niceeval 0.13.1 → 0.13.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (548) hide show
  1. package/INDEX.md +25 -2
  2. package/README.md +9 -10
  3. package/README.zh.md +9 -10
  4. package/dist/agents/ai-sdk.cjs.map +1 -1
  5. package/dist/agents/ai-sdk.d.cts +1 -1
  6. package/dist/agents/ai-sdk.d.mts +1 -1
  7. package/dist/agents/ai-sdk.d.ts +1 -1
  8. package/dist/agents/bub-install-spec.cjs +19 -5
  9. package/dist/agents/bub-install-spec.cjs.map +1 -1
  10. package/dist/agents/bub-install-spec.d.cts +9 -2
  11. package/dist/agents/bub-install-spec.d.mts +9 -2
  12. package/dist/agents/bub-install-spec.d.ts +9 -2
  13. package/dist/agents/bub-install-spec.js +14 -12
  14. package/dist/agents/bub.cjs +10 -6
  15. package/dist/agents/bub.cjs.map +1 -1
  16. package/dist/agents/bub.d.cts +2 -2
  17. package/dist/agents/bub.d.mts +2 -2
  18. package/dist/agents/bub.d.ts +2 -2
  19. package/dist/agents/claude-code.cjs.map +1 -1
  20. package/dist/agents/claude-code.d.cts +2 -2
  21. package/dist/agents/claude-code.d.mts +2 -2
  22. package/dist/agents/claude-code.d.ts +2 -2
  23. package/dist/agents/codex.cjs +4 -4
  24. package/dist/agents/codex.cjs.map +1 -1
  25. package/dist/agents/codex.d.cts +3 -3
  26. package/dist/agents/codex.d.mts +3 -3
  27. package/dist/agents/codex.d.ts +3 -3
  28. package/dist/agents/coding-cli-versions.cjs +10 -1
  29. package/dist/agents/coding-cli-versions.cjs.map +1 -1
  30. package/dist/agents/coding-cli-versions.d.cts +8 -3
  31. package/dist/agents/coding-cli-versions.d.mts +8 -3
  32. package/dist/agents/coding-cli-versions.d.ts +8 -3
  33. package/dist/agents/coding-cli-versions.js +18 -12
  34. package/dist/agents/deepseek-harness.cjs +151 -0
  35. package/dist/agents/deepseek-harness.cjs.map +1 -0
  36. package/dist/agents/deepseek-harness.d.cts +14 -0
  37. package/dist/agents/deepseek-harness.d.mts +14 -0
  38. package/dist/agents/deepseek-harness.d.ts +14 -0
  39. package/dist/agents/deepseek-harness.js +7 -0
  40. package/dist/agents/deepseek-harness.js.map +1 -0
  41. package/dist/agents/exact-npm-plugins.cjs +28 -0
  42. package/dist/agents/exact-npm-plugins.cjs.map +1 -0
  43. package/dist/agents/exact-npm-plugins.d.cts +10 -0
  44. package/dist/agents/exact-npm-plugins.d.mts +10 -0
  45. package/dist/agents/exact-npm-plugins.d.ts +10 -0
  46. package/dist/agents/exact-npm-plugins.js +8 -0
  47. package/dist/agents/exact-npm-plugins.js.map +1 -0
  48. package/dist/agents/index.cjs +5 -1
  49. package/dist/agents/index.cjs.map +1 -1
  50. package/dist/agents/index.d.cts +4 -0
  51. package/dist/agents/index.d.mts +4 -0
  52. package/dist/agents/index.d.ts +4 -0
  53. package/dist/agents/index.js +54 -50
  54. package/dist/agents/index.mjs +54 -50
  55. package/dist/agents/omp.cjs +170 -0
  56. package/dist/agents/omp.cjs.map +1 -0
  57. package/dist/agents/omp.d.cts +14 -0
  58. package/dist/agents/omp.d.mts +14 -0
  59. package/dist/agents/omp.d.ts +14 -0
  60. package/dist/agents/omp.js +7 -0
  61. package/dist/agents/omp.js.map +1 -0
  62. package/dist/agents/openclaw.cjs +51 -2
  63. package/dist/agents/openclaw.cjs.map +1 -1
  64. package/dist/agents/openclaw.d.cts +2 -0
  65. package/dist/agents/openclaw.d.mts +2 -0
  66. package/dist/agents/openclaw.d.ts +2 -0
  67. package/dist/agents/types.cjs.map +1 -1
  68. package/dist/agents/types.d.cts +4 -4
  69. package/dist/agents/types.d.mts +4 -4
  70. package/dist/agents/types.d.ts +4 -4
  71. package/dist/agents/ui-message-stream.cjs +24 -7
  72. package/dist/agents/ui-message-stream.cjs.map +1 -1
  73. package/dist/analysis/api.cjs +28 -2
  74. package/dist/analysis/api.cjs.map +1 -1
  75. package/dist/analysis/api.d.cts +22 -1
  76. package/dist/analysis/api.d.mts +22 -1
  77. package/dist/analysis/api.d.ts +22 -1
  78. package/dist/analysis/api.js +8 -6
  79. package/dist/analysis/bindings.cjs +11 -18
  80. package/dist/analysis/bindings.cjs.map +1 -1
  81. package/dist/analysis/bindings.d.cts +177 -49
  82. package/dist/analysis/bindings.d.mts +177 -49
  83. package/dist/analysis/bindings.d.ts +177 -49
  84. package/dist/analysis/contracts.cjs +1 -0
  85. package/dist/analysis/contracts.cjs.map +1 -1
  86. package/dist/analysis/contracts.d.cts +43 -3
  87. package/dist/analysis/contracts.d.mts +43 -3
  88. package/dist/analysis/contracts.d.ts +43 -3
  89. package/dist/analysis/cost-projection.cjs +2 -1
  90. package/dist/analysis/cost-projection.cjs.map +1 -1
  91. package/dist/analysis/cost-projection.d.cts +1 -1
  92. package/dist/analysis/cost-projection.d.mts +1 -1
  93. package/dist/analysis/cost-projection.d.ts +1 -1
  94. package/dist/analysis/cost.cjs +13 -3
  95. package/dist/analysis/cost.cjs.map +1 -1
  96. package/dist/analysis/cost.d.cts +10 -3
  97. package/dist/analysis/cost.d.mts +10 -3
  98. package/dist/analysis/cost.d.ts +10 -3
  99. package/dist/analysis/experiment-groups.cjs +96 -0
  100. package/dist/analysis/experiment-groups.cjs.map +1 -0
  101. package/dist/analysis/experiment-groups.d.cts +9 -0
  102. package/dist/analysis/experiment-groups.d.mts +9 -0
  103. package/dist/analysis/experiment-groups.d.ts +9 -0
  104. package/dist/analysis/experiment-groups.js +10 -0
  105. package/dist/analysis/experiment-groups.js.map +1 -0
  106. package/dist/analysis/index.cjs +4 -1
  107. package/dist/analysis/index.cjs.map +1 -1
  108. package/dist/analysis/index.d.cts +4 -2
  109. package/dist/analysis/index.d.mts +4 -2
  110. package/dist/analysis/index.d.ts +4 -2
  111. package/dist/analysis/index.js +40 -36
  112. package/dist/analysis/index.mjs +40 -36
  113. package/dist/assertions/limits.cjs +4 -0
  114. package/dist/assertions/limits.cjs.map +1 -1
  115. package/dist/assertions/limits.d.cts +4 -0
  116. package/dist/assertions/limits.d.mts +4 -0
  117. package/dist/assertions/limits.d.ts +4 -0
  118. package/dist/assertions/match.cjs +63 -25
  119. package/dist/assertions/match.cjs.map +1 -1
  120. package/dist/assertions/match.d.cts +7 -0
  121. package/dist/assertions/match.d.mts +7 -0
  122. package/dist/assertions/match.d.ts +7 -0
  123. package/dist/assertions/record/attachment.cjs +32 -4
  124. package/dist/assertions/record/attachment.cjs.map +1 -1
  125. package/dist/assertions/record/diff.cjs +10 -4
  126. package/dist/assertions/record/diff.cjs.map +1 -1
  127. package/dist/assertions/record/producer.cjs +101 -4
  128. package/dist/assertions/record/producer.cjs.map +1 -1
  129. package/dist/assertions/record/producer.d.cts +4 -1
  130. package/dist/assertions/record/producer.d.mts +4 -1
  131. package/dist/assertions/record/producer.d.ts +4 -1
  132. package/dist/assertions/runtime.cjs +45 -5
  133. package/dist/assertions/runtime.cjs.map +1 -1
  134. package/dist/cli/record.cjs +113 -8
  135. package/dist/cli/record.cjs.map +1 -1
  136. package/dist/cli/record.d.cts +20 -1
  137. package/dist/cli/record.d.mts +20 -1
  138. package/dist/cli/record.d.ts +20 -1
  139. package/dist/cli/record.js +4 -2
  140. package/dist/cli.cjs +386 -31
  141. package/dist/cli.cjs.map +1 -1
  142. package/dist/cli.d.cts +10 -2
  143. package/dist/cli.d.mts +10 -2
  144. package/dist/cli.d.ts +10 -2
  145. package/dist/context/send-retry.cjs +4 -4
  146. package/dist/context/send-retry.cjs.map +1 -1
  147. package/dist/coordination/host/runtime.cjs +8 -30
  148. package/dist/coordination/host/runtime.cjs.map +1 -1
  149. package/dist/coordination/host/runtime.d.cts +3 -3
  150. package/dist/coordination/host/runtime.d.mts +3 -3
  151. package/dist/coordination/host/runtime.d.ts +3 -3
  152. package/dist/coordination/host/types.cjs.map +1 -1
  153. package/dist/coordination/host/types.d.cts +0 -5
  154. package/dist/coordination/host/types.d.mts +0 -5
  155. package/dist/coordination/host/types.d.ts +0 -5
  156. package/dist/coordination/platform/node.cjs +90 -9
  157. package/dist/coordination/platform/node.cjs.map +1 -1
  158. package/dist/define.cjs +25 -1
  159. package/dist/define.cjs.map +1 -1
  160. package/dist/experiment/host/index.cjs +1 -0
  161. package/dist/experiment/host/index.cjs.map +1 -1
  162. package/dist/i18n/en.cjs +26 -8
  163. package/dist/i18n/en.cjs.map +1 -1
  164. package/dist/i18n/en.d.cts +19 -6
  165. package/dist/i18n/en.d.mts +19 -6
  166. package/dist/i18n/en.d.ts +19 -6
  167. package/dist/index.cjs.map +1 -1
  168. package/dist/index.d.cts +1 -1
  169. package/dist/index.d.mts +1 -1
  170. package/dist/index.d.ts +1 -1
  171. package/dist/o11y/parsers/hermes.cjs +1 -1
  172. package/dist/o11y/parsers/hermes.cjs.map +1 -1
  173. package/dist/o11y/prices.json +1 -1
  174. package/dist/o11y/record/families.cjs +12 -3
  175. package/dist/o11y/record/families.cjs.map +1 -1
  176. package/dist/o11y/record/families.d.cts +8 -8
  177. package/dist/o11y/record/families.d.mts +8 -8
  178. package/dist/o11y/record/families.d.ts +8 -8
  179. package/dist/o11y/record/family-projectors.d.cts +66 -18
  180. package/dist/o11y/record/family-projectors.d.mts +66 -18
  181. package/dist/o11y/record/family-projectors.d.ts +66 -18
  182. package/dist/o11y/record/family-writers.d.cts +11 -3
  183. package/dist/o11y/record/family-writers.d.mts +11 -3
  184. package/dist/o11y/record/family-writers.d.ts +11 -3
  185. package/dist/o11y/record/runner-producer.cjs +14 -4
  186. package/dist/o11y/record/runner-producer.cjs.map +1 -1
  187. package/dist/record/codec/core.d.cts +2 -2
  188. package/dist/record/codec/core.d.mts +2 -2
  189. package/dist/record/codec/core.d.ts +2 -2
  190. package/dist/record/family/catalog.d.cts +44 -12
  191. package/dist/record/family/catalog.d.mts +44 -12
  192. package/dist/record/family/catalog.d.ts +44 -12
  193. package/dist/record/family/index.js +128 -124
  194. package/dist/record/family/observability-v1.cjs +35 -0
  195. package/dist/record/family/observability-v1.cjs.map +1 -0
  196. package/dist/record/family/observability-v1.d.cts +3 -0
  197. package/dist/record/family/observability-v1.d.mts +3 -0
  198. package/dist/record/family/observability-v1.d.ts +3 -0
  199. package/dist/record/family/observability-v1.js +6 -0
  200. package/dist/record/family/observability-v1.js.map +1 -0
  201. package/dist/record/family/observability.cjs +58 -9
  202. package/dist/record/family/observability.cjs.map +1 -1
  203. package/dist/record/family/observability.d.cts +1014 -15
  204. package/dist/record/family/observability.d.mts +1014 -15
  205. package/dist/record/family/observability.d.ts +1014 -15
  206. package/dist/record/family/observability.js +22 -18
  207. package/dist/record/host/runtime.cjs +600 -31
  208. package/dist/record/host/runtime.cjs.map +1 -1
  209. package/dist/record/host/types.cjs.map +1 -1
  210. package/dist/record/host/types.d.cts +33 -9
  211. package/dist/record/host/types.d.mts +33 -9
  212. package/dist/record/host/types.d.ts +33 -9
  213. package/dist/record/maintenance/runtime.cjs +1 -2
  214. package/dist/record/maintenance/runtime.cjs.map +1 -1
  215. package/dist/record/model/core.cjs.map +1 -1
  216. package/dist/record/model/core.d.cts +1 -1
  217. package/dist/record/model/core.d.mts +1 -1
  218. package/dist/record/model/core.d.ts +1 -1
  219. package/dist/record/model/definition.d.cts +6 -6
  220. package/dist/record/model/definition.d.mts +6 -6
  221. package/dist/record/model/definition.d.ts +6 -6
  222. package/dist/record/model/identifiers.cjs +1 -1
  223. package/dist/record/model/identifiers.cjs.map +1 -1
  224. package/dist/record/model/identifiers.d.cts +1 -1
  225. package/dist/record/model/identifiers.d.mts +1 -1
  226. package/dist/record/model/identifiers.d.ts +1 -1
  227. package/dist/record/platform/node.cjs +159 -23
  228. package/dist/record/platform/node.cjs.map +1 -1
  229. package/dist/record/platform/services.cjs.map +1 -1
  230. package/dist/record/platform/services.d.cts +15 -2
  231. package/dist/record/platform/services.d.mts +15 -2
  232. package/dist/record/platform/services.d.ts +15 -2
  233. package/dist/record/reader/errors.cjs +37 -1
  234. package/dist/record/reader/errors.cjs.map +1 -1
  235. package/dist/record/reader/errors.d.cts +49 -1
  236. package/dist/record/reader/errors.d.mts +49 -1
  237. package/dist/record/reader/errors.d.ts +49 -1
  238. package/dist/record/reader/errors.js +22 -12
  239. package/dist/record/reader/format.cjs +76 -17
  240. package/dist/record/reader/format.cjs.map +1 -1
  241. package/dist/record/reader/format.d.cts +11 -4
  242. package/dist/record/reader/format.d.mts +11 -4
  243. package/dist/record/reader/format.d.ts +11 -4
  244. package/dist/record/reader/format.js +2 -0
  245. package/dist/record/reader/index.js +32 -18
  246. package/dist/record/reader/runtime.cjs +64 -0
  247. package/dist/record/reader/runtime.cjs.map +1 -1
  248. package/dist/record/reader/runtime.d.cts +15 -0
  249. package/dist/record/reader/runtime.d.mts +15 -0
  250. package/dist/record/reader/runtime.d.ts +15 -0
  251. package/dist/record/reader/runtime.js +2 -0
  252. package/dist/report/assets/styles.css +53 -29
  253. package/dist/report/built-in/analysis-values.cjs +21 -13
  254. package/dist/report/built-in/analysis-values.cjs.map +1 -1
  255. package/dist/report/built-in/analysis-values.d.cts +11 -22
  256. package/dist/report/built-in/analysis-values.d.mts +11 -22
  257. package/dist/report/built-in/analysis-values.d.ts +11 -22
  258. package/dist/report/built-in/analysis-values.js +4 -6
  259. package/dist/report/built-in/index.cjs +1 -3
  260. package/dist/report/built-in/index.cjs.map +1 -1
  261. package/dist/report/built-in/index.d.cts +1 -1
  262. package/dist/report/built-in/index.d.mts +1 -1
  263. package/dist/report/built-in/index.d.ts +1 -1
  264. package/dist/report/built-in/index.js +4 -8
  265. package/dist/report/built-in/index.mjs +4 -8
  266. package/dist/report/built-in/machine.cjs +0 -2
  267. package/dist/report/built-in/machine.cjs.map +1 -1
  268. package/dist/report/built-in/machine.d.cts +0 -2
  269. package/dist/report/built-in/machine.d.mts +0 -2
  270. package/dist/report/built-in/machine.d.ts +0 -2
  271. package/dist/report/built-in/result-components.cjs +49 -51
  272. package/dist/report/built-in/result-components.cjs.map +1 -1
  273. package/dist/report/built-in/result-components.d.cts +16 -17
  274. package/dist/report/built-in/result-components.d.mts +16 -17
  275. package/dist/report/built-in/result-components.d.ts +16 -17
  276. package/dist/report/built-in/result-components.js +0 -4
  277. package/dist/report/built-in/run-membership-overview.cjs +126 -17
  278. package/dist/report/built-in/run-membership-overview.cjs.map +1 -1
  279. package/dist/report/built-in/run-membership-overview.d.cts +14 -0
  280. package/dist/report/built-in/run-membership-overview.d.mts +14 -0
  281. package/dist/report/built-in/run-membership-overview.d.ts +14 -0
  282. package/dist/report/built-in/run-membership-overview.js +4 -2
  283. package/dist/report/built-in/standard.cjs +80 -45
  284. package/dist/report/built-in/standard.cjs.map +1 -1
  285. package/dist/report/built-in/standard.d.cts +19 -41
  286. package/dist/report/built-in/standard.d.mts +19 -41
  287. package/dist/report/built-in/standard.d.ts +19 -41
  288. package/dist/report/built-in/standard.js +6 -6
  289. package/dist/report/components/attempt-detail/compute.cjs +78 -2
  290. package/dist/report/components/attempt-detail/compute.cjs.map +1 -1
  291. package/dist/report/components/attempt-detail/compute.d.cts +1 -1
  292. package/dist/report/components/attempt-detail/compute.d.mts +1 -1
  293. package/dist/report/components/attempt-detail/compute.d.ts +1 -1
  294. package/dist/report/components/attempt-detail/content.cjs +1 -1
  295. package/dist/report/components/attempt-detail/content.cjs.map +1 -1
  296. package/dist/report/components/entity-lists/compute.cjs +42 -5
  297. package/dist/report/components/entity-lists/compute.cjs.map +1 -1
  298. package/dist/report/components/entity-lists/compute.d.cts +10 -8
  299. package/dist/report/components/entity-lists/compute.d.mts +10 -8
  300. package/dist/report/components/entity-lists/compute.d.ts +10 -8
  301. package/dist/report/components/entity-lists/content.cjs +31 -6
  302. package/dist/report/components/entity-lists/content.cjs.map +1 -1
  303. package/dist/report/components/entity-lists/index.cjs +9 -4
  304. package/dist/report/components/entity-lists/index.cjs.map +1 -1
  305. package/dist/report/components/entity-lists/index.d.cts +4 -7
  306. package/dist/report/components/entity-lists/index.d.mts +4 -7
  307. package/dist/report/components/entity-lists/index.d.ts +4 -7
  308. package/dist/report/components/summaries/compute.cjs +8 -1
  309. package/dist/report/components/summaries/compute.cjs.map +1 -1
  310. package/dist/report/components/summaries/compute.d.cts +9 -1
  311. package/dist/report/components/summaries/compute.d.mts +9 -1
  312. package/dist/report/components/summaries/compute.d.ts +9 -1
  313. package/dist/report/components/summaries/index.cjs +48 -4
  314. package/dist/report/components/summaries/index.cjs.map +1 -1
  315. package/dist/report/components/summaries/index.d.cts +7 -4
  316. package/dist/report/components/summaries/index.d.mts +7 -4
  317. package/dist/report/components/summaries/index.d.ts +7 -4
  318. package/dist/report/definition/cell.cjs +3 -0
  319. package/dist/report/definition/cell.cjs.map +1 -1
  320. package/dist/report/definition/cell.d.cts +2 -0
  321. package/dist/report/definition/cell.d.mts +2 -0
  322. package/dist/report/definition/cell.d.ts +2 -0
  323. package/dist/report/definition/primitives/chart.cjs +8 -5
  324. package/dist/report/definition/primitives/chart.cjs.map +1 -1
  325. package/dist/report/definition/primitives/points-dataset.cjs +1 -0
  326. package/dist/report/definition/primitives/points-dataset.cjs.map +1 -1
  327. package/dist/report/definition/primitives.cjs +15 -2
  328. package/dist/report/definition/primitives.cjs.map +1 -1
  329. package/dist/report/definition/report.cjs +27 -3
  330. package/dist/report/definition/report.cjs.map +1 -1
  331. package/dist/report/definition/report.d.cts +8 -0
  332. package/dist/report/definition/report.d.mts +8 -0
  333. package/dist/report/definition/report.d.ts +8 -0
  334. package/dist/report/execution/machine.cjs +30 -14
  335. package/dist/report/execution/machine.cjs.map +1 -1
  336. package/dist/report/execution/machine.d.cts +20 -10
  337. package/dist/report/execution/machine.d.mts +20 -10
  338. package/dist/report/execution/machine.d.ts +20 -10
  339. package/dist/report/execution/machine.js +6 -6
  340. package/dist/report/host/execute.cjs +25 -16
  341. package/dist/report/host/execute.cjs.map +1 -1
  342. package/dist/report/host/execute.d.cts +4 -0
  343. package/dist/report/host/execute.d.mts +4 -0
  344. package/dist/report/host/execute.d.ts +4 -0
  345. package/dist/report/host/from-record.cjs +22 -5
  346. package/dist/report/host/from-record.cjs.map +1 -1
  347. package/dist/report/host/machine.cjs +53 -11
  348. package/dist/report/host/machine.cjs.map +1 -1
  349. package/dist/report/host/site-runtime.cjs +9 -8
  350. package/dist/report/host/site-runtime.cjs.map +1 -1
  351. package/dist/report/host/site-runtime.d.cts +1 -1
  352. package/dist/report/host/site-runtime.d.mts +1 -1
  353. package/dist/report/host/site-runtime.d.ts +1 -1
  354. package/dist/report/host/static.cjs +56 -9
  355. package/dist/report/host/static.cjs.map +1 -1
  356. package/dist/report/index.cjs.map +1 -1
  357. package/dist/report/index.d.cts +1 -1
  358. package/dist/report/index.d.mts +1 -1
  359. package/dist/report/index.d.ts +1 -1
  360. package/dist/report/model/dataset.cjs +7 -2
  361. package/dist/report/model/dataset.cjs.map +1 -1
  362. package/dist/report/model/locale.cjs +2 -0
  363. package/dist/report/model/locale.cjs.map +1 -1
  364. package/dist/report/model/locale.d.cts +1 -0
  365. package/dist/report/model/locale.d.mts +1 -0
  366. package/dist/report/model/locale.d.ts +1 -0
  367. package/dist/report/model/metrics.cjs +3 -1
  368. package/dist/report/model/metrics.cjs.map +1 -1
  369. package/dist/report/model/pricing.cjs +16 -11
  370. package/dist/report/model/pricing.cjs.map +1 -1
  371. package/dist/report/react/styles.css +53 -29
  372. package/dist/runner/adoption.cjs +1 -0
  373. package/dist/runner/adoption.cjs.map +1 -1
  374. package/dist/runner/attempt.cjs +44 -5
  375. package/dist/runner/attempt.cjs.map +1 -1
  376. package/dist/runner/attempt.d.cts +13 -1
  377. package/dist/runner/attempt.d.mts +13 -1
  378. package/dist/runner/attempt.d.ts +13 -1
  379. package/dist/runner/config-identity.cjs +10 -2
  380. package/dist/runner/config-identity.cjs.map +1 -1
  381. package/dist/runner/config-identity.d.cts +4 -2
  382. package/dist/runner/config-identity.d.mts +4 -2
  383. package/dist/runner/config-identity.d.ts +4 -2
  384. package/dist/runner/feedback/human.cjs +298 -59
  385. package/dist/runner/feedback/human.cjs.map +1 -1
  386. package/dist/runner/feedback/json.cjs +14 -6
  387. package/dist/runner/feedback/json.cjs.map +1 -1
  388. package/dist/runner/feedback/json.d.cts +3 -2
  389. package/dist/runner/feedback/json.d.mts +3 -2
  390. package/dist/runner/feedback/json.d.ts +3 -2
  391. package/dist/runner/feedback/reducer.cjs +2 -0
  392. package/dist/runner/feedback/reducer.cjs.map +1 -1
  393. package/dist/runner/judge-config.cjs +1 -1
  394. package/dist/runner/judge-config.cjs.map +1 -1
  395. package/dist/runner/ledger.cjs +124 -12
  396. package/dist/runner/ledger.cjs.map +1 -1
  397. package/dist/runner/project-current.cjs +13 -5
  398. package/dist/runner/project-current.cjs.map +1 -1
  399. package/dist/runner/run.cjs +564 -256
  400. package/dist/runner/run.cjs.map +1 -1
  401. package/dist/runner/sandbox-pool.cjs +161 -30
  402. package/dist/runner/sandbox-pool.cjs.map +1 -1
  403. package/dist/runner/sandbox-pool.d.cts +34 -2
  404. package/dist/runner/sandbox-pool.d.mts +34 -2
  405. package/dist/runner/sandbox-pool.d.ts +34 -2
  406. package/dist/runner/shared-state-lease.cjs +803 -0
  407. package/dist/runner/shared-state-lease.cjs.map +1 -0
  408. package/dist/runner/shared-state-lease.d.cts +121 -0
  409. package/dist/runner/shared-state-lease.d.mts +121 -0
  410. package/dist/runner/shared-state-lease.d.ts +121 -0
  411. package/dist/runner/shared-state-lease.js +24 -0
  412. package/dist/runner/shared-state-lease.js.map +1 -0
  413. package/dist/runner/teardown-registry.cjs +97 -34
  414. package/dist/runner/teardown-registry.cjs.map +1 -1
  415. package/dist/runner/teardown-registry.d.cts +27 -1
  416. package/dist/runner/teardown-registry.d.mts +27 -1
  417. package/dist/runner/teardown-registry.d.ts +27 -1
  418. package/dist/runner/teardown-registry.js +20 -16
  419. package/dist/runner/types.cjs.map +1 -1
  420. package/dist/runner/types.d.cts +31 -5
  421. package/dist/runner/types.d.mts +31 -5
  422. package/dist/runner/types.d.ts +31 -5
  423. package/dist/sample/analysis.cjs +249 -459
  424. package/dist/sample/analysis.cjs.map +1 -1
  425. package/dist/sample/capability.cjs +138 -7
  426. package/dist/sample/capability.cjs.map +1 -1
  427. package/dist/sample/capability.d.cts +3 -1
  428. package/dist/sample/capability.d.mts +3 -1
  429. package/dist/sample/capability.d.ts +3 -1
  430. package/dist/sample/capability.js +8 -6
  431. package/dist/sandbox/docker-agent-image.cjs +5 -1
  432. package/dist/sandbox/docker-agent-image.cjs.map +1 -1
  433. package/dist/sandbox/docker-agent-image.d.cts +2 -0
  434. package/dist/sandbox/docker-agent-image.d.mts +2 -0
  435. package/dist/sandbox/docker-agent-image.d.ts +2 -0
  436. package/dist/sandbox/docker-agent-image.js +14 -10
  437. package/dist/sandbox/docker-profile/schema.cjs +283 -534
  438. package/dist/sandbox/docker-profile/schema.cjs.map +1 -1
  439. package/dist/sandbox/docker-profile/schema.d.cts +10 -27
  440. package/dist/sandbox/docker-profile/schema.d.mts +10 -27
  441. package/dist/sandbox/docker-profile/schema.d.ts +10 -27
  442. package/dist/sandbox/e2b-agent-template.cjs +5 -2
  443. package/dist/sandbox/e2b-agent-template.cjs.map +1 -1
  444. package/dist/sandbox/index.cjs +4 -2
  445. package/dist/sandbox/index.cjs.map +1 -1
  446. package/dist/sandbox/index.d.cts +1 -1
  447. package/dist/sandbox/index.d.mts +1 -1
  448. package/dist/sandbox/index.d.ts +1 -1
  449. package/dist/sandbox/index.js +120 -116
  450. package/dist/sandbox/index.mjs +120 -116
  451. package/dist/sandbox/keep-registry.cjs +28 -66
  452. package/dist/sandbox/keep-registry.cjs.map +1 -1
  453. package/dist/sandbox/types.cjs.map +1 -1
  454. package/dist/sandbox/types.d.cts +1 -1
  455. package/dist/sandbox/types.d.mts +1 -1
  456. package/dist/sandbox/types.d.ts +1 -1
  457. package/dist/shared/aggregate.cjs +16 -6
  458. package/dist/shared/aggregate.cjs.map +1 -1
  459. package/dist/shared/aggregate.d.cts +12 -4
  460. package/dist/shared/aggregate.d.mts +12 -4
  461. package/dist/shared/aggregate.d.ts +12 -4
  462. package/dist/shared/turn-label.cjs +20 -2
  463. package/dist/shared/turn-label.cjs.map +1 -1
  464. package/dist/shared/turn-label.d.cts +2 -0
  465. package/dist/shared/turn-label.d.mts +2 -0
  466. package/dist/shared/turn-label.d.ts +2 -0
  467. package/dist/shared/turn-label.js +4 -2
  468. package/dist/vendor/remark/remark-gfm.cjs +7 -7
  469. package/dist/vendor/remark/remark-gfm.cjs.map +1 -1
  470. package/dist/vendor/remark/remark-parse.cjs +12 -12
  471. package/dist/vendor/remark/remark-parse.cjs.map +1 -1
  472. package/dist/vendor/remark/remark.cjs +13 -13
  473. package/dist/vendor/remark/remark.cjs.map +1 -1
  474. package/dist/view/server.cjs +6 -0
  475. package/dist/view/server.cjs.map +1 -1
  476. package/docs-site/images/hitl-handshake-zh.svg +3 -3
  477. package/docs-site/zh/examples/ai-agent-application.mdx +1 -1
  478. package/docs-site/zh/examples/coding-agent-extensions.mdx +1 -1
  479. package/docs-site/zh/examples/integrations/ai-sdk-v7.mdx +4 -3
  480. package/docs-site/zh/examples/integrations/claude-sdk.mdx +3 -3
  481. package/docs-site/zh/examples/integrations/codex-sdk.mdx +5 -5
  482. package/docs-site/zh/examples/integrations/langgraph.mdx +4 -4
  483. package/docs-site/zh/examples/integrations/pi-sdk.mdx +5 -5
  484. package/docs-site/zh/explanation/adapter.mdx +5 -5
  485. package/docs-site/zh/explanation/assert.mdx +7 -7
  486. package/docs-site/zh/explanation/drive.mdx +4 -2
  487. package/docs-site/zh/explanation/evals.mdx +10 -8
  488. package/docs-site/zh/explanation/experiment.mdx +2 -2
  489. package/docs-site/zh/explanation/hitl.mdx +9 -9
  490. package/docs-site/zh/explanation/judge.mdx +5 -5
  491. package/docs-site/zh/explanation/overview.mdx +3 -3
  492. package/docs-site/zh/explanation/runner.mdx +1 -1
  493. package/docs-site/zh/index.mdx +3 -3
  494. package/docs-site/zh/reference/builtin-agents.mdx +13 -13
  495. package/docs-site/zh/reference/capabilities.mdx +1 -1
  496. package/docs-site/zh/reference/cli.mdx +18 -12
  497. package/docs-site/zh/reference/define-agent.mdx +130 -5
  498. package/docs-site/zh/reference/define-config.mdx +2 -2
  499. package/docs-site/zh/reference/define-eval.mdx +4 -4
  500. package/docs-site/zh/reference/events.mdx +11 -11
  501. package/docs-site/zh/reference/official-adapters.mdx +6 -6
  502. package/docs-site/zh/reference/results-data.mdx +6 -0
  503. package/docs-site/zh/troubleshooting/debugging.mdx +1 -1
  504. package/docs-site/zh/troubleshooting/recover-after-kill.mdx +37 -5
  505. package/docs-site/zh/tutorials/accept-results.mdx +72 -0
  506. package/docs-site/zh/tutorials/agent-onboarding.mdx +6 -6
  507. package/docs-site/zh/tutorials/authoring.mdx +9 -13
  508. package/docs-site/zh/tutorials/ci-integration.mdx +6 -6
  509. package/docs-site/zh/tutorials/compare-runs.mdx +61 -0
  510. package/docs-site/zh/tutorials/concurrency.mdx +13 -12
  511. package/docs-site/zh/tutorials/configuration.mdx +4 -6
  512. package/docs-site/zh/tutorials/connect-your-agent.mdx +1 -1
  513. package/docs-site/zh/tutorials/control-run-cost.mdx +58 -0
  514. package/docs-site/zh/tutorials/criteria-files.mdx +2 -2
  515. package/docs-site/zh/tutorials/custom-reports.mdx +2 -2
  516. package/docs-site/zh/tutorials/debug-lifecycle-plan.mdx +46 -0
  517. package/docs-site/zh/tutorials/docker-in-docker.mdx +52 -43
  518. package/docs-site/zh/tutorials/eval-groups.mdx +6 -6
  519. package/docs-site/zh/tutorials/evaluation-kinds.mdx +3 -3
  520. package/docs-site/zh/tutorials/experiments.mdx +2 -3
  521. package/docs-site/zh/tutorials/handle-execution-failures.mdx +18 -10
  522. package/docs-site/zh/tutorials/install-custom-sandbox-agent.mdx +16 -8
  523. package/docs-site/zh/tutorials/nixos-managed-dind.mdx +160 -0
  524. package/docs-site/zh/tutorials/plugins.mdx +14 -0
  525. package/docs-site/zh/tutorials/rerun-and-cache.mdx +4 -2
  526. package/docs-site/zh/tutorials/sandbox-agent.mdx +17 -11
  527. package/docs-site/zh/tutorials/sandbox-providers.mdx +17 -13
  528. package/docs-site/zh/tutorials/sandbox-reuse.mdx +12 -19
  529. package/docs-site/zh/tutorials/select-and-preview.mdx +65 -0
  530. package/docs-site/zh/tutorials/verify-judge.mdx +78 -0
  531. package/docs-site/zh/tutorials/viewing-results.mdx +38 -1
  532. package/docs-site/zh/tutorials/write-experiment.mdx +7 -5
  533. package/docs-site/zh/tutorials/write-send.mdx +9 -8
  534. package/package.json +9 -5
  535. package/dist/report/built-in/overview.cjs +0 -44
  536. package/dist/report/built-in/overview.cjs.map +0 -1
  537. package/dist/report/built-in/overview.d.cts +0 -6
  538. package/dist/report/built-in/overview.d.mts +0 -6
  539. package/dist/report/built-in/overview.d.ts +0 -6
  540. package/dist/report/built-in/overview.js +0 -9
  541. package/dist/report/built-in/overview.js.map +0 -1
  542. package/dist/runner/gate-lease.cjs +0 -283
  543. package/dist/runner/gate-lease.cjs.map +0 -1
  544. package/dist/runner/gate-lease.d.cts +0 -62
  545. package/dist/runner/gate-lease.d.mts +0 -62
  546. package/dist/runner/gate-lease.d.ts +0 -62
  547. package/dist/runner/gate-lease.js +0 -22
  548. package/dist/runner/gate-lease.js.map +0 -1
package/dist/sandbox/docker-profile/schema.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AA+QA,wGAEC;AAiFD,wEAEC;AA8UD,sEA0CC;AAGD,oEAGC;AAED,gEAQC;AAOD,oEAiBC;AApwBD,mCAAgC;AAChC,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA2E;AAC9D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,6BAA6B,GAAG,+CAAuC,CAAC;AACxE,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW;IACX,YAAY;IACZ,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,eAAe;IACf,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,MAAM;CACT,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7C,MAAM,SAAS,GAAM,CAAC,CAAC;AACvB,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAwHD,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC;AACD,SAAS,IAAI,CAAC,IAAsD,EAAE,OAAe,EAAE,IAAa;IAChG,MAAM,IAAA,8BAAkB,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;AACzF,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAChB,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,yBAAyB,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,KAAyC,EAAE,OAA0B,EAAE,IAAY;IACjG,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,IAAI,WAAW,kDAAkD,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IACtJ,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,6BAA6B,EAAE,IAAI,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3B,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAA,sBAAU,EAAC,MAAM,CAAC,EAAE,CAAC;QACtB,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,2BAA2B,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,SAAS,sBAAsB,CAAC,KAAc,EAAE,IAAY;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,sCAAsC,EAAE,IAAI,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,kCAAkC,EAAE,IAAI,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,mCAAmC,EAAE,IAAI,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,QAAQ,CAAC,KAAc,EAAE,IAAY;IAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;QAC/C,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;KACrE,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE;oBACD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;oBACnC,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;iBACjD;gBACD,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,yEAAyE;AACzE,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE;gBACV,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI;gBACzC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO;aAClD;YACD,aAAa,EAAE;gBACX,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI;gBAC1C,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO;gBAChD,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ;aACrD;SACJ;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACzE,UAAU,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS;gBAC/C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa;gBACvD,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU;aACpD;YACD,MAAM,EAAE;gBACJ,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;gBACnD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACrD,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACvD;SACJ;QACD,QAAQ,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;YACzC,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,eAAe;YACjD,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa;YAC7C,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;YACrC,SAAS,EAAE;gBACP,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;gBACrC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,WAAW;gBACnD,eAAe,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,eAAe;gBAC3D,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI;aACxC;SACJ;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE;oBACD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;oBACrC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;iBACnD;gBACD,MAAM,EAAE;oBACJ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACxC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACtE,6BAA6B,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBAC1F,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACvD,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACxC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACtE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBACpD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACxD,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAChE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACzC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,uEAAuE;AACvE,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;YAC5C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC;YAC5C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACjE,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;YAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;YAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;YAC5B,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,kBAAkB,CAAC,KAAc,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO,KAAK,6CAAqC,EAAE,CAAC;QAC3D,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,oBAAoB,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,IAAI,MAAM,CAAC;IAC9B,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1C,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC1B,IAAI,CAAC,uCAAuC,EAAE,GAAG,OAAO,0BAA0B,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;IAC3G,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,uCAAuC,EAAE,GAAG,OAAO,oCAAoC,EAAE,GAAG,OAAO,UAAU,CAAC,CAAC;IACxH,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,OAAO,YAAY,KAAK,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,uCAAuC,EAAE,GAAG,OAAO,YAAY,KAAK,oEAAoE,EAAE,GAAG,OAAO,YAAY,KAAK,GAAG,CAAC,CAAC;QACnL,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE;QACb,MAAM;QACN,kBAAkB;QAClB,qBAAqB;QACrB,+BAA+B;QAC/B,WAAW;QACX,MAAM;QACN,qBAAqB;QACrB,YAAY;QACZ,cAAc;QACd,kBAAkB;QAClB,KAAK;KACR,EAAE,UAAU,CAAC,CAAC;IACf,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QACjC,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,8BAA8B,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;IACrH,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC/E,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;QACjF,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,4CAA4C,EAAE,GAAG,UAAU,mBAAmB,CAAC,CAAC;IAC/I,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,mCAAmC,EAAE,GAAG,UAAU,sBAAsB,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,MAAM,CAAC,6BAA6B,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,6CAA6C,EAAE,GAAG,UAAU,gCAAgC,CAAC,CAAC;IAC7J,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;QACxG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5F,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,gDAAgD,EAAE,GAAG,UAAU,YAAY,CAAC,CAAC;IAC5I,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,0BAA0B,EAAE,GAAG,UAAU,OAAO,CAAC,CAAC;IACjH,CAAC;IACD,IAAI,MAAM,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,mCAAmC,EAAE,GAAG,UAAU,sBAAsB,CAAC,CAAC;IACzI,CAAC;IACD,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAC/B,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,4BAA4B,EAAE,GAAG,UAAU,aAAa,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,8BAA8B,EAAE,GAAG,UAAU,eAAe,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,gCAAgC,EAAE,GAAG,UAAU,mBAAmB,CAAC,CAAC;IACnI,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,oBAAoB,EAAE,GAAG,UAAU,MAAM,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,6CAAqC;QAC9C,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;QACjF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,IAAI,EAAE,cAAc;YACpB,gBAAgB,EAAE,yBAAyB;YAC3C,mBAAmB,EAAE,IAAI;YACzB,6BAA6B,EAAE,IAAI;YACnC,SAAS,EAAE,yCAAiC;YAC5C,IAAI,EAAE,UAAU;YAChB,mBAAmB,EAAE,IAAI;YACzB,UAAU,EAAE,MAAM;YAClB,YAAY,EAAE,MAAM;YACpB,gBAAgB,EAAE,IAAI;YACtB,GAAG,EAAE,KAAK;SACb,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC7C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE;QACb,cAAc;QACd,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,cAAc;QACd,SAAS;KACZ,EAAE,IAAI,CAAC,CAAC;IACT,IAAI,MAAM,CAAC,YAAY,KAAK,KAAK;QAC7B,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,6BAA6B,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAChH,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK;QAClC,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,kCAAkC,EAAE,GAAG,IAAI,oBAAoB,CAAC,CAAC;IAC1H,IAAI,MAAM,CAAC,oBAAoB,KAAK,KAAK;QACrC,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,qCAAqC,EAAE,GAAG,IAAI,uBAAuB,CAAC,CAAC;IAChI,IAAI,MAAM,CAAC,qBAAqB,KAAK,iBAAiB,EAAE,CAAC;QACrD,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,kDAAkD,EAAE,GAAG,IAAI,wBAAwB,CAAC,CAAC;IAC9I,CAAC;IACD,IAAI,MAAM,CAAC,YAAY,KAAK,qBAAqB,EAAE,CAAC;QAChD,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,6CAA6C,EAAE,GAAG,IAAI,eAAe,CAAC,CAAC;IAChI,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,YAAY,EAAE,KAAK;QACnB,iBAAiB,EAAE,KAAK;QACxB,oBAAoB,EAAE,KAAK;QAC3B,qBAAqB,EAAE,iBAAiB;QACxC,YAAY,EAAE,qBAAqB;QACnC,OAAO,EAAE,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,UAAU,CAAC;KACjE,CAAC,CAAC;AACP,CAAC;AACD,SAAS,cAAc,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,mBAAmB,CAAC;IACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,qBAAqB,EAAE,cAAc,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QACtB,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,sBAAsB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACjG,MAAM,WAAW,GAAG,iCAAiC,CAAC;IACtD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC5D,QAAQ,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,QAAQ,KAAK,oCAAoC,EAAE,CAAC;QAC5D,IAAI,CAAC,uCAAuC,EAAE,GAAG,WAAW,0BAA0B,EAAE,GAAG,WAAW,WAAW,CAAC,CAAC;IACvH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM;QACZ,mBAAmB,EAAE,cAAc,CAAC,MAAM,CAAC,mBAAmB,EAAE,GAAG,IAAI,sBAAsB,CAAC;QAC9F,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,gCAAgC,CAAC;QAC7E,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,WAAW,OAAO,CAAC;YACvD,OAAO,EAAE,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,WAAW,UAAU,CAAC;YAC1E,QAAQ,EAAE,oCAAoC;SACjD,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,KAAc;IAChC,MAAM,IAAI,GAAG,iBAAiB,CAAC;IAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IACrF,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,MAAM,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QAC1E,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,sBAAsB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,IAAI,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,GAAG,IAAI,aAAa,CAAC;IAC5C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC/D,QAAQ,CAAC,UAAU,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/F,MAAM,UAAU,GAAG,GAAG,IAAI,SAAS,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACnD,QAAQ,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,CAAC,EAAE,UAAU,CAAC,CAAC;IACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACrE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QAC5G,IAAI,CAAC,uCAAuC,EAAE,GAAG,UAAU,gDAAgD,EAAE,GAAG,UAAU,cAAc,CAAC,CAAC;IAC9I,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,eAAe,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,EAAE,GAAG,IAAI,kBAAkB,CAAC;QAClF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACjB,GAAG,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,MAAM,CAAC;YAC1D,GAAG,EAAE,sBAAsB,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,SAAS,MAAM,CAAC;SAC7D,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,QAAQ,EAAE,cAAc,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,cAAc,WAAW,CAAC;YAC3E,SAAS,EAAE,YAAY,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,cAAc,YAAY,CAAC;YAC5E,aAAa,EAAE,YAAY,CAAC,UAAU,CAAC,aAAa,EAAE,GAAG,cAAc,gBAAgB,CAAC;YACxF,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC,UAAU,EAAE,GAAG,cAAc,aAAa,CAAC;SACzF,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,UAAU,gBAAgB,CAAC;YAChF,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,UAAU,iBAAiB,CAAC;YACrF,WAAW,EAAE,mBAAmB;SACnC,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACrC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;IACtH,MAAM,aAAa,GAAG,GAAG,IAAI,YAAY,CAAC;IAC1C,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IAC5D,QAAQ,CAAC,SAAS,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;IACvF,IAAI,MAAM,CAAC,eAAe,KAAK,CAAC;QAC5B,IAAI,CAAC,uCAAuC,EAAE,GAAG,IAAI,4BAA4B,EAAE,GAAG,IAAI,kBAAkB,CAAC,CAAC;IAClH,IAAI,SAAS,CAAC,eAAe,KAAK,CAAC;QAC/B,IAAI,CAAC,uCAAuC,EAAE,GAAG,aAAa,4BAA4B,EAAE,GAAG,aAAa,kBAAkB,CAAC,CAAC;IACpI,MAAM,MAAM,GAAG;QACX,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;QACjD,WAAW,EAAE,mBAAmB,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,IAAI,cAAc,CAAC;QAC3E,eAAe,EAAE,SAAS;QAC1B,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,OAAO,CAAC;QACtD,aAAa,EAAE,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,IAAI,gBAAgB,CAAC;QACjF,SAAS,EAAE,mBAAmB,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC;QACrE,SAAS,EAAE;YACP,IAAI,EAAE,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,aAAa,OAAO,CAAC;YAC7D,WAAW,EAAE,mBAAmB,CAAC,SAAS,CAAC,WAAW,EAAE,GAAG,aAAa,cAAc,CAAC;YACvF,eAAe,EAAE,SAAS;YAC1B,IAAI,EAAE,mBAAmB,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,aAAa,OAAO,CAAC;SACrE;KACJ,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAClI,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI;YACJ,OAAO,EAAE,kGAAkG;SAC9G,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;KACpD,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,IAAI,EAAE,MAAM;YACZ,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClB,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;gBACnD,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACrD,WAAW,EAAE,mBAAmB;aACnC,CAAC;SACL,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW;YACzC,eAAe,EAAE,CAAC;YAClB,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,IAAI;YAC3B,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa;YAC7C,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS;YACrC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SAC9D,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI;oBACrC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrE,CAAC;gBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACxC,gBAAgB,EAAE,yBAAyB;oBAC3C,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACtE,6BAA6B,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBAC1F,SAAS,EAAE,yCAAiC;oBAC5C,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACxC,mBAAmB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACtE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBACpD,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACxD,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAChE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACzC,CAAC;aACL,CAAC;SACL,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,oDAAoD;AACpD,SAAgB,6BAA6B,CAAC,KAAc;IACxD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACxC,QAAQ,CAAC,IAAI,EAAE,CAAC,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;IACnJ,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,uCAAuC,EAAE,mCAAmC,EAAE,uBAAuB,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,+CAAuC,EAAE,CAAC;QACjE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,wCAAwC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,qBAAqB,IAAI,IAAI,CAAC,aAAa,KAAK,wBAAwB,EAAE,CAAC;QAClG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,mDAAmD;YACzD,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;SACvG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACtE,MAAM,sBAAsB,GAAG,cAAc,CAAC,IAAI,CAAC,sBAAsB,EAAE,gCAAgC,CAAC,CAAC;IAC7G,MAAM,OAAO,GAAG,aAAa,CAAC;QAC1B,aAAa,EAAE,CAAC;QAChB,SAAS;QACT,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,sBAAsB;QACtB,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,CAAC;QACzC,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;QACnC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC;KACrD,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACjF,IAAI,sBAAsB,KAAK,gBAAgB,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,gBAAgB,EAAE;YACnH,OAAO,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,sBAAsB,EAAE;SAC1E,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACY,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAC5D,QAAA,8BAA8B,GAAG,6BAA6B,CAAC;AAC5E,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,MAAM,sBAAsB,GAAG,8CAA8C,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,6BAA6B,CAAC,EAAE,GAAG,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;AAC/E,CAAC;AACY,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,uEAAuE;AAC1D,QAAA,8BAA8B,GAAG,eAAM,CAAC,OAAO,CAAC,0BAA0B,EAAE;IACrF,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,sDAAsD;CACtE,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI;YAC9B,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,WAAW;YAC5C,eAAe,EAAE,CAAC;YAClB,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI;YAC9B,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,aAAa;YAChD,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,SAAS;YACxC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Schema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError, } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SCHEMA_VERSION = DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n string,\n ...string[]\n] = Object.freeze([\n \"0.0.0.0/8\",\n \"10.0.0.0/8\",\n \"100.64.0.0/10\",\n \"127.0.0.0/8\",\n \"169.254.0.0/16\",\n \"172.16.0.0/12\",\n \"192.0.0.0/24\",\n \"192.0.2.0/24\",\n \"192.168.0.0/16\",\n \"198.18.0.0/15\",\n \"198.51.100.0/24\",\n \"203.0.113.0/24\",\n \"224.0.0.0/4\",\n \"240.0.0.0/4\",\n \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n \"dns\",\n \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n \"cpu\",\n \"memory\",\n \"pids\"\n] = Object.freeze([\"cpu\", \"memory\", \"pids\"]);\nconst ZERO_SWAP: 0 = 0;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n string,\n ...string[]\n] {\n const [first, ...rest] = values;\n if (first === undefined)\n throw new Error(\"expected a non-empty string tuple\");\n return Object.freeze([first, ...rest]);\n}\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"managed-vm-rootless/v1\";\nexport interface DockerProfileUnixEndpoint {\n readonly path: string;\n readonly peerUid: number;\n}\n/** 可由 descriptor 直接声明、并由宿主 attestation 重新核对的 outer 网络策略。 */\nexport interface DockerProfileNetworkPolicy {\n readonly version: typeof DOCKER_PROFILE_NETWORK_POLICY_VERSION;\n readonly dns: {\n readonly mode: \"explicit\";\n readonly servers: readonly [\n string,\n ...string[]\n ];\n };\n readonly egress: {\n readonly mode: \"rootless-nat\";\n readonly allowedProtocols: readonly [\n \"dns\",\n \"https\"\n ];\n readonly denyPrivateNetworks: true;\n readonly denySiblingSyntheticEndpoints: true;\n /** rootlesskit/slirp4netns 与宿主私网/loopback 的 fail-closed deny 集合。 */\n readonly denyCidrs: readonly [\n string,\n ...string[]\n ];\n readonly ipv6: \"disabled\";\n readonly disableHostLoopback: true;\n readonly portDriver: \"none\";\n readonly daemonBridge: \"none\";\n readonly exclusiveNetwork: true;\n readonly icc: false;\n };\n}\nexport interface DockerExecutionProfileV1 {\n readonly schemaVersion: 1;\n readonly profileId: string;\n readonly securityLevel: DockerExecutionProfileSecurityLevel;\n readonly semanticPolicyRevision: string;\n readonly transport: {\n readonly kind: \"unix\";\n readonly hostMachineIdentity: string;\n readonly dockerSocket: DockerProfileUnixEndpoint;\n readonly controlSocket: DockerProfileUnixEndpoint & {\n readonly protocol: \"niceeval-docker-profile-control/v1\";\n };\n };\n readonly backend: {\n readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n readonly machineIdentity: string;\n readonly owner: {\n readonly uid: number;\n readonly gid: number;\n };\n readonly filesystem: {\n readonly identity: string;\n readonly mountPath: string;\n readonly dockerRootDir: string;\n readonly limitBytes: number;\n };\n readonly cgroup: {\n readonly aggregatePath: string;\n readonly policyRevision: string;\n readonly controllers: readonly [\n \"cpu\",\n \"memory\",\n \"pids\"\n ];\n };\n };\n /** 已扣除宿主 daemon/build/watchdog/recovery headroom，可授予 Attempt 的容量。 */\n readonly capacity: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n readonly maxContainers: number;\n readonly maxBuilds: number;\n /** aggregate cgroup 硬上限，不是可授予 Attempt 的容量。 */\n readonly aggregate: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n };\n };\n readonly policy: {\n readonly hostLoopback: false;\n readonly tcpDockerEndpoint: false;\n readonly outerSocketInjection: false;\n readonly privilegedTranslation: \"rootless-userns\";\n readonly writableRoot: \"declared-tmpfs-only\";\n readonly network: DockerProfileNetworkPolicy;\n };\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\nexport interface DockerProfilePublicSummary {\n readonly schemaVersion: 1;\n readonly profileId: string;\n readonly securityLevel: DockerExecutionProfileSecurityLevel;\n readonly semanticPolicyRevision: string;\n readonly capacity: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n readonly maxContainers: number;\n readonly maxBuilds: number;\n readonly aggregate: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n };\n };\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nfunction isRecord(value: unknown): value is globalThis.Record<string, unknown> {\n if (value === null || typeof value !== \"object\" || Array.isArray(value))\n return false;\n const prototype = Object.getPrototypeOf(value);\n return prototype === Object.prototype || prototype === null;\n}\nfunction fail(code: Parameters<typeof dockerProfileError>[0][\"code\"], message: string, path?: string): never {\n throw dockerProfileError({ code, message, ...(path === undefined ? {} : { path }) });\n}\nfunction objectAt(value: unknown, path: string): globalThis.Record<string, unknown> {\n if (!isRecord(value))\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be a plain object`, path);\n return value;\n}\nfunction onlyKeys(value: globalThis.Record<string, unknown>, allowed: readonly string[], path: string): void {\n const known = new Set(allowed);\n const unsupported = Object.keys(value).find((key) => !known.has(key));\n if (unsupported !== undefined) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.${unsupported} is not supported by Docker execution profile v1`, `${path}.${unsupported}`);\n }\n}\nfunction requiredString(value: unknown, path: string): string {\n if (typeof value !== \"string\" || value.trim() === \"\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be a non-empty string`, path);\n }\n if (value.includes(\"\\u0000\")) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must not contain NUL`, path);\n }\n return value;\n}\nfunction absolutePath(value: unknown, path: string): string {\n const result = requiredString(value, path);\n if (!isAbsolute(result)) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be an absolute path`, path);\n }\n return result;\n}\nfunction nonNegativeSafeInteger(value: unknown, path: string): number {\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value < 0) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be a non-negative safe integer`, path);\n }\n return value;\n}\nfunction positiveSafeInteger(value: unknown, path: string): number {\n if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be a positive safe integer`, path);\n }\n return value;\n}\nfunction positiveFinite(value: unknown, path: string): number {\n if (typeof value !== \"number\" || !Number.isFinite(value) || value <= 0) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path} must be a positive finite number`, path);\n }\n return value;\n}\nfunction endpoint(value: unknown, path: string): DockerProfileUnixEndpoint {\n const record = objectAt(value, path);\n onlyKeys(record, [\"path\", \"peerUid\"], path);\n return Object.freeze({\n path: absolutePath(record.path, `${path}.path`),\n peerUid: nonNegativeSafeInteger(record.peerUid, `${path}.peerUid`),\n });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n return {\n schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n securityLevel: input.securityLevel,\n backend: {\n kind: input.backend.kind,\n cgroup: {\n policyRevision: input.backend.cgroup.policyRevision,\n controllers: [...input.backend.cgroup.controllers],\n },\n },\n policy: {\n hostLoopback: input.policy.hostLoopback,\n tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n outerSocketInjection: input.policy.outerSocketInjection,\n privilegedTranslation: input.policy.privilegedTranslation,\n writableRoot: input.policy.writableRoot,\n network: {\n version: input.policy.network.version,\n dns: {\n mode: input.policy.network.dns.mode,\n servers: [...input.policy.network.dns.servers],\n },\n egress: {\n mode: input.policy.network.egress.mode,\n allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n denyCidrs: [...input.policy.network.egress.denyCidrs],\n ipv6: input.policy.network.egress.ipv6,\n disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n portDriver: input.policy.network.egress.portDriver,\n daemonBridge: input.policy.network.egress.daemonBridge,\n exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n icc: input.policy.network.egress.icc,\n },\n },\n },\n };\n}\n/** 从受信 schema 字段重新计算语义 policy revision；profileId、alias、socket 与容量不参与。 */\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n return {\n schemaVersion: profile.schemaVersion,\n profileId: profile.profileId,\n securityLevel: profile.securityLevel,\n semanticPolicyRevision: profile.semanticPolicyRevision,\n transport: {\n kind: profile.transport.kind,\n hostMachineIdentity: profile.transport.hostMachineIdentity,\n dockerSocket: {\n path: profile.transport.dockerSocket.path,\n peerUid: profile.transport.dockerSocket.peerUid,\n },\n controlSocket: {\n path: profile.transport.controlSocket.path,\n peerUid: profile.transport.controlSocket.peerUid,\n protocol: profile.transport.controlSocket.protocol,\n },\n },\n backend: {\n kind: profile.backend.kind,\n machineIdentity: profile.backend.machineIdentity,\n owner: { uid: profile.backend.owner.uid, gid: profile.backend.owner.gid },\n filesystem: {\n identity: profile.backend.filesystem.identity,\n mountPath: profile.backend.filesystem.mountPath,\n dockerRootDir: profile.backend.filesystem.dockerRootDir,\n limitBytes: profile.backend.filesystem.limitBytes,\n },\n cgroup: {\n aggregatePath: profile.backend.cgroup.aggregatePath,\n policyRevision: profile.backend.cgroup.policyRevision,\n controllers: [...profile.backend.cgroup.controllers],\n },\n },\n capacity: {\n cpus: profile.capacity.cpus,\n memoryBytes: profile.capacity.memoryBytes,\n memorySwapBytes: profile.capacity.memorySwapBytes,\n pids: profile.capacity.pids,\n maxContainers: profile.capacity.maxContainers,\n maxBuilds: profile.capacity.maxBuilds,\n aggregate: {\n cpus: profile.capacity.aggregate.cpus,\n memoryBytes: profile.capacity.aggregate.memoryBytes,\n memorySwapBytes: profile.capacity.aggregate.memorySwapBytes,\n pids: profile.capacity.aggregate.pids,\n },\n },\n policy: {\n hostLoopback: profile.policy.hostLoopback,\n tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n outerSocketInjection: profile.policy.outerSocketInjection,\n privilegedTranslation: profile.policy.privilegedTranslation,\n writableRoot: profile.policy.writableRoot,\n network: {\n version: profile.policy.network.version,\n dns: {\n mode: profile.policy.network.dns.mode,\n servers: [...profile.policy.network.dns.servers],\n },\n egress: {\n mode: profile.policy.network.egress.mode,\n allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n denyPrivateNetworks: profile.policy.network.egress.denyPrivateNetworks,\n denySiblingSyntheticEndpoints: profile.policy.network.egress.denySiblingSyntheticEndpoints,\n denyCidrs: [...profile.policy.network.egress.denyCidrs],\n ipv6: profile.policy.network.egress.ipv6,\n disableHostLoopback: profile.policy.network.egress.disableHostLoopback,\n portDriver: profile.policy.network.egress.portDriver,\n daemonBridge: profile.policy.network.egress.daemonBridge,\n exclusiveNetwork: profile.policy.network.egress.exclusiveNetwork,\n icc: profile.policy.network.egress.icc,\n },\n },\n },\n };\n}\n/** 对规范化 descriptor 求稳定 canonical digest；返回值可直接作为 descriptor digest。 */\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n return `sha256:${digestOf(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nfunction isPublicDnsServer(value: string): boolean {\n const kind = isIP(value);\n if (kind === 4) {\n const octets = value.split(\".\").map(Number);\n const first = octets[0];\n const second = octets[1];\n const third = octets[2];\n if (first === undefined || second === undefined || third === undefined)\n return false;\n if (first === 0 || first === 10 || first === 127 || first >= 224)\n return false;\n if (first === 100 && second >= 64 && second <= 127)\n return false;\n if (first === 169 && second === 254)\n return false;\n if (first === 172 && second >= 16 && second <= 31)\n return false;\n if (first === 192 && second === 168)\n return false;\n if (first === 192 && second === 0 && third === 0)\n return false;\n if (first === 192 && second === 0 && third === 2)\n return false;\n if (first === 198 && (second === 18 || second === 19))\n return false;\n if (first === 198 && second === 51 && third === 100)\n return false;\n if (first === 203 && second === 0 && third === 113)\n return false;\n return true;\n }\n if (kind === 6) {\n const normalized = value.toLowerCase();\n if (normalized.startsWith(\"::ffff:\"))\n return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n return normalized !== \"::\" && normalized !== \"::1\" &&\n !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n !normalized.startsWith(\"ff\") &&\n !normalized.startsWith(\"2001:db8:\");\n }\n return false;\n}\nfunction parseNetworkPolicy(value: unknown, path: string): DockerProfileNetworkPolicy {\n const record = objectAt(value, path);\n onlyKeys(record, [\"version\", \"dns\", \"egress\"], path);\n if (record.version !== DOCKER_PROFILE_NETWORK_POLICY_VERSION) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.version must be 1`, `${path}.version`);\n }\n const dnsPath = `${path}.dns`;\n const dns = objectAt(record.dns, dnsPath);\n onlyKeys(dns, [\"mode\", \"servers\"], dnsPath);\n if (dns.mode !== \"explicit\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${dnsPath}.mode must be \"explicit\"`, `${dnsPath}.mode`);\n }\n if (!Array.isArray(dns.servers) || dns.servers.length === 0) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${dnsPath}.servers must be a non-empty array`, `${dnsPath}.servers`);\n }\n const servers = dns.servers.map((server, index) => {\n const parsed = requiredString(server, `${dnsPath}.servers[${index}]`);\n if (!isPublicDnsServer(parsed)) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${dnsPath}.servers[${index}] must be a public IP address, not a private or synthetic endpoint`, `${dnsPath}.servers[${index}]`);\n }\n return parsed;\n });\n const egressPath = `${path}.egress`;\n const egress = objectAt(record.egress, egressPath);\n onlyKeys(egress, [\n \"mode\",\n \"allowedProtocols\",\n \"denyPrivateNetworks\",\n \"denySiblingSyntheticEndpoints\",\n \"denyCidrs\",\n \"ipv6\",\n \"disableHostLoopback\",\n \"portDriver\",\n \"daemonBridge\",\n \"exclusiveNetwork\",\n \"icc\",\n ], egressPath);\n if (egress.mode !== \"rootless-nat\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.mode must be \"rootless-nat\"`, `${egressPath}.mode`);\n }\n if (!Array.isArray(egress.allowedProtocols) || egress.allowedProtocols.length !== 2 ||\n egress.allowedProtocols[0] !== \"dns\" || egress.allowedProtocols[1] !== \"https\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.allowedProtocols must be [\"dns\", \"https\"]`, `${egressPath}.allowedProtocols`);\n }\n if (egress.denyPrivateNetworks !== true) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.denyPrivateNetworks must be true`, `${egressPath}.denyPrivateNetworks`);\n }\n if (egress.denySiblingSyntheticEndpoints !== true) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.denySiblingSyntheticEndpoints must be true`, `${egressPath}.denySiblingSyntheticEndpoints`);\n }\n if (!Array.isArray(egress.denyCidrs) || egress.denyCidrs.length !== DOCKER_PROFILE_NETWORK_DENY_CIDRS.length ||\n egress.denyCidrs.some((cidr, index) => cidr !== DOCKER_PROFILE_NETWORK_DENY_CIDRS[index])) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.denyCidrs must be the v1 fail-closed CIDR set`, `${egressPath}.denyCidrs`);\n }\n if (egress.ipv6 !== \"disabled\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.ipv6 must be \"disabled\"`, `${egressPath}.ipv6`);\n }\n if (egress.disableHostLoopback !== true) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.disableHostLoopback must be true`, `${egressPath}.disableHostLoopback`);\n }\n if (egress.portDriver !== \"none\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.portDriver must be \"none\"`, `${egressPath}.portDriver`);\n }\n if (egress.daemonBridge !== \"none\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.daemonBridge must be \"none\"`, `${egressPath}.daemonBridge`);\n }\n if (egress.exclusiveNetwork !== true) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.exclusiveNetwork must be true`, `${egressPath}.exclusiveNetwork`);\n }\n if (egress.icc !== false) {\n fail(\"sandbox.docker-profile-schema-invalid\", `${egressPath}.icc must be false`, `${egressPath}.icc`);\n }\n return Object.freeze({\n version: DOCKER_PROFILE_NETWORK_POLICY_VERSION,\n dns: Object.freeze({ mode: \"explicit\", servers: frozenNonEmptyStrings(servers) }),\n egress: Object.freeze({\n mode: \"rootless-nat\",\n allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n denyPrivateNetworks: true,\n denySiblingSyntheticEndpoints: true,\n denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n ipv6: \"disabled\",\n disableHostLoopback: true,\n portDriver: \"none\",\n daemonBridge: \"none\",\n exclusiveNetwork: true,\n icc: false,\n }),\n });\n}\nfunction parsePolicy(value: unknown, path: string): DockerExecutionProfileV1[\"policy\"] {\n const record = objectAt(value, path);\n onlyKeys(record, [\n \"hostLoopback\",\n \"tcpDockerEndpoint\",\n \"outerSocketInjection\",\n \"privilegedTranslation\",\n \"writableRoot\",\n \"network\",\n ], path);\n if (record.hostLoopback !== false)\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.hostLoopback must be false`, `${path}.hostLoopback`);\n if (record.tcpDockerEndpoint !== false)\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.tcpDockerEndpoint must be false`, `${path}.tcpDockerEndpoint`);\n if (record.outerSocketInjection !== false)\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.outerSocketInjection must be false`, `${path}.outerSocketInjection`);\n if (record.privilegedTranslation !== \"rootless-userns\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.privilegedTranslation must be \"rootless-userns\"`, `${path}.privilegedTranslation`);\n }\n if (record.writableRoot !== \"declared-tmpfs-only\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.writableRoot must be \"declared-tmpfs-only\"`, `${path}.writableRoot`);\n }\n return Object.freeze({\n hostLoopback: false,\n tcpDockerEndpoint: false,\n outerSocketInjection: false,\n privilegedTranslation: \"rootless-userns\",\n writableRoot: \"declared-tmpfs-only\",\n network: parseNetworkPolicy(record.network, `${path}.network`),\n });\n}\nfunction parseTransport(value: unknown): DockerExecutionProfileV1[\"transport\"] {\n const path = \"profile.transport\";\n const record = objectAt(value, path);\n onlyKeys(record, [\"kind\", \"hostMachineIdentity\", \"dockerSocket\", \"controlSocket\"], path);\n if (record.kind !== \"unix\")\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.kind must be \"unix\"`, `${path}.kind`);\n const controlPath = \"profile.transport.controlSocket\";\n const control = objectAt(record.controlSocket, controlPath);\n onlyKeys(control, [\"path\", \"peerUid\", \"protocol\"], controlPath);\n if (control.protocol !== \"niceeval-docker-profile-control/v1\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${controlPath}.protocol is unsupported`, `${controlPath}.protocol`);\n }\n return Object.freeze({\n kind: \"unix\",\n hostMachineIdentity: requiredString(record.hostMachineIdentity, `${path}.hostMachineIdentity`),\n dockerSocket: endpoint(record.dockerSocket, \"profile.transport.dockerSocket\"),\n controlSocket: Object.freeze({\n path: absolutePath(control.path, `${controlPath}.path`),\n peerUid: nonNegativeSafeInteger(control.peerUid, `${controlPath}.peerUid`),\n protocol: \"niceeval-docker-profile-control/v1\",\n }),\n });\n}\nfunction parseBackend(value: unknown): DockerExecutionProfileV1[\"backend\"] {\n const path = \"profile.backend\";\n const record = objectAt(value, path);\n onlyKeys(record, [\"kind\", \"machineIdentity\", \"owner\", \"filesystem\", \"cgroup\"], path);\n if (record.kind !== \"local-systemd\" && record.kind !== \"dedicated-linux-vm\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.kind is unsupported`, `${path}.kind`);\n }\n const ownerPath = `${path}.owner`;\n const owner = objectAt(record.owner, ownerPath);\n onlyKeys(owner, [\"uid\", \"gid\"], ownerPath);\n const filesystemPath = `${path}.filesystem`;\n const filesystem = objectAt(record.filesystem, filesystemPath);\n onlyKeys(filesystem, [\"identity\", \"mountPath\", \"dockerRootDir\", \"limitBytes\"], filesystemPath);\n const cgroupPath = `${path}.cgroup`;\n const cgroup = objectAt(record.cgroup, cgroupPath);\n onlyKeys(cgroup, [\"aggregatePath\", \"policyRevision\", \"controllers\"], cgroupPath);\n if (!Array.isArray(cgroup.controllers) || cgroup.controllers.length !== 3 ||\n cgroup.controllers[0] !== \"cpu\" || cgroup.controllers[1] !== \"memory\" || cgroup.controllers[2] !== \"pids\") {\n fail(\"sandbox.docker-profile-schema-invalid\", `${cgroupPath}.controllers must be [\"cpu\", \"memory\", \"pids\"]`, `${cgroupPath}.controllers`);\n }\n return Object.freeze({\n kind: record.kind,\n machineIdentity: requiredString(record.machineIdentity, `${path}.machineIdentity`),\n owner: Object.freeze({\n uid: nonNegativeSafeInteger(owner.uid, `${ownerPath}.uid`),\n gid: nonNegativeSafeInteger(owner.gid, `${ownerPath}.gid`),\n }),\n filesystem: Object.freeze({\n identity: requiredString(filesystem.identity, `${filesystemPath}.identity`),\n mountPath: absolutePath(filesystem.mountPath, `${filesystemPath}.mountPath`),\n dockerRootDir: absolutePath(filesystem.dockerRootDir, `${filesystemPath}.dockerRootDir`),\n limitBytes: positiveSafeInteger(filesystem.limitBytes, `${filesystemPath}.limitBytes`),\n }),\n cgroup: Object.freeze({\n aggregatePath: absolutePath(cgroup.aggregatePath, `${cgroupPath}.aggregatePath`),\n policyRevision: requiredString(cgroup.policyRevision, `${cgroupPath}.policyRevision`),\n controllers: PROFILE_CONTROLLERS,\n }),\n });\n}\nfunction parseCapacity(value: unknown): DockerExecutionProfileV1[\"capacity\"] {\n const path = \"profile.capacity\";\n const record = objectAt(value, path);\n onlyKeys(record, [\"cpus\", \"memoryBytes\", \"memorySwapBytes\", \"pids\", \"maxContainers\", \"maxBuilds\", \"aggregate\"], path);\n const aggregatePath = `${path}.aggregate`;\n const aggregate = objectAt(record.aggregate, aggregatePath);\n onlyKeys(aggregate, [\"cpus\", \"memoryBytes\", \"memorySwapBytes\", \"pids\"], aggregatePath);\n if (record.memorySwapBytes !== 0)\n fail(\"sandbox.docker-profile-schema-invalid\", `${path}.memorySwapBytes must be 0`, `${path}.memorySwapBytes`);\n if (aggregate.memorySwapBytes !== 0)\n fail(\"sandbox.docker-profile-schema-invalid\", `${aggregatePath}.memorySwapBytes must be 0`, `${aggregatePath}.memorySwapBytes`);\n const parsed = {\n cpus: positiveFinite(record.cpus, `${path}.cpus`),\n memoryBytes: positiveSafeInteger(record.memoryBytes, `${path}.memoryBytes`),\n memorySwapBytes: ZERO_SWAP,\n pids: positiveSafeInteger(record.pids, `${path}.pids`),\n maxContainers: positiveSafeInteger(record.maxContainers, `${path}.maxContainers`),\n maxBuilds: positiveSafeInteger(record.maxBuilds, `${path}.maxBuilds`),\n aggregate: {\n cpus: positiveFinite(aggregate.cpus, `${aggregatePath}.cpus`),\n memoryBytes: positiveSafeInteger(aggregate.memoryBytes, `${aggregatePath}.memoryBytes`),\n memorySwapBytes: ZERO_SWAP,\n pids: positiveSafeInteger(aggregate.pids, `${aggregatePath}.pids`),\n },\n };\n if (parsed.aggregate.cpus < parsed.cpus || parsed.aggregate.memoryBytes < parsed.memoryBytes || parsed.aggregate.pids < parsed.pids) {\n throw dockerProfileError({\n code: \"sandbox.docker-profile-capacity-invalid\",\n path,\n message: \"profile.capacity.aggregate must be at least as large as allocatable CPU, memory and PID capacity\",\n });\n }\n return Object.freeze({\n cpus: parsed.cpus,\n memoryBytes: parsed.memoryBytes,\n memorySwapBytes: parsed.memorySwapBytes,\n pids: parsed.pids,\n maxContainers: parsed.maxContainers,\n maxBuilds: parsed.maxBuilds,\n aggregate: Object.freeze({ ...parsed.aggregate }),\n });\n}\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n return Object.freeze({\n schemaVersion: 1,\n profileId: profile.profileId,\n securityLevel: profile.securityLevel,\n semanticPolicyRevision: profile.semanticPolicyRevision,\n transport: Object.freeze({\n kind: \"unix\",\n hostMachineIdentity: profile.transport.hostMachineIdentity,\n dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n }),\n backend: Object.freeze({\n kind: profile.backend.kind,\n machineIdentity: profile.backend.machineIdentity,\n owner: Object.freeze({ ...profile.backend.owner }),\n filesystem: Object.freeze({ ...profile.backend.filesystem }),\n cgroup: Object.freeze({\n aggregatePath: profile.backend.cgroup.aggregatePath,\n policyRevision: profile.backend.cgroup.policyRevision,\n controllers: PROFILE_CONTROLLERS,\n }),\n }),\n capacity: Object.freeze({\n cpus: profile.capacity.cpus,\n memoryBytes: profile.capacity.memoryBytes,\n memorySwapBytes: 0,\n pids: profile.capacity.pids,\n maxContainers: profile.capacity.maxContainers,\n maxBuilds: profile.capacity.maxBuilds,\n aggregate: Object.freeze({ ...profile.capacity.aggregate }),\n }),\n policy: Object.freeze({\n hostLoopback: profile.policy.hostLoopback,\n tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n outerSocketInjection: profile.policy.outerSocketInjection,\n privilegedTranslation: profile.policy.privilegedTranslation,\n writableRoot: profile.policy.writableRoot,\n network: Object.freeze({\n version: profile.policy.network.version,\n dns: Object.freeze({\n mode: profile.policy.network.dns.mode,\n servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n }),\n egress: Object.freeze({\n mode: profile.policy.network.egress.mode,\n allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n denyPrivateNetworks: profile.policy.network.egress.denyPrivateNetworks,\n denySiblingSyntheticEndpoints: profile.policy.network.egress.denySiblingSyntheticEndpoints,\n denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n ipv6: profile.policy.network.egress.ipv6,\n disableHostLoopback: profile.policy.network.egress.disableHostLoopback,\n portDriver: profile.policy.network.egress.portDriver,\n daemonBridge: profile.policy.network.egress.daemonBridge,\n exclusiveNetwork: profile.policy.network.egress.exclusiveNetwork,\n icc: profile.policy.network.egress.icc,\n }),\n }),\n }),\n });\n}\n/** 严格解析未知输入；不会执行 descriptor 中的 callback、命令或其它代码。 */\nexport function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1 {\n const root = objectAt(value, \"profile\");\n onlyKeys(root, [\"schemaVersion\", \"profileId\", \"securityLevel\", \"semanticPolicyRevision\", \"transport\", \"backend\", \"capacity\", \"policy\"], \"profile\");\n if (root.schemaVersion === undefined) {\n fail(\"sandbox.docker-profile-schema-invalid\", \"profile.schemaVersion is required\", \"profile.schemaVersion\");\n }\n if (root.schemaVersion !== DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION) {\n throw dockerProfileError({\n code: \"sandbox.docker-profile-unknown-version\",\n path: \"profile.schemaVersion\",\n message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n });\n }\n if (root.securityLevel !== \"managed-rootless/v1\" && root.securityLevel !== \"managed-vm-rootless/v1\") {\n throw dockerProfileError({\n code: \"sandbox.docker-profile-security-level-unsupported\",\n path: \"profile.securityLevel\",\n message: `Unsupported Docker execution profile security level ${JSON.stringify(root.securityLevel)}`,\n });\n }\n const profileId = requiredString(root.profileId, \"profile.profileId\");\n const semanticPolicyRevision = requiredString(root.semanticPolicyRevision, \"profile.semanticPolicyRevision\");\n const profile = freezeProfile({\n schemaVersion: 1,\n profileId,\n securityLevel: root.securityLevel,\n semanticPolicyRevision,\n transport: parseTransport(root.transport),\n backend: parseBackend(root.backend),\n capacity: parseCapacity(root.capacity),\n policy: parsePolicy(root.policy, \"profile.policy\"),\n });\n const expectedRevision = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n if (semanticPolicyRevision !== expectedRevision) {\n throw dockerProfileError({\n code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n path: \"profile.semanticPolicyRevision\",\n message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expectedRevision}`,\n details: { expected: expectedRevision, actual: semanticPolicyRevision },\n });\n }\n return profile;\n}\nexport const parseDockerExecutionProfile = parseDockerExecutionProfileV1;\nexport const decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;\nexport function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n const semanticPolicyRevision = dockerExecutionProfileSemanticPolicyRevisionOf(input);\n return parseDockerExecutionProfileV1({ ...input, semanticPolicyRevision });\n}\nexport const createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n try {\n parseDockerExecutionProfileV1(value);\n return true;\n }\n catch {\n return false;\n }\n}\n/** Effect Schema 只负责把该纯数据边界暴露给 Effect consumers；稳定业务错误由 parse 函数提供。 */\nexport const DockerExecutionProfileV1Schema = Schema.declare(isDockerExecutionProfileV1, {\n identifier: \"DockerExecutionProfileV1\",\n description: \"a callback-free NiceEval Docker execution profile v1\",\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n const normalized = parseDockerExecutionProfileV1(profile);\n return Object.freeze({\n schemaVersion: 1,\n profileId: normalized.profileId,\n securityLevel: normalized.securityLevel,\n semanticPolicyRevision: normalized.semanticPolicyRevision,\n capacity: Object.freeze({\n cpus: normalized.capacity.cpus,\n memoryBytes: normalized.capacity.memoryBytes,\n memorySwapBytes: 0,\n pids: normalized.capacity.pids,\n maxContainers: normalized.capacity.maxContainers,\n maxBuilds: normalized.capacity.maxBuilds,\n aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n }),\n });\n}\n"]}
1
+ {"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AAgXA,wGAEC;AA6CD,sEAeC;AAGD,oEAKC;AAED,gEAQC;AA2CD,wEAEC;AAED,oEAYC;AA3fD,mCAAqD;AACrD,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA0E;AAC7D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,6BAA6B,GAAG,+CAAuC,CAAC;AACxE,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAC3E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACjE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa;IACnE,aAAa,EAAE,MAAM;CACxB,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC,CAAC;AAyGH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,KAAc;IACtB,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAgB;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAM,CAAC,OAAO,CAAc,CAAC,KAAK,EAAwB,EAAE;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC,EAAE;IACC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,yCAAyC;CACzD,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;AACzJ,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;AACzM,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,sBAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACzJ,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC/M,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACvM,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;AAC9L,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,OAAO,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QACV,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,eAAe,GAAG,cAAc,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;IACzG,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,0DAA0D;CAC1E,CAAC,CAAC,CAAC;AACJ,MAAM,WAAW,GAAG,eAAM,CAAC,aAAa,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;IAC3I,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC5K,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC,yBAAyB,CAAC;IAC7C,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,WAAW,CAAC;IAC9B,OAAO,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;QACb,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,eAAM,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;IACF,MAAM,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,6BAA6B,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,GAAG,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;CACL,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC,2BAA2B,CAAC;IACjD,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;IACpE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,mBAAmB,CAAC,gCAAgC,CAAC;IAChE,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,cAAc,CAAC,4BAA4B,CAAC;QAClD,WAAW,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;QACrE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,mBAAmB,CAAC,4BAA4B,CAAC;KAC1D,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;IAC/D,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,kFAAkF;CAClG,CAAC,CAAC,CAAC;AACJ,mGAAmG;AACtF,QAAA,8BAA8B,GAAyD,WAAW,CAAC;IAC5G,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC5C,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;IAC9E,sBAAsB,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC7E,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,mBAAmB,EAAE,cAAc,CAAC,kCAAkC,CAAC;QACvE,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,WAAW,CAAC;YACvB,IAAI,EAAE,YAAY,CAAC,gCAAgC,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,CAAC;YAC9D,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;SACjE,CAAC;KACL,CAAC;IACF,OAAO,EAAE,WAAW,CAAC;QACjB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC;QAC3D,eAAe,EAAE,cAAc,CAAC,qCAAqC,CAAC;QACtE,KAAK,EAAE,WAAW,CAAC;YACf,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;YACpD,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;SACvD,CAAC;QACF,UAAU,EAAE,WAAW,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,iCAAiC,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,wBAAwB,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,UAAU,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;SACvE,CAAC;QACF,MAAM,EAAE,WAAW,CAAC;YAChB,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,cAAc,EAAE,cAAc,CAAC,mCAAmC,CAAC;YACnE,WAAW,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACrG,CAAC;KACL,CAAC;IACF,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,WAAW,CAAC;QAChB,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,iBAAiB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,oBAAoB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxD,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACnD,OAAO,EAAE,aAAa;KACzB,CAAC;CACL,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,+FAA+F;AAC/F,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,OAAO;QACV,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,OAAO,CAAC,SAAS;YACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,OAAO,CAAC,QAAQ;YACnB,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,GAAG,OAAO,CAAC,MAAM;YACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO;gBACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACf,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;oBAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrE,CAAC;gBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,yBAAyB;oBAC3C,SAAS,EAAE,yCAAiC;iBAC/C,CAAC;aACL,CAAC;SACL,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAC5F,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,gBAAgB,CAAC,IAA4B;IAClD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ;QACvE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;QACjC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAA6B;IAC9D,MAAM,KAAK,GAAG,oBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAA,8BAAkB,EAAC;gBACtB,IAAI,EAAE,uCAAuC;gBAC7C,IAAI;gBACJ,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,wCAAwC;YAC9C,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,mDAAmD;YACzD,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;SACxG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,uCAAuC;QAC7C,IAAI;QACJ,OAAO,EAAE,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,6BAA6B,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,eAAM,CAAC,mBAAmB,CAAC,sCAA8B,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtB,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,QAAQ,EAAE;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACY,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAC5D,QAAA,8BAA8B,GAAG,6BAA6B,CAAC;AAC5E,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,OAAO,6BAA6B,CAAC;QACjC,GAAG,KAAK;QACR,sBAAsB,EAAE,8CAA8C,CAAC,KAAK,CAAC;KAChF,CAAC,CAAC;AACP,CAAC;AACY,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YACnD,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE;SACxD;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE;YAC7C,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;SAC9F;QACD,QAAQ,EAAE;YACN,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;SAC/C;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAChG,MAAM,EAAE;oBACJ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1D;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,UAAU,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Either, ParseResult, Schema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SCHEMA_VERSION = DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n string,\n ...string[]\n] = Object.freeze([\n \"0.0.0.0/8\", \"10.0.0.0/8\", \"100.64.0.0/10\", \"127.0.0.0/8\", \"169.254.0.0/16\",\n \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.2.0/24\", \"192.168.0.0/16\",\n \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"224.0.0.0/4\",\n \"240.0.0.0/4\", \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n \"dns\",\n \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n \"cpu\",\n \"memory\",\n \"pids\"\n] = Object.freeze([\n \"cpu\", \"memory\", \"pids\",\n]);\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"managed-vm-rootless/v1\";\nexport interface DockerProfileUnixEndpoint {\n readonly path: string;\n readonly peerUid: number;\n}\n/** Callback-free descriptor data that crosses the host deployment trust boundary. */\nexport interface DockerProfileNetworkPolicy {\n readonly version: 1;\n readonly dns: {\n readonly mode: \"explicit\";\n readonly servers: readonly [\n string,\n ...string[]\n ];\n };\n readonly egress: {\n readonly mode: \"rootless-nat\";\n readonly allowedProtocols: readonly [\n \"dns\",\n \"https\"\n ];\n readonly denyPrivateNetworks: true;\n readonly denySiblingSyntheticEndpoints: true;\n readonly denyCidrs: readonly [\n string,\n ...string[]\n ];\n readonly ipv6: \"disabled\";\n readonly disableHostLoopback: true;\n readonly portDriver: \"none\";\n readonly daemonBridge: \"none\";\n readonly exclusiveNetwork: true;\n readonly icc: false;\n };\n}\nexport interface DockerExecutionProfileV1 {\n readonly schemaVersion: 1;\n readonly profileId: string;\n readonly securityLevel: DockerExecutionProfileSecurityLevel;\n readonly semanticPolicyRevision: string;\n readonly transport: {\n readonly kind: \"unix\";\n readonly hostMachineIdentity: string;\n readonly dockerSocket: DockerProfileUnixEndpoint;\n readonly controlSocket: DockerProfileUnixEndpoint & {\n readonly protocol: \"niceeval-docker-profile-control/v1\";\n };\n };\n readonly backend: {\n readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n readonly machineIdentity: string;\n readonly owner: {\n readonly uid: number;\n readonly gid: number;\n };\n readonly filesystem: {\n readonly identity: string;\n readonly mountPath: string;\n readonly dockerRootDir: string;\n readonly limitBytes: number;\n };\n readonly cgroup: {\n readonly aggregatePath: string;\n readonly policyRevision: string;\n readonly controllers: readonly [\n \"cpu\",\n \"memory\",\n \"pids\"\n ];\n };\n };\n readonly capacity: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n readonly maxContainers: number;\n readonly maxBuilds: number;\n readonly aggregate: {\n readonly cpus: number;\n readonly memoryBytes: number;\n readonly memorySwapBytes: 0;\n readonly pids: number;\n };\n };\n readonly policy: {\n readonly hostLoopback: false;\n readonly tcpDockerEndpoint: false;\n readonly outerSocketInjection: false;\n readonly privilegedTranslation: \"rootless-userns\";\n readonly writableRoot: \"declared-tmpfs-only\";\n readonly network: DockerProfileNetworkPolicy;\n };\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\n/** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */\nexport interface DockerProfilePublicSummary {\n readonly schemaVersion: 1;\n readonly profileId: string;\n readonly securityLevel: DockerExecutionProfileSecurityLevel;\n readonly semanticPolicyRevision: string;\n readonly capacity: DockerExecutionProfileV1[\"capacity\"];\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nconst ParseOptions = Object.freeze({\n errors: \"all\" as const,\n exact: true,\n onExcessProperty: \"error\" as const,\n});\ntype PlainObject = Readonly<Record<PropertyKey, unknown>>;\nconst PlainObjectSchema = Schema.declare<PlainObject>((value): value is PlainObject => {\n if (typeof value !== \"object\" || value === null || Array.isArray(value))\n return false;\n const prototype = Object.getPrototypeOf(value);\n return prototype === Object.prototype || prototype === null;\n}, {\n identifier: \"DockerProfilePlainObject\",\n description: \"a plain object or null-prototype record\",\n});\nconst plainStruct = <Fields extends Schema.Struct.Fields>(fields: Fields) => Schema.compose(Schema.Struct(fields), { strict: false })(PlainObjectSchema);\nconst nonEmptyString = (identifier: string) => Schema.String.pipe(Schema.filter((value) => value.trim() !== \"\" && !value.includes(\"\\0\"), { identifier, description: \"a non-empty string without NUL\" }));\nconst absolutePath = (identifier: string) => nonEmptyString(identifier).pipe(Schema.filter(isAbsolute, { identifier, description: \"an absolute path\" }));\nconst nonNegativeSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: \"a non-negative safe integer\" }));\nconst positiveSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: \"a positive safe integer\" }));\nconst positiveFinite = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isFinite(value) && value > 0, { identifier, description: \"a positive finite number\" }));\nfunction isPublicDnsServer(value: string): boolean {\n const kind = isIP(value);\n if (kind === 4) {\n const [first, second, third] = value.split(\".\").map(Number);\n if (first === undefined || second === undefined || third === undefined)\n return false;\n if (first === 0 || first === 10 || first === 127 || first >= 224)\n return false;\n if (first === 100 && second >= 64 && second <= 127)\n return false;\n if (first === 169 && second === 254)\n return false;\n if (first === 172 && second >= 16 && second <= 31)\n return false;\n if (first === 192 && second === 168)\n return false;\n if (first === 192 && second === 0 && (third === 0 || third === 2))\n return false;\n if (first === 198 && (second === 18 || second === 19))\n return false;\n if (first === 198 && second === 51 && third === 100)\n return false;\n return !(first === 203 && second === 0 && third === 113);\n }\n if (kind !== 6)\n return false;\n const normalized = value.toLowerCase();\n if (normalized.startsWith(\"::ffff:\")) {\n return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n }\n return normalized !== \"::\" && normalized !== \"::1\" &&\n !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n !normalized.startsWith(\"ff\") && !normalized.startsWith(\"2001:db8:\");\n}\nconst DnsServerSchema = nonEmptyString(\"DockerProfilePublicDnsServer\").pipe(Schema.filter(isPublicDnsServer, {\n identifier: \"DockerProfilePublicDnsServer\",\n description: \"a public IP address, not a private or synthetic endpoint\",\n}));\nconst CidrsSchema = Schema.NonEmptyArray(Schema.String).pipe(Schema.filter((value) => value.length === DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&\n value.every((cidr, index) => cidr === DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: \"DockerProfileDenyCidrs\", description: \"the v1 fail-closed CIDR set\" }));\nconst EndpointSchema = plainStruct({\n path: absolutePath(\"DockerProfileSocketPath\"),\n peerUid: nonNegativeSafeInteger(\"DockerProfilePeerUid\"),\n});\nconst NetworkSchema = plainStruct({\n version: Schema.Literal(1),\n dns: plainStruct({\n mode: Schema.Literal(\"explicit\"),\n servers: Schema.NonEmptyArray(DnsServerSchema),\n }),\n egress: plainStruct({\n mode: Schema.Literal(\"rootless-nat\"),\n allowedProtocols: Schema.Tuple(Schema.Literal(\"dns\"), Schema.Literal(\"https\")),\n denyPrivateNetworks: Schema.Literal(true),\n denySiblingSyntheticEndpoints: Schema.Literal(true),\n denyCidrs: CidrsSchema,\n ipv6: Schema.Literal(\"disabled\"),\n disableHostLoopback: Schema.Literal(true),\n portDriver: Schema.Literal(\"none\"),\n daemonBridge: Schema.Literal(\"none\"),\n exclusiveNetwork: Schema.Literal(true),\n icc: Schema.Literal(false),\n }),\n});\nconst CapacitySchema = plainStruct({\n cpus: positiveFinite(\"DockerProfileCapacityCpus\"),\n memoryBytes: positiveSafeInteger(\"DockerProfileCapacityMemoryBytes\"),\n memorySwapBytes: Schema.Literal(0),\n pids: positiveSafeInteger(\"DockerProfileCapacityPids\"),\n maxContainers: positiveSafeInteger(\"DockerProfileCapacityMaxContainers\"),\n maxBuilds: positiveSafeInteger(\"DockerProfileCapacityMaxBuilds\"),\n aggregate: plainStruct({\n cpus: positiveFinite(\"DockerProfileAggregateCpus\"),\n memoryBytes: positiveSafeInteger(\"DockerProfileAggregateMemoryBytes\"),\n memorySwapBytes: Schema.Literal(0),\n pids: positiveSafeInteger(\"DockerProfileAggregatePids\"),\n }),\n}).pipe(Schema.filter((value) => value.aggregate.cpus >= value.cpus &&\n value.aggregate.memoryBytes >= value.memoryBytes &&\n value.aggregate.pids >= value.pids, {\n identifier: \"DockerProfileCapacity\",\n description: \"aggregate capacity at least as large as allocatable CPU, memory and PID capacity\",\n}));\n/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */\nexport const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject> = plainStruct({\n schemaVersion: Schema.Literal(1),\n profileId: nonEmptyString(\"DockerProfileId\"),\n securityLevel: Schema.Literal(\"managed-rootless/v1\", \"managed-vm-rootless/v1\"),\n semanticPolicyRevision: nonEmptyString(\"DockerProfileSemanticPolicyRevision\"),\n transport: plainStruct({\n kind: Schema.Literal(\"unix\"),\n hostMachineIdentity: nonEmptyString(\"DockerProfileHostMachineIdentity\"),\n dockerSocket: EndpointSchema,\n controlSocket: plainStruct({\n path: absolutePath(\"DockerProfileControlSocketPath\"),\n peerUid: nonNegativeSafeInteger(\"DockerProfileControlPeerUid\"),\n protocol: Schema.Literal(\"niceeval-docker-profile-control/v1\"),\n }),\n }),\n backend: plainStruct({\n kind: Schema.Literal(\"local-systemd\", \"dedicated-linux-vm\"),\n machineIdentity: nonEmptyString(\"DockerProfileBackendMachineIdentity\"),\n owner: plainStruct({\n uid: nonNegativeSafeInteger(\"DockerProfileOwnerUid\"),\n gid: nonNegativeSafeInteger(\"DockerProfileOwnerGid\"),\n }),\n filesystem: plainStruct({\n identity: nonEmptyString(\"DockerProfileFilesystemIdentity\"),\n mountPath: absolutePath(\"DockerProfileMountPath\"),\n dockerRootDir: absolutePath(\"DockerProfileDockerRootDir\"),\n limitBytes: positiveSafeInteger(\"DockerProfileFilesystemLimitBytes\"),\n }),\n cgroup: plainStruct({\n aggregatePath: absolutePath(\"DockerProfileAggregatePath\"),\n policyRevision: nonEmptyString(\"DockerProfileCgroupPolicyRevision\"),\n controllers: Schema.Tuple(Schema.Literal(\"cpu\"), Schema.Literal(\"memory\"), Schema.Literal(\"pids\")),\n }),\n }),\n capacity: CapacitySchema,\n policy: plainStruct({\n hostLoopback: Schema.Literal(false),\n tcpDockerEndpoint: Schema.Literal(false),\n outerSocketInjection: Schema.Literal(false),\n privilegedTranslation: Schema.Literal(\"rootless-userns\"),\n writableRoot: Schema.Literal(\"declared-tmpfs-only\"),\n network: NetworkSchema,\n }),\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n string,\n ...string[]\n] {\n const [first, ...rest] = values;\n if (first === undefined)\n throw new Error(\"expected a non-empty string tuple\");\n return Object.freeze([first, ...rest]);\n}\n/** Canonicalize only after structural decoding; nested containers are immutable to callers. */\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n return Object.freeze({\n ...profile,\n transport: Object.freeze({\n ...profile.transport,\n dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n }),\n backend: Object.freeze({\n ...profile.backend,\n owner: Object.freeze({ ...profile.backend.owner }),\n filesystem: Object.freeze({ ...profile.backend.filesystem }),\n cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),\n }),\n capacity: Object.freeze({\n ...profile.capacity,\n memorySwapBytes: 0,\n aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),\n }),\n policy: Object.freeze({\n ...profile.policy,\n network: Object.freeze({\n ...profile.policy.network,\n dns: Object.freeze({\n ...profile.policy.network.dns,\n servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n }),\n egress: Object.freeze({\n ...profile.policy.network.egress,\n allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n }),\n }),\n }),\n });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n return {\n schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n securityLevel: input.securityLevel,\n backend: {\n kind: input.backend.kind,\n cgroup: {\n policyRevision: input.backend.cgroup.policyRevision,\n controllers: [...input.backend.cgroup.controllers],\n },\n },\n policy: {\n hostLoopback: input.policy.hostLoopback,\n tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n outerSocketInjection: input.policy.outerSocketInjection,\n privilegedTranslation: input.policy.privilegedTranslation,\n writableRoot: input.policy.writableRoot,\n network: {\n version: input.policy.network.version,\n dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },\n egress: {\n mode: input.policy.network.egress.mode,\n allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n denyCidrs: [...input.policy.network.egress.denyCidrs],\n ipv6: input.policy.network.egress.ipv6,\n disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n portDriver: input.policy.network.egress.portDriver,\n daemonBridge: input.policy.network.egress.daemonBridge,\n exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n icc: input.policy.network.egress.icc,\n },\n },\n },\n };\n}\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction formatSchemaPath(path: readonly PropertyKey[]): string {\n return path.reduce<string>((result, segment) => typeof segment === \"number\" ||\n (typeof segment === \"string\" && /^\\\\d+$/.test(segment))\n ? `${result}[${String(segment)}]`\n : `${result}.${String(segment)}`, \"profile\");\n}\nfunction schemaError(value: unknown, error: ParseResult.ParseError): DockerProfileError {\n const issue = ParseResult.ArrayFormatter.formatErrorSync(error)[0];\n const path = issue === undefined ? \"profile\" : formatSchemaPath(issue.path);\n const root = typeof value === \"object\" && value !== null && !Array.isArray(value)\n ? value as Record<string, unknown>\n : undefined;\n if (path === \"profile.schemaVersion\") {\n if (root?.schemaVersion === undefined) {\n return dockerProfileError({\n code: \"sandbox.docker-profile-schema-invalid\",\n path,\n message: \"profile.schemaVersion is required\",\n });\n }\n return dockerProfileError({\n code: \"sandbox.docker-profile-unknown-version\",\n path,\n message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n });\n }\n if (path === \"profile.securityLevel\") {\n return dockerProfileError({\n code: \"sandbox.docker-profile-security-level-unsupported\",\n path,\n message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,\n });\n }\n return dockerProfileError({\n code: path === \"profile.capacity\"\n ? \"sandbox.docker-profile-capacity-invalid\"\n : \"sandbox.docker-profile-schema-invalid\",\n path,\n message: issue === undefined\n ? \"profile is not a valid Docker execution profile v1\"\n : `${path} ${issue.message}`,\n });\n}\nexport function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1 {\n const decoded = Schema.decodeUnknownEither(DockerExecutionProfileV1Schema, ParseOptions)(value);\n if (Either.isLeft(decoded))\n throw schemaError(value, decoded.left);\n const profile = freezeProfile(decoded.right);\n const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n if (profile.semanticPolicyRevision !== expected) {\n throw dockerProfileError({\n code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n path: \"profile.semanticPolicyRevision\",\n message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,\n details: { expected, actual: profile.semanticPolicyRevision },\n });\n }\n return profile;\n}\nexport const parseDockerExecutionProfile = parseDockerExecutionProfileV1;\nexport const decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;\nexport function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n return parseDockerExecutionProfileV1({\n ...input,\n semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),\n });\n}\nexport const createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n try {\n parseDockerExecutionProfileV1(value);\n return true;\n }\n catch {\n return false;\n }\n}\n/** Digest the fixed v1 wire shape, not incidental object insertion order. */\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n return {\n schemaVersion: profile.schemaVersion,\n profileId: profile.profileId,\n securityLevel: profile.securityLevel,\n semanticPolicyRevision: profile.semanticPolicyRevision,\n transport: {\n kind: profile.transport.kind,\n hostMachineIdentity: profile.transport.hostMachineIdentity,\n dockerSocket: { ...profile.transport.dockerSocket },\n controlSocket: { ...profile.transport.controlSocket },\n },\n backend: {\n kind: profile.backend.kind,\n machineIdentity: profile.backend.machineIdentity,\n owner: { ...profile.backend.owner },\n filesystem: { ...profile.backend.filesystem },\n cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },\n },\n capacity: {\n ...profile.capacity,\n aggregate: { ...profile.capacity.aggregate },\n },\n policy: {\n hostLoopback: profile.policy.hostLoopback,\n tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n outerSocketInjection: profile.policy.outerSocketInjection,\n privilegedTranslation: profile.policy.privilegedTranslation,\n writableRoot: profile.policy.writableRoot,\n network: {\n version: profile.policy.network.version,\n dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },\n egress: {\n ...profile.policy.network.egress,\n allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n denyCidrs: [...profile.policy.network.egress.denyCidrs],\n },\n },\n },\n };\n}\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n return `sha256:${digestOf(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n const normalized = parseDockerExecutionProfileV1(profile);\n return Object.freeze({\n schemaVersion: 1,\n profileId: normalized.profileId,\n securityLevel: normalized.securityLevel,\n semanticPolicyRevision: normalized.semanticPolicyRevision,\n capacity: Object.freeze({\n ...normalized.capacity,\n aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n }),\n });\n}\n"]}
package/dist/sandbox/docker-profile/schema.d.cts CHANGED
@@ -8,9 +8,9 @@ export interface DockerProfileUnixEndpoint {
8
8
  readonly path: string;
9
9
  readonly peerUid: number;
10
10
  }
11
- /** 可由 descriptor 直接声明、并由宿主 attestation 重新核对的 outer 网络策略。 */
11
+ /** Callback-free descriptor data that crosses the host deployment trust boundary. */
12
12
  export interface DockerProfileNetworkPolicy {
13
- readonly version: typeof DOCKER_PROFILE_NETWORK_POLICY_VERSION;
13
+ readonly version: 1;
14
14
  readonly dns: {
15
15
  readonly mode: "explicit";
16
16
  readonly servers: readonly [string, ...string[]];
@@ -20,7 +20,6 @@ export interface DockerProfileNetworkPolicy {
20
20
  readonly allowedProtocols: readonly ["dns", "https"];
21
21
  readonly denyPrivateNetworks: true;
22
22
  readonly denySiblingSyntheticEndpoints: true;
23
- /** rootlesskit/slirp4netns 与宿主私网/loopback 的 fail-closed deny 集合。 */
24
23
  readonly denyCidrs: readonly [string, ...string[]];
25
24
  readonly ipv6: "disabled";
26
25
  readonly disableHostLoopback: true;
@@ -62,7 +61,6 @@ export interface DockerExecutionProfileV1 {
62
61
  readonly controllers: readonly ["cpu", "memory", "pids"];
63
62
  };
64
63
  };
65
- /** 已扣除宿主 daemon/build/watchdog/recovery headroom，可授予 Attempt 的容量。 */
66
64
  readonly capacity: {
67
65
  readonly cpus: number;
68
66
  readonly memoryBytes: number;
@@ -70,7 +68,6 @@ export interface DockerExecutionProfileV1 {
70
68
  readonly pids: number;
71
69
  readonly maxContainers: number;
72
70
  readonly maxBuilds: number;
73
- /** aggregate cgroup 硬上限，不是可授予 Attempt 的容量。 */
74
71
  readonly aggregate: {
75
72
  readonly cpus: number;
76
73
  readonly memoryBytes: number;
@@ -88,42 +85,28 @@ export interface DockerExecutionProfileV1 {
88
85
  };
89
86
  }
90
87
  export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
88
+ /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */
91
89
  export interface DockerProfilePublicSummary {
92
90
  readonly schemaVersion: 1;
93
91
  readonly profileId: string;
94
92
  readonly securityLevel: DockerExecutionProfileSecurityLevel;
95
93
  readonly semanticPolicyRevision: string;
96
- readonly capacity: {
97
- readonly cpus: number;
98
- readonly memoryBytes: number;
99
- readonly memorySwapBytes: 0;
100
- readonly pids: number;
101
- readonly maxContainers: number;
102
- readonly maxBuilds: number;
103
- readonly aggregate: {
104
- readonly cpus: number;
105
- readonly memoryBytes: number;
106
- readonly memorySwapBytes: 0;
107
- readonly pids: number;
108
- };
109
- };
94
+ readonly capacity: DockerExecutionProfileV1["capacity"];
110
95
  }
111
96
  type DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, "securityLevel" | "backend" | "policy">;
112
- /** 从受信 schema 字段重新计算语义 policy revision；profileId、alias、socket 与容量不参与。 */
97
+ type PlainObject = Readonly<Record<PropertyKey, unknown>>;
98
+ /** Wire structure only; semantic revision and frozen canonical values are checked after decode. */
99
+ export declare const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject>;
100
+ export declare const DockerExecutionProfileSchema: Schema.Schema<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never>;
113
101
  export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
114
102
  export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
115
- /** 对规范化 descriptor 求稳定 canonical digest；返回值可直接作为 descriptor digest。 */
116
- export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
117
- export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
118
- /** 严格解析未知输入；不会执行 descriptor 中的 callback、命令或其它代码。 */
119
103
  export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
120
104
  export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
121
105
  export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
122
106
  export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
123
107
  export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
124
108
  export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
125
- /** Effect Schema 只负责把该纯数据边界暴露给 Effect consumers；稳定业务错误由 parse 函数提供。 */
126
- export declare const DockerExecutionProfileV1Schema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
127
- export declare const DockerExecutionProfileSchema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
109
+ export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
110
+ export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
128
111
  export declare function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary;
129
112
  export {};
package/dist/sandbox/docker-profile/schema.d.mts CHANGED
@@ -8,9 +8,9 @@ export interface DockerProfileUnixEndpoint {
8
8
  readonly path: string;
9
9
  readonly peerUid: number;
10
10
  }
11
- /** 可由 descriptor 直接声明、并由宿主 attestation 重新核对的 outer 网络策略。 */
11
+ /** Callback-free descriptor data that crosses the host deployment trust boundary. */
12
12
  export interface DockerProfileNetworkPolicy {
13
- readonly version: typeof DOCKER_PROFILE_NETWORK_POLICY_VERSION;
13
+ readonly version: 1;
14
14
  readonly dns: {
15
15
  readonly mode: "explicit";
16
16
  readonly servers: readonly [string, ...string[]];
@@ -20,7 +20,6 @@ export interface DockerProfileNetworkPolicy {
20
20
  readonly allowedProtocols: readonly ["dns", "https"];
21
21
  readonly denyPrivateNetworks: true;
22
22
  readonly denySiblingSyntheticEndpoints: true;
23
- /** rootlesskit/slirp4netns 与宿主私网/loopback 的 fail-closed deny 集合。 */
24
23
  readonly denyCidrs: readonly [string, ...string[]];
25
24
  readonly ipv6: "disabled";
26
25
  readonly disableHostLoopback: true;
@@ -62,7 +61,6 @@ export interface DockerExecutionProfileV1 {
62
61
  readonly controllers: readonly ["cpu", "memory", "pids"];
63
62
  };
64
63
  };
65
- /** 已扣除宿主 daemon/build/watchdog/recovery headroom，可授予 Attempt 的容量。 */
66
64
  readonly capacity: {
67
65
  readonly cpus: number;
68
66
  readonly memoryBytes: number;
@@ -70,7 +68,6 @@ export interface DockerExecutionProfileV1 {
70
68
  readonly pids: number;
71
69
  readonly maxContainers: number;
72
70
  readonly maxBuilds: number;
73
- /** aggregate cgroup 硬上限，不是可授予 Attempt 的容量。 */
74
71
  readonly aggregate: {
75
72
  readonly cpus: number;
76
73
  readonly memoryBytes: number;
@@ -88,42 +85,28 @@ export interface DockerExecutionProfileV1 {
88
85
  };
89
86
  }
90
87
  export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
88
+ /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */
91
89
  export interface DockerProfilePublicSummary {
92
90
  readonly schemaVersion: 1;
93
91
  readonly profileId: string;
94
92
  readonly securityLevel: DockerExecutionProfileSecurityLevel;
95
93
  readonly semanticPolicyRevision: string;
96
- readonly capacity: {
97
- readonly cpus: number;
98
- readonly memoryBytes: number;
99
- readonly memorySwapBytes: 0;
100
- readonly pids: number;
101
- readonly maxContainers: number;
102
- readonly maxBuilds: number;
103
- readonly aggregate: {
104
- readonly cpus: number;
105
- readonly memoryBytes: number;
106
- readonly memorySwapBytes: 0;
107
- readonly pids: number;
108
- };
109
- };
94
+ readonly capacity: DockerExecutionProfileV1["capacity"];
110
95
  }
111
96
  type DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, "securityLevel" | "backend" | "policy">;
112
- /** 从受信 schema 字段重新计算语义 policy revision；profileId、alias、socket 与容量不参与。 */
97
+ type PlainObject = Readonly<Record<PropertyKey, unknown>>;
98
+ /** Wire structure only; semantic revision and frozen canonical values are checked after decode. */
99
+ export declare const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject>;
100
+ export declare const DockerExecutionProfileSchema: Schema.Schema<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never>;
113
101
  export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
114
102
  export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
115
- /** 对规范化 descriptor 求稳定 canonical digest；返回值可直接作为 descriptor digest。 */
116
- export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
117
- export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
118
- /** 严格解析未知输入；不会执行 descriptor 中的 callback、命令或其它代码。 */
119
103
  export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
120
104
  export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
121
105
  export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
122
106
  export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
123
107
  export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
124
108
  export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
125
- /** Effect Schema 只负责把该纯数据边界暴露给 Effect consumers；稳定业务错误由 parse 函数提供。 */
126
- export declare const DockerExecutionProfileV1Schema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
127
- export declare const DockerExecutionProfileSchema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
109
+ export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
110
+ export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
128
111
  export declare function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary;
129
112
  export {};
package/dist/sandbox/docker-profile/schema.d.ts CHANGED
@@ -8,9 +8,9 @@ export interface DockerProfileUnixEndpoint {
8
8
  readonly path: string;
9
9
  readonly peerUid: number;
10
10
  }
11
- /** 可由 descriptor 直接声明、并由宿主 attestation 重新核对的 outer 网络策略。 */
11
+ /** Callback-free descriptor data that crosses the host deployment trust boundary. */
12
12
  export interface DockerProfileNetworkPolicy {
13
- readonly version: typeof DOCKER_PROFILE_NETWORK_POLICY_VERSION;
13
+ readonly version: 1;
14
14
  readonly dns: {
15
15
  readonly mode: "explicit";
16
16
  readonly servers: readonly [string, ...string[]];
@@ -20,7 +20,6 @@ export interface DockerProfileNetworkPolicy {
20
20
  readonly allowedProtocols: readonly ["dns", "https"];
21
21
  readonly denyPrivateNetworks: true;
22
22
  readonly denySiblingSyntheticEndpoints: true;
23
- /** rootlesskit/slirp4netns 与宿主私网/loopback 的 fail-closed deny 集合。 */
24
23
  readonly denyCidrs: readonly [string, ...string[]];
25
24
  readonly ipv6: "disabled";
26
25
  readonly disableHostLoopback: true;
@@ -62,7 +61,6 @@ export interface DockerExecutionProfileV1 {
62
61
  readonly controllers: readonly ["cpu", "memory", "pids"];
63
62
  };
64
63
  };
65
- /** 已扣除宿主 daemon/build/watchdog/recovery headroom，可授予 Attempt 的容量。 */
66
64
  readonly capacity: {
67
65
  readonly cpus: number;
68
66
  readonly memoryBytes: number;
@@ -70,7 +68,6 @@ export interface DockerExecutionProfileV1 {
70
68
  readonly pids: number;
71
69
  readonly maxContainers: number;
72
70
  readonly maxBuilds: number;
73
- /** aggregate cgroup 硬上限，不是可授予 Attempt 的容量。 */
74
71
  readonly aggregate: {
75
72
  readonly cpus: number;
76
73
  readonly memoryBytes: number;
@@ -88,42 +85,28 @@ export interface DockerExecutionProfileV1 {
88
85
  };
89
86
  }
90
87
  export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
88
+ /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */
91
89
  export interface DockerProfilePublicSummary {
92
90
  readonly schemaVersion: 1;
93
91
  readonly profileId: string;
94
92
  readonly securityLevel: DockerExecutionProfileSecurityLevel;
95
93
  readonly semanticPolicyRevision: string;
96
- readonly capacity: {
97
- readonly cpus: number;
98
- readonly memoryBytes: number;
99
- readonly memorySwapBytes: 0;
100
- readonly pids: number;
101
- readonly maxContainers: number;
102
- readonly maxBuilds: number;
103
- readonly aggregate: {
104
- readonly cpus: number;
105
- readonly memoryBytes: number;
106
- readonly memorySwapBytes: 0;
107
- readonly pids: number;
108
- };
109
- };
94
+ readonly capacity: DockerExecutionProfileV1["capacity"];
110
95
  }
111
96
  type DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, "securityLevel" | "backend" | "policy">;
112
- /** 从受信 schema 字段重新计算语义 policy revision；profileId、alias、socket 与容量不参与。 */
97
+ type PlainObject = Readonly<Record<PropertyKey, unknown>>;
98
+ /** Wire structure only; semantic revision and frozen canonical values are checked after decode. */
99
+ export declare const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject>;
100
+ export declare const DockerExecutionProfileSchema: Schema.Schema<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never>;
113
101
  export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
114
102
  export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
115
- /** 对规范化 descriptor 求稳定 canonical digest；返回值可直接作为 descriptor digest。 */
116
- export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
117
- export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
118
- /** 严格解析未知输入；不会执行 descriptor 中的 callback、命令或其它代码。 */
119
103
  export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
120
104
  export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
121
105
  export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
122
106
  export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
123
107
  export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
124
108
  export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
125
- /** Effect Schema 只负责把该纯数据边界暴露给 Effect consumers；稳定业务错误由 parse 函数提供。 */
126
- export declare const DockerExecutionProfileV1Schema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
127
- export declare const DockerExecutionProfileSchema: Schema.declare<DockerExecutionProfileV1, DockerExecutionProfileV1, readonly [], never>;
109
+ export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
110
+ export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;
128
111
  export declare function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary;
129
112
  export {};
package/dist/sandbox/e2b-agent-template.cjs CHANGED
@@ -123,16 +123,19 @@ function e2bCodingAgentTemplate(agent, options = {}) {
123
123
  return template.runCmd(`npm install -g @openai/codex@${coding_cli_versions_ts_1.DEFAULT_CODEX_CLI_VERSION}`, { user: "root" });
124
124
  }
125
125
  const packages = (0, bub_install_spec_ts_1.normalizeBubPackages)(options.bubPythonPackages ?? []);
126
- const installHash = (0, bub_install_spec_ts_1.bubInstallHash)(packages);
126
+ const installHash = (0, bub_install_spec_ts_1.bubInstallHash)(packages, bub_install_spec_ts_1.DEFAULT_BUB_REQUIREMENT, bub_install_spec_ts_1.DEFAULT_BUB_OTEL_PLUGIN, bub_install_spec_ts_1.DEFAULT_BUB_DEPENDENCY_OVERRIDES);
127
127
  const withPackages = packages.map((value) => ` --with ${shellQuote(value)}`).join("");
128
128
  const marker = `/home/user/${bub_install_spec_ts_1.BUB_INSTALL_MARKER}`;
129
129
  const overrideFile = "/tmp/bub-override.txt";
130
+ const overrides = [bub_install_spec_ts_1.DEFAULT_BUB_REQUIREMENT, ...bub_install_spec_ts_1.DEFAULT_BUB_DEPENDENCY_OVERRIDES]
131
+ .map(shellQuote)
132
+ .join(" ");
130
133
  return withNodeToolContract((0, e2b_1.Template)().fromBaseImage())
131
134
  .runCmd("curl -LsSf https://astral.sh/uv/install.sh | sh", { user: E2B_RUN_USER })
132
135
  .runCmd([
133
136
  // override 把 `bub` 钉成一个 PyPI 版本:OTel 插件所在 workspace 把 bub 声明成 git
134
137
  // 依赖,不覆盖的话构建会拉到 Bub 主干,模板里装的版本随构建时间漂移。
135
- `printf '%s\\n' ${shellQuote(bub_install_spec_ts_1.DEFAULT_BUB_REQUIREMENT)} > ${overrideFile}`,
138
+ `printf '%s\\n' ${overrides} > ${overrideFile}`,
136
139
  `$HOME/.local/bin/uv tool install --python 3.12 --prerelease allow bub --overrides ${overrideFile} --with ${shellQuote(bub_install_spec_ts_1.DEFAULT_BUB_OTEL_PLUGIN)}${withPackages}`,
137
140
  `mkdir -p $(dirname ${marker}) && printf '%s' ${shellQuote(installHash)} > ${marker}`,
138
141
  ], { user: E2B_RUN_USER });
package/dist/sandbox/e2b-agent-template.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"e2b-agent-template.js","sourceRoot":"","sources":["e2b-agent-template.ts"],"names":[],"mappings":";;;AAoDA,kDAEC;AAyCD,8DASC;AAYD,wDA2BC;AA/ID,6BAAqD;AACrD,uEAA4J;AAC5J,6EAAwI;AAYxI,mFAAmF;AACtE,QAAA,4BAA4B,GAAG;IACxC,aAAa,EAAE,QAAQ;IACvB,KAAK,EAAE,OAAO;CACR,CAAC;AACX,iEAAiE;AACpD,QAAA,iBAAiB,GAAG,2BAA2B,CAAC;AAC7D,4CAA4C;AAC/B,QAAA,0BAA0B,GAA8C;IACjF,aAAa,EAAE,GAAG,yBAAiB,uBAAuB;IAC1D,KAAK,EAAE,GAAG,yBAAiB,iBAAiB;IAC5C,GAAG,EAAE,GAAG,yBAAiB,eAAe;CAC3C,CAAC;AACF;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAA8C;IAC1E,aAAa,EAAE,QAAQ;IACvB,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;CAChB,CAAC;AACF;;;GAGG;AACU,QAAA,iCAAiC,GAAG,GAAG,kCAA0B,CAAC,aAAa,CAAC,IAAI,0BAA0B,CAAC,aAAa,CAAC,EAAE,CAAC;AAChI,QAAA,2BAA2B,GAAG,GAAG,kCAA0B,CAAC,KAAK,IAAI,0BAA0B,CAAC,KAAK,EAAE,CAAC;AACxG,QAAA,yBAAyB,GAAG,GAAG,kCAA0B,CAAC,GAAG,IAAI,0BAA0B,CAAC,GAAG,EAAE,CAAC;AAC/G;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAqB;IACrD,OAAO,IAAA,gDAAuB,EAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,KAAa;IAC7B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACjD,CAAC;AACD,mDAAmD;AACnD,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,aAAa,GAAG,GAAG,4BAAoB,MAAM,CAAC;AACpD,MAAM,iBAAiB,GAAG,GAAG,4BAAoB,mBAAmB,CAAC;AACrE;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,QAAyB;IACnD,OAAO,QAAQ;SACV,MAAM,CAAC,YAAY,aAAa,IAAI,iBAAiB,aAAa,YAAY,IAAI,aAAa,IAAI,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACzI,MAAM,CAAC,yBAAyB,4BAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SAC/E,MAAM,CAAC,gGAAgG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SAC1H,MAAM,CAAC,mHAAmH,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC7J,CAAC;AACD;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CAAC,QAAyB;IAC/D,OAAO,QAAQ,CAAC,MAAM,CAAC;QACnB,sCAAsC,4BAAoB,wEAAwE,4BAAoB,kBAAkB;QACxK,wBAAwB,aAAa,oBAAoB,aAAa,mDAAmD;QACzH,WAAW,aAAa,eAAe,aAAa,+CAA+C;QACnG,WAAW,iBAAiB,eAAe,iBAAiB,+CAA+C;QAC3G,sJAAsJ;QACtJ,mHAAmH;KACtH,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/B,CAAC;AACD;;;;;;;;;;GAUG;AACH,SAAgB,sBAAsB,CAAC,KAAqB,EAAE,UAAyC,EAAE;IACrG,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAA,cAAQ,GAAE,CAAC,YAAY,CAAC,oCAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC1B,yFAAyF;YACzF,6EAA6E;YAC7E,OAAO,QAAQ,CAAC,MAAM,CAAC,qDAAqD,wDAA+B,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,gCAAgC,kDAAyB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAA,oCAAc,EAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,cAAc,wCAAkB,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,uBAAuB,CAAC;IAC7C,OAAO,oBAAoB,CAAC,IAAA,cAAQ,GAAE,CAAC,aAAa,EAAE,CAAC;SAClD,MAAM,CAAC,iDAAiD,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SACjF,MAAM,CAAC;QACR,kEAAkE;QAClE,uCAAuC;QACvC,kBAAkB,UAAU,CAAC,6CAAuB,CAAC,MAAM,YAAY,EAAE;QACzE,qFAAqF,YAAY,WAAW,UAAU,CAAC,6CAAuB,CAAC,GAAG,YAAY,EAAE;QAChK,sBAAsB,MAAM,oBAAoB,UAAU,CAAC,WAAW,CAAC,MAAM,MAAM,EAAE;KACxF,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import { Template, type TemplateBuilder } from \"e2b\";\nimport { BUB_INSTALL_MARKER, DEFAULT_BUB_OTEL_PLUGIN, DEFAULT_BUB_REQUIREMENT, bubInstallHash, normalizeBubPackages, } from \"../agents/bub-install-spec.ts\";\nimport { DEFAULT_CLAUDE_CODE_CLI_VERSION, DEFAULT_CODEX_CLI_VERSION, agentBaselineVersionTag, } from \"../agents/coding-cli-versions.ts\";\n/**\n * 已发布（或即将发布进台账）的 E2B 公共基线 Agent。\n *\n * 是 `CodingAgentBaseline` 的子集：OpenCode / Hermes / OpenClaw 只有 Docker 公共镜像，\n * E2B 模板尚未进 `sandbox/e2b/published.json`，不能提前导出指向空制品的常量。\n */\nexport type E2BCodingAgent = \"claude-code\" | \"codex\" | \"bub\";\nexport interface E2BCodingAgentTemplateOptions {\n /** Extra packages installed in Bub's uv tool environment and included in its compatibility marker. */\n bubPythonPackages?: readonly string[];\n}\n/** Provider-owned template aliases. Bub is built from NiceEval's pinned recipe. */\nexport const E2B_OFFICIAL_AGENT_TEMPLATES = {\n \"claude-code\": \"claude\",\n codex: \"codex\",\n} as const;\n/** NiceEval 公共 E2B baseline 所在的 Team namespace;跨 Team 引用必须带它。 */\nexport const NICEEVAL_E2B_TEAM = \"correctroads-default-team\";\n/** 每个 Agent 的公共 E2B template 名字（不含 tag）。 */\nexport const NICEEVAL_E2B_TEMPLATE_NAME: globalThis.Record<E2BCodingAgent, string> = {\n \"claude-code\": `${NICEEVAL_E2B_TEAM}/niceeval-claude-code`,\n codex: `${NICEEVAL_E2B_TEAM}/niceeval-codex`,\n bub: `${NICEEVAL_E2B_TEAM}/niceeval-bub`,\n};\n/**\n * 各 Agent 当前已发布并完成启动校验的公共 template tag。\n *\n * E2B 的发布是维护者手动动作（需要 `e2b auth login`），所以这里记的是**已发布事实**，\n * 不是源码配方派生值：构建脚本按 `agentBaselineVersionTag()` 打 tag，发布并真机验证后，\n * 同一批改动更新这张表与 `sandbox/e2b/published.json`。两者与源码版本常量的一致性由\n * `e2b-agent-template.test.ts` 守护——版本常量走在发布前面时测试红，常量不会先指向不存在的制品。\n */\nconst PUBLISHED_E2B_BASELINE_TAG: globalThis.Record<E2BCodingAgent, string> = {\n \"claude-code\": \"v0.6.1\",\n codex: \"v0.6.1\",\n bub: \"v0.6.1\",\n};\n/**\n * NiceEval 官方公共 E2B baseline：每个值已经是完整、版本钉死、跨 Team 的 template ref。\n * 直接交给 `e2bSandbox({ template })`，或交给 E2B `Template().fromTemplate(...)` 继续派生。\n */\nexport const NICEEVAL_CLAUDE_CODE_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME[\"claude-code\"]}:${PUBLISHED_E2B_BASELINE_TAG[\"claude-code\"]}`;\nexport const NICEEVAL_CODEX_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME.codex}:${PUBLISHED_E2B_BASELINE_TAG.codex}`;\nexport const NICEEVAL_BUB_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME.bub}:${PUBLISHED_E2B_BASELINE_TAG.bub}`;\n/**\n * Build tag for the next official E2B baseline of this agent: `<agent version>-r<recipe revision>`.\n *\n * 构建脚本用它打 tag,而不是用 niceeval 自己的 release——制品的版本位是它装的那个 Agent 的版本。\n */\nexport function e2bBaselineBuildTag(agent: E2BCodingAgent): string {\n return agentBaselineVersionTag(agent);\n}\nfunction shellQuote(value: string): string {\n return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n/** E2B 沙箱的运行用户:agent 与 eval 的命令都以它执行,契约按它的视角定义。 */\nconst E2B_RUN_USER = \"user\";\n/**\n * NiceEval 三份 E2B baseline 共同的 Node 工具前缀:运行用户的 npm global prefix、\n * 全局 bin 与全局 module 目录都收敛到这里。\n *\n * E2B 官方 `claude` 与 `codex` 起点把 Node 装在不同前缀下(`/usr` 与 `/usr/local`),\n * 默认 npm prefix 随之不同,只有后者对运行用户可写。不规范化的话,同一条 eval 的\n * `npm install -g` 会只因换 Agent 就整片 EACCES,而 Agent CLI 自检仍然通过。\n */\nexport const E2B_NODE_TOOL_PREFIX = \"/usr/local\";\nconst NODE_TOOL_BIN = `${E2B_NODE_TOOL_PREFIX}/bin`;\nconst NODE_TOOL_MODULES = `${E2B_NODE_TOOL_PREFIX}/lib/node_modules`;\n/**\n * 横切在三条 Agent 配方之上的 Node 工具契约:准备运行用户可写的全局目录,把它的\n * npm prefix 写进 user 级 npmrc(user config 优先级高于 builtin/global,不依赖登录 shell),\n * 并收敛跨 provider 基线工具面(与 Docker 侧 sandbox/docker/Dockerfile 的 base target 同一份\n * 契约,见 docs/feature/sandbox/library/prebuilt-environments.md「跨 provider 基线工具面」):\n * 官方起点若带 yarn 实体就移除(包管理器只保证 npm 与 corepack),并断言 python3 存在\n * (E2B 官方起点已带,这里只是 fail fast——不是安装步骤)。\n */\nfunction withNodeToolContract(template: TemplateBuilder): TemplateBuilder {\n return template\n .runCmd(`mkdir -p ${NODE_TOOL_BIN} ${NODE_TOOL_MODULES} && chown ${E2B_RUN_USER} ${NODE_TOOL_BIN} ${NODE_TOOL_MODULES}`, { user: \"root\" })\n .runCmd(`npm config set prefix ${E2B_NODE_TOOL_PREFIX}`, { user: E2B_RUN_USER })\n .runCmd(`for bin in yarn yarnpkg; do path=$(command -v \"$bin\" 2>/dev/null) && rm -f \"$path\"; done; true`, { user: \"root\" })\n .runCmd(`command -v python3 >/dev/null 2>&1 || { echo \"python3 missing from official coding-agent baseline\" >&2; exit 1; }`, { user: E2B_RUN_USER });\n}\n/**\n * Assert the shared Node tooling contract inside a template build, as the sandbox run user.\n *\n * 校验 npm global prefix、`PATH`、两个全局目录的写权限,以及跨 provider 基线工具面\n * (不存在 yarn 实体、python3 存在)。任一项漂移时 build 在写入 registry 前失败,不会发布一份\n * 「Agent CLI 能启动、但 `npm install -g` 必挂」或「工具面与 Docker 侧基线不一致」的模板。\n * 构建脚本应在全部安装步骤之后链这一步——用户在 `e2bCodingAgentTemplate()` 之后继续叠加的\n * `.aptInstall()` / `.runCmd()` 也会被这里的最终检查覆盖到。\n */\nexport function verifyE2BNodeToolContract(template: TemplateBuilder): TemplateBuilder {\n return template.runCmd([\n `test \"$(npm config get prefix)\" = \"${E2B_NODE_TOOL_PREFIX}\" || { echo \"npm global prefix is $(npm config get prefix), expected ${E2B_NODE_TOOL_PREFIX}\" >&2; exit 1; }`,\n `case \":$PATH:\" in *\":${NODE_TOOL_BIN}:\"*) ;; *) echo \"${NODE_TOOL_BIN} is missing from PATH: $PATH\" >&2; exit 1 ;; esac`,\n `test -w ${NODE_TOOL_BIN} || { echo \"${NODE_TOOL_BIN} is not writable by $(id -un)\" >&2; exit 1; }`,\n `test -w ${NODE_TOOL_MODULES} || { echo \"${NODE_TOOL_MODULES} is not writable by $(id -un)\" >&2; exit 1; }`,\n `command -v yarn >/dev/null 2>&1 && { echo \"yarn must not be preinstalled in the official baseline, found: $(command -v yarn)\" >&2; exit 1; } || true`,\n `command -v python3 >/dev/null 2>&1 || { echo \"python3 missing from official coding-agent baseline\" >&2; exit 1; }`,\n ], { user: E2B_RUN_USER });\n}\n/**\n * Start an extensible E2B template for a coding agent.\n *\n * Claude Code and Codex extend E2B's official templates. Bub uses NiceEval's\n * immutable install recipe because E2B does not currently publish a Bub base.\n * Callers can chain normal E2B TemplateBuilder operations before building.\n *\n * 三种 agent 的产物共享同一份 Node 工具契约:运行用户的 npm global prefix 是\n * `/usr/local`,`/usr/local/bin` 在 PATH 中,该前缀下的 bin 与 module 目录对它可写。\n * 因此叠加全局 Node 工具用普通 `npm install -g <pkg>` 即可,不按 agent 分支。\n */\nexport function e2bCodingAgentTemplate(agent: E2BCodingAgent, options: E2BCodingAgentTemplateOptions = {}): TemplateBuilder {\n if (agent === \"claude-code\" || agent === \"codex\") {\n if (options.bubPythonPackages?.length) {\n throw new Error(\"bubPythonPackages can only be used with the Bub E2B template\");\n }\n const template = withNodeToolContract(Template().fromTemplate(E2B_OFFICIAL_AGENT_TEMPLATES[agent]));\n if (agent === \"claude-code\") {\n // E2B's official template puts a native Claude binary first in the user PATH; installing\n // npm as root would leave that older binary shadowing /usr/local/bin/claude.\n return template.runCmd(`curl -fsSL https://claude.ai/install.sh | bash -s ${DEFAULT_CLAUDE_CODE_CLI_VERSION}`, { user: E2B_RUN_USER });\n }\n return template.runCmd(`npm install -g @openai/codex@${DEFAULT_CODEX_CLI_VERSION}`, { user: \"root\" });\n }\n const packages = normalizeBubPackages(options.bubPythonPackages ?? []);\n const installHash = bubInstallHash(packages);\n const withPackages = packages.map((value) => ` --with ${shellQuote(value)}`).join(\"\");\n const marker = `/home/user/${BUB_INSTALL_MARKER}`;\n const overrideFile = \"/tmp/bub-override.txt\";\n return withNodeToolContract(Template().fromBaseImage())\n .runCmd(\"curl -LsSf https://astral.sh/uv/install.sh | sh\", { user: E2B_RUN_USER })\n .runCmd([\n // override 把 `bub` 钉成一个 PyPI 版本:OTel 插件所在 workspace 把 bub 声明成 git\n // 依赖,不覆盖的话构建会拉到 Bub 主干,模板里装的版本随构建时间漂移。\n `printf '%s\\\\n' ${shellQuote(DEFAULT_BUB_REQUIREMENT)} > ${overrideFile}`,\n `$HOME/.local/bin/uv tool install --python 3.12 --prerelease allow bub --overrides ${overrideFile} --with ${shellQuote(DEFAULT_BUB_OTEL_PLUGIN)}${withPackages}`,\n `mkdir -p $(dirname ${marker}) && printf '%s' ${shellQuote(installHash)} > ${marker}`,\n ], { user: E2B_RUN_USER });\n}\n"]}
1
+ {"version":3,"file":"e2b-agent-template.js","sourceRoot":"","sources":["e2b-agent-template.ts"],"names":[],"mappings":";;;AAoDA,kDAEC;AAyCD,8DASC;AAYD,wDA8BC;AAlJD,6BAAqD;AACrD,uEAA8L;AAC9L,6EAAwI;AAYxI,mFAAmF;AACtE,QAAA,4BAA4B,GAAG;IACxC,aAAa,EAAE,QAAQ;IACvB,KAAK,EAAE,OAAO;CACR,CAAC;AACX,iEAAiE;AACpD,QAAA,iBAAiB,GAAG,2BAA2B,CAAC;AAC7D,4CAA4C;AAC/B,QAAA,0BAA0B,GAA8C;IACjF,aAAa,EAAE,GAAG,yBAAiB,uBAAuB;IAC1D,KAAK,EAAE,GAAG,yBAAiB,iBAAiB;IAC5C,GAAG,EAAE,GAAG,yBAAiB,eAAe;CAC3C,CAAC;AACF;;;;;;;GAOG;AACH,MAAM,0BAA0B,GAA8C;IAC1E,aAAa,EAAE,QAAQ;IACvB,KAAK,EAAE,QAAQ;IACf,GAAG,EAAE,QAAQ;CAChB,CAAC;AACF;;;GAGG;AACU,QAAA,iCAAiC,GAAG,GAAG,kCAA0B,CAAC,aAAa,CAAC,IAAI,0BAA0B,CAAC,aAAa,CAAC,EAAE,CAAC;AAChI,QAAA,2BAA2B,GAAG,GAAG,kCAA0B,CAAC,KAAK,IAAI,0BAA0B,CAAC,KAAK,EAAE,CAAC;AACxG,QAAA,yBAAyB,GAAG,GAAG,kCAA0B,CAAC,GAAG,IAAI,0BAA0B,CAAC,GAAG,EAAE,CAAC;AAC/G;;;;GAIG;AACH,SAAgB,mBAAmB,CAAC,KAAqB;IACrD,OAAO,IAAA,gDAAuB,EAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AACD,SAAS,UAAU,CAAC,KAAa;IAC7B,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACjD,CAAC;AACD,mDAAmD;AACnD,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B;;;;;;;GAOG;AACU,QAAA,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,aAAa,GAAG,GAAG,4BAAoB,MAAM,CAAC;AACpD,MAAM,iBAAiB,GAAG,GAAG,4BAAoB,mBAAmB,CAAC;AACrE;;;;;;;GAOG;AACH,SAAS,oBAAoB,CAAC,QAAyB;IACnD,OAAO,QAAQ;SACV,MAAM,CAAC,YAAY,aAAa,IAAI,iBAAiB,aAAa,YAAY,IAAI,aAAa,IAAI,iBAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACzI,MAAM,CAAC,yBAAyB,4BAAoB,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SAC/E,MAAM,CAAC,gGAAgG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SAC1H,MAAM,CAAC,mHAAmH,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC7J,CAAC;AACD;;;;;;;;GAQG;AACH,SAAgB,yBAAyB,CAAC,QAAyB;IAC/D,OAAO,QAAQ,CAAC,MAAM,CAAC;QACnB,sCAAsC,4BAAoB,wEAAwE,4BAAoB,kBAAkB;QACxK,wBAAwB,aAAa,oBAAoB,aAAa,mDAAmD;QACzH,WAAW,aAAa,eAAe,aAAa,+CAA+C;QACnG,WAAW,iBAAiB,eAAe,iBAAiB,+CAA+C;QAC3G,sJAAsJ;QACtJ,mHAAmH;KACtH,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/B,CAAC;AACD;;;;;;;;;;GAUG;AACH,SAAgB,sBAAsB,CAAC,KAAqB,EAAE,UAAyC,EAAE;IACrG,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QAC/C,IAAI,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAA,cAAQ,GAAE,CAAC,YAAY,CAAC,oCAA4B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpG,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC1B,yFAAyF;YACzF,6EAA6E;YAC7E,OAAO,QAAQ,CAAC,MAAM,CAAC,qDAAqD,wDAA+B,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3I,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,CAAC,gCAAgC,kDAAyB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAA,oCAAc,EAAC,QAAQ,EAAE,6CAAuB,EAAE,6CAAuB,EAAE,sDAAgC,CAAC,CAAC;IACjI,MAAM,YAAY,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,cAAc,wCAAkB,EAAE,CAAC;IAClD,MAAM,YAAY,GAAG,uBAAuB,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,6CAAuB,EAAE,GAAG,sDAAgC,CAAC;SAC3E,GAAG,CAAC,UAAU,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,oBAAoB,CAAC,IAAA,cAAQ,GAAE,CAAC,aAAa,EAAE,CAAC;SAClD,MAAM,CAAC,iDAAiD,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;SACjF,MAAM,CAAC;QACR,kEAAkE;QAClE,uCAAuC;QACvC,kBAAkB,SAAS,MAAM,YAAY,EAAE;QAC/C,qFAAqF,YAAY,WAAW,UAAU,CAAC,6CAAuB,CAAC,GAAG,YAAY,EAAE;QAChK,sBAAsB,MAAM,oBAAoB,UAAU,CAAC,WAAW,CAAC,MAAM,MAAM,EAAE;KACxF,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/B,CAAC","sourcesContent":["import { Template, type TemplateBuilder } from \"e2b\";\nimport { BUB_INSTALL_MARKER, DEFAULT_BUB_DEPENDENCY_OVERRIDES, DEFAULT_BUB_OTEL_PLUGIN, DEFAULT_BUB_REQUIREMENT, bubInstallHash, normalizeBubPackages, } from \"../agents/bub-install-spec.ts\";\nimport { DEFAULT_CLAUDE_CODE_CLI_VERSION, DEFAULT_CODEX_CLI_VERSION, agentBaselineVersionTag, } from \"../agents/coding-cli-versions.ts\";\n/**\n * 已发布（或即将发布进台账）的 E2B 公共基线 Agent。\n *\n * 是 `CodingAgentBaseline` 的子集：OpenCode / Hermes / OpenClaw 只有 Docker 公共镜像，\n * E2B 模板尚未进 `sandbox/e2b/published.json`，不能提前导出指向空制品的常量。\n */\nexport type E2BCodingAgent = \"claude-code\" | \"codex\" | \"bub\";\nexport interface E2BCodingAgentTemplateOptions {\n /** Extra packages installed in Bub's uv tool environment and included in its compatibility marker. */\n bubPythonPackages?: readonly string[];\n}\n/** Provider-owned template aliases. Bub is built from NiceEval's pinned recipe. */\nexport const E2B_OFFICIAL_AGENT_TEMPLATES = {\n \"claude-code\": \"claude\",\n codex: \"codex\",\n} as const;\n/** NiceEval 公共 E2B baseline 所在的 Team namespace;跨 Team 引用必须带它。 */\nexport const NICEEVAL_E2B_TEAM = \"correctroads-default-team\";\n/** 每个 Agent 的公共 E2B template 名字（不含 tag）。 */\nexport const NICEEVAL_E2B_TEMPLATE_NAME: globalThis.Record<E2BCodingAgent, string> = {\n \"claude-code\": `${NICEEVAL_E2B_TEAM}/niceeval-claude-code`,\n codex: `${NICEEVAL_E2B_TEAM}/niceeval-codex`,\n bub: `${NICEEVAL_E2B_TEAM}/niceeval-bub`,\n};\n/**\n * 各 Agent 当前已发布并完成启动校验的公共 template tag。\n *\n * E2B 的发布是维护者手动动作（需要 `e2b auth login`），所以这里记的是**已发布事实**，\n * 不是源码配方派生值：构建脚本按 `agentBaselineVersionTag()` 打 tag，发布并真机验证后，\n * 同一批改动更新这张表与 `sandbox/e2b/published.json`。两者与源码版本常量的一致性由\n * `e2b-agent-template.test.ts` 守护——版本常量走在发布前面时测试红，常量不会先指向不存在的制品。\n */\nconst PUBLISHED_E2B_BASELINE_TAG: globalThis.Record<E2BCodingAgent, string> = {\n \"claude-code\": \"v0.6.1\",\n codex: \"v0.6.1\",\n bub: \"v0.6.1\",\n};\n/**\n * NiceEval 官方公共 E2B baseline：每个值已经是完整、版本钉死、跨 Team 的 template ref。\n * 直接交给 `e2bSandbox({ template })`，或交给 E2B `Template().fromTemplate(...)` 继续派生。\n */\nexport const NICEEVAL_CLAUDE_CODE_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME[\"claude-code\"]}:${PUBLISHED_E2B_BASELINE_TAG[\"claude-code\"]}`;\nexport const NICEEVAL_CODEX_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME.codex}:${PUBLISHED_E2B_BASELINE_TAG.codex}`;\nexport const NICEEVAL_BUB_E2B_TEMPLATE = `${NICEEVAL_E2B_TEMPLATE_NAME.bub}:${PUBLISHED_E2B_BASELINE_TAG.bub}`;\n/**\n * Build tag for the next official E2B baseline of this agent: `<agent version>-r<recipe revision>`.\n *\n * 构建脚本用它打 tag,而不是用 niceeval 自己的 release——制品的版本位是它装的那个 Agent 的版本。\n */\nexport function e2bBaselineBuildTag(agent: E2BCodingAgent): string {\n return agentBaselineVersionTag(agent);\n}\nfunction shellQuote(value: string): string {\n return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n/** E2B 沙箱的运行用户:agent 与 eval 的命令都以它执行,契约按它的视角定义。 */\nconst E2B_RUN_USER = \"user\";\n/**\n * NiceEval 三份 E2B baseline 共同的 Node 工具前缀:运行用户的 npm global prefix、\n * 全局 bin 与全局 module 目录都收敛到这里。\n *\n * E2B 官方 `claude` 与 `codex` 起点把 Node 装在不同前缀下(`/usr` 与 `/usr/local`),\n * 默认 npm prefix 随之不同,只有后者对运行用户可写。不规范化的话,同一条 eval 的\n * `npm install -g` 会只因换 Agent 就整片 EACCES,而 Agent CLI 自检仍然通过。\n */\nexport const E2B_NODE_TOOL_PREFIX = \"/usr/local\";\nconst NODE_TOOL_BIN = `${E2B_NODE_TOOL_PREFIX}/bin`;\nconst NODE_TOOL_MODULES = `${E2B_NODE_TOOL_PREFIX}/lib/node_modules`;\n/**\n * 横切在三条 Agent 配方之上的 Node 工具契约:准备运行用户可写的全局目录,把它的\n * npm prefix 写进 user 级 npmrc(user config 优先级高于 builtin/global,不依赖登录 shell),\n * 并收敛跨 provider 基线工具面(与 Docker 侧 sandbox/docker/Dockerfile 的 base target 同一份\n * 契约,见 docs/feature/sandbox/library/prebuilt-environments.md「跨 provider 基线工具面」):\n * 官方起点若带 yarn 实体就移除(包管理器只保证 npm 与 corepack),并断言 python3 存在\n * (E2B 官方起点已带,这里只是 fail fast——不是安装步骤)。\n */\nfunction withNodeToolContract(template: TemplateBuilder): TemplateBuilder {\n return template\n .runCmd(`mkdir -p ${NODE_TOOL_BIN} ${NODE_TOOL_MODULES} && chown ${E2B_RUN_USER} ${NODE_TOOL_BIN} ${NODE_TOOL_MODULES}`, { user: \"root\" })\n .runCmd(`npm config set prefix ${E2B_NODE_TOOL_PREFIX}`, { user: E2B_RUN_USER })\n .runCmd(`for bin in yarn yarnpkg; do path=$(command -v \"$bin\" 2>/dev/null) && rm -f \"$path\"; done; true`, { user: \"root\" })\n .runCmd(`command -v python3 >/dev/null 2>&1 || { echo \"python3 missing from official coding-agent baseline\" >&2; exit 1; }`, { user: E2B_RUN_USER });\n}\n/**\n * Assert the shared Node tooling contract inside a template build, as the sandbox run user.\n *\n * 校验 npm global prefix、`PATH`、两个全局目录的写权限,以及跨 provider 基线工具面\n * (不存在 yarn 实体、python3 存在)。任一项漂移时 build 在写入 registry 前失败,不会发布一份\n * 「Agent CLI 能启动、但 `npm install -g` 必挂」或「工具面与 Docker 侧基线不一致」的模板。\n * 构建脚本应在全部安装步骤之后链这一步——用户在 `e2bCodingAgentTemplate()` 之后继续叠加的\n * `.aptInstall()` / `.runCmd()` 也会被这里的最终检查覆盖到。\n */\nexport function verifyE2BNodeToolContract(template: TemplateBuilder): TemplateBuilder {\n return template.runCmd([\n `test \"$(npm config get prefix)\" = \"${E2B_NODE_TOOL_PREFIX}\" || { echo \"npm global prefix is $(npm config get prefix), expected ${E2B_NODE_TOOL_PREFIX}\" >&2; exit 1; }`,\n `case \":$PATH:\" in *\":${NODE_TOOL_BIN}:\"*) ;; *) echo \"${NODE_TOOL_BIN} is missing from PATH: $PATH\" >&2; exit 1 ;; esac`,\n `test -w ${NODE_TOOL_BIN} || { echo \"${NODE_TOOL_BIN} is not writable by $(id -un)\" >&2; exit 1; }`,\n `test -w ${NODE_TOOL_MODULES} || { echo \"${NODE_TOOL_MODULES} is not writable by $(id -un)\" >&2; exit 1; }`,\n `command -v yarn >/dev/null 2>&1 && { echo \"yarn must not be preinstalled in the official baseline, found: $(command -v yarn)\" >&2; exit 1; } || true`,\n `command -v python3 >/dev/null 2>&1 || { echo \"python3 missing from official coding-agent baseline\" >&2; exit 1; }`,\n ], { user: E2B_RUN_USER });\n}\n/**\n * Start an extensible E2B template for a coding agent.\n *\n * Claude Code and Codex extend E2B's official templates. Bub uses NiceEval's\n * immutable install recipe because E2B does not currently publish a Bub base.\n * Callers can chain normal E2B TemplateBuilder operations before building.\n *\n * 三种 agent 的产物共享同一份 Node 工具契约:运行用户的 npm global prefix 是\n * `/usr/local`,`/usr/local/bin` 在 PATH 中,该前缀下的 bin 与 module 目录对它可写。\n * 因此叠加全局 Node 工具用普通 `npm install -g <pkg>` 即可,不按 agent 分支。\n */\nexport function e2bCodingAgentTemplate(agent: E2BCodingAgent, options: E2BCodingAgentTemplateOptions = {}): TemplateBuilder {\n if (agent === \"claude-code\" || agent === \"codex\") {\n if (options.bubPythonPackages?.length) {\n throw new Error(\"bubPythonPackages can only be used with the Bub E2B template\");\n }\n const template = withNodeToolContract(Template().fromTemplate(E2B_OFFICIAL_AGENT_TEMPLATES[agent]));\n if (agent === \"claude-code\") {\n // E2B's official template puts a native Claude binary first in the user PATH; installing\n // npm as root would leave that older binary shadowing /usr/local/bin/claude.\n return template.runCmd(`curl -fsSL https://claude.ai/install.sh | bash -s ${DEFAULT_CLAUDE_CODE_CLI_VERSION}`, { user: E2B_RUN_USER });\n }\n return template.runCmd(`npm install -g @openai/codex@${DEFAULT_CODEX_CLI_VERSION}`, { user: \"root\" });\n }\n const packages = normalizeBubPackages(options.bubPythonPackages ?? []);\n const installHash = bubInstallHash(packages, DEFAULT_BUB_REQUIREMENT, DEFAULT_BUB_OTEL_PLUGIN, DEFAULT_BUB_DEPENDENCY_OVERRIDES);\n const withPackages = packages.map((value) => ` --with ${shellQuote(value)}`).join(\"\");\n const marker = `/home/user/${BUB_INSTALL_MARKER}`;\n const overrideFile = \"/tmp/bub-override.txt\";\n const overrides = [DEFAULT_BUB_REQUIREMENT, ...DEFAULT_BUB_DEPENDENCY_OVERRIDES]\n .map(shellQuote)\n .join(\" \");\n return withNodeToolContract(Template().fromBaseImage())\n .runCmd(\"curl -LsSf https://astral.sh/uv/install.sh | sh\", { user: E2B_RUN_USER })\n .runCmd([\n // override 把 `bub` 钉成一个 PyPI 版本:OTel 插件所在 workspace 把 bub 声明成 git\n // 依赖,不覆盖的话构建会拉到 Bub 主干,模板里装的版本随构建时间漂移。\n `printf '%s\\\\n' ${overrides} > ${overrideFile}`,\n `$HOME/.local/bin/uv tool install --python 3.12 --prerelease allow bub --overrides ${overrideFile} --with ${shellQuote(DEFAULT_BUB_OTEL_PLUGIN)}${withPackages}`,\n `mkdir -p $(dirname ${marker}) && printf '%s' ${shellQuote(installHash)} > ${marker}`,\n ], { user: E2B_RUN_USER });\n}\n"]}