner: { uid: profile.backend.owner.uid, gid: profile.backend.owner.gid },
-            filesystem: {
-                identity: profile.backend.filesystem.identity,
-                mountPath: profile.backend.filesystem.mountPath,
-                dockerRootDir: profile.backend.filesystem.dockerRootDir,
-                limitBytes: profile.backend.filesystem.limitBytes,
-            },
-            cgroup: {
-                aggregatePath: profile.backend.cgroup.aggregatePath,
-                policyRevision: profile.backend.cgroup.policyRevision,
-                controllers: [...profile.backend.cgroup.controllers],
-            },
-        },
-        capacity: {
-            cpus: profile.capacity.cpus,
-            memoryBytes: profile.capacity.memoryBytes,
-            memorySwapBytes: profile.capacity.memorySwapBytes,
-            pids: profile.capacity.pids,
-            maxContainers: profile.capacity.maxContainers,
-            maxBuilds: profile.capacity.maxBuilds,
-            aggregate: {
-                cpus: profile.capacity.aggregate.cpus,
-                memoryBytes: profile.capacity.aggregate.memoryBytes,
-                memorySwapBytes: profile.capacity.aggregate.memorySwapBytes,
-                pids: profile.capacity.aggregate.pids,
-            },
-        },
-        policy: {
-            hostLoopback: profile.policy.hostLoopback,
-            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,
-            outerSocketInjection: profile.policy.outerSocketInjection,
-            privilegedTranslation: profile.policy.privilegedTranslation,
-            writableRoot: profile.policy.writableRoot,
-            network: {
-                version: profile.policy.network.version,
-                dns: {
-                    mode: profile.policy.network.dns.mode,
-                    servers: [...profile.policy.network.dns.servers],
-                },
-                egress: {
-                    mode: profile.policy.network.egress.mode,
-                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],
-                    denyPrivateNetworks: profile.policy.network.egress.denyPrivateNetworks,
-                    denySiblingSyntheticEndpoints: profile.policy.network.egress.denySiblingSyntheticEndpoints,
-                    denyCidrs: [...profile.policy.network.egress.denyCidrs],
-                    ipv6: profile.policy.network.egress.ipv6,
-                    disableHostLoopback: profile.policy.network.egress.disableHostLoopback,
-                    portDriver: profile.policy.network.egress.portDriver,
-                    daemonBridge: profile.policy.network.egress.daemonBridge,
-                    exclusiveNetwork: profile.policy.network.egress.exclusiveNetwork,
-                    icc: profile.policy.network.egress.icc,
-                },
-            },
-        },
-    };
-}
-/** 对规范化 descriptor 求稳定 canonical digest；返回值可直接作为 descriptor digest。 */
-function dockerExecutionProfileV1Digest(profile) {
-    return `sha256:${(0, identity_ts_1.digestOf)(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;
-}
-exports.dockerProfileDigestOf = dockerExecutionProfileV1Digest;
+}, {
+    identifier: "DockerProfilePlainObject",
+    description: "a plain object or null-prototype record",
+});
+const plainStruct = (fields) => effect_1.Schema.compose(effect_1.Schema.Struct(fields), { strict: false })(PlainObjectSchema);
+const nonEmptyString = (identifier) => effect_1.Schema.String.pipe(effect_1.Schema.filter((value) => value.trim() !== "" && !value.includes("\0"), { identifier, description: "a non-empty string without NUL" }));
+const absolutePath = (identifier) => nonEmptyString(identifier).pipe(effect_1.Schema.filter(node_path_1.isAbsolute, { identifier, description: "an absolute path" }));
+const nonNegativeSafeInteger = (identifier) => effect_1.Schema.JsonNumber.pipe(effect_1.Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: "a non-negative safe integer" }));
+const positiveSafeInteger = (identifier) => effect_1.Schema.JsonNumber.pipe(effect_1.Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: "a positive safe integer" }));
+const positiveFinite = (identifier) => effect_1.Schema.JsonNumber.pipe(effect_1.Schema.filter((value) => Number.isFinite(value) && value > 0, { identifier, description: "a positive finite number" }));
 function isPublicDnsServer(value) {
     const kind = (0, node_net_1.isIP)(value);
     if (kind === 4) {
-        const octets = value.split(".").map(Number);
-        const first = octets[0];
-        const second = octets[1];
-        const third = octets[2];
+        const [first, second, third] = value.split(".").map(Number);
         if (first === undefined || second === undefined || third === undefined)
             return false;
         if (first === 0 || first === 10 || first === 127 || first >= 224)
@@ -251,358 +61,260 @@ function isPublicDnsServer(value) {
             return false;
         if (first === 192 && second === 168)
             return false;
-        if (first === 192 && second === 0 && third === 0)
-            return false;
-        if (first === 192 && second === 0 && third === 2)
+        if (first === 192 && second === 0 && (third === 0 || third === 2))
             return false;
         if (first === 198 && (second === 18 || second === 19))
             return false;
         if (first === 198 && second === 51 && third === 100)
             return false;
-        if (first === 203 && second === 0 && third === 113)
-            return false;
-        return true;
-    }
-    if (kind === 6) {
-        const normalized = value.toLowerCase();
-        if (normalized.startsWith("::ffff:"))
-            return isPublicDnsServer(normalized.slice("::ffff:".length));
-        return normalized !== "::" && normalized !== "::1" &&
-            !normalized.startsWith("fc") && !normalized.startsWith("fd") &&
-            !normalized.startsWith("fe8") && !normalized.startsWith("fe9") &&
-            !normalized.startsWith("fea") && !normalized.startsWith("feb") &&
-            !normalized.startsWith("ff") &&
-            !normalized.startsWith("2001:db8:");
-    }
-    return false;
-}
-function parseNetworkPolicy(value, path) {
-    const record = objectAt(value, path);
-    onlyKeys(record, ["version", "dns", "egress"], path);
-    if (record.version !== exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION) {
-        fail("sandbox.docker-profile-schema-invalid", `${path}.version must be 1`, `${path}.version`);
-    }
-    const dnsPath = `${path}.dns`;
-    const dns = objectAt(record.dns, dnsPath);
-    onlyKeys(dns, ["mode", "servers"], dnsPath);
-    if (dns.mode !== "explicit") {
-        fail("sandbox.docker-profile-schema-invalid", `${dnsPath}.mode must be "explicit"`, `${dnsPath}.mode`);
+        return !(first === 203 && second === 0 && third === 113);
     }
-    if (!Array.isArray(dns.servers) || dns.servers.length === 0) {
-        fail("sandbox.docker-profile-schema-invalid", `${dnsPath}.servers must be a non-empty array`, `${dnsPath}.servers`);
-    }
-    const servers = dns.servers.map((server, index) => {
-        const parsed = requiredString(server, `${dnsPath}.servers[${index}]`);
-        if (!isPublicDnsServer(parsed)) {
-            fail("sandbox.docker-profile-schema-invalid", `${dnsPath}.servers[${index}] must be a public IP address, not a private or synthetic endpoint`, `${dnsPath}.servers[${index}]`);
-        }
-        return parsed;
-    });
-    const egressPath = `${path}.egress`;
-    const egress = objectAt(record.egress, egressPath);
-    onlyKeys(egress, [
-        "mode",
-        "allowedProtocols",
-        "denyPrivateNetworks",
-        "denySiblingSyntheticEndpoints",
-        "denyCidrs",
-        "ipv6",
-        "disableHostLoopback",
-        "portDriver",
-        "daemonBridge",
-        "exclusiveNetwork",
-        "icc",
-    ], egressPath);
-    if (egress.mode !== "rootless-nat") {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.mode must be "rootless-nat"`, `${egressPath}.mode`);
-    }
-    if (!Array.isArray(egress.allowedProtocols) || egress.allowedProtocols.length !== 2 ||
-        egress.allowedProtocols[0] !== "dns" || egress.allowedProtocols[1] !== "https") {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.allowedProtocols must be ["dns", "https"]`, `${egressPath}.allowedProtocols`);
-    }
-    if (egress.denyPrivateNetworks !== true) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.denyPrivateNetworks must be true`, `${egressPath}.denyPrivateNetworks`);
-    }
-    if (egress.denySiblingSyntheticEndpoints !== true) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.denySiblingSyntheticEndpoints must be true`, `${egressPath}.denySiblingSyntheticEndpoints`);
-    }
-    if (!Array.isArray(egress.denyCidrs) || egress.denyCidrs.length !== exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS.length ||
-        egress.denyCidrs.some((cidr, index) => cidr !== exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS[index])) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.denyCidrs must be the v1 fail-closed CIDR set`, `${egressPath}.denyCidrs`);
-    }
-    if (egress.ipv6 !== "disabled") {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.ipv6 must be "disabled"`, `${egressPath}.ipv6`);
-    }
-    if (egress.disableHostLoopback !== true) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.disableHostLoopback must be true`, `${egressPath}.disableHostLoopback`);
-    }
-    if (egress.portDriver !== "none") {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.portDriver must be "none"`, `${egressPath}.portDriver`);
-    }
-    if (egress.daemonBridge !== "none") {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.daemonBridge must be "none"`, `${egressPath}.daemonBridge`);
-    }
-    if (egress.exclusiveNetwork !== true) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.exclusiveNetwork must be true`, `${egressPath}.exclusiveNetwork`);
-    }
-    if (egress.icc !== false) {
-        fail("sandbox.docker-profile-schema-invalid", `${egressPath}.icc must be false`, `${egressPath}.icc`);
-    }
-    return Object.freeze({
-        version: exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION,
-        dns: Object.freeze({ mode: "explicit", servers: frozenNonEmptyStrings(servers) }),
-        egress: Object.freeze({
-            mode: "rootless-nat",
-            allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,
-            denyPrivateNetworks: true,
-            denySiblingSyntheticEndpoints: true,
-            denyCidrs: exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS,
-            ipv6: "disabled",
-            disableHostLoopback: true,
-            portDriver: "none",
-            daemonBridge: "none",
-            exclusiveNetwork: true,
-            icc: false,
-        }),
-    });
-}
-function parsePolicy(value, path) {
-    const record = objectAt(value, path);
-    onlyKeys(record, [
-        "hostLoopback",
-        "tcpDockerEndpoint",
-        "outerSocketInjection",
-        "privilegedTranslation",
-        "writableRoot",
-        "network",
-    ], path);
-    if (record.hostLoopback !== false)
-        fail("sandbox.docker-profile-schema-invalid", `${path}.hostLoopback must be false`, `${path}.hostLoopback`);
-    if (record.tcpDockerEndpoint !== false)
-        fail("sandbox.docker-profile-schema-invalid", `${path}.tcpDockerEndpoint must be false`, `${path}.tcpDockerEndpoint`);
-    if (record.outerSocketInjection !== false)
-        fail("sandbox.docker-profile-schema-invalid", `${path}.outerSocketInjection must be false`, `${path}.outerSocketInjection`);
-    if (record.privilegedTranslation !== "rootless-userns") {
-        fail("sandbox.docker-profile-schema-invalid", `${path}.privilegedTranslation must be "rootless-userns"`, `${path}.privilegedTranslation`);
-    }
-    if (record.writableRoot !== "declared-tmpfs-only") {
-        fail("sandbox.docker-profile-schema-invalid", `${path}.writableRoot must be "declared-tmpfs-only"`, `${path}.writableRoot`);
-    }
-    return Object.freeze({
-        hostLoopback: false,
-        tcpDockerEndpoint: false,
-        outerSocketInjection: false,
-        privilegedTranslation: "rootless-userns",
-        writableRoot: "declared-tmpfs-only",
-        network: parseNetworkPolicy(record.network, `${path}.network`),
-    });
+    if (kind !== 6)
+        return false;
+    const normalized = value.toLowerCase();
+    if (normalized.startsWith("::ffff:")) {
+        return isPublicDnsServer(normalized.slice("::ffff:".length));
+    }
+    return normalized !== "::" && normalized !== "::1" &&
+        !normalized.startsWith("fc") && !normalized.startsWith("fd") &&
+        !normalized.startsWith("fe8") && !normalized.startsWith("fe9") &&
+        !normalized.startsWith("fea") && !normalized.startsWith("feb") &&
+        !normalized.startsWith("ff") && !normalized.startsWith("2001:db8:");
 }
-function parseTransport(value) {
-    const path = "profile.transport";
-    const record = objectAt(value, path);
-    onlyKeys(record, ["kind", "hostMachineIdentity", "dockerSocket", "controlSocket"], path);
-    if (record.kind !== "unix")
-        fail("sandbox.docker-profile-schema-invalid", `${path}.kind must be "unix"`, `${path}.kind`);
-    const controlPath = "profile.transport.controlSocket";
-    const control = objectAt(record.controlSocket, controlPath);
-    onlyKeys(control, ["path", "peerUid", "protocol"], controlPath);
-    if (control.protocol !== "niceeval-docker-profile-control/v1") {
-        fail("sandbox.docker-profile-schema-invalid", `${controlPath}.protocol is unsupported`, `${controlPath}.protocol`);
-    }
-    return Object.freeze({
-        kind: "unix",
-        hostMachineIdentity: requiredString(record.hostMachineIdentity, `${path}.hostMachineIdentity`),
-        dockerSocket: endpoint(record.dockerSocket, "profile.transport.dockerSocket"),
-        controlSocket: Object.freeze({
-            path: absolutePath(control.path, `${controlPath}.path`),
-            peerUid: nonNegativeSafeInteger(control.peerUid, `${controlPath}.peerUid`),
-            protocol: "niceeval-docker-profile-control/v1",
+const DnsServerSchema = nonEmptyString("DockerProfilePublicDnsServer").pipe(effect_1.Schema.filter(isPublicDnsServer, {
+    identifier: "DockerProfilePublicDnsServer",
+    description: "a public IP address, not a private or synthetic endpoint",
+}));
+const CidrsSchema = effect_1.Schema.NonEmptyArray(effect_1.Schema.String).pipe(effect_1.Schema.filter((value) => value.length === exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&
+    value.every((cidr, index) => cidr === exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: "DockerProfileDenyCidrs", description: "the v1 fail-closed CIDR set" }));
+const EndpointSchema = plainStruct({
+    path: absolutePath("DockerProfileSocketPath"),
+    peerUid: nonNegativeSafeInteger("DockerProfilePeerUid"),
+});
+const NetworkSchema = plainStruct({
+    version: effect_1.Schema.Literal(1),
+    dns: plainStruct({
+        mode: effect_1.Schema.Literal("explicit"),
+        servers: effect_1.Schema.NonEmptyArray(DnsServerSchema),
+    }),
+    egress: plainStruct({
+        mode: effect_1.Schema.Literal("rootless-nat"),
+        allowedProtocols: effect_1.Schema.Tuple(effect_1.Schema.Literal("dns"), effect_1.Schema.Literal("https")),
+        denyPrivateNetworks: effect_1.Schema.Literal(true),
+        denySiblingSyntheticEndpoints: effect_1.Schema.Literal(true),
+        denyCidrs: CidrsSchema,
+        ipv6: effect_1.Schema.Literal("disabled"),
+        disableHostLoopback: effect_1.Schema.Literal(true),
+        portDriver: effect_1.Schema.Literal("none"),
+        daemonBridge: effect_1.Schema.Literal("none"),
+        exclusiveNetwork: effect_1.Schema.Literal(true),
+        icc: effect_1.Schema.Literal(false),
+    }),
+});
+const CapacitySchema = plainStruct({
+    cpus: positiveFinite("DockerProfileCapacityCpus"),
+    memoryBytes: positiveSafeInteger("DockerProfileCapacityMemoryBytes"),
+    memorySwapBytes: effect_1.Schema.Literal(0),
+    pids: positiveSafeInteger("DockerProfileCapacityPids"),
+    maxContainers: positiveSafeInteger("DockerProfileCapacityMaxContainers"),
+    maxBuilds: positiveSafeInteger("DockerProfileCapacityMaxBuilds"),
+    aggregate: plainStruct({
+        cpus: positiveFinite("DockerProfileAggregateCpus"),
+        memoryBytes: positiveSafeInteger("DockerProfileAggregateMemoryBytes"),
+        memorySwapBytes: effect_1.Schema.Literal(0),
+        pids: positiveSafeInteger("DockerProfileAggregatePids"),
+    }),
+}).pipe(effect_1.Schema.filter((value) => value.aggregate.cpus >= value.cpus &&
+    value.aggregate.memoryBytes >= value.memoryBytes &&
+    value.aggregate.pids >= value.pids, {
+    identifier: "DockerProfileCapacity",
+    description: "aggregate capacity at least as large as allocatable CPU, memory and PID capacity",
+}));
+/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */
+exports.DockerExecutionProfileV1Schema = plainStruct({
+    schemaVersion: effect_1.Schema.Literal(1),
+    profileId: nonEmptyString("DockerProfileId"),
+    securityLevel: effect_1.Schema.Literal("managed-rootless/v1", "managed-vm-rootless/v1"),
+    semanticPolicyRevision: nonEmptyString("DockerProfileSemanticPolicyRevision"),
+    transport: plainStruct({
+        kind: effect_1.Schema.Literal("unix"),
+        hostMachineIdentity: nonEmptyString("DockerProfileHostMachineIdentity"),
+        dockerSocket: EndpointSchema,
+        controlSocket: plainStruct({
+            path: absolutePath("DockerProfileControlSocketPath"),
+            peerUid: nonNegativeSafeInteger("DockerProfileControlPeerUid"),
+            protocol: effect_1.Schema.Literal("niceeval-docker-profile-control/v1"),
         }),
-    });
-}
-function parseBackend(value) {
-    const path = "profile.backend";
-    const record = objectAt(value, path);
-    onlyKeys(record, ["kind", "machineIdentity", "owner", "filesystem", "cgroup"], path);
-    if (record.kind !== "local-systemd" && record.kind !== "dedicated-linux-vm") {
-        fail("sandbox.docker-profile-schema-invalid", `${path}.kind is unsupported`, `${path}.kind`);
-    }
-    const ownerPath = `${path}.owner`;
-    const owner = objectAt(record.owner, ownerPath);
-    onlyKeys(owner, ["uid", "gid"], ownerPath);
-    const filesystemPath = `${path}.filesystem`;
-    const filesystem = objectAt(record.filesystem, filesystemPath);
-    onlyKeys(filesystem, ["identity", "mountPath", "dockerRootDir", "limitBytes"], filesystemPath);
-    const cgroupPath = `${path}.cgroup`;
-    const cgroup = objectAt(record.cgroup, cgroupPath);
-    onlyKeys(cgroup, ["aggregatePath", "policyRevision", "controllers"], cgroupPath);
-    if (!Array.isArray(cgroup.controllers) || cgroup.controllers.length !== 3 ||
-        cgroup.controllers[0] !== "cpu" || cgroup.controllers[1] !== "memory" || cgroup.controllers[2] !== "pids") {
-        fail("sandbox.docker-profile-schema-invalid", `${cgroupPath}.controllers must be ["cpu", "memory", "pids"]`, `${cgroupPath}.controllers`);
-    }
-    return Object.freeze({
-        kind: record.kind,
-        machineIdentity: requiredString(record.machineIdentity, `${path}.machineIdentity`),
-        owner: Object.freeze({
-            uid: nonNegativeSafeInteger(owner.uid, `${ownerPath}.uid`),
-            gid: nonNegativeSafeInteger(owner.gid, `${ownerPath}.gid`),
+    }),
+    backend: plainStruct({
+        kind: effect_1.Schema.Literal("local-systemd", "dedicated-linux-vm"),
+        machineIdentity: nonEmptyString("DockerProfileBackendMachineIdentity"),
+        owner: plainStruct({
+            uid: nonNegativeSafeInteger("DockerProfileOwnerUid"),
+            gid: nonNegativeSafeInteger("DockerProfileOwnerGid"),
         }),
-        filesystem: Object.freeze({
-            identity: requiredString(filesystem.identity, `${filesystemPath}.identity`),
-            mountPath: absolutePath(filesystem.mountPath, `${filesystemPath}.mountPath`),
-            dockerRootDir: absolutePath(filesystem.dockerRootDir, `${filesystemPath}.dockerRootDir`),
-            limitBytes: positiveSafeInteger(filesystem.limitBytes, `${filesystemPath}.limitBytes`),
+        filesystem: plainStruct({
+            identity: nonEmptyString("DockerProfileFilesystemIdentity"),
+            mountPath: absolutePath("DockerProfileMountPath"),
+            dockerRootDir: absolutePath("DockerProfileDockerRootDir"),
+            limitBytes: positiveSafeInteger("DockerProfileFilesystemLimitBytes"),
         }),
-        cgroup: Object.freeze({
-            aggregatePath: absolutePath(cgroup.aggregatePath, `${cgroupPath}.aggregatePath`),
-            policyRevision: requiredString(cgroup.policyRevision, `${cgroupPath}.policyRevision`),
-            controllers: PROFILE_CONTROLLERS,
+        cgroup: plainStruct({
+            aggregatePath: absolutePath("DockerProfileAggregatePath"),
+            policyRevision: nonEmptyString("DockerProfileCgroupPolicyRevision"),
+            controllers: effect_1.Schema.Tuple(effect_1.Schema.Literal("cpu"), effect_1.Schema.Literal("memory"), effect_1.Schema.Literal("pids")),
         }),
-    });
-}
-function parseCapacity(value) {
-    const path = "profile.capacity";
-    const record = objectAt(value, path);
-    onlyKeys(record, ["cpus", "memoryBytes", "memorySwapBytes", "pids", "maxContainers", "maxBuilds", "aggregate"], path);
-    const aggregatePath = `${path}.aggregate`;
-    const aggregate = objectAt(record.aggregate, aggregatePath);
-    onlyKeys(aggregate, ["cpus", "memoryBytes", "memorySwapBytes", "pids"], aggregatePath);
-    if (record.memorySwapBytes !== 0)
-        fail("sandbox.docker-profile-schema-invalid", `${path}.memorySwapBytes must be 0`, `${path}.memorySwapBytes`);
-    if (aggregate.memorySwapBytes !== 0)
-        fail("sandbox.docker-profile-schema-invalid", `${aggregatePath}.memorySwapBytes must be 0`, `${aggregatePath}.memorySwapBytes`);
-    const parsed = {
-        cpus: positiveFinite(record.cpus, `${path}.cpus`),
-        memoryBytes: positiveSafeInteger(record.memoryBytes, `${path}.memoryBytes`),
-        memorySwapBytes: ZERO_SWAP,
-        pids: positiveSafeInteger(record.pids, `${path}.pids`),
-        maxContainers: positiveSafeInteger(record.maxContainers, `${path}.maxContainers`),
-        maxBuilds: positiveSafeInteger(record.maxBuilds, `${path}.maxBuilds`),
-        aggregate: {
-            cpus: positiveFinite(aggregate.cpus, `${aggregatePath}.cpus`),
-            memoryBytes: positiveSafeInteger(aggregate.memoryBytes, `${aggregatePath}.memoryBytes`),
-            memorySwapBytes: ZERO_SWAP,
-            pids: positiveSafeInteger(aggregate.pids, `${aggregatePath}.pids`),
-        },
-    };
-    if (parsed.aggregate.cpus < parsed.cpus || parsed.aggregate.memoryBytes < parsed.memoryBytes || parsed.aggregate.pids < parsed.pids) {
-        throw (0, errors_ts_1.dockerProfileError)({
-            code: "sandbox.docker-profile-capacity-invalid",
-            path,
-            message: "profile.capacity.aggregate must be at least as large as allocatable CPU, memory and PID capacity",
-        });
-    }
-    return Object.freeze({
-        cpus: parsed.cpus,
-        memoryBytes: parsed.memoryBytes,
-        memorySwapBytes: parsed.memorySwapBytes,
-        pids: parsed.pids,
-        maxContainers: parsed.maxContainers,
-        maxBuilds: parsed.maxBuilds,
-        aggregate: Object.freeze({ ...parsed.aggregate }),
-    });
+    }),
+    capacity: CapacitySchema,
+    policy: plainStruct({
+        hostLoopback: effect_1.Schema.Literal(false),
+        tcpDockerEndpoint: effect_1.Schema.Literal(false),
+        outerSocketInjection: effect_1.Schema.Literal(false),
+        privilegedTranslation: effect_1.Schema.Literal("rootless-userns"),
+        writableRoot: effect_1.Schema.Literal("declared-tmpfs-only"),
+        network: NetworkSchema,
+    }),
+});
+exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema;
+function frozenNonEmptyStrings(values) {
+    const [first, ...rest] = values;
+    if (first === undefined)
+        throw new Error("expected a non-empty string tuple");
+    return Object.freeze([first, ...rest]);
 }
+/** Canonicalize only after structural decoding; nested containers are immutable to callers. */
 function freezeProfile(profile) {
     return Object.freeze({
-        schemaVersion: 1,
-        profileId: profile.profileId,
-        securityLevel: profile.securityLevel,
-        semanticPolicyRevision: profile.semanticPolicyRevision,
+        ...profile,
         transport: Object.freeze({
-            kind: "unix",
-            hostMachineIdentity: profile.transport.hostMachineIdentity,
+            ...profile.transport,
             dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),
             controlSocket: Object.freeze({ ...profile.transport.controlSocket }),
         }),
         backend: Object.freeze({
-            kind: profile.backend.kind,
-            machineIdentity: profile.backend.machineIdentity,
+            ...profile.backend,
             owner: Object.freeze({ ...profile.backend.owner }),
             filesystem: Object.freeze({ ...profile.backend.filesystem }),
-            cgroup: Object.freeze({
-                aggregatePath: profile.backend.cgroup.aggregatePath,
-                policyRevision: profile.backend.cgroup.policyRevision,
-                controllers: PROFILE_CONTROLLERS,
-            }),
+            cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),
         }),
         capacity: Object.freeze({
-            cpus: profile.capacity.cpus,
-            memoryBytes: profile.capacity.memoryBytes,
+            ...profile.capacity,
             memorySwapBytes: 0,
-            pids: profile.capacity.pids,
-            maxContainers: profile.capacity.maxContainers,
-            maxBuilds: profile.capacity.maxBuilds,
-            aggregate: Object.freeze({ ...profile.capacity.aggregate }),
+            aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),
         }),
         policy: Object.freeze({
-            hostLoopback: profile.policy.hostLoopback,
-            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,
-            outerSocketInjection: profile.policy.outerSocketInjection,
-            privilegedTranslation: profile.policy.privilegedTranslation,
-            writableRoot: profile.policy.writableRoot,
+            ...profile.policy,
             network: Object.freeze({
-                version: profile.policy.network.version,
+                ...profile.policy.network,
                 dns: Object.freeze({
-                    mode: profile.policy.network.dns.mode,
+                    ...profile.policy.network.dns,
                     servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),
                 }),
                 egress: Object.freeze({
-                    mode: profile.policy.network.egress.mode,
+                    ...profile.policy.network.egress,
                     allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,
-                    denyPrivateNetworks: profile.policy.network.egress.denyPrivateNetworks,
-                    denySiblingSyntheticEndpoints: profile.policy.network.egress.denySiblingSyntheticEndpoints,
                     denyCidrs: exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS,
-                    ipv6: profile.policy.network.egress.ipv6,
-                    disableHostLoopback: profile.policy.network.egress.disableHostLoopback,
-                    portDriver: profile.policy.network.egress.portDriver,
-                    daemonBridge: profile.policy.network.egress.daemonBridge,
-                    exclusiveNetwork: profile.policy.network.egress.exclusiveNetwork,
-                    icc: profile.policy.network.egress.icc,
                 }),
             }),
         }),
     });
 }
-/** 严格解析未知输入；不会执行 descriptor 中的 callback、命令或其它代码。 */
-function parseDockerExecutionProfileV1(value) {
-    const root = objectAt(value, "profile");
-    onlyKeys(root, ["schemaVersion", "profileId", "securityLevel", "semanticPolicyRevision", "transport", "backend", "capacity", "policy"], "profile");
-    if (root.schemaVersion === undefined) {
-        fail("sandbox.docker-profile-schema-invalid", "profile.schemaVersion is required", "profile.schemaVersion");
-    }
-    if (root.schemaVersion !== exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION) {
-        throw (0, errors_ts_1.dockerProfileError)({
+function semanticPolicyJson(input) {
+    return {
+        schemaVersion: exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,
+        securityLevel: input.securityLevel,
+        backend: {
+            kind: input.backend.kind,
+            cgroup: {
+                policyRevision: input.backend.cgroup.policyRevision,
+                controllers: [...input.backend.cgroup.controllers],
+            },
+        },
+        policy: {
+            hostLoopback: input.policy.hostLoopback,
+            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,
+            outerSocketInjection: input.policy.outerSocketInjection,
+            privilegedTranslation: input.policy.privilegedTranslation,
+            writableRoot: input.policy.writableRoot,
+            network: {
+                version: input.policy.network.version,
+                dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },
+                egress: {
+                    mode: input.policy.network.egress.mode,
+                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],
+                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,
+                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,
+                    denyCidrs: [...input.policy.network.egress.denyCidrs],
+                    ipv6: input.policy.network.egress.ipv6,
+                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,
+                    portDriver: input.policy.network.egress.portDriver,
+                    daemonBridge: input.policy.network.egress.daemonBridge,
+                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,
+                    icc: input.policy.network.egress.icc,
+                },
+            },
+        },
+    };
+}
+function dockerExecutionProfileSemanticPolicyRevisionOf(input) {
+    return (0, identity_ts_1.digestOf)(semanticPolicyJson(input)).slice(0, 8);
+}
+exports.dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;
+function formatSchemaPath(path) {
+    return path.reduce((result, segment) => typeof segment === "number" ||
+        (typeof segment === "string" && /^\\d+$/.test(segment))
+        ? `${result}[${String(segment)}]`
+        : `${result}.${String(segment)}`, "profile");
+}
+function schemaError(value, error) {
+    const issue = effect_1.ParseResult.ArrayFormatter.formatErrorSync(error)[0];
+    const path = issue === undefined ? "profile" : formatSchemaPath(issue.path);
+    const root = typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+    if (path === "profile.schemaVersion") {
+        if (root?.schemaVersion === undefined) {
+            return (0, errors_ts_1.dockerProfileError)({
+                code: "sandbox.docker-profile-schema-invalid",
+                path,
+                message: "profile.schemaVersion is required",
+            });
+        }
+        return (0, errors_ts_1.dockerProfileError)({
             code: "sandbox.docker-profile-unknown-version",
-            path: "profile.schemaVersion",
+            path,
             message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,
         });
     }
-    if (root.securityLevel !== "managed-rootless/v1" && root.securityLevel !== "managed-vm-rootless/v1") {
-        throw (0, errors_ts_1.dockerProfileError)({
+    if (path === "profile.securityLevel") {
+        return (0, errors_ts_1.dockerProfileError)({
             code: "sandbox.docker-profile-security-level-unsupported",
-            path: "profile.securityLevel",
-            message: `Unsupported Docker execution profile security level ${JSON.stringify(root.securityLevel)}`,
+            path,
+            message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,
         });
     }
-    const profileId = requiredString(root.profileId, "profile.profileId");
-    const semanticPolicyRevision = requiredString(root.semanticPolicyRevision, "profile.semanticPolicyRevision");
-    const profile = freezeProfile({
-        schemaVersion: 1,
-        profileId,
-        securityLevel: root.securityLevel,
-        semanticPolicyRevision,
-        transport: parseTransport(root.transport),
-        backend: parseBackend(root.backend),
-        capacity: parseCapacity(root.capacity),
-        policy: parsePolicy(root.policy, "profile.policy"),
+    return (0, errors_ts_1.dockerProfileError)({
+        code: path === "profile.capacity"
+            ? "sandbox.docker-profile-capacity-invalid"
+            : "sandbox.docker-profile-schema-invalid",
+        path,
+        message: issue === undefined
+            ? "profile is not a valid Docker execution profile v1"
+            : `${path} ${issue.message}`,
     });
-    const expectedRevision = dockerExecutionProfileSemanticPolicyRevisionOf(profile);
-    if (semanticPolicyRevision !== expectedRevision) {
+}
+function parseDockerExecutionProfileV1(value) {
+    const decoded = effect_1.Schema.decodeUnknownEither(exports.DockerExecutionProfileV1Schema, ParseOptions)(value);
+    if (effect_1.Either.isLeft(decoded))
+        throw schemaError(value, decoded.left);
+    const profile = freezeProfile(decoded.right);
+    const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);
+    if (profile.semanticPolicyRevision !== expected) {
         throw (0, errors_ts_1.dockerProfileError)({
             code: "sandbox.docker-profile-semantic-policy-mismatch",
             path: "profile.semanticPolicyRevision",
-            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expectedRevision}`,
-            details: { expected: expectedRevision, actual: semanticPolicyRevision },
+            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,
+            details: { expected, actual: profile.semanticPolicyRevision },
         });
     }
     return profile;
@@ -610,8 +322,10 @@ function parseDockerExecutionProfileV1(value) {
 exports.parseDockerExecutionProfile = parseDockerExecutionProfileV1;
 exports.decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;
 function makeDockerExecutionProfileV1(input) {
-    const semanticPolicyRevision = dockerExecutionProfileSemanticPolicyRevisionOf(input);
-    return parseDockerExecutionProfileV1({ ...input, semanticPolicyRevision });
+    return parseDockerExecutionProfileV1({
+        ...input,
+        semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),
+    });
 }
 exports.createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;
 function isDockerExecutionProfileV1(value) {
@@ -623,12 +337,52 @@ function isDockerExecutionProfileV1(value) {
         return false;
     }
 }
-/** Effect Schema 只负责把该纯数据边界暴露给 Effect consumers；稳定业务错误由 parse 函数提供。 */
-exports.DockerExecutionProfileV1Schema = effect_1.Schema.declare(isDockerExecutionProfileV1, {
-    identifier: "DockerExecutionProfileV1",
-    description: "a callback-free NiceEval Docker execution profile v1",
-});
-exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema;
+/** Digest the fixed v1 wire shape, not incidental object insertion order. */
+function canonicalJson(profile) {
+    return {
+        schemaVersion: profile.schemaVersion,
+        profileId: profile.profileId,
+        securityLevel: profile.securityLevel,
+        semanticPolicyRevision: profile.semanticPolicyRevision,
+        transport: {
+            kind: profile.transport.kind,
+            hostMachineIdentity: profile.transport.hostMachineIdentity,
+            dockerSocket: { ...profile.transport.dockerSocket },
+            controlSocket: { ...profile.transport.controlSocket },
+        },
+        backend: {
+            kind: profile.backend.kind,
+            machineIdentity: profile.backend.machineIdentity,
+            owner: { ...profile.backend.owner },
+            filesystem: { ...profile.backend.filesystem },
+            cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },
+        },
+        capacity: {
+            ...profile.capacity,
+            aggregate: { ...profile.capacity.aggregate },
+        },
+        policy: {
+            hostLoopback: profile.policy.hostLoopback,
+            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,
+            outerSocketInjection: profile.policy.outerSocketInjection,
+            privilegedTranslation: profile.policy.privilegedTranslation,
+            writableRoot: profile.policy.writableRoot,
+            network: {
+                version: profile.policy.network.version,
+                dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },
+                egress: {
+                    ...profile.policy.network.egress,
+                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],
+                    denyCidrs: [...profile.policy.network.egress.denyCidrs],
+                },
+            },
+        },
+    };
+}
+function dockerExecutionProfileV1Digest(profile) {
+    return `sha256:${(0, identity_ts_1.digestOf)(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;
+}
+exports.dockerProfileDigestOf = dockerExecutionProfileV1Digest;
 function dockerProfilePublicSummaryOf(profile) {
     const normalized = parseDockerExecutionProfileV1(profile);
     return Object.freeze({
@@ -637,12 +391,7 @@ function dockerProfilePublicSummaryOf(profile) {
         securityLevel: normalized.securityLevel,
         semanticPolicyRevision: normalized.semanticPolicyRevision,
         capacity: Object.freeze({
-            cpus: normalized.capacity.cpus,
-            memoryBytes: normalized.capacity.memoryBytes,
-            memorySwapBytes: 0,
-            pids: normalized.capacity.pids,
-            maxContainers: normalized.capacity.maxContainers,
-            maxBuilds: normalized.capacity.maxBuilds,
+            ...normalized.capacity,
             aggregate: Object.freeze({ ...normalized.capacity.aggregate }),
         }),
     });