niceeval 0.13.3 → 0.13.4-canary.39

package/dist/sandbox/compose.d.cts

@@ -1,7 +1,7 @@
 import { Effect, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.cjs";
 import { type LeakGateHints } from "../runner/leak-gate.cjs";
-import type { SandboxBuildExecutionContext, SandboxBuildProvider, SandboxBuildWork } from "./build-coordinator.cjs";
+import { type SandboxBuildExecutionContext, type SandboxBuildProvider, type SandboxBuildWork } from "./build-coordinator.cjs";
 import type { MaterializedSandboxCase, SandboxMaterializeContext } from "./case-types.cjs";
 import { type BuildKey } from "./identity.cjs";
 import { type RunIdentity } from "./run-identity.cjs";

package/dist/sandbox/compose.d.mts

@@ -1,7 +1,7 @@
 import { Effect, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.mjs";
 import { type LeakGateHints } from "../runner/leak-gate.mjs";
-import type { SandboxBuildExecutionContext, SandboxBuildProvider, SandboxBuildWork } from "./build-coordinator.mjs";
+import { type SandboxBuildExecutionContext, type SandboxBuildProvider, type SandboxBuildWork } from "./build-coordinator.mjs";
 import type { MaterializedSandboxCase, SandboxMaterializeContext } from "./case-types.mjs";
 import { type BuildKey } from "./identity.mjs";
 import { type RunIdentity } from "./run-identity.mjs";

package/dist/sandbox/compose.d.ts

@@ -1,7 +1,7 @@
 import { Effect, type Scope } from "effect";
 import type { JsonValue } from "../shared/types.js";
 import { type LeakGateHints } from "../runner/leak-gate.js";
-import type { SandboxBuildExecutionContext, SandboxBuildProvider, SandboxBuildWork } from "./build-coordinator.js";
+import { type SandboxBuildExecutionContext, type SandboxBuildProvider, type SandboxBuildWork } from "./build-coordinator.js";
 import type { MaterializedSandboxCase, SandboxMaterializeContext } from "./case-types.js";
 import { type BuildKey } from "./identity.js";
 import { type RunIdentity } from "./run-identity.js";

package/dist/sandbox/docker-profile/cli.cjs

@@ -88,7 +88,9 @@ async function smokeProfile(alias) {
                 MemorySwap: 512 * 1024 * 1024,
                 PidsLimit: 256,
                 ReadonlyRootfs: true,
-                Dns: [...binding.profile.policy.network.dns.servers],
+                ...(binding.profile.policy.level === "managed-rootless/v1"
+                    ? { Dns: [...binding.profile.policy.network.dns.servers] }
+                    : {}),
                 Tmpfs: {
                     "/var/lib/docker": "rw,exec,nosuid,nodev,size=256m",
                     "/run": "rw,exec,nosuid,nodev,size=64m",
@@ -139,7 +141,7 @@ async function smokeProfile(alias) {
 }
 async function runDockerProfileCommand(positionals, options) {
     if (positionals[0] !== "profile") {
-        process.stderr.write("Usage: niceeval docker profile list [--json]\n" +
+        options.err("Usage: niceeval docker profile list [--json]\n" +
             "       niceeval docker profile doctor <alias> [--smoke] [--json]\n");
         return 1;
     }
@@ -156,14 +158,14 @@ async function runDockerProfileCommand(positionals, options) {
                 health: "descriptor-valid",
             }));
             if (options.json)
-                process.stdout.write(`${JSON.stringify({ format: "niceeval.docker-profiles", schemaVersion: 1, profiles: rows })}\n`);
+                options.out(`${JSON.stringify({ format: "niceeval.docker-profiles", schemaVersion: 1, profiles: rows })}\n`);
             else
                 for (const row of rows)
-                    process.stdout.write(`${row.alias}\t${row.profileId.slice(0, 12)}\t${row.securityLevel}\tpolicy ${row.semanticPolicyRevision.slice(0, 12)}\t${row.health}\n`);
+                    options.out(`${row.alias}\t${row.profileId.slice(0, 12)}\t${row.securityLevel}\tpolicy ${row.semanticPolicyRevision.slice(0, 12)}\t${row.health}\n`);
             return 0;
         }
         catch (error) {
-            process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+            options.err(`${error instanceof Error ? error.message : String(error)}\n`);
             return 1;
         }
     }
@@ -172,7 +174,9 @@ async function runDockerProfileCommand(positionals, options) {
         const checks = [];
         try {
             const binding = await (0, runtime_ts_1.attestDockerProfile)(alias);
-            checks.push({ name: "descriptor and registry", status: "PASS", detail: binding.descriptorDigest }, { name: "Docker/control attestation", status: "PASS", detail: `generation ${binding.daemonGeneration}` }, { name: "rootless cgroup backend", status: "PASS", detail: `${binding.platform} · ${binding.profile.backend.cgroup.aggregatePath}` }, { name: "network policy", status: "PASS", detail: `v${binding.profile.policy.network.version} · IPv6 disabled · pinned DNS` });
+            checks.push({ name: "descriptor and registry", status: "PASS", detail: binding.descriptorDigest }, { name: "Docker/control attestation", status: "PASS", detail: `generation ${binding.daemonGeneration}` }, { name: "cgroup backend", status: "PASS", detail: `${binding.platform} · ${binding.profile.backend.cgroup.aggregatePath}` }, binding.profile.policy.level === "managed-rootless/v1"
+                ? { name: "network policy", status: "PASS", detail: `v${binding.profile.policy.network.version} · IPv6 disabled · pinned DNS` }
+                : { name: "raw storage policy", status: "PASS", detail: "project-quota Docker data allocation; no rootless/network claim" });
             if (options.smoke)
                 checks.push(...await smokeProfile(alias));
         }
@@ -180,13 +184,13 @@ async function runDockerProfileCommand(positionals, options) {
             checks.push({ name: "profile", status: "FAIL", detail: error instanceof Error ? error.message : String(error) });
         }
         if (options.json)
-            process.stdout.write(`${JSON.stringify({ format: "niceeval.docker-profile-doctor", schemaVersion: 1, alias, checks })}\n`);
+            options.out(`${JSON.stringify({ format: "niceeval.docker-profile-doctor", schemaVersion: 1, alias, checks })}\n`);
         else
             for (const check of checks)
-                process.stdout.write(`${check.status}  ${check.name}  ${check.detail}\n`);
+                options.out(`${check.status}  ${check.name}  ${check.detail}\n`);
         return checks.some((check) => check.status === "FAIL") ? 1 : 0;
     }
-    process.stderr.write("Usage: niceeval docker profile list [--json]\n" +
+    options.err("Usage: niceeval docker profile list [--json]\n" +
         "       niceeval docker profile doctor <alias> [--smoke] [--json]\n");
     return 1;
 }

package/dist/sandbox/docker-profile/cli.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["cli.ts"],"names":[],"mappings":";;;AAgCA,sEAIC;AAmHD,0DAoDC;AA3MD,6CAAyC;AAEzC,6CAA2M;AAU3M,qFAAqF;AACxE,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,SAAS;IACT,oCAAoC;IACpC,sBAAsB;CAChB,CAAC,CAAC;AACZ,2FAA2F;AAC9E,QAAA,qCAAqC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,IAAI;IACJ,KAAK;IACL;QACI,+CAA+C;QAC/C,iCAAiC;QACjC,8GAA8G;QAC9G,MAAM;KACT,CAAC,IAAI,CAAC,IAAI,CAAC;CAIf,CAAC,CAAC;AACH,SAAgB,6BAA6B;IAGzC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,sCAA8B,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,KAAa;IAC7C,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO;IACX,CAAC;IACD,MAAM,CAAC,CAAC,CAAC;IACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACpI,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,SAA2B,EAAE,OAA0B;IAIvE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC;AACnH,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,KAAK,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,IAAA,4CAA+B,EAAC,KAAK,EAAE,WAAW,EAAE;QAC1E,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC9B,IAAI,EAAE,GAAG;QACT,UAAU,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG;QACX,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QAChD,wBAAwB,EAAE,KAAK,CAAC,YAAY;QAC5C,yBAAyB,EAAE,WAAW,CAAC,aAAa;QACpD,0BAA0B,EAAE,WAAW,CAAC,cAAc;QACtD,qBAAqB,EAAE,cAAc;KACxC,CAAC;IACF,qDAAqD;IACrD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC1E,IAAI,SAAuC,CAAC;IAC5C,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YACjC,IAAI,EAAE,mBAAmB,IAAA,wBAAU,GAAE,EAAE;YACvC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,sCAAsC,EAAE,OAAO,EAAE;YAC5D,MAAM,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;YACrC,KAAK,EAAE,gBAAgB;YACvB,GAAG,6BAA6B,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,UAAU,EAAE;gBACR,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,OAAO,CAAC,EAAE;gBACvB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;gBACzB,UAAU,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;gBAC7B,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,IAAI;gBACpB,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;gBACpD,KAAK,EAAE;oBACH,iBAAiB,EAAE,gCAAgC;oBACnD,MAAM,EAAE,+BAA+B;oBACvC,MAAM,EAAE,oCAAoC;iBAC/C;aACJ;SACJ,CAAC,CAAC;QACH,MAAM,IAAA,2CAA8B,EAAC,KAAK,EAAE,WAAW,CAAC,aAAa,EAAE;YACnE,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,cAAc;SAC5B,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACV,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,6CAAqC,CAAC,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2DAA2D,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,6GAA6G,CAAC,CAAC,CAAC;QAClK,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO;YACH,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE;YAChG,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;YACjG,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE;SACtF,CAAC;IACN,CAAC;YACO,CAAC;QACL,MAAM,IAAA,4CAA+B,EAAC,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACrF,MAAM,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;AACL,CAAC;AACM,KAAK,UAAU,uBAAuB,CAAC,WAA8B,EAAE,OAAgC;IAC1G,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD;YACjE,oEAAoE,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,UAAU,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtE,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAyB,GAAE,CAAC;YACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;gBAC1C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;gBAC5D,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI;gBAC1C,MAAM,EAAE,kBAAkB;aAC7B,CAAC,CAAC,CAAC;YACJ,IAAI,OAAO,CAAC,IAAI;gBACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;;gBAEtH,KAAK,MAAM,GAAG,IAAI,IAAI;oBAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,aAAa,YAAY,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACtK,OAAO,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpF,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,OAAO,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,+BAA+B,EAAE,CAAC,CAAC;YACld,IAAI,OAAO,CAAC,KAAK;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;;YAE3H,KAAK,MAAM,KAAK,IAAI,MAAM;gBACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD;QACjE,oEAAoE,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type Docker from \"dockerode\";\nimport { acquireDockerProfileReservation, attestDockerProfile, commitDockerProfileReservation, createDockerProfileLease, loadDockerProfileRegistry, releaseDockerProfileReservation, } from \"./runtime.ts\";\nexport interface DockerProfileCliOptions {\n    readonly json: boolean;\n    readonly smoke: boolean;\n}\ninterface Check {\n    readonly name: string;\n    readonly status: \"PASS\" | \"FAIL\";\n    readonly detail: string;\n}\n/** Keep Docker's official entrypoint, but bypass its automatic TCP/TLS selection. */\nexport const DOCKER_PROFILE_DOCTOR_DIND_CMD = Object.freeze([\n    \"dockerd\",\n    \"--host=unix:///var/run/docker.sock\",\n    \"--shutdown-timeout=2\",\n] as const);\n/** `/proc/net/tcp{,6}` exposes listening sockets without requiring an extra image tool. */\nexport const DOCKER_PROFILE_DOCTOR_UNIX_ONLY_CHECK = Object.freeze([\n    \"sh\",\n    \"-ec\",\n    [\n        \"for table in /proc/net/tcp /proc/net/tcp6; do\",\n        \"  [ -r \\\"$table\\\" ] || continue\",\n        \"  awk '$4 == \\\"0A\\\" && ($2 ~ /:0947$/ || $2 ~ /:0948$/) { found = 1 } END { exit found ? 1 : 0 }' \\\"$table\\\"\",\n        \"done\",\n    ].join(\"\\n\"),\n] as const satisfies readonly [\n    string,\n    ...string[]\n]);\nexport function dockerProfileDoctorDindConfig(): {\n    Cmd: string[];\n} {\n    return Object.freeze({ Cmd: [...DOCKER_PROFILE_DOCTOR_DIND_CMD] });\n}\nasync function pull(docker: Docker, image: string): Promise<void> {\n    try {\n        await docker.getImage(image).inspect();\n        return;\n    }\n    catch { }\n    const stream = await docker.pull(image);\n    await new Promise<void>((resolve, reject) => docker.modem.followProgress(stream, (error) => error ? reject(error) : resolve()));\n}\nasync function exec(container: Docker.Container, command: readonly string[]): Promise<{\n    code: number;\n    output: string;\n}> {\n    const process = await container.exec({ Cmd: [...command], AttachStdout: true, AttachStderr: true });\n    const stream = await process.start({});\n    const chunks: Buffer[] = [];\n    await new Promise<void>((resolve, reject) => {\n        stream.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n        stream.on(\"end\", resolve);\n        stream.on(\"error\", reject);\n    });\n    const inspected = await process.inspect();\n    return { code: inspected.ExitCode ?? 1, output: Buffer.concat(chunks).toString().replace(/[\\x00-\\x08]/g, \"\") };\n}\nasync function smokeProfile(alias: string): Promise<Check[]> {\n    const binding = await attestDockerProfile(alias);\n    const lease = await createDockerProfileLease(binding);\n    const reservation = await acquireDockerProfileReservation(lease, \"container\", {\n        cpus: 2,\n        memoryBytes: 512 * 1024 * 1024,\n        pids: 256,\n        containers: 1,\n    });\n    const labels = {\n        \"niceeval.profile-id\": binding.profile.profileId,\n        \"niceeval.invocation-id\": lease.invocationId,\n        \"niceeval.reservation-id\": reservation.reservationId,\n        \"niceeval.provision-token\": reservation.provisionToken,\n        \"niceeval.attempt-id\": \"doctor-smoke\",\n    };\n    // doctor 的非 smoke 路径也不应要求安装 optional dockerode peer。\n    const { default: DockerClient } = await __niceevalDynamicImport(\"dockerode\");\n    const docker = new DockerClient({ socketPath: binding.dockerSocketPath });\n    let container: Docker.Container | undefined;\n    let network: Docker.Network | undefined;\n    try {\n        await pull(docker, \"docker:29-dind\");\n        network = await docker.createNetwork({\n            Name: `niceeval-doctor-${randomUUID()}`,\n            Driver: \"bridge\",\n            Options: { \"com.docker.network.bridge.enable_icc\": \"false\" },\n            Labels: labels,\n        });\n        container = await docker.createContainer({\n            Image: \"docker:29-dind\",\n            ...dockerProfileDoctorDindConfig(),\n            Labels: labels,\n            HostConfig: {\n                Privileged: true,\n                NetworkMode: network.id,\n                NanoCpus: 2000000000,\n                Memory: 512 * 1024 * 1024,\n                MemorySwap: 512 * 1024 * 1024,\n                PidsLimit: 256,\n                ReadonlyRootfs: true,\n                Dns: [...binding.profile.policy.network.dns.servers],\n                Tmpfs: {\n                    \"/var/lib/docker\": \"rw,exec,nosuid,nodev,size=256m\",\n                    \"/run\": \"rw,exec,nosuid,nodev,size=64m\",\n                    \"/tmp\": \"rw,nosuid,nodev,size=64m,mode=1777\",\n                },\n            },\n        });\n        await commitDockerProfileReservation(lease, reservation.reservationId, {\n            containerId: container.id,\n            networkId: network.id,\n            attemptId: \"doctor-smoke\",\n        });\n        await container.start();\n        let ready = false;\n        for (let attempt = 0; attempt < 120; attempt += 1) {\n            const result = await exec(container, [\"docker\", \"info\"]);\n            if (result.code === 0) {\n                ready = true;\n                break;\n            }\n            await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n        if (!ready)\n            throw new Error(\"inner dockerd did not become ready within 30 seconds\");\n        const unixOnly = await exec(container, [...DOCKER_PROFILE_DOCTOR_UNIX_ONLY_CHECK]);\n        if (unixOnly.code !== 0) {\n            throw new Error(`inner dockerd unexpectedly listens on TCP 2375 or 2376: ${unixOnly.output}`);\n        }\n        const limits = await exec(container, [\"sh\", \"-c\", \"cat /sys/fs/cgroup/cpu.max /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.swap.max /sys/fs/cgroup/pids.max\"]);\n        if (limits.code !== 0)\n            throw new Error(`cgroup probe failed: ${limits.output}`);\n        const nested = await exec(container, [\"docker\", \"run\", \"--rm\", \"alpine:3.20\", \"true\"]);\n        if (nested.code !== 0)\n            throw new Error(`nested Docker failed: ${nested.output}`);\n        return [\n            { name: \"Unix-only Docker endpoint\", status: \"PASS\", detail: \"no TCP listener on 2375 or 2376\" },\n            { name: \"outer hard limits\", status: \"PASS\", detail: limits.output.trim().replace(/\\n/g, \" · \") },\n            { name: \"nested Docker\", status: \"PASS\", detail: \"docker:29-dind ran alpine:3.20\" },\n        ];\n    }\n    finally {\n        await releaseDockerProfileReservation(lease, reservation.reservationId).catch(async () => {\n            await container?.remove({ force: true }).catch(() => undefined);\n            await network?.remove().catch(() => undefined);\n        });\n        await lease.stopHeartbeat().catch(() => undefined);\n    }\n}\nexport async function runDockerProfileCommand(positionals: readonly string[], options: DockerProfileCliOptions): Promise<number> {\n    if (positionals[0] !== \"profile\") {\n        process.stderr.write(\"Usage: niceeval docker profile list [--json]\\n\" +\n            \"       niceeval docker profile doctor <alias> [--smoke] [--json]\\n\");\n        return 1;\n    }\n    const subcommand = positionals[1];\n    if (subcommand === \"list\" && positionals.length === 2 && !options.smoke) {\n        try {\n            const registry = await loadDockerProfileRegistry();\n            const rows = registry.entries.map((entry) => ({\n                alias: entry.alias,\n                profileId: entry.profileId,\n                securityLevel: entry.profile.securityLevel,\n                semanticPolicyRevision: entry.profile.semanticPolicyRevision,\n                endpointKind: entry.profile.transport.kind,\n                health: \"descriptor-valid\",\n            }));\n            if (options.json)\n                process.stdout.write(`${JSON.stringify({ format: \"niceeval.docker-profiles\", schemaVersion: 1, profiles: rows })}\\n`);\n            else\n                for (const row of rows)\n                    process.stdout.write(`${row.alias}\\t${row.profileId.slice(0, 12)}\\t${row.securityLevel}\\tpolicy ${row.semanticPolicyRevision.slice(0, 12)}\\t${row.health}\\n`);\n            return 0;\n        }\n        catch (error) {\n            process.stderr.write(`${error instanceof Error ? error.message : String(error)}\\n`);\n            return 1;\n        }\n    }\n    if (subcommand === \"doctor\" && positionals.length === 3) {\n        const alias = positionals[2]!;\n        const checks: Check[] = [];\n        try {\n            const binding = await attestDockerProfile(alias);\n            checks.push({ name: \"descriptor and registry\", status: \"PASS\", detail: binding.descriptorDigest }, { name: \"Docker/control attestation\", status: \"PASS\", detail: `generation ${binding.daemonGeneration}` }, { name: \"rootless cgroup backend\", status: \"PASS\", detail: `${binding.platform} · ${binding.profile.backend.cgroup.aggregatePath}` }, { name: \"network policy\", status: \"PASS\", detail: `v${binding.profile.policy.network.version} · IPv6 disabled · pinned DNS` });\n            if (options.smoke)\n                checks.push(...await smokeProfile(alias));\n        }\n        catch (error) {\n            checks.push({ name: \"profile\", status: \"FAIL\", detail: error instanceof Error ? error.message : String(error) });\n        }\n        if (options.json)\n            process.stdout.write(`${JSON.stringify({ format: \"niceeval.docker-profile-doctor\", schemaVersion: 1, alias, checks })}\\n`);\n        else\n            for (const check of checks)\n                process.stdout.write(`${check.status}  ${check.name}  ${check.detail}\\n`);\n        return checks.some((check) => check.status === \"FAIL\") ? 1 : 0;\n    }\n    process.stderr.write(\"Usage: niceeval docker profile list [--json]\\n\" +\n        \"       niceeval docker profile doctor <alias> [--smoke] [--json]\\n\");\n    return 1;\n}\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["cli.ts"],"names":[],"mappings":";;;AAkCA,sEAIC;AAqHD,0DAsDC;AAjND,6CAAyC;AAEzC,6CAA2M;AAY3M,qFAAqF;AACxE,QAAA,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IACxD,SAAS;IACT,oCAAoC;IACpC,sBAAsB;CAChB,CAAC,CAAC;AACZ,2FAA2F;AAC9E,QAAA,qCAAqC,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/D,IAAI;IACJ,KAAK;IACL;QACI,+CAA+C;QAC/C,iCAAiC;QACjC,8GAA8G;QAC9G,MAAM;KACT,CAAC,IAAI,CAAC,IAAI,CAAC;CAIf,CAAC,CAAC;AACH,SAAgB,6BAA6B;IAGzC,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,sCAA8B,CAAC,EAAE,CAAC,CAAC;AACvE,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,KAAa;IAC7C,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QACvC,OAAO;IACX,CAAC;IACD,MAAM,CAAC,CAAC,CAAC;IACT,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACpI,CAAC;AACD,KAAK,UAAU,IAAI,CAAC,SAA2B,EAAE,OAA0B;IAIvE,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,EAAE,CAAC;AACnH,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,KAAa;IACrC,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,KAAK,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,IAAA,qCAAwB,EAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,MAAM,IAAA,4CAA+B,EAAC,KAAK,EAAE,WAAW,EAAE;QAC1E,IAAI,EAAE,CAAC;QACP,WAAW,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;QAC9B,IAAI,EAAE,GAAG;QACT,UAAU,EAAE,CAAC;KAChB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG;QACX,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QAChD,wBAAwB,EAAE,KAAK,CAAC,YAAY;QAC5C,yBAAyB,EAAE,WAAW,CAAC,aAAa;QACpD,0BAA0B,EAAE,WAAW,CAAC,cAAc;QACtD,qBAAqB,EAAE,cAAc;KACxC,CAAC;IACF,qDAAqD;IACrD,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC1E,IAAI,SAAuC,CAAC;IAC5C,IAAI,OAAmC,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;YACjC,IAAI,EAAE,mBAAmB,IAAA,wBAAU,GAAE,EAAE;YACvC,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,sCAAsC,EAAE,OAAO,EAAE;YAC5D,MAAM,EAAE,MAAM;SACjB,CAAC,CAAC;QACH,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;YACrC,KAAK,EAAE,gBAAgB;YACvB,GAAG,6BAA6B,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,UAAU,EAAE;gBACR,UAAU,EAAE,IAAI;gBAChB,WAAW,EAAE,OAAO,CAAC,EAAE;gBACvB,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;gBACzB,UAAU,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;gBAC7B,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,IAAI;gBACpB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB;oBACtD,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;oBAC1D,CAAC,CAAC,EAAE,CAAC;gBACT,KAAK,EAAE;oBACH,iBAAiB,EAAE,gCAAgC;oBACnD,MAAM,EAAE,+BAA+B;oBACvC,MAAM,EAAE,oCAAoC;iBAC/C;aACJ;SACJ,CAAC,CAAC;QACH,MAAM,IAAA,2CAA8B,EAAC,KAAK,EAAE,WAAW,CAAC,aAAa,EAAE;YACnE,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,SAAS,EAAE,cAAc;SAC5B,CAAC,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,KAAK,GAAG,KAAK,CAAC;QAClB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACpB,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM;YACV,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,CAAC,KAAK;YACN,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,6CAAqC,CAAC,CAAC,CAAC;QACnF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,2DAA2D,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,6GAA6G,CAAC,CAAC,CAAC;QAClK,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,OAAO;YACH,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iCAAiC,EAAE;YAChG,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE;YACjG,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gCAAgC,EAAE;SACtF,CAAC;IACN,CAAC;YACO,CAAC;QACL,MAAM,IAAA,4CAA+B,EAAC,KAAK,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE;YACrF,MAAM,SAAS,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAChE,MAAM,OAAO,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;AACL,CAAC;AACM,KAAK,UAAU,uBAAuB,CAAC,WAA8B,EAAE,OAAgC;IAC1G,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,gDAAgD;YACxD,oEAAoE,CAAC,CAAC;QAC1E,OAAO,CAAC,CAAC;IACb,CAAC;IACD,MAAM,UAAU,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,UAAU,KAAK,MAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACtE,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAA,sCAAyB,GAAE,CAAC;YACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC1C,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa;gBAC1C,sBAAsB,EAAE,KAAK,CAAC,OAAO,CAAC,sBAAsB;gBAC5D,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI;gBAC1C,MAAM,EAAE,kBAAkB;aAC7B,CAAC,CAAC,CAAC;YACJ,IAAI,OAAO,CAAC,IAAI;gBACZ,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;;gBAE7G,KAAK,MAAM,GAAG,IAAI,IAAI;oBAClB,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,aAAa,YAAY,GAAG,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YAC7J,OAAO,CAAC,CAAC;QACb,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3E,OAAO,CAAC,CAAC;QACb,CAAC;IACL,CAAC;IACD,IAAI,UAAU,KAAK,QAAQ,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAE,CAAC;QAC9B,MAAM,MAAM,GAAY,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAA,gCAAmB,EAAC,KAAK,CAAC,CAAC;YACjD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,gBAAgB,EAAE,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,OAAO,CAAC,gBAAgB,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB;gBAC5X,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,+BAA+B,EAAE;gBAC/H,CAAC,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,iEAAiE,EAAE,CAAC,CAAC;YACjI,IAAI,OAAO,CAAC,KAAK;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,KAAK,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,CAAC,IAAI;YACZ,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,aAAa,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;;YAElH,KAAK,MAAM,KAAK,IAAI,MAAM;gBACtB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gDAAgD;QACxD,oEAAoE,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC;AACb,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport type Docker from \"dockerode\";\nimport { acquireDockerProfileReservation, attestDockerProfile, commitDockerProfileReservation, createDockerProfileLease, loadDockerProfileRegistry, releaseDockerProfileReservation, } from \"./runtime.ts\";\nexport interface DockerProfileCliOptions {\n    readonly json: boolean;\n    readonly smoke: boolean;\n    readonly out: (text: string) => void;\n    readonly err: (text: string) => void;\n}\ninterface Check {\n    readonly name: string;\n    readonly status: \"PASS\" | \"FAIL\";\n    readonly detail: string;\n}\n/** Keep Docker's official entrypoint, but bypass its automatic TCP/TLS selection. */\nexport const DOCKER_PROFILE_DOCTOR_DIND_CMD = Object.freeze([\n    \"dockerd\",\n    \"--host=unix:///var/run/docker.sock\",\n    \"--shutdown-timeout=2\",\n] as const);\n/** `/proc/net/tcp{,6}` exposes listening sockets without requiring an extra image tool. */\nexport const DOCKER_PROFILE_DOCTOR_UNIX_ONLY_CHECK = Object.freeze([\n    \"sh\",\n    \"-ec\",\n    [\n        \"for table in /proc/net/tcp /proc/net/tcp6; do\",\n        \"  [ -r \\\"$table\\\" ] || continue\",\n        \"  awk '$4 == \\\"0A\\\" && ($2 ~ /:0947$/ || $2 ~ /:0948$/) { found = 1 } END { exit found ? 1 : 0 }' \\\"$table\\\"\",\n        \"done\",\n    ].join(\"\\n\"),\n] as const satisfies readonly [\n    string,\n    ...string[]\n]);\nexport function dockerProfileDoctorDindConfig(): {\n    Cmd: string[];\n} {\n    return Object.freeze({ Cmd: [...DOCKER_PROFILE_DOCTOR_DIND_CMD] });\n}\nasync function pull(docker: Docker, image: string): Promise<void> {\n    try {\n        await docker.getImage(image).inspect();\n        return;\n    }\n    catch { }\n    const stream = await docker.pull(image);\n    await new Promise<void>((resolve, reject) => docker.modem.followProgress(stream, (error) => error ? reject(error) : resolve()));\n}\nasync function exec(container: Docker.Container, command: readonly string[]): Promise<{\n    code: number;\n    output: string;\n}> {\n    const process = await container.exec({ Cmd: [...command], AttachStdout: true, AttachStderr: true });\n    const stream = await process.start({});\n    const chunks: Buffer[] = [];\n    await new Promise<void>((resolve, reject) => {\n        stream.on(\"data\", (chunk: Buffer) => chunks.push(chunk));\n        stream.on(\"end\", resolve);\n        stream.on(\"error\", reject);\n    });\n    const inspected = await process.inspect();\n    return { code: inspected.ExitCode ?? 1, output: Buffer.concat(chunks).toString().replace(/[\\x00-\\x08]/g, \"\") };\n}\nasync function smokeProfile(alias: string): Promise<Check[]> {\n    const binding = await attestDockerProfile(alias);\n    const lease = await createDockerProfileLease(binding);\n    const reservation = await acquireDockerProfileReservation(lease, \"container\", {\n        cpus: 2,\n        memoryBytes: 512 * 1024 * 1024,\n        pids: 256,\n        containers: 1,\n    });\n    const labels = {\n        \"niceeval.profile-id\": binding.profile.profileId,\n        \"niceeval.invocation-id\": lease.invocationId,\n        \"niceeval.reservation-id\": reservation.reservationId,\n        \"niceeval.provision-token\": reservation.provisionToken,\n        \"niceeval.attempt-id\": \"doctor-smoke\",\n    };\n    // doctor 的非 smoke 路径也不应要求安装 optional dockerode peer。\n    const { default: DockerClient } = await __niceevalDynamicImport(\"dockerode\");\n    const docker = new DockerClient({ socketPath: binding.dockerSocketPath });\n    let container: Docker.Container | undefined;\n    let network: Docker.Network | undefined;\n    try {\n        await pull(docker, \"docker:29-dind\");\n        network = await docker.createNetwork({\n            Name: `niceeval-doctor-${randomUUID()}`,\n            Driver: \"bridge\",\n            Options: { \"com.docker.network.bridge.enable_icc\": \"false\" },\n            Labels: labels,\n        });\n        container = await docker.createContainer({\n            Image: \"docker:29-dind\",\n            ...dockerProfileDoctorDindConfig(),\n            Labels: labels,\n            HostConfig: {\n                Privileged: true,\n                NetworkMode: network.id,\n                NanoCpus: 2000000000,\n                Memory: 512 * 1024 * 1024,\n                MemorySwap: 512 * 1024 * 1024,\n                PidsLimit: 256,\n                ReadonlyRootfs: true,\n                ...(binding.profile.policy.level === \"managed-rootless/v1\"\n                    ? { Dns: [...binding.profile.policy.network.dns.servers] }\n                    : {}),\n                Tmpfs: {\n                    \"/var/lib/docker\": \"rw,exec,nosuid,nodev,size=256m\",\n                    \"/run\": \"rw,exec,nosuid,nodev,size=64m\",\n                    \"/tmp\": \"rw,nosuid,nodev,size=64m,mode=1777\",\n                },\n            },\n        });\n        await commitDockerProfileReservation(lease, reservation.reservationId, {\n            containerId: container.id,\n            networkId: network.id,\n            attemptId: \"doctor-smoke\",\n        });\n        await container.start();\n        let ready = false;\n        for (let attempt = 0; attempt < 120; attempt += 1) {\n            const result = await exec(container, [\"docker\", \"info\"]);\n            if (result.code === 0) {\n                ready = true;\n                break;\n            }\n            await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n        if (!ready)\n            throw new Error(\"inner dockerd did not become ready within 30 seconds\");\n        const unixOnly = await exec(container, [...DOCKER_PROFILE_DOCTOR_UNIX_ONLY_CHECK]);\n        if (unixOnly.code !== 0) {\n            throw new Error(`inner dockerd unexpectedly listens on TCP 2375 or 2376: ${unixOnly.output}`);\n        }\n        const limits = await exec(container, [\"sh\", \"-c\", \"cat /sys/fs/cgroup/cpu.max /sys/fs/cgroup/memory.max /sys/fs/cgroup/memory.swap.max /sys/fs/cgroup/pids.max\"]);\n        if (limits.code !== 0)\n            throw new Error(`cgroup probe failed: ${limits.output}`);\n        const nested = await exec(container, [\"docker\", \"run\", \"--rm\", \"alpine:3.20\", \"true\"]);\n        if (nested.code !== 0)\n            throw new Error(`nested Docker failed: ${nested.output}`);\n        return [\n            { name: \"Unix-only Docker endpoint\", status: \"PASS\", detail: \"no TCP listener on 2375 or 2376\" },\n            { name: \"outer hard limits\", status: \"PASS\", detail: limits.output.trim().replace(/\\n/g, \" · \") },\n            { name: \"nested Docker\", status: \"PASS\", detail: \"docker:29-dind ran alpine:3.20\" },\n        ];\n    }\n    finally {\n        await releaseDockerProfileReservation(lease, reservation.reservationId).catch(async () => {\n            await container?.remove({ force: true }).catch(() => undefined);\n            await network?.remove().catch(() => undefined);\n        });\n        await lease.stopHeartbeat().catch(() => undefined);\n    }\n}\nexport async function runDockerProfileCommand(positionals: readonly string[], options: DockerProfileCliOptions): Promise<number> {\n    if (positionals[0] !== \"profile\") {\n        options.err(\"Usage: niceeval docker profile list [--json]\\n\" +\n            \"       niceeval docker profile doctor <alias> [--smoke] [--json]\\n\");\n        return 1;\n    }\n    const subcommand = positionals[1];\n    if (subcommand === \"list\" && positionals.length === 2 && !options.smoke) {\n        try {\n            const registry = await loadDockerProfileRegistry();\n            const rows = registry.entries.map((entry) => ({\n                alias: entry.alias,\n                profileId: entry.profileId,\n                securityLevel: entry.profile.securityLevel,\n                semanticPolicyRevision: entry.profile.semanticPolicyRevision,\n                endpointKind: entry.profile.transport.kind,\n                health: \"descriptor-valid\",\n            }));\n            if (options.json)\n                options.out(`${JSON.stringify({ format: \"niceeval.docker-profiles\", schemaVersion: 1, profiles: rows })}\\n`);\n            else\n                for (const row of rows)\n                    options.out(`${row.alias}\\t${row.profileId.slice(0, 12)}\\t${row.securityLevel}\\tpolicy ${row.semanticPolicyRevision.slice(0, 12)}\\t${row.health}\\n`);\n            return 0;\n        }\n        catch (error) {\n            options.err(`${error instanceof Error ? error.message : String(error)}\\n`);\n            return 1;\n        }\n    }\n    if (subcommand === \"doctor\" && positionals.length === 3) {\n        const alias = positionals[2]!;\n        const checks: Check[] = [];\n        try {\n            const binding = await attestDockerProfile(alias);\n            checks.push({ name: \"descriptor and registry\", status: \"PASS\", detail: binding.descriptorDigest }, { name: \"Docker/control attestation\", status: \"PASS\", detail: `generation ${binding.daemonGeneration}` }, { name: \"cgroup backend\", status: \"PASS\", detail: `${binding.platform} · ${binding.profile.backend.cgroup.aggregatePath}` }, binding.profile.policy.level === \"managed-rootless/v1\"\n                ? { name: \"network policy\", status: \"PASS\", detail: `v${binding.profile.policy.network.version} · IPv6 disabled · pinned DNS` }\n                : { name: \"raw storage policy\", status: \"PASS\", detail: \"project-quota Docker data allocation; no rootless/network claim\" });\n            if (options.smoke)\n                checks.push(...await smokeProfile(alias));\n        }\n        catch (error) {\n            checks.push({ name: \"profile\", status: \"FAIL\", detail: error instanceof Error ? error.message : String(error) });\n        }\n        if (options.json)\n            options.out(`${JSON.stringify({ format: \"niceeval.docker-profile-doctor\", schemaVersion: 1, alias, checks })}\\n`);\n        else\n            for (const check of checks)\n                options.out(`${check.status}  ${check.name}  ${check.detail}\\n`);\n        return checks.some((check) => check.status === \"FAIL\") ? 1 : 0;\n    }\n    options.err(\"Usage: niceeval docker profile list [--json]\\n\" +\n        \"       niceeval docker profile doctor <alias> [--smoke] [--json]\\n\");\n    return 1;\n}\n"]}

package/dist/sandbox/docker-profile/cli.d.cts

@@ -1,6 +1,8 @@
 export interface DockerProfileCliOptions {
     readonly json: boolean;
     readonly smoke: boolean;
+    readonly out: (text: string) => void;
+    readonly err: (text: string) => void;
 }
 /** Keep Docker's official entrypoint, but bypass its automatic TCP/TLS selection. */
 export declare const DOCKER_PROFILE_DOCTOR_DIND_CMD: readonly ["dockerd", "--host=unix:///var/run/docker.sock", "--shutdown-timeout=2"];

package/dist/sandbox/docker-profile/cli.d.mts

@@ -1,6 +1,8 @@
 export interface DockerProfileCliOptions {
     readonly json: boolean;
     readonly smoke: boolean;
+    readonly out: (text: string) => void;
+    readonly err: (text: string) => void;
 }
 /** Keep Docker's official entrypoint, but bypass its automatic TCP/TLS selection. */
 export declare const DOCKER_PROFILE_DOCTOR_DIND_CMD: readonly ["dockerd", "--host=unix:///var/run/docker.sock", "--shutdown-timeout=2"];

package/dist/sandbox/docker-profile/cli.d.ts

@@ -1,6 +1,8 @@
 export interface DockerProfileCliOptions {
     readonly json: boolean;
     readonly smoke: boolean;
+    readonly out: (text: string) => void;
+    readonly err: (text: string) => void;
 }
 /** Keep Docker's official entrypoint, but bypass its automatic TCP/TLS selection. */
 export declare const DOCKER_PROFILE_DOCTOR_DIND_CMD: readonly ["dockerd", "--host=unix:///var/run/docker.sock", "--shutdown-timeout=2"];

package/dist/sandbox/docker-profile/runtime.cjs

@@ -8,6 +8,7 @@ exports.attestDockerProfile = attestDockerProfile;
 exports.createDockerProfileLease = createDockerProfileLease;
 exports.acquireDockerProfileReservation = acquireDockerProfileReservation;
 exports.commitDockerProfileReservation = commitDockerProfileReservation;
+exports.createDockerProfileContainer = createDockerProfileContainer;
 exports.releaseDockerProfileReservation = releaseDockerProfileReservation;
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
@@ -108,8 +109,9 @@ async function attestEntry(entry) {
     const { default: Docker } = await __niceevalDynamicImport("dockerode");
     const docker = new Docker({ socketPath: profile.transport.dockerSocket.path });
     const info = await docker.info();
-    if (!rootlessSecurityOptions(info))
+    if (profile.securityLevel !== "raw-dind-storage/v1" && !rootlessSecurityOptions(info)) {
         throw new Error(`Docker profile ${entry.alias} daemon is not rootless`);
+    }
     if (info.DockerRootDir !== profile.backend.filesystem.dockerRootDir) {
         throw new Error(`Docker profile ${entry.alias} DockerRootDir does not match descriptor`);
     }
@@ -169,17 +171,49 @@ async function createDockerProfileLease(binding) {
         },
     };
 }
-async function acquireDockerProfileReservation(lease, reservationKind, resources) {
+async function acquireDockerProfileReservation(lease, reservationKind, resources, signal) {
     const reservationId = (0, node_crypto_1.randomUUID)();
     let reservation = await controlRequest(lease.binding.controlSocketPath, {
         kind: "reservation.acquire", invocationId: lease.invocationId, leaseToken: lease.leaseToken,
         reservationId, reservationKind, resources,
     });
-    while (reservation.state === "queued") {
-        await new Promise((resolve) => setTimeout(resolve, 100));
-        reservation = await controlRequest(lease.binding.controlSocketPath, {
-            kind: "reservation.get", invocationId: lease.invocationId, leaseToken: lease.leaseToken, reservationId,
-        });
+    try {
+        while (reservation.state === "queued") {
+            if (signal?.aborted)
+                throw signal.reason ?? new DOMException("Docker profile reservation aborted", "AbortError");
+            await new Promise((resolve, reject) => {
+                let abort;
+                const timer = setTimeout(() => {
+                    if (abort !== undefined)
+                        signal?.removeEventListener("abort", abort);
+                    resolve();
+                }, 100);
+                if (signal === undefined)
+                    return;
+                abort = () => {
+                    clearTimeout(timer);
+                    signal.removeEventListener("abort", abort);
+                    reject(signal.reason ?? new DOMException("Docker profile reservation aborted", "AbortError"));
+                };
+                signal.addEventListener("abort", abort, { once: true });
+            });
+            reservation = await controlRequest(lease.binding.controlSocketPath, {
+                kind: "reservation.get", invocationId: lease.invocationId, leaseToken: lease.leaseToken, reservationId,
+            });
+            if (signal?.aborted)
+                throw signal.reason ?? new DOMException("Docker profile reservation aborted", "AbortError");
+        }
+    }
+    catch (error) {
+        if (signal?.aborted) {
+            await controlRequest(lease.binding.controlSocketPath, {
+                kind: reservation.state === "queued" ? "reservation.cancel" : "reservation.release",
+                invocationId: lease.invocationId,
+                leaseToken: lease.leaseToken,
+                reservationId,
+            }).catch(() => undefined);
+        }
+        throw error;
     }
     return reservation;
 }
@@ -189,6 +223,33 @@ async function commitDockerProfileReservation(lease, reservationId, input) {
         reservationId, ...input,
     });
 }
+async function createDockerProfileContainer(lease, reservationId, create) {
+    try {
+        return await controlRequest(lease.binding.controlSocketPath, {
+            kind: "container.create",
+            invocationId: lease.invocationId,
+            leaseToken: lease.leaseToken,
+            reservationId,
+            create,
+        });
+    }
+    catch (error) {
+        // A lost reply can leave the journal committed. Recover the control-owned IDs instead of
+        // issuing a second create or asking DockerSandbox's legacy reconciler to remove them.
+        const reservation = await controlRequest(lease.binding.controlSocketPath, {
+            kind: "reservation.get",
+            invocationId: lease.invocationId,
+            leaseToken: lease.leaseToken,
+            reservationId,
+        }).catch(() => undefined);
+        if (reservation?.state === "committed" &&
+            reservation.containerId !== undefined &&
+            reservation.networkId !== undefined) {
+            return { containerId: reservation.containerId, networkId: reservation.networkId, state: "active" };
+        }
+        throw error;
+    }
+}
 async function releaseDockerProfileReservation(lease, reservationId, terminationEvidence) {
     await controlRequest(lease.binding.controlSocketPath, {
         kind: "reservation.release", invocationId: lease.invocationId, leaseToken: lease.leaseToken,

package/dist/sandbox/docker-profile/runtime.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":";;;AA4CA,kEAkBC;AACD,8DAEC;AAiGD,kDAEC;AACD,4DAoCC;AACD,0EAaC;AACD,wEASC;AACD,0EAKC;AAvOD,6CAAyC;AACzC,+CAAkE;AAClE,uCAAmC;AACnC,yCAAiD;AACjD,+CAA2G;AAE9F,QAAA,2BAA2B,GAAG,+BAA+B,CAAC;AAsB3E,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,KAAK,GAAG,MAAM,CAAC;AAC1B,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAA,iBAAK,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,IAAA,eAAI,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,IAAI;YAChB,MAAM;QACV,OAAO,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,yGAAyG;AAClG,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACjE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAA,kBAAO,EAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7J,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAK,EAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,EAAE,MAAM,CAAC,CAAY;YAC9D,MAAM;YACN,SAAS,EAAE;gBACP,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE;gBACjC,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxB,WAAW,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC;aACzC;SACJ,CAAC;IACN,CAAC,CAAC,CAAC,CAAC;IACJ,OAAO,IAAA,iCAAmB,EAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AACM,KAAK,UAAU,yBAAyB;IAC3C,OAAO,2BAA2B,CAAC,mCAA2B,CAAC,CAAC;AACpE,CAAC;AACD,SAAS,cAAc,CAAI,IAAY,EAAE,OAA0C;IAC/E,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAA,kBAAO,EAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAOjC,CAAC;gBACF,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,eAAe,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC,CAAC;gBACvH,CAAC;;oBAEG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,WAAmB;IACvD,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,aAAa,KAAK,CAAC,GAAG,cAAc,WAAW,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,uBAAuB,CAAC,IAEhC;IACG,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5G,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,KAAiC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,OAAO,CAAC,GAAG,CAAC;QACd,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC;QACvF,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC;KAC5F,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CASnC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAC5G,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI;QAC5H,SAAS,CAAC,mBAAmB,KAAK,OAAO,CAAC,SAAS,CAAC,mBAAmB;QACvE,SAAS,CAAC,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,0DAA0D;IAC1D,oDAAoD;IACpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,0CAA0C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE;QAC7C,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI;QACrD,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI;QACvD,QAAQ,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;KAC5B,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACnD,OAAO,WAAW,CAAC,IAAA,kCAAoB,EAAC,MAAM,yBAAyB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC;AACM,KAAK,UAAU,wBAAwB,CAAC,OAAoC;IAC/E,MAAM,YAAY,GAAG,IAAA,wBAAU,GAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAEjC,OAAO,CAAC,iBAAiB,EAAE;QAC1B,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY;KACf,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAiD,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,OAAO;YACP,OAAO;QACX,MAAM,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC5C,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;SACxE,CAAC,CAAC;IACP,CAAC,CAAC;IACF,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO;QACH,OAAO;QACP,YAAY;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,KAAK,IAAI,EAAE;YACtB,IAAI,OAAO;gBACP,OAAO;YACX,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,KAAK,SAAS;gBACnB,aAAa,CAAC,KAAK,CAAC,CAAC;YACzB,MAAM,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE;gBAC5C,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;aACpE,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;AACN,CAAC;AACM,KAAK,UAAU,+BAA+B,CAAC,KAAyB,EAAE,eAAsC,EAAE,SAA2C;IAChK,MAAM,aAAa,GAAG,IAAA,wBAAU,GAAE,CAAC;IACnC,IAAI,WAAW,GAAG,MAAM,cAAc,CAA2B,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAC9F,IAAI,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3F,aAAa,EAAE,eAAe,EAAE,SAAS;KAC5C,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QACzD,WAAW,GAAG,MAAM,cAAc,CAA2B,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC1F,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa;SACzG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AACM,KAAK,UAAU,8BAA8B,CAAC,KAAyB,EAAE,aAAqB,EAAE,KAItG;IACG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAClD,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC1F,aAAa,EAAE,GAAG,KAAK;KAC1B,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,+BAA+B,CAAC,KAAyB,EAAE,aAAqB,EAAE,mBAAuD;IAC3J,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAClD,IAAI,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3F,aAAa,EAAE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACvF,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { lstat, readFile, readdir, stat } from \"node:fs/promises\";\nimport { connect } from \"node:net\";\nimport { dirname, join, parse } from \"node:path\";\nimport { indexDockerProfiles, resolveDockerProfile, type ResolvedDockerProfileEntry } from \"./registry.ts\";\nimport type { DockerExecutionProfileV1 } from \"./schema.ts\";\nexport const DOCKER_PROFILE_REGISTRY_DIR = \"/etc/niceeval/docker-profiles\";\nexport interface DockerProfileRuntimeBinding {\n    readonly alias: string;\n    readonly profile: DockerExecutionProfileV1;\n    readonly descriptorDigest: string;\n    readonly daemonGeneration: string;\n    readonly daemonId: string;\n    readonly dockerSocketPath: string;\n    readonly controlSocketPath: string;\n    readonly platform: string;\n}\nexport interface DockerProfileLease {\n    readonly binding: DockerProfileRuntimeBinding;\n    readonly invocationId: string;\n    readonly leaseToken: string;\n    readonly stopHeartbeat: () => Promise<void>;\n}\nexport interface DockerProfileReservation {\n    readonly reservationId: string;\n    readonly provisionToken: string;\n    readonly state: \"queued\" | \"granted\" | \"committed\" | \"releasing\";\n}\nfunction modeOf(value: number): number {\n    return value & 0o7777;\n}\nasync function parentModes(path: string): Promise<number[]> {\n    const result: number[] = [];\n    const root = parse(path).root;\n    let current = dirname(path);\n    while (true) {\n        result.push(modeOf((await stat(current)).mode));\n        if (current === root)\n            break;\n        current = dirname(current);\n    }\n    return result;\n}\n/** Production registry location is fixed; tests may exercise descriptor I/O at an explicit directory. */\nexport async function loadDockerProfileRegistryAt(registryDir: string): Promise<ReturnType<typeof indexDockerProfiles>> {\n    const names = (await readdir(registryDir)).filter((name) => name.endsWith(\".json\") && !name.endsWith(\".host.json\") && !name.endsWith(\".daemon.json\")).sort();\n    const entries = await Promise.all(names.map(async (name) => {\n        const source = join(registryDir, name);\n        const facts = await lstat(source);\n        return {\n            alias: name.slice(0, -\".json\".length),\n            profile: JSON.parse(await readFile(source, \"utf8\")) as unknown,\n            source,\n            fileFacts: {\n                isSymlink: facts.isSymbolicLink(),\n                ownerUid: facts.uid,\n                mode: modeOf(facts.mode),\n                parentModes: await parentModes(source),\n            },\n        };\n    }));\n    return indexDockerProfiles(entries, { expectedOwnerUid: 0 });\n}\nexport async function loadDockerProfileRegistry(): Promise<ReturnType<typeof indexDockerProfiles>> {\n    return loadDockerProfileRegistryAt(DOCKER_PROFILE_REGISTRY_DIR);\n}\nfunction controlRequest<T>(path: string, request: Readonly<Record<string, unknown>>): Promise<T> {\n    return new Promise<T>((resolve, reject) => {\n        const socket = connect(path);\n        let response = \"\";\n        socket.setTimeout(10000);\n        socket.on(\"connect\", () => socket.end(`${JSON.stringify(request)}\\n`));\n        socket.on(\"data\", (chunk: Buffer) => { response += chunk.toString(); });\n        socket.on(\"timeout\", () => socket.destroy(new Error(`Docker profile control timeout: ${path}`)));\n        socket.on(\"error\", reject);\n        socket.on(\"close\", () => {\n            try {\n                const parsed = JSON.parse(response) as {\n                    ok?: boolean;\n                    result?: T;\n                    error?: {\n                        code?: string;\n                        message?: string;\n                    };\n                };\n                if (parsed.ok !== true || parsed.result === undefined) {\n                    reject(new Error(`${parsed.error?.code ?? \"control-error\"}: ${parsed.error?.message ?? \"invalid control reply\"}`));\n                }\n                else\n                    resolve(parsed.result);\n            }\n            catch (error) {\n                reject(error);\n            }\n        });\n    });\n}\nasync function socketFact(path: string, expectedUid: number): Promise<void> {\n    const value = await lstat(path);\n    if (!value.isSocket())\n        throw new Error(`Docker profile endpoint is not a Unix socket: ${path}`);\n    if (value.uid !== expectedUid)\n        throw new Error(`Docker profile endpoint ${path} owner is ${value.uid}, expected ${expectedUid}`);\n    if ((modeOf(value.mode) & 0o002) !== 0)\n        throw new Error(`Docker profile endpoint is world-writable: ${path}`);\n}\nfunction rootlessSecurityOptions(info: {\n    readonly SecurityOptions?: readonly string[];\n}): boolean {\n    return (info.SecurityOptions ?? []).some((option: string) => option.toLowerCase().includes(\"rootless\"));\n}\nasync function attestEntry(entry: ResolvedDockerProfileEntry): Promise<DockerProfileRuntimeBinding> {\n    const profile = entry.profile;\n    await Promise.all([\n        socketFact(profile.transport.dockerSocket.path, profile.transport.dockerSocket.peerUid),\n        socketFact(profile.transport.controlSocket.path, profile.transport.controlSocket.peerUid),\n    ]);\n    const nonce = randomUUID();\n    const challenge = await controlRequest<{\n        readonly protocol: string;\n        readonly profileId: string;\n        readonly descriptorDigest: string;\n        readonly hostMachineIdentity: string;\n        readonly backendMachineIdentity: string;\n        readonly daemonGeneration: string;\n        readonly clientNonce: string;\n        readonly admissionOpen: boolean;\n    }>(profile.transport.controlSocket.path, { kind: \"challenge\", clientNonce: nonce });\n    if (challenge.protocol !== profile.transport.controlSocket.protocol || challenge.profileId !== profile.profileId ||\n        challenge.descriptorDigest !== entry.descriptorDigest || challenge.clientNonce !== nonce || challenge.admissionOpen !== true ||\n        challenge.hostMachineIdentity !== profile.transport.hostMachineIdentity ||\n        challenge.backendMachineIdentity !== profile.backend.machineIdentity) {\n        throw new Error(`Docker profile ${entry.alias} control attestation does not match its descriptor`);\n    }\n    // dockerode 是 optional peer；只有用户实际使用 Docker profile 时才加载。\n    // 保持这里为热路径动态 import，避免不使用 Docker 的最小安装仅因 CLI 启动就崩溃。\n    const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n    const docker = new Docker({ socketPath: profile.transport.dockerSocket.path });\n    const info = await docker.info();\n    if (!rootlessSecurityOptions(info))\n        throw new Error(`Docker profile ${entry.alias} daemon is not rootless`);\n    if (info.DockerRootDir !== profile.backend.filesystem.dockerRootDir) {\n        throw new Error(`Docker profile ${entry.alias} DockerRootDir does not match descriptor`);\n    }\n    if (String(info.CgroupVersion) !== \"2\" || info.CgroupDriver !== \"systemd\") {\n        throw new Error(`Docker profile ${entry.alias} requires cgroup v2 with the systemd driver`);\n    }\n    const os = info.OSType || \"linux\";\n    const arch = info.Architecture || \"amd64\";\n    if (typeof info.ID !== \"string\" || info.ID === \"\")\n        throw new Error(`Docker profile ${entry.alias} daemon ID is missing`);\n    return Object.freeze({\n        alias: entry.alias,\n        profile,\n        descriptorDigest: entry.descriptorDigest,\n        daemonGeneration: challenge.daemonGeneration,\n        daemonId: info.ID,\n        dockerSocketPath: profile.transport.dockerSocket.path,\n        controlSocketPath: profile.transport.controlSocket.path,\n        platform: `${os}/${arch}`,\n    });\n}\nexport async function attestDockerProfile(alias: string): Promise<DockerProfileRuntimeBinding> {\n    return attestEntry(resolveDockerProfile(await loadDockerProfileRegistry(), alias));\n}\nexport async function createDockerProfileLease(binding: DockerProfileRuntimeBinding): Promise<DockerProfileLease> {\n    const invocationId = randomUUID();\n    const created = await controlRequest<{\n        readonly leaseToken: string;\n    }>(binding.controlSocketPath, {\n        kind: \"lease.create\",\n        profileId: binding.profile.profileId,\n        daemonGeneration: binding.daemonGeneration,\n        invocationId,\n    });\n    let stopped = false;\n    let timer: ReturnType<typeof setInterval> | undefined;\n    const heartbeat = async () => {\n        if (stopped)\n            return;\n        await controlRequest(binding.controlSocketPath, {\n            kind: \"lease.heartbeat\", invocationId, leaseToken: created.leaseToken,\n        });\n    };\n    timer = setInterval(() => { void heartbeat().catch(() => { }); }, 5000);\n    timer.unref();\n    return {\n        binding,\n        invocationId,\n        leaseToken: created.leaseToken,\n        stopHeartbeat: async () => {\n            if (stopped)\n                return;\n            stopped = true;\n            if (timer !== undefined)\n                clearInterval(timer);\n            await controlRequest(binding.controlSocketPath, {\n                kind: \"lease.drain\", invocationId, leaseToken: created.leaseToken,\n            });\n        },\n    };\n}\nexport async function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: \"container\" | \"build\", resources: Readonly<Record<string, number>>): Promise<DockerProfileReservation> {\n    const reservationId = randomUUID();\n    let reservation = await controlRequest<DockerProfileReservation>(lease.binding.controlSocketPath, {\n        kind: \"reservation.acquire\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, reservationKind, resources,\n    });\n    while (reservation.state === \"queued\") {\n        await new Promise((resolve) => setTimeout(resolve, 100));\n        reservation = await controlRequest<DockerProfileReservation>(lease.binding.controlSocketPath, {\n            kind: \"reservation.get\", invocationId: lease.invocationId, leaseToken: lease.leaseToken, reservationId,\n        });\n    }\n    return reservation;\n}\nexport async function commitDockerProfileReservation(lease: DockerProfileLease, reservationId: string, input: {\n    readonly containerId?: string;\n    readonly networkId?: string;\n    readonly attemptId?: string;\n}): Promise<void> {\n    await controlRequest(lease.binding.controlSocketPath, {\n        kind: \"reservation.commit\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, ...input,\n    });\n}\nexport async function releaseDockerProfileReservation(lease: DockerProfileLease, reservationId: string, terminationEvidence?: Readonly<Record<string, boolean>>): Promise<void> {\n    await controlRequest(lease.binding.controlSocketPath, {\n        kind: \"reservation.release\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, ...(terminationEvidence === undefined ? {} : { terminationEvidence }),\n    });\n}\n"]}
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["runtime.ts"],"names":[],"mappings":";;;AA6DA,kEAkBC;AACD,8DAEC;AAkGD,kDAEC;AACD,4DAoCC;AACD,0EA6CC;AACD,wEASC;AACD,oEA0BC;AACD,0EAKC;AApTD,6CAAyC;AACzC,+CAAkE;AAClE,uCAAmC;AACnC,yCAAiD;AACjD,+CAA2G;AAE9F,QAAA,2BAA2B,GAAG,+BAA+B,CAAC;AAuC3E,SAAS,MAAM,CAAC,KAAa;IACzB,OAAO,KAAK,GAAG,MAAM,CAAC;AAC1B,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,IAAA,iBAAK,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAG,IAAA,mBAAO,EAAC,IAAI,CAAC,CAAC;IAC5B,OAAO,IAAI,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,IAAA,eAAI,EAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,OAAO,KAAK,IAAI;YAChB,MAAM;QACV,OAAO,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AACD,yGAAyG;AAClG,KAAK,UAAU,2BAA2B,CAAC,WAAmB;IACjE,MAAM,KAAK,GAAG,CAAC,MAAM,IAAA,kBAAO,EAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7J,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,IAAA,gBAAI,EAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAK,EAAC,MAAM,CAAC,CAAC;QAClC,OAAO;YACH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,IAAA,mBAAQ,EAAC,MAAM,EAAE,MAAM,CAAC,CAAY;YAC9D,MAAM;YACN,SAAS,EAAE;gBACP,SAAS,EAAE,KAAK,CAAC,cAAc,EAAE;gBACjC,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;gBACxB,WAAW,EAAE,MAAM,WAAW,CAAC,MAAM,CAAC;aACzC;SACJ,CAAC;IACN,CAAC,CAAC,CAAC,CAAC;IACJ,OAAO,IAAA,iCAAmB,EAAC,OAAO,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AACM,KAAK,UAAU,yBAAyB;IAC3C,OAAO,2BAA2B,CAAC,mCAA2B,CAAC,CAAC;AACpE,CAAC;AACD,SAAS,cAAc,CAAI,IAAY,EAAE,OAA0C;IAC/E,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,IAAA,kBAAO,EAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAOjC,CAAC;gBACF,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACpD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAI,eAAe,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,IAAI,uBAAuB,EAAE,CAAC,CAAC,CAAC;gBACvH,CAAC;;oBAEG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,MAAM,CAAC,KAAK,CAAC,CAAC;YAClB,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,WAAmB;IACvD,MAAM,KAAK,GAAG,MAAM,IAAA,gBAAK,EAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE;QACjB,MAAM,IAAI,KAAK,CAAC,iDAAiD,IAAI,EAAE,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;QACzB,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,aAAa,KAAK,CAAC,GAAG,cAAc,WAAW,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;AAC9E,CAAC;AACD,SAAS,uBAAuB,CAAC,IAEhC;IACG,OAAO,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAc,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;AAC5G,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,KAAiC;IACxD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,OAAO,CAAC,GAAG,CAAC;QACd,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC;QACvF,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,OAAO,CAAC;KAC5F,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,cAAc,CASnC,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;IACpF,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,IAAI,SAAS,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAC5G,SAAS,CAAC,gBAAgB,KAAK,KAAK,CAAC,gBAAgB,IAAI,SAAS,CAAC,WAAW,KAAK,KAAK,IAAI,SAAS,CAAC,aAAa,KAAK,IAAI;QAC5H,SAAS,CAAC,mBAAmB,KAAK,OAAO,CAAC,SAAS,CAAC,mBAAmB;QACvE,SAAS,CAAC,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,oDAAoD,CAAC,CAAC;IACvG,CAAC;IACD,0DAA0D;IAC1D,oDAAoD;IACpD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,uBAAuB,CAAC,WAAW,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,CAAC,aAAa,KAAK,qBAAqB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,yBAAyB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;QAClE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,0CAA0C,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,6CAA6C,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC;IAClC,MAAM,IAAI,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC;IAC1C,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE;QAC7C,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,CAAC,KAAK,uBAAuB,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO;QACP,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,gBAAgB,EAAE,SAAS,CAAC,gBAAgB;QAC5C,QAAQ,EAAE,IAAI,CAAC,EAAE;QACjB,gBAAgB,EAAE,OAAO,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI;QACrD,iBAAiB,EAAE,OAAO,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI;QACvD,QAAQ,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE;KAC5B,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,mBAAmB,CAAC,KAAa;IACnD,OAAO,WAAW,CAAC,IAAA,kCAAoB,EAAC,MAAM,yBAAyB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;AACvF,CAAC;AACM,KAAK,UAAU,wBAAwB,CAAC,OAAoC;IAC/E,MAAM,YAAY,GAAG,IAAA,wBAAU,GAAE,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAEjC,OAAO,CAAC,iBAAiB,EAAE;QAC1B,IAAI,EAAE,cAAc;QACpB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,SAAS;QACpC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,YAAY;KACf,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAiD,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,IAAI,EAAE;QACzB,IAAI,OAAO;YACP,OAAO;QACX,MAAM,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC5C,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;SACxE,CAAC,CAAC;IACP,CAAC,CAAC;IACF,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACxE,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO;QACH,OAAO;QACP,YAAY;QACZ,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,aAAa,EAAE,KAAK,IAAI,EAAE;YACtB,IAAI,OAAO;gBACP,OAAO;YACX,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,KAAK,KAAK,SAAS;gBACnB,aAAa,CAAC,KAAK,CAAC,CAAC;YACzB,MAAM,cAAc,CAAC,OAAO,CAAC,iBAAiB,EAAE;gBAC5C,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU;aACpE,CAAC,CAAC;QACP,CAAC;KACJ,CAAC;AACN,CAAC;AACM,KAAK,UAAU,+BAA+B,CAAC,KAAyB,EAAE,eAAsC,EAAE,SAA2C,EAAE,MAAoB;IACtL,MAAM,aAAa,GAAG,IAAA,wBAAU,GAAE,CAAC;IACnC,IAAI,WAAW,GAAG,MAAM,cAAc,CAA2B,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAC9F,IAAI,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3F,aAAa,EAAE,eAAe,EAAE,SAAS;KAC5C,CAAC,CAAC;IACH,IAAI,CAAC;QACD,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,MAAM,EAAE,OAAO;gBACf,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC;YAChG,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;gBACxC,IAAI,KAA+B,CAAC;gBACpC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC1B,IAAI,KAAK,KAAK,SAAS;wBACnB,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;oBAChD,OAAO,EAAE,CAAC;gBACd,CAAC,EAAE,GAAG,CAAC,CAAC;gBACR,IAAI,MAAM,KAAK,SAAS;oBACpB,OAAO;gBACX,KAAK,GAAG,GAAG,EAAE;oBACT,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAM,CAAC,CAAC;oBAC5C,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC,CAAC;gBAClG,CAAC,CAAC;gBACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5D,CAAC,CAAC,CAAC;YACH,WAAW,GAAG,MAAM,cAAc,CAA2B,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;gBAC1F,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,aAAa;aACzG,CAAC,CAAC;YACH,IAAI,MAAM,EAAE,OAAO;gBACf,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,oCAAoC,EAAE,YAAY,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAClB,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;gBAClD,IAAI,EAAE,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB;gBACnF,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,aAAa;aAChB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC;AACM,KAAK,UAAU,8BAA8B,CAAC,KAAyB,EAAE,aAAqB,EAAE,KAItG;IACG,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAClD,IAAI,EAAE,oBAAoB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC1F,aAAa,EAAE,GAAG,KAAK;KAC1B,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,4BAA4B,CAAC,KAAyB,EAAE,aAAqB,EAAE,MAAyC;IAC1I,IAAI,CAAC;QACD,OAAO,MAAM,cAAc,CAAqC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAC7F,IAAI,EAAE,kBAAkB;YACxB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa;YACb,MAAM;SACT,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,yFAAyF;QACzF,sFAAsF;QACtF,MAAM,WAAW,GAAG,MAAM,cAAc,CAA2B,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;YAChG,IAAI,EAAE,iBAAiB;YACvB,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,aAAa;SAChB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC1B,IAAI,WAAW,EAAE,KAAK,KAAK,WAAW;YAClC,WAAW,CAAC,WAAW,KAAK,SAAS;YACrC,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvG,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACM,KAAK,UAAU,+BAA+B,CAAC,KAAyB,EAAE,aAAqB,EAAE,mBAAuD;IAC3J,MAAM,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE;QAClD,IAAI,EAAE,qBAAqB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC3F,aAAa,EAAE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC;KACvF,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { randomUUID } from \"node:crypto\";\nimport { lstat, readFile, readdir, stat } from \"node:fs/promises\";\nimport { connect } from \"node:net\";\nimport { dirname, join, parse } from \"node:path\";\nimport { indexDockerProfiles, resolveDockerProfile, type ResolvedDockerProfileEntry } from \"./registry.ts\";\nimport type { DockerExecutionProfileV1 } from \"./schema.ts\";\nexport const DOCKER_PROFILE_REGISTRY_DIR = \"/etc/niceeval/docker-profiles\";\nexport interface DockerProfileRuntimeBinding {\n    readonly alias: string;\n    readonly profile: DockerExecutionProfileV1;\n    readonly descriptorDigest: string;\n    readonly daemonGeneration: string;\n    readonly daemonId: string;\n    readonly dockerSocketPath: string;\n    readonly controlSocketPath: string;\n    readonly platform: string;\n}\nexport interface DockerProfileLease {\n    readonly binding: DockerProfileRuntimeBinding;\n    readonly invocationId: string;\n    readonly leaseToken: string;\n    readonly stopHeartbeat: () => Promise<void>;\n}\nexport interface DockerProfileReservation {\n    readonly reservationId: string;\n    readonly provisionToken: string;\n    readonly state: \"queued\" | \"granted\" | \"committed\" | \"releasing\";\n    readonly containerId?: string;\n    readonly networkId?: string;\n}\nexport interface DockerProfileContainerCreateInput {\n    readonly image: string;\n    readonly attemptId: string;\n    readonly command?: readonly string[];\n    readonly entrypoint?: string;\n    readonly environment?: readonly string[];\n    readonly workingDir?: string;\n    readonly user?: string;\n    readonly tmpfs?: Readonly<Record<string, string>>;\n}\nexport interface DockerProfileContainerCreateResult {\n    readonly containerId: string;\n    readonly networkId: string;\n    readonly state: \"active\";\n}\nfunction modeOf(value: number): number {\n    return value & 0o7777;\n}\nasync function parentModes(path: string): Promise<number[]> {\n    const result: number[] = [];\n    const root = parse(path).root;\n    let current = dirname(path);\n    while (true) {\n        result.push(modeOf((await stat(current)).mode));\n        if (current === root)\n            break;\n        current = dirname(current);\n    }\n    return result;\n}\n/** Production registry location is fixed; tests may exercise descriptor I/O at an explicit directory. */\nexport async function loadDockerProfileRegistryAt(registryDir: string): Promise<ReturnType<typeof indexDockerProfiles>> {\n    const names = (await readdir(registryDir)).filter((name) => name.endsWith(\".json\") && !name.endsWith(\".host.json\") && !name.endsWith(\".daemon.json\")).sort();\n    const entries = await Promise.all(names.map(async (name) => {\n        const source = join(registryDir, name);\n        const facts = await lstat(source);\n        return {\n            alias: name.slice(0, -\".json\".length),\n            profile: JSON.parse(await readFile(source, \"utf8\")) as unknown,\n            source,\n            fileFacts: {\n                isSymlink: facts.isSymbolicLink(),\n                ownerUid: facts.uid,\n                mode: modeOf(facts.mode),\n                parentModes: await parentModes(source),\n            },\n        };\n    }));\n    return indexDockerProfiles(entries, { expectedOwnerUid: 0 });\n}\nexport async function loadDockerProfileRegistry(): Promise<ReturnType<typeof indexDockerProfiles>> {\n    return loadDockerProfileRegistryAt(DOCKER_PROFILE_REGISTRY_DIR);\n}\nfunction controlRequest<T>(path: string, request: Readonly<Record<string, unknown>>): Promise<T> {\n    return new Promise<T>((resolve, reject) => {\n        const socket = connect(path);\n        let response = \"\";\n        socket.setTimeout(10000);\n        socket.on(\"connect\", () => socket.end(`${JSON.stringify(request)}\\n`));\n        socket.on(\"data\", (chunk: Buffer) => { response += chunk.toString(); });\n        socket.on(\"timeout\", () => socket.destroy(new Error(`Docker profile control timeout: ${path}`)));\n        socket.on(\"error\", reject);\n        socket.on(\"close\", () => {\n            try {\n                const parsed = JSON.parse(response) as {\n                    ok?: boolean;\n                    result?: T;\n                    error?: {\n                        code?: string;\n                        message?: string;\n                    };\n                };\n                if (parsed.ok !== true || parsed.result === undefined) {\n                    reject(new Error(`${parsed.error?.code ?? \"control-error\"}: ${parsed.error?.message ?? \"invalid control reply\"}`));\n                }\n                else\n                    resolve(parsed.result);\n            }\n            catch (error) {\n                reject(error);\n            }\n        });\n    });\n}\nasync function socketFact(path: string, expectedUid: number): Promise<void> {\n    const value = await lstat(path);\n    if (!value.isSocket())\n        throw new Error(`Docker profile endpoint is not a Unix socket: ${path}`);\n    if (value.uid !== expectedUid)\n        throw new Error(`Docker profile endpoint ${path} owner is ${value.uid}, expected ${expectedUid}`);\n    if ((modeOf(value.mode) & 0o002) !== 0)\n        throw new Error(`Docker profile endpoint is world-writable: ${path}`);\n}\nfunction rootlessSecurityOptions(info: {\n    readonly SecurityOptions?: readonly string[];\n}): boolean {\n    return (info.SecurityOptions ?? []).some((option: string) => option.toLowerCase().includes(\"rootless\"));\n}\nasync function attestEntry(entry: ResolvedDockerProfileEntry): Promise<DockerProfileRuntimeBinding> {\n    const profile = entry.profile;\n    await Promise.all([\n        socketFact(profile.transport.dockerSocket.path, profile.transport.dockerSocket.peerUid),\n        socketFact(profile.transport.controlSocket.path, profile.transport.controlSocket.peerUid),\n    ]);\n    const nonce = randomUUID();\n    const challenge = await controlRequest<{\n        readonly protocol: string;\n        readonly profileId: string;\n        readonly descriptorDigest: string;\n        readonly hostMachineIdentity: string;\n        readonly backendMachineIdentity: string;\n        readonly daemonGeneration: string;\n        readonly clientNonce: string;\n        readonly admissionOpen: boolean;\n    }>(profile.transport.controlSocket.path, { kind: \"challenge\", clientNonce: nonce });\n    if (challenge.protocol !== profile.transport.controlSocket.protocol || challenge.profileId !== profile.profileId ||\n        challenge.descriptorDigest !== entry.descriptorDigest || challenge.clientNonce !== nonce || challenge.admissionOpen !== true ||\n        challenge.hostMachineIdentity !== profile.transport.hostMachineIdentity ||\n        challenge.backendMachineIdentity !== profile.backend.machineIdentity) {\n        throw new Error(`Docker profile ${entry.alias} control attestation does not match its descriptor`);\n    }\n    // dockerode 是 optional peer；只有用户实际使用 Docker profile 时才加载。\n    // 保持这里为热路径动态 import，避免不使用 Docker 的最小安装仅因 CLI 启动就崩溃。\n    const { default: Docker } = await __niceevalDynamicImport(\"dockerode\");\n    const docker = new Docker({ socketPath: profile.transport.dockerSocket.path });\n    const info = await docker.info();\n    if (profile.securityLevel !== \"raw-dind-storage/v1\" && !rootlessSecurityOptions(info)) {\n        throw new Error(`Docker profile ${entry.alias} daemon is not rootless`);\n    }\n    if (info.DockerRootDir !== profile.backend.filesystem.dockerRootDir) {\n        throw new Error(`Docker profile ${entry.alias} DockerRootDir does not match descriptor`);\n    }\n    if (String(info.CgroupVersion) !== \"2\" || info.CgroupDriver !== \"systemd\") {\n        throw new Error(`Docker profile ${entry.alias} requires cgroup v2 with the systemd driver`);\n    }\n    const os = info.OSType || \"linux\";\n    const arch = info.Architecture || \"amd64\";\n    if (typeof info.ID !== \"string\" || info.ID === \"\")\n        throw new Error(`Docker profile ${entry.alias} daemon ID is missing`);\n    return Object.freeze({\n        alias: entry.alias,\n        profile,\n        descriptorDigest: entry.descriptorDigest,\n        daemonGeneration: challenge.daemonGeneration,\n        daemonId: info.ID,\n        dockerSocketPath: profile.transport.dockerSocket.path,\n        controlSocketPath: profile.transport.controlSocket.path,\n        platform: `${os}/${arch}`,\n    });\n}\nexport async function attestDockerProfile(alias: string): Promise<DockerProfileRuntimeBinding> {\n    return attestEntry(resolveDockerProfile(await loadDockerProfileRegistry(), alias));\n}\nexport async function createDockerProfileLease(binding: DockerProfileRuntimeBinding): Promise<DockerProfileLease> {\n    const invocationId = randomUUID();\n    const created = await controlRequest<{\n        readonly leaseToken: string;\n    }>(binding.controlSocketPath, {\n        kind: \"lease.create\",\n        profileId: binding.profile.profileId,\n        daemonGeneration: binding.daemonGeneration,\n        invocationId,\n    });\n    let stopped = false;\n    let timer: ReturnType<typeof setInterval> | undefined;\n    const heartbeat = async () => {\n        if (stopped)\n            return;\n        await controlRequest(binding.controlSocketPath, {\n            kind: \"lease.heartbeat\", invocationId, leaseToken: created.leaseToken,\n        });\n    };\n    timer = setInterval(() => { void heartbeat().catch(() => { }); }, 5000);\n    timer.unref();\n    return {\n        binding,\n        invocationId,\n        leaseToken: created.leaseToken,\n        stopHeartbeat: async () => {\n            if (stopped)\n                return;\n            stopped = true;\n            if (timer !== undefined)\n                clearInterval(timer);\n            await controlRequest(binding.controlSocketPath, {\n                kind: \"lease.drain\", invocationId, leaseToken: created.leaseToken,\n            });\n        },\n    };\n}\nexport async function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: \"container\" | \"build\", resources: Readonly<Record<string, number>>, signal?: AbortSignal): Promise<DockerProfileReservation> {\n    const reservationId = randomUUID();\n    let reservation = await controlRequest<DockerProfileReservation>(lease.binding.controlSocketPath, {\n        kind: \"reservation.acquire\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, reservationKind, resources,\n    });\n    try {\n        while (reservation.state === \"queued\") {\n            if (signal?.aborted)\n                throw signal.reason ?? new DOMException(\"Docker profile reservation aborted\", \"AbortError\");\n            await new Promise<void>((resolve, reject) => {\n                let abort: (() => void) | undefined;\n                const timer = setTimeout(() => {\n                    if (abort !== undefined)\n                        signal?.removeEventListener(\"abort\", abort);\n                    resolve();\n                }, 100);\n                if (signal === undefined)\n                    return;\n                abort = () => {\n                    clearTimeout(timer);\n                    signal.removeEventListener(\"abort\", abort!);\n                    reject(signal.reason ?? new DOMException(\"Docker profile reservation aborted\", \"AbortError\"));\n                };\n                signal.addEventListener(\"abort\", abort, { once: true });\n            });\n            reservation = await controlRequest<DockerProfileReservation>(lease.binding.controlSocketPath, {\n                kind: \"reservation.get\", invocationId: lease.invocationId, leaseToken: lease.leaseToken, reservationId,\n            });\n            if (signal?.aborted)\n                throw signal.reason ?? new DOMException(\"Docker profile reservation aborted\", \"AbortError\");\n        }\n    }\n    catch (error) {\n        if (signal?.aborted) {\n            await controlRequest(lease.binding.controlSocketPath, {\n                kind: reservation.state === \"queued\" ? \"reservation.cancel\" : \"reservation.release\",\n                invocationId: lease.invocationId,\n                leaseToken: lease.leaseToken,\n                reservationId,\n            }).catch(() => undefined);\n        }\n        throw error;\n    }\n    return reservation;\n}\nexport async function commitDockerProfileReservation(lease: DockerProfileLease, reservationId: string, input: {\n    readonly containerId?: string;\n    readonly networkId?: string;\n    readonly attemptId?: string;\n}): Promise<void> {\n    await controlRequest(lease.binding.controlSocketPath, {\n        kind: \"reservation.commit\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, ...input,\n    });\n}\nexport async function createDockerProfileContainer(lease: DockerProfileLease, reservationId: string, create: DockerProfileContainerCreateInput): Promise<DockerProfileContainerCreateResult> {\n    try {\n        return await controlRequest<DockerProfileContainerCreateResult>(lease.binding.controlSocketPath, {\n            kind: \"container.create\",\n            invocationId: lease.invocationId,\n            leaseToken: lease.leaseToken,\n            reservationId,\n            create,\n        });\n    }\n    catch (error) {\n        // A lost reply can leave the journal committed. Recover the control-owned IDs instead of\n        // issuing a second create or asking DockerSandbox's legacy reconciler to remove them.\n        const reservation = await controlRequest<DockerProfileReservation>(lease.binding.controlSocketPath, {\n            kind: \"reservation.get\",\n            invocationId: lease.invocationId,\n            leaseToken: lease.leaseToken,\n            reservationId,\n        }).catch(() => undefined);\n        if (reservation?.state === \"committed\" &&\n            reservation.containerId !== undefined &&\n            reservation.networkId !== undefined) {\n            return { containerId: reservation.containerId, networkId: reservation.networkId, state: \"active\" };\n        }\n        throw error;\n    }\n}\nexport async function releaseDockerProfileReservation(lease: DockerProfileLease, reservationId: string, terminationEvidence?: Readonly<Record<string, boolean>>): Promise<void> {\n    await controlRequest(lease.binding.controlSocketPath, {\n        kind: \"reservation.release\", invocationId: lease.invocationId, leaseToken: lease.leaseToken,\n        reservationId, ...(terminationEvidence === undefined ? {} : { terminationEvidence }),\n    });\n}\n"]}

package/dist/sandbox/docker-profile/runtime.d.cts

@@ -21,16 +21,34 @@ export interface DockerProfileReservation {
     readonly reservationId: string;
     readonly provisionToken: string;
     readonly state: "queued" | "granted" | "committed" | "releasing";
+    readonly containerId?: string;
+    readonly networkId?: string;
+}
+export interface DockerProfileContainerCreateInput {
+    readonly image: string;
+    readonly attemptId: string;
+    readonly command?: readonly string[];
+    readonly entrypoint?: string;
+    readonly environment?: readonly string[];
+    readonly workingDir?: string;
+    readonly user?: string;
+    readonly tmpfs?: Readonly<Record<string, string>>;
+}
+export interface DockerProfileContainerCreateResult {
+    readonly containerId: string;
+    readonly networkId: string;
+    readonly state: "active";
 }
 /** Production registry location is fixed; tests may exercise descriptor I/O at an explicit directory. */
 export declare function loadDockerProfileRegistryAt(registryDir: string): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function loadDockerProfileRegistry(): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function attestDockerProfile(alias: string): Promise<DockerProfileRuntimeBinding>;
 export declare function createDockerProfileLease(binding: DockerProfileRuntimeBinding): Promise<DockerProfileLease>;
-export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>): Promise<DockerProfileReservation>;
+export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>, signal?: AbortSignal): Promise<DockerProfileReservation>;
 export declare function commitDockerProfileReservation(lease: DockerProfileLease, reservationId: string, input: {
     readonly containerId?: string;
     readonly networkId?: string;
     readonly attemptId?: string;
 }): Promise<void>;
+export declare function createDockerProfileContainer(lease: DockerProfileLease, reservationId: string, create: DockerProfileContainerCreateInput): Promise<DockerProfileContainerCreateResult>;
 export declare function releaseDockerProfileReservation(lease: DockerProfileLease, reservationId: string, terminationEvidence?: Readonly<Record<string, boolean>>): Promise<void>;

package/dist/sandbox/docker-profile/runtime.d.mts

@@ -21,16 +21,34 @@ export interface DockerProfileReservation {
     readonly reservationId: string;
     readonly provisionToken: string;
     readonly state: "queued" | "granted" | "committed" | "releasing";
+    readonly containerId?: string;
+    readonly networkId?: string;
+}
+export interface DockerProfileContainerCreateInput {
+    readonly image: string;
+    readonly attemptId: string;
+    readonly command?: readonly string[];
+    readonly entrypoint?: string;
+    readonly environment?: readonly string[];
+    readonly workingDir?: string;
+    readonly user?: string;
+    readonly tmpfs?: Readonly<Record<string, string>>;
+}
+export interface DockerProfileContainerCreateResult {
+    readonly containerId: string;
+    readonly networkId: string;
+    readonly state: "active";
 }
 /** Production registry location is fixed; tests may exercise descriptor I/O at an explicit directory. */
 export declare function loadDockerProfileRegistryAt(registryDir: string): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function loadDockerProfileRegistry(): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function attestDockerProfile(alias: string): Promise<DockerProfileRuntimeBinding>;
 export declare function createDockerProfileLease(binding: DockerProfileRuntimeBinding): Promise<DockerProfileLease>;
-export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>): Promise<DockerProfileReservation>;
+export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>, signal?: AbortSignal): Promise<DockerProfileReservation>;
 export declare function commitDockerProfileReservation(lease: DockerProfileLease, reservationId: string, input: {
     readonly containerId?: string;
     readonly networkId?: string;
     readonly attemptId?: string;
 }): Promise<void>;
+export declare function createDockerProfileContainer(lease: DockerProfileLease, reservationId: string, create: DockerProfileContainerCreateInput): Promise<DockerProfileContainerCreateResult>;
 export declare function releaseDockerProfileReservation(lease: DockerProfileLease, reservationId: string, terminationEvidence?: Readonly<Record<string, boolean>>): Promise<void>;

package/dist/sandbox/docker-profile/runtime.d.ts

@@ -21,16 +21,34 @@ export interface DockerProfileReservation {
     readonly reservationId: string;
     readonly provisionToken: string;
     readonly state: "queued" | "granted" | "committed" | "releasing";
+    readonly containerId?: string;
+    readonly networkId?: string;
+}
+export interface DockerProfileContainerCreateInput {
+    readonly image: string;
+    readonly attemptId: string;
+    readonly command?: readonly string[];
+    readonly entrypoint?: string;
+    readonly environment?: readonly string[];
+    readonly workingDir?: string;
+    readonly user?: string;
+    readonly tmpfs?: Readonly<Record<string, string>>;
+}
+export interface DockerProfileContainerCreateResult {
+    readonly containerId: string;
+    readonly networkId: string;
+    readonly state: "active";
 }
 /** Production registry location is fixed; tests may exercise descriptor I/O at an explicit directory. */
 export declare function loadDockerProfileRegistryAt(registryDir: string): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function loadDockerProfileRegistry(): Promise<ReturnType<typeof indexDockerProfiles>>;
 export declare function attestDockerProfile(alias: string): Promise<DockerProfileRuntimeBinding>;
 export declare function createDockerProfileLease(binding: DockerProfileRuntimeBinding): Promise<DockerProfileLease>;
-export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>): Promise<DockerProfileReservation>;
+export declare function acquireDockerProfileReservation(lease: DockerProfileLease, reservationKind: "container" | "build", resources: Readonly<Record<string, number>>, signal?: AbortSignal): Promise<DockerProfileReservation>;
 export declare function commitDockerProfileReservation(lease: DockerProfileLease, reservationId: string, input: {
     readonly containerId?: string;
     readonly networkId?: string;
     readonly attemptId?: string;
 }): Promise<void>;
+export declare function createDockerProfileContainer(lease: DockerProfileLease, reservationId: string, create: DockerProfileContainerCreateInput): Promise<DockerProfileContainerCreateResult>;
 export declare function releaseDockerProfileReservation(lease: DockerProfileLease, reservationId: string, terminationEvidence?: Readonly<Record<string, boolean>>): Promise<void>;

package/dist/sandbox/docker-profile/runtime.js

@@ -9,12 +9,14 @@ const __niceevalExport2 = __niceevalCanonical["attestDockerProfile"];
 export { __niceevalExport2 as attestDockerProfile };
 const __niceevalExport3 = __niceevalCanonical["commitDockerProfileReservation"];
 export { __niceevalExport3 as commitDockerProfileReservation };
-const __niceevalExport4 = __niceevalCanonical["createDockerProfileLease"];
-export { __niceevalExport4 as createDockerProfileLease };
-const __niceevalExport5 = __niceevalCanonical["loadDockerProfileRegistry"];
-export { __niceevalExport5 as loadDockerProfileRegistry };
-const __niceevalExport6 = __niceevalCanonical["loadDockerProfileRegistryAt"];
-export { __niceevalExport6 as loadDockerProfileRegistryAt };
-const __niceevalExport7 = __niceevalCanonical["releaseDockerProfileReservation"];
-export { __niceevalExport7 as releaseDockerProfileReservation };
+const __niceevalExport4 = __niceevalCanonical["createDockerProfileContainer"];
+export { __niceevalExport4 as createDockerProfileContainer };
+const __niceevalExport5 = __niceevalCanonical["createDockerProfileLease"];
+export { __niceevalExport5 as createDockerProfileLease };
+const __niceevalExport6 = __niceevalCanonical["loadDockerProfileRegistry"];
+export { __niceevalExport6 as loadDockerProfileRegistry };
+const __niceevalExport7 = __niceevalCanonical["loadDockerProfileRegistryAt"];
+export { __niceevalExport7 as loadDockerProfileRegistryAt };
+const __niceevalExport8 = __niceevalCanonical["releaseDockerProfileReservation"];
+export { __niceevalExport8 as releaseDockerProfileReservation };
 //# sourceMappingURL=runtime.js.map