niceeval 0.13.3 → 0.13.4-canary.39

package/dist/sandbox/docker-profile/schema.cjs

@@ -118,6 +118,7 @@ const CapacitySchema = plainStruct({
     pids: positiveSafeInteger("DockerProfileCapacityPids"),
     maxContainers: positiveSafeInteger("DockerProfileCapacityMaxContainers"),
     maxBuilds: positiveSafeInteger("DockerProfileCapacityMaxBuilds"),
+    ephemeralDiskBytes: positiveSafeInteger("DockerProfileCapacityEphemeralDiskBytes"),
     aggregate: plainStruct({
         cpus: positiveFinite("DockerProfileAggregateCpus"),
         memoryBytes: positiveSafeInteger("DockerProfileAggregateMemoryBytes"),
@@ -134,7 +135,7 @@ const CapacitySchema = plainStruct({
 exports.DockerExecutionProfileV1Schema = plainStruct({
     schemaVersion: effect_1.Schema.Literal(1),
     profileId: nonEmptyString("DockerProfileId"),
-    securityLevel: effect_1.Schema.Literal("managed-rootless/v1", "managed-vm-rootless/v1"),
+    securityLevel: effect_1.Schema.Literal("managed-rootless/v1", "raw-dind-storage/v1"),
     semanticPolicyRevision: nonEmptyString("DockerProfileSemanticPolicyRevision"),
     transport: plainStruct({
         kind: effect_1.Schema.Literal("unix"),
@@ -158,6 +159,11 @@ exports.DockerExecutionProfileV1Schema = plainStruct({
             mountPath: absolutePath("DockerProfileMountPath"),
             dockerRootDir: absolutePath("DockerProfileDockerRootDir"),
             limitBytes: positiveSafeInteger("DockerProfileFilesystemLimitBytes"),
+            dockerDataPool: plainStruct({
+                count: positiveSafeInteger("DockerProfileDockerDataSlotCount"),
+                bytesPerAllocation: positiveSafeInteger("DockerProfileDockerDataAllocationLimitBytes"),
+                attestation: effect_1.Schema.Literal("linux-project-quota/v1"),
+            }),
         }),
         cgroup: plainStruct({
             aggregatePath: absolutePath("DockerProfileAggregatePath"),
@@ -166,14 +172,20 @@ exports.DockerExecutionProfileV1Schema = plainStruct({
         }),
     }),
     capacity: CapacitySchema,
-    policy: plainStruct({
+    policy: effect_1.Schema.Union(plainStruct({
+        level: effect_1.Schema.Literal("raw-dind-storage/v1"),
+        privilegedTranslation: effect_1.Schema.Literal("host-daemon"),
+        dockerData: effect_1.Schema.Literal("private-project-quota-allocation/v1"),
+    }), plainStruct({
+        level: effect_1.Schema.Literal("managed-rootless/v1"),
         hostLoopback: effect_1.Schema.Literal(false),
         tcpDockerEndpoint: effect_1.Schema.Literal(false),
         outerSocketInjection: effect_1.Schema.Literal(false),
         privilegedTranslation: effect_1.Schema.Literal("rootless-userns"),
         writableRoot: effect_1.Schema.Literal("declared-tmpfs-only"),
+        dockerData: effect_1.Schema.Literal("private-project-quota-allocation/v1"),
         network: NetworkSchema,
-    }),
+    })),
 });
 exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema;
 function frozenNonEmptyStrings(values) {
@@ -194,7 +206,10 @@ function freezeProfile(profile) {
         backend: Object.freeze({
             ...profile.backend,
             owner: Object.freeze({ ...profile.backend.owner }),
-            filesystem: Object.freeze({ ...profile.backend.filesystem }),
+            filesystem: Object.freeze({
+                ...profile.backend.filesystem,
+                dockerDataPool: Object.freeze({ ...profile.backend.filesystem.dockerDataPool }),
+            }),
             cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),
         }),
         capacity: Object.freeze({
@@ -202,21 +217,23 @@ function freezeProfile(profile) {
             memorySwapBytes: 0,
             aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),
         }),
-        policy: Object.freeze({
-            ...profile.policy,
-            network: Object.freeze({
-                ...profile.policy.network,
-                dns: Object.freeze({
-                    ...profile.policy.network.dns,
-                    servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),
-                }),
-                egress: Object.freeze({
-                    ...profile.policy.network.egress,
-                    allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,
-                    denyCidrs: exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS,
+        policy: profile.policy.level === "raw-dind-storage/v1"
+            ? Object.freeze({ ...profile.policy })
+            : Object.freeze({
+                ...profile.policy,
+                network: Object.freeze({
+                    ...profile.policy.network,
+                    dns: Object.freeze({
+                        ...profile.policy.network.dns,
+                        servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),
+                    }),
+                    egress: Object.freeze({
+                        ...profile.policy.network.egress,
+                        allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,
+                        denyCidrs: exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS,
+                    }),
                 }),
             }),
-        }),
     });
 }
 function semanticPolicyJson(input) {
@@ -230,12 +247,18 @@ function semanticPolicyJson(input) {
                 controllers: [...input.backend.cgroup.controllers],
             },
         },
-        policy: {
+        policy: input.policy.level === "raw-dind-storage/v1" ? {
+            level: input.policy.level,
+            privilegedTranslation: input.policy.privilegedTranslation,
+            dockerData: input.policy.dockerData,
+        } : {
+            level: input.policy.level,
             hostLoopback: input.policy.hostLoopback,
             tcpDockerEndpoint: input.policy.tcpDockerEndpoint,
             outerSocketInjection: input.policy.outerSocketInjection,
             privilegedTranslation: input.policy.privilegedTranslation,
             writableRoot: input.policy.writableRoot,
+            dockerData: input.policy.dockerData,
             network: {
                 version: input.policy.network.version,
                 dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },
@@ -308,6 +331,26 @@ function parseDockerExecutionProfileV1(value) {
     if (effect_1.Either.isLeft(decoded))
         throw schemaError(value, decoded.left);
     const profile = freezeProfile(decoded.right);
+    if (profile.backend.filesystem.dockerDataPool.count < profile.capacity.maxContainers ||
+        profile.backend.filesystem.dockerDataPool.count *
+            profile.backend.filesystem.dockerDataPool.bytesPerAllocation < profile.capacity.ephemeralDiskBytes) {
+        throw (0, errors_ts_1.dockerProfileError)({
+            code: "sandbox.docker-profile-capacity-invalid",
+            path: "profile.backend.filesystem.dockerDataPool",
+            message: "Docker data allocations must cover maxContainers and allocatable ephemeralDiskBytes",
+        });
+    }
+    const rawStorage = profile.securityLevel === "raw-dind-storage/v1";
+    if (profile.policy.level !== profile.securityLevel ||
+        (rawStorage
+            ? profile.policy.privilegedTranslation !== "host-daemon"
+            : profile.policy.privilegedTranslation !== "rootless-userns")) {
+        throw (0, errors_ts_1.dockerProfileError)({
+            code: "sandbox.docker-profile-security-level-unsupported",
+            path: "profile.policy",
+            message: "Docker profile policy level and privileged translation must match its security level",
+        });
+    }
     const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);
     if (profile.semanticPolicyRevision !== expected) {
         throw (0, errors_ts_1.dockerProfileError)({
@@ -361,12 +404,18 @@ function canonicalJson(profile) {
             ...profile.capacity,
             aggregate: { ...profile.capacity.aggregate },
         },
-        policy: {
+        policy: profile.policy.level === "raw-dind-storage/v1" ? {
+            level: profile.policy.level,
+            privilegedTranslation: profile.policy.privilegedTranslation,
+            dockerData: profile.policy.dockerData,
+        } : {
+            level: profile.policy.level,
             hostLoopback: profile.policy.hostLoopback,
             tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,
             outerSocketInjection: profile.policy.outerSocketInjection,
             privilegedTranslation: profile.policy.privilegedTranslation,
             writableRoot: profile.policy.writableRoot,
+            dockerData: profile.policy.dockerData,
             network: {
                 version: profile.policy.network.version,
                 dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },

package/dist/sandbox/docker-profile/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AAgXA,wGAEC;AA6CD,sEAeC;AAGD,oEAKC;AAED,gEAQC;AA2CD,wEAEC;AAED,oEAYC;AA3fD,mCAAqD;AACrD,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA0E;AAC7D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,6BAA6B,GAAG,+CAAuC,CAAC;AACxE,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAC3E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACjE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa;IACnE,aAAa,EAAE,MAAM;CACxB,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC,CAAC;AAyGH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,KAAc;IACtB,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAgB;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAM,CAAC,OAAO,CAAc,CAAC,KAAK,EAAwB,EAAE;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC,EAAE;IACC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,yCAAyC;CACzD,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;AACzJ,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;AACzM,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,sBAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACzJ,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC/M,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACvM,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;AAC9L,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,OAAO,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QACV,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,eAAe,GAAG,cAAc,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;IACzG,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,0DAA0D;CAC1E,CAAC,CAAC,CAAC;AACJ,MAAM,WAAW,GAAG,eAAM,CAAC,aAAa,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;IAC3I,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC5K,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC,yBAAyB,CAAC;IAC7C,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,WAAW,CAAC;IAC9B,OAAO,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;QACb,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,eAAM,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;IACF,MAAM,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,6BAA6B,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,GAAG,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;CACL,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC,2BAA2B,CAAC;IACjD,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;IACpE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,mBAAmB,CAAC,gCAAgC,CAAC;IAChE,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,cAAc,CAAC,4BAA4B,CAAC;QAClD,WAAW,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;QACrE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,mBAAmB,CAAC,4BAA4B,CAAC;KAC1D,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;IAC/D,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,kFAAkF;CAClG,CAAC,CAAC,CAAC;AACJ,mGAAmG;AACtF,QAAA,8BAA8B,GAAyD,WAAW,CAAC;IAC5G,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC5C,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;IAC9E,sBAAsB,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC7E,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,mBAAmB,EAAE,cAAc,CAAC,kCAAkC,CAAC;QACvE,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,WAAW,CAAC;YACvB,IAAI,EAAE,YAAY,CAAC,gCAAgC,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,CAAC;YAC9D,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;SACjE,CAAC;KACL,CAAC;IACF,OAAO,EAAE,WAAW,CAAC;QACjB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC;QAC3D,eAAe,EAAE,cAAc,CAAC,qCAAqC,CAAC;QACtE,KAAK,EAAE,WAAW,CAAC;YACf,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;YACpD,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;SACvD,CAAC;QACF,UAAU,EAAE,WAAW,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,iCAAiC,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,wBAAwB,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,UAAU,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;SACvE,CAAC;QACF,MAAM,EAAE,WAAW,CAAC;YAChB,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,cAAc,EAAE,cAAc,CAAC,mCAAmC,CAAC;YACnE,WAAW,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACrG,CAAC;KACL,CAAC;IACF,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,WAAW,CAAC;QAChB,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,iBAAiB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,oBAAoB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxD,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACnD,OAAO,EAAE,aAAa;KACzB,CAAC;CACL,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,+FAA+F;AAC/F,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,OAAO;QACV,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,OAAO,CAAC,SAAS;YACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAC5D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,OAAO,CAAC,QAAQ;YACnB,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YAClB,GAAG,OAAO,CAAC,MAAM;YACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACnB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO;gBACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;oBACf,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;oBAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;iBACrE,CAAC;gBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;oBAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,yBAAyB;oBAC3C,SAAS,EAAE,yCAAiC;iBAC/C,CAAC;aACL,CAAC;SACL,CAAC;KACL,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAC5F,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,gBAAgB,CAAC,IAA4B;IAClD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ;QACvE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;QACjC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAA6B;IAC9D,MAAM,KAAK,GAAG,oBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAA,8BAAkB,EAAC;gBACtB,IAAI,EAAE,uCAAuC;gBAC7C,IAAI;gBACJ,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,wCAAwC;YAC9C,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,mDAAmD;YACzD,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;SACxG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,uCAAuC;QAC7C,IAAI;QACJ,OAAO,EAAE,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,6BAA6B,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,eAAM,CAAC,mBAAmB,CAAC,sCAA8B,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtB,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,QAAQ,EAAE;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACY,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAC5D,QAAA,8BAA8B,GAAG,6BAA6B,CAAC;AAC5E,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,OAAO,6BAA6B,CAAC;QACjC,GAAG,KAAK;QACR,sBAAsB,EAAE,8CAA8C,CAAC,KAAK,CAAC;KAChF,CAAC,CAAC;AACP,CAAC;AACY,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YACnD,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE;SACxD;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE;YAC7C,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;SAC9F;QACD,QAAQ,EAAE;YACN,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;SAC/C;QACD,MAAM,EAAE;YACJ,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAChG,MAAM,EAAE;oBACJ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1D;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,UAAU,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Either, ParseResult, Schema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SCHEMA_VERSION = DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n    string,\n    ...string[]\n] = Object.freeze([\n    \"0.0.0.0/8\", \"10.0.0.0/8\", \"100.64.0.0/10\", \"127.0.0.0/8\", \"169.254.0.0/16\",\n    \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.2.0/24\", \"192.168.0.0/16\",\n    \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"224.0.0.0/4\",\n    \"240.0.0.0/4\", \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n    \"dns\",\n    \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n    \"cpu\",\n    \"memory\",\n    \"pids\"\n] = Object.freeze([\n    \"cpu\", \"memory\", \"pids\",\n]);\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"managed-vm-rootless/v1\";\nexport interface DockerProfileUnixEndpoint {\n    readonly path: string;\n    readonly peerUid: number;\n}\n/** Callback-free descriptor data that crosses the host deployment trust boundary. */\nexport interface DockerProfileNetworkPolicy {\n    readonly version: 1;\n    readonly dns: {\n        readonly mode: \"explicit\";\n        readonly servers: readonly [\n            string,\n            ...string[]\n        ];\n    };\n    readonly egress: {\n        readonly mode: \"rootless-nat\";\n        readonly allowedProtocols: readonly [\n            \"dns\",\n            \"https\"\n        ];\n        readonly denyPrivateNetworks: true;\n        readonly denySiblingSyntheticEndpoints: true;\n        readonly denyCidrs: readonly [\n            string,\n            ...string[]\n        ];\n        readonly ipv6: \"disabled\";\n        readonly disableHostLoopback: true;\n        readonly portDriver: \"none\";\n        readonly daemonBridge: \"none\";\n        readonly exclusiveNetwork: true;\n        readonly icc: false;\n    };\n}\nexport interface DockerExecutionProfileV1 {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly transport: {\n        readonly kind: \"unix\";\n        readonly hostMachineIdentity: string;\n        readonly dockerSocket: DockerProfileUnixEndpoint;\n        readonly controlSocket: DockerProfileUnixEndpoint & {\n            readonly protocol: \"niceeval-docker-profile-control/v1\";\n        };\n    };\n    readonly backend: {\n        readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n        readonly machineIdentity: string;\n        readonly owner: {\n            readonly uid: number;\n            readonly gid: number;\n        };\n        readonly filesystem: {\n            readonly identity: string;\n            readonly mountPath: string;\n            readonly dockerRootDir: string;\n            readonly limitBytes: number;\n        };\n        readonly cgroup: {\n            readonly aggregatePath: string;\n            readonly policyRevision: string;\n            readonly controllers: readonly [\n                \"cpu\",\n                \"memory\",\n                \"pids\"\n            ];\n        };\n    };\n    readonly capacity: {\n        readonly cpus: number;\n        readonly memoryBytes: number;\n        readonly memorySwapBytes: 0;\n        readonly pids: number;\n        readonly maxContainers: number;\n        readonly maxBuilds: number;\n        readonly aggregate: {\n            readonly cpus: number;\n            readonly memoryBytes: number;\n            readonly memorySwapBytes: 0;\n            readonly pids: number;\n        };\n    };\n    readonly policy: {\n        readonly hostLoopback: false;\n        readonly tcpDockerEndpoint: false;\n        readonly outerSocketInjection: false;\n        readonly privilegedTranslation: \"rootless-userns\";\n        readonly writableRoot: \"declared-tmpfs-only\";\n        readonly network: DockerProfileNetworkPolicy;\n    };\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\n/** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */\nexport interface DockerProfilePublicSummary {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly capacity: DockerExecutionProfileV1[\"capacity\"];\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nconst ParseOptions = Object.freeze({\n    errors: \"all\" as const,\n    exact: true,\n    onExcessProperty: \"error\" as const,\n});\ntype PlainObject = Readonly<Record<PropertyKey, unknown>>;\nconst PlainObjectSchema = Schema.declare<PlainObject>((value): value is PlainObject => {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}, {\n    identifier: \"DockerProfilePlainObject\",\n    description: \"a plain object or null-prototype record\",\n});\nconst plainStruct = <Fields extends Schema.Struct.Fields>(fields: Fields) => Schema.compose(Schema.Struct(fields), { strict: false })(PlainObjectSchema);\nconst nonEmptyString = (identifier: string) => Schema.String.pipe(Schema.filter((value) => value.trim() !== \"\" && !value.includes(\"\\0\"), { identifier, description: \"a non-empty string without NUL\" }));\nconst absolutePath = (identifier: string) => nonEmptyString(identifier).pipe(Schema.filter(isAbsolute, { identifier, description: \"an absolute path\" }));\nconst nonNegativeSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: \"a non-negative safe integer\" }));\nconst positiveSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: \"a positive safe integer\" }));\nconst positiveFinite = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isFinite(value) && value > 0, { identifier, description: \"a positive finite number\" }));\nfunction isPublicDnsServer(value: string): boolean {\n    const kind = isIP(value);\n    if (kind === 4) {\n        const [first, second, third] = value.split(\".\").map(Number);\n        if (first === undefined || second === undefined || third === undefined)\n            return false;\n        if (first === 0 || first === 10 || first === 127 || first >= 224)\n            return false;\n        if (first === 100 && second >= 64 && second <= 127)\n            return false;\n        if (first === 169 && second === 254)\n            return false;\n        if (first === 172 && second >= 16 && second <= 31)\n            return false;\n        if (first === 192 && second === 168)\n            return false;\n        if (first === 192 && second === 0 && (third === 0 || third === 2))\n            return false;\n        if (first === 198 && (second === 18 || second === 19))\n            return false;\n        if (first === 198 && second === 51 && third === 100)\n            return false;\n        return !(first === 203 && second === 0 && third === 113);\n    }\n    if (kind !== 6)\n        return false;\n    const normalized = value.toLowerCase();\n    if (normalized.startsWith(\"::ffff:\")) {\n        return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n    }\n    return normalized !== \"::\" && normalized !== \"::1\" &&\n        !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n        !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n        !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n        !normalized.startsWith(\"ff\") && !normalized.startsWith(\"2001:db8:\");\n}\nconst DnsServerSchema = nonEmptyString(\"DockerProfilePublicDnsServer\").pipe(Schema.filter(isPublicDnsServer, {\n    identifier: \"DockerProfilePublicDnsServer\",\n    description: \"a public IP address, not a private or synthetic endpoint\",\n}));\nconst CidrsSchema = Schema.NonEmptyArray(Schema.String).pipe(Schema.filter((value) => value.length === DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&\n    value.every((cidr, index) => cidr === DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: \"DockerProfileDenyCidrs\", description: \"the v1 fail-closed CIDR set\" }));\nconst EndpointSchema = plainStruct({\n    path: absolutePath(\"DockerProfileSocketPath\"),\n    peerUid: nonNegativeSafeInteger(\"DockerProfilePeerUid\"),\n});\nconst NetworkSchema = plainStruct({\n    version: Schema.Literal(1),\n    dns: plainStruct({\n        mode: Schema.Literal(\"explicit\"),\n        servers: Schema.NonEmptyArray(DnsServerSchema),\n    }),\n    egress: plainStruct({\n        mode: Schema.Literal(\"rootless-nat\"),\n        allowedProtocols: Schema.Tuple(Schema.Literal(\"dns\"), Schema.Literal(\"https\")),\n        denyPrivateNetworks: Schema.Literal(true),\n        denySiblingSyntheticEndpoints: Schema.Literal(true),\n        denyCidrs: CidrsSchema,\n        ipv6: Schema.Literal(\"disabled\"),\n        disableHostLoopback: Schema.Literal(true),\n        portDriver: Schema.Literal(\"none\"),\n        daemonBridge: Schema.Literal(\"none\"),\n        exclusiveNetwork: Schema.Literal(true),\n        icc: Schema.Literal(false),\n    }),\n});\nconst CapacitySchema = plainStruct({\n    cpus: positiveFinite(\"DockerProfileCapacityCpus\"),\n    memoryBytes: positiveSafeInteger(\"DockerProfileCapacityMemoryBytes\"),\n    memorySwapBytes: Schema.Literal(0),\n    pids: positiveSafeInteger(\"DockerProfileCapacityPids\"),\n    maxContainers: positiveSafeInteger(\"DockerProfileCapacityMaxContainers\"),\n    maxBuilds: positiveSafeInteger(\"DockerProfileCapacityMaxBuilds\"),\n    aggregate: plainStruct({\n        cpus: positiveFinite(\"DockerProfileAggregateCpus\"),\n        memoryBytes: positiveSafeInteger(\"DockerProfileAggregateMemoryBytes\"),\n        memorySwapBytes: Schema.Literal(0),\n        pids: positiveSafeInteger(\"DockerProfileAggregatePids\"),\n    }),\n}).pipe(Schema.filter((value) => value.aggregate.cpus >= value.cpus &&\n    value.aggregate.memoryBytes >= value.memoryBytes &&\n    value.aggregate.pids >= value.pids, {\n    identifier: \"DockerProfileCapacity\",\n    description: \"aggregate capacity at least as large as allocatable CPU, memory and PID capacity\",\n}));\n/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */\nexport const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject> = plainStruct({\n    schemaVersion: Schema.Literal(1),\n    profileId: nonEmptyString(\"DockerProfileId\"),\n    securityLevel: Schema.Literal(\"managed-rootless/v1\", \"managed-vm-rootless/v1\"),\n    semanticPolicyRevision: nonEmptyString(\"DockerProfileSemanticPolicyRevision\"),\n    transport: plainStruct({\n        kind: Schema.Literal(\"unix\"),\n        hostMachineIdentity: nonEmptyString(\"DockerProfileHostMachineIdentity\"),\n        dockerSocket: EndpointSchema,\n        controlSocket: plainStruct({\n            path: absolutePath(\"DockerProfileControlSocketPath\"),\n            peerUid: nonNegativeSafeInteger(\"DockerProfileControlPeerUid\"),\n            protocol: Schema.Literal(\"niceeval-docker-profile-control/v1\"),\n        }),\n    }),\n    backend: plainStruct({\n        kind: Schema.Literal(\"local-systemd\", \"dedicated-linux-vm\"),\n        machineIdentity: nonEmptyString(\"DockerProfileBackendMachineIdentity\"),\n        owner: plainStruct({\n            uid: nonNegativeSafeInteger(\"DockerProfileOwnerUid\"),\n            gid: nonNegativeSafeInteger(\"DockerProfileOwnerGid\"),\n        }),\n        filesystem: plainStruct({\n            identity: nonEmptyString(\"DockerProfileFilesystemIdentity\"),\n            mountPath: absolutePath(\"DockerProfileMountPath\"),\n            dockerRootDir: absolutePath(\"DockerProfileDockerRootDir\"),\n            limitBytes: positiveSafeInteger(\"DockerProfileFilesystemLimitBytes\"),\n        }),\n        cgroup: plainStruct({\n            aggregatePath: absolutePath(\"DockerProfileAggregatePath\"),\n            policyRevision: nonEmptyString(\"DockerProfileCgroupPolicyRevision\"),\n            controllers: Schema.Tuple(Schema.Literal(\"cpu\"), Schema.Literal(\"memory\"), Schema.Literal(\"pids\")),\n        }),\n    }),\n    capacity: CapacitySchema,\n    policy: plainStruct({\n        hostLoopback: Schema.Literal(false),\n        tcpDockerEndpoint: Schema.Literal(false),\n        outerSocketInjection: Schema.Literal(false),\n        privilegedTranslation: Schema.Literal(\"rootless-userns\"),\n        writableRoot: Schema.Literal(\"declared-tmpfs-only\"),\n        network: NetworkSchema,\n    }),\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n    string,\n    ...string[]\n] {\n    const [first, ...rest] = values;\n    if (first === undefined)\n        throw new Error(\"expected a non-empty string tuple\");\n    return Object.freeze([first, ...rest]);\n}\n/** Canonicalize only after structural decoding; nested containers are immutable to callers. */\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n    return Object.freeze({\n        ...profile,\n        transport: Object.freeze({\n            ...profile.transport,\n            dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n            controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n        }),\n        backend: Object.freeze({\n            ...profile.backend,\n            owner: Object.freeze({ ...profile.backend.owner }),\n            filesystem: Object.freeze({ ...profile.backend.filesystem }),\n            cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),\n        }),\n        capacity: Object.freeze({\n            ...profile.capacity,\n            memorySwapBytes: 0,\n            aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),\n        }),\n        policy: Object.freeze({\n            ...profile.policy,\n            network: Object.freeze({\n                ...profile.policy.network,\n                dns: Object.freeze({\n                    ...profile.policy.network.dns,\n                    servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n                }),\n                egress: Object.freeze({\n                    ...profile.policy.network.egress,\n                    allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n                    denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n                }),\n            }),\n        }),\n    });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n    return {\n        schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n        securityLevel: input.securityLevel,\n        backend: {\n            kind: input.backend.kind,\n            cgroup: {\n                policyRevision: input.backend.cgroup.policyRevision,\n                controllers: [...input.backend.cgroup.controllers],\n            },\n        },\n        policy: {\n            hostLoopback: input.policy.hostLoopback,\n            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n            outerSocketInjection: input.policy.outerSocketInjection,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            writableRoot: input.policy.writableRoot,\n            network: {\n                version: input.policy.network.version,\n                dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },\n                egress: {\n                    mode: input.policy.network.egress.mode,\n                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n                    denyCidrs: [...input.policy.network.egress.denyCidrs],\n                    ipv6: input.policy.network.egress.ipv6,\n                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n                    portDriver: input.policy.network.egress.portDriver,\n                    daemonBridge: input.policy.network.egress.daemonBridge,\n                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n                    icc: input.policy.network.egress.icc,\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n    return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction formatSchemaPath(path: readonly PropertyKey[]): string {\n    return path.reduce<string>((result, segment) => typeof segment === \"number\" ||\n        (typeof segment === \"string\" && /^\\\\d+$/.test(segment))\n        ? `${result}[${String(segment)}]`\n        : `${result}.${String(segment)}`, \"profile\");\n}\nfunction schemaError(value: unknown, error: ParseResult.ParseError): DockerProfileError {\n    const issue = ParseResult.ArrayFormatter.formatErrorSync(error)[0];\n    const path = issue === undefined ? \"profile\" : formatSchemaPath(issue.path);\n    const root = typeof value === \"object\" && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined;\n    if (path === \"profile.schemaVersion\") {\n        if (root?.schemaVersion === undefined) {\n            return dockerProfileError({\n                code: \"sandbox.docker-profile-schema-invalid\",\n                path,\n                message: \"profile.schemaVersion is required\",\n            });\n        }\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-unknown-version\",\n            path,\n            message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n        });\n    }\n    if (path === \"profile.securityLevel\") {\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path,\n            message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,\n        });\n    }\n    return dockerProfileError({\n        code: path === \"profile.capacity\"\n            ? \"sandbox.docker-profile-capacity-invalid\"\n            : \"sandbox.docker-profile-schema-invalid\",\n        path,\n        message: issue === undefined\n            ? \"profile is not a valid Docker execution profile v1\"\n            : `${path} ${issue.message}`,\n    });\n}\nexport function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1 {\n    const decoded = Schema.decodeUnknownEither(DockerExecutionProfileV1Schema, ParseOptions)(value);\n    if (Either.isLeft(decoded))\n        throw schemaError(value, decoded.left);\n    const profile = freezeProfile(decoded.right);\n    const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n    if (profile.semanticPolicyRevision !== expected) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n            path: \"profile.semanticPolicyRevision\",\n            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,\n            details: { expected, actual: profile.semanticPolicyRevision },\n        });\n    }\n    return profile;\n}\nexport const parseDockerExecutionProfile = parseDockerExecutionProfileV1;\nexport const decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;\nexport function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n    return parseDockerExecutionProfileV1({\n        ...input,\n        semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),\n    });\n}\nexport const createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n    try {\n        parseDockerExecutionProfileV1(value);\n        return true;\n    }\n    catch {\n        return false;\n    }\n}\n/** Digest the fixed v1 wire shape, not incidental object insertion order. */\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n    return {\n        schemaVersion: profile.schemaVersion,\n        profileId: profile.profileId,\n        securityLevel: profile.securityLevel,\n        semanticPolicyRevision: profile.semanticPolicyRevision,\n        transport: {\n            kind: profile.transport.kind,\n            hostMachineIdentity: profile.transport.hostMachineIdentity,\n            dockerSocket: { ...profile.transport.dockerSocket },\n            controlSocket: { ...profile.transport.controlSocket },\n        },\n        backend: {\n            kind: profile.backend.kind,\n            machineIdentity: profile.backend.machineIdentity,\n            owner: { ...profile.backend.owner },\n            filesystem: { ...profile.backend.filesystem },\n            cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },\n        },\n        capacity: {\n            ...profile.capacity,\n            aggregate: { ...profile.capacity.aggregate },\n        },\n        policy: {\n            hostLoopback: profile.policy.hostLoopback,\n            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n            outerSocketInjection: profile.policy.outerSocketInjection,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            writableRoot: profile.policy.writableRoot,\n            network: {\n                version: profile.policy.network.version,\n                dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },\n                egress: {\n                    ...profile.policy.network.egress,\n                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n                    denyCidrs: [...profile.policy.network.egress.denyCidrs],\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n    return `sha256:${digestOf(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n    const normalized = parseDockerExecutionProfileV1(profile);\n    return Object.freeze({\n        schemaVersion: 1,\n        profileId: normalized.profileId,\n        securityLevel: normalized.securityLevel,\n        semanticPolicyRevision: normalized.semanticPolicyRevision,\n        capacity: Object.freeze({\n            ...normalized.capacity,\n            aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n        }),\n    });\n}\n"]}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AAqZA,wGAEC;AA6CD,sEAmCC;AAGD,oEAKC;AAED,gEAQC;AAiDD,wEAEC;AAED,oEAYC;AA1jBD,mCAAqD;AACrD,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA0E;AAC7D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,6BAA6B,GAAG,+CAAuC,CAAC;AACxE,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAC3E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACjE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa;IACnE,aAAa,EAAE,MAAM;CACxB,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC,CAAC;AAuHH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,KAAc;IACtB,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAgB;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAM,CAAC,OAAO,CAAc,CAAC,KAAK,EAAwB,EAAE;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC,EAAE;IACC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,yCAAyC;CACzD,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAAC,eAAM,CAAC,OAAO,CAAC,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;AACzJ,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC;AACzM,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,sBAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;AACzJ,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC/M,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;AACvM,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,UAAU,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC;AAC9L,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,OAAO,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QACV,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,eAAe,GAAG,cAAc,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE;IACzG,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,0DAA0D;CAC1E,CAAC,CAAC,CAAC;AACJ,MAAM,WAAW,GAAG,eAAM,CAAC,aAAa,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;IAC3I,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC;AAC5K,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC,yBAAyB,CAAC;IAC7C,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,WAAW,CAAC;IAC9B,OAAO,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;QACb,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,eAAM,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;IACF,MAAM,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9E,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,6BAA6B,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,GAAG,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;CACL,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC,2BAA2B,CAAC;IACjD,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;IACpE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,mBAAmB,CAAC,gCAAgC,CAAC;IAChE,kBAAkB,EAAE,mBAAmB,CAAC,yCAAyC,CAAC;IAClF,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,cAAc,CAAC,4BAA4B,CAAC;QAClD,WAAW,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;QACrE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,mBAAmB,CAAC,4BAA4B,CAAC;KAC1D,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;IAC/D,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,kFAAkF;CAClG,CAAC,CAAC,CAAC;AACJ,mGAAmG;AACtF,QAAA,8BAA8B,GAAyD,WAAW,CAAC;IAC5G,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC5C,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,qBAAqB,CAAC;IAC3E,sBAAsB,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC7E,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,mBAAmB,EAAE,cAAc,CAAC,kCAAkC,CAAC;QACvE,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,WAAW,CAAC;YACvB,IAAI,EAAE,YAAY,CAAC,gCAAgC,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,CAAC;YAC9D,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;SACjE,CAAC;KACL,CAAC;IACF,OAAO,EAAE,WAAW,CAAC;QACjB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,eAAe,EAAE,oBAAoB,CAAC;QAC3D,eAAe,EAAE,cAAc,CAAC,qCAAqC,CAAC;QACtE,KAAK,EAAE,WAAW,CAAC;YACf,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;YACpD,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;SACvD,CAAC;QACF,UAAU,EAAE,WAAW,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,iCAAiC,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,wBAAwB,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,UAAU,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;YACpE,cAAc,EAAE,WAAW,CAAC;gBACxB,KAAK,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;gBAC9D,kBAAkB,EAAE,mBAAmB,CAAC,6CAA6C,CAAC;gBACtF,WAAW,EAAE,eAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC;aACxD,CAAC;SACL,CAAC;QACF,MAAM,EAAE,WAAW,CAAC;YAChB,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,cAAc,EAAE,cAAc,CAAC,mCAAmC,CAAC;YACnE,WAAW,EAAE,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACrG,CAAC;KACL,CAAC;IACF,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,eAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC5C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QACpD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;KACpE,CAAC,EAAE,WAAW,CAAC;QACZ,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QAC5C,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACnC,iBAAiB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QACxC,oBAAoB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;QACxD,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACnD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;QACjE,OAAO,EAAE,aAAa;KACzB,CAAC,CAAC;CACN,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,+FAA+F;AAC/F,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,OAAO;QACV,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,OAAO,CAAC,SAAS;YACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;aAClF,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,OAAO,CAAC,QAAQ;YACnB,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACZ,GAAG,OAAO,CAAC,MAAM;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACnB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO;oBACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;wBACf,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;wBAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;qBACrE,CAAC;oBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;wBAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;wBAChC,gBAAgB,EAAE,yBAAyB;wBAC3C,SAAS,EAAE,yCAAiC;qBAC/C,CAAC;iBACL,CAAC;aACL,CAAC;KACT,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACnD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;SACtC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAC5F,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,gBAAgB,CAAC,IAA4B;IAClD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,OAAO,KAAK,QAAQ;QACvE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;QACjC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAA6B;IAC9D,MAAM,KAAK,GAAG,oBAAW,CAAC,cAAc,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAA,8BAAkB,EAAC;gBACtB,IAAI,EAAE,uCAAuC;gBAC7C,IAAI;gBACJ,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,wCAAwC;YAC9C,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,mDAAmD;YACzD,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;SACxG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,uCAAuC;QAC7C,IAAI;QACJ,OAAO,EAAE,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,6BAA6B,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,eAAM,CAAC,mBAAmB,CAAC,sCAA8B,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,eAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QACtB,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa;QAChF,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK;YAC3C,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,2CAA2C;YACjD,OAAO,EAAE,qFAAqF;SACjG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,KAAK,qBAAqB,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;QAC9C,CAAC,UAAU;YACP,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,aAAa;YACxD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACpE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,mDAAmD;YACzD,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sFAAsF;SAClG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,QAAQ,EAAE;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACY,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAC5D,QAAA,8BAA8B,GAAG,6BAA6B,CAAC;AAC5E,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,OAAO,6BAA6B,CAAC;QACjC,GAAG,KAAK;QACR,sBAAsB,EAAE,8CAA8C,CAAC,KAAK,CAAC;KAChF,CAAC,CAAC;AACP,CAAC;AACY,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YACnD,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE;SACxD;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE;YAC7C,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;SAC9F;QACD,QAAQ,EAAE;YACN,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;SAC/C;QACD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACrD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;SACxC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;YACrC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAChG,MAAM,EAAE;oBACJ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1D;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,UAAU,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Either, ParseResult, Schema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SCHEMA_VERSION = DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n    string,\n    ...string[]\n] = Object.freeze([\n    \"0.0.0.0/8\", \"10.0.0.0/8\", \"100.64.0.0/10\", \"127.0.0.0/8\", \"169.254.0.0/16\",\n    \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.2.0/24\", \"192.168.0.0/16\",\n    \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"224.0.0.0/4\",\n    \"240.0.0.0/4\", \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n    \"dns\",\n    \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n    \"cpu\",\n    \"memory\",\n    \"pids\"\n] = Object.freeze([\n    \"cpu\", \"memory\", \"pids\",\n]);\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"raw-dind-storage/v1\";\nexport interface DockerProfileUnixEndpoint {\n    readonly path: string;\n    readonly peerUid: number;\n}\n/** Callback-free descriptor data that crosses the host deployment trust boundary. */\nexport interface DockerProfileNetworkPolicy {\n    readonly version: 1;\n    readonly dns: {\n        readonly mode: \"explicit\";\n        readonly servers: readonly [\n            string,\n            ...string[]\n        ];\n    };\n    readonly egress: {\n        readonly mode: \"rootless-nat\";\n        readonly allowedProtocols: readonly [\n            \"dns\",\n            \"https\"\n        ];\n        readonly denyPrivateNetworks: true;\n        readonly denySiblingSyntheticEndpoints: true;\n        readonly denyCidrs: readonly [\n            string,\n            ...string[]\n        ];\n        readonly ipv6: \"disabled\";\n        readonly disableHostLoopback: true;\n        readonly portDriver: \"none\";\n        readonly daemonBridge: \"none\";\n        readonly exclusiveNetwork: true;\n        readonly icc: false;\n    };\n}\nexport interface DockerRawStoragePolicy {\n    readonly level: \"raw-dind-storage/v1\";\n    readonly privilegedTranslation: \"host-daemon\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n}\nexport interface DockerManagedRootlessPolicy {\n    readonly level: \"managed-rootless/v1\";\n    readonly hostLoopback: false;\n    readonly tcpDockerEndpoint: false;\n    readonly outerSocketInjection: false;\n    readonly privilegedTranslation: \"rootless-userns\";\n    readonly writableRoot: \"declared-tmpfs-only\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n    readonly network: DockerProfileNetworkPolicy;\n}\nexport interface DockerExecutionProfileV1 {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly transport: {\n        readonly kind: \"unix\";\n        readonly hostMachineIdentity: string;\n        readonly dockerSocket: DockerProfileUnixEndpoint;\n        readonly controlSocket: DockerProfileUnixEndpoint & {\n            readonly protocol: \"niceeval-docker-profile-control/v1\";\n        };\n    };\n    readonly backend: {\n        readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n        readonly machineIdentity: string;\n        readonly owner: {\n            readonly uid: number;\n            readonly gid: number;\n        };\n        readonly filesystem: {\n            readonly identity: string;\n            readonly mountPath: string;\n            readonly dockerRootDir: string;\n            readonly limitBytes: number;\n            readonly dockerDataPool: {\n                readonly count: number;\n                readonly bytesPerAllocation: number;\n                readonly attestation: \"linux-project-quota/v1\";\n            };\n        };\n        readonly cgroup: {\n            readonly aggregatePath: string;\n            readonly policyRevision: string;\n            readonly controllers: readonly [\n                \"cpu\",\n                \"memory\",\n                \"pids\"\n            ];\n        };\n    };\n    readonly capacity: {\n        readonly cpus: number;\n        readonly memoryBytes: number;\n        readonly memorySwapBytes: 0;\n        readonly pids: number;\n        readonly maxContainers: number;\n        readonly maxBuilds: number;\n        readonly ephemeralDiskBytes: number;\n        readonly aggregate: {\n            readonly cpus: number;\n            readonly memoryBytes: number;\n            readonly memorySwapBytes: 0;\n            readonly pids: number;\n        };\n    };\n    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\n/** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */\nexport interface DockerProfilePublicSummary {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly capacity: DockerExecutionProfileV1[\"capacity\"];\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nconst ParseOptions = Object.freeze({\n    errors: \"all\" as const,\n    exact: true,\n    onExcessProperty: \"error\" as const,\n});\ntype PlainObject = Readonly<Record<PropertyKey, unknown>>;\nconst PlainObjectSchema = Schema.declare<PlainObject>((value): value is PlainObject => {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}, {\n    identifier: \"DockerProfilePlainObject\",\n    description: \"a plain object or null-prototype record\",\n});\nconst plainStruct = <Fields extends Schema.Struct.Fields>(fields: Fields) => Schema.compose(Schema.Struct(fields), { strict: false })(PlainObjectSchema);\nconst nonEmptyString = (identifier: string) => Schema.String.pipe(Schema.filter((value) => value.trim() !== \"\" && !value.includes(\"\\0\"), { identifier, description: \"a non-empty string without NUL\" }));\nconst absolutePath = (identifier: string) => nonEmptyString(identifier).pipe(Schema.filter(isAbsolute, { identifier, description: \"an absolute path\" }));\nconst nonNegativeSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: \"a non-negative safe integer\" }));\nconst positiveSafeInteger = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: \"a positive safe integer\" }));\nconst positiveFinite = (identifier: string) => Schema.JsonNumber.pipe(Schema.filter((value) => Number.isFinite(value) && value > 0, { identifier, description: \"a positive finite number\" }));\nfunction isPublicDnsServer(value: string): boolean {\n    const kind = isIP(value);\n    if (kind === 4) {\n        const [first, second, third] = value.split(\".\").map(Number);\n        if (first === undefined || second === undefined || third === undefined)\n            return false;\n        if (first === 0 || first === 10 || first === 127 || first >= 224)\n            return false;\n        if (first === 100 && second >= 64 && second <= 127)\n            return false;\n        if (first === 169 && second === 254)\n            return false;\n        if (first === 172 && second >= 16 && second <= 31)\n            return false;\n        if (first === 192 && second === 168)\n            return false;\n        if (first === 192 && second === 0 && (third === 0 || third === 2))\n            return false;\n        if (first === 198 && (second === 18 || second === 19))\n            return false;\n        if (first === 198 && second === 51 && third === 100)\n            return false;\n        return !(first === 203 && second === 0 && third === 113);\n    }\n    if (kind !== 6)\n        return false;\n    const normalized = value.toLowerCase();\n    if (normalized.startsWith(\"::ffff:\")) {\n        return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n    }\n    return normalized !== \"::\" && normalized !== \"::1\" &&\n        !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n        !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n        !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n        !normalized.startsWith(\"ff\") && !normalized.startsWith(\"2001:db8:\");\n}\nconst DnsServerSchema = nonEmptyString(\"DockerProfilePublicDnsServer\").pipe(Schema.filter(isPublicDnsServer, {\n    identifier: \"DockerProfilePublicDnsServer\",\n    description: \"a public IP address, not a private or synthetic endpoint\",\n}));\nconst CidrsSchema = Schema.NonEmptyArray(Schema.String).pipe(Schema.filter((value) => value.length === DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&\n    value.every((cidr, index) => cidr === DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: \"DockerProfileDenyCidrs\", description: \"the v1 fail-closed CIDR set\" }));\nconst EndpointSchema = plainStruct({\n    path: absolutePath(\"DockerProfileSocketPath\"),\n    peerUid: nonNegativeSafeInteger(\"DockerProfilePeerUid\"),\n});\nconst NetworkSchema = plainStruct({\n    version: Schema.Literal(1),\n    dns: plainStruct({\n        mode: Schema.Literal(\"explicit\"),\n        servers: Schema.NonEmptyArray(DnsServerSchema),\n    }),\n    egress: plainStruct({\n        mode: Schema.Literal(\"rootless-nat\"),\n        allowedProtocols: Schema.Tuple(Schema.Literal(\"dns\"), Schema.Literal(\"https\")),\n        denyPrivateNetworks: Schema.Literal(true),\n        denySiblingSyntheticEndpoints: Schema.Literal(true),\n        denyCidrs: CidrsSchema,\n        ipv6: Schema.Literal(\"disabled\"),\n        disableHostLoopback: Schema.Literal(true),\n        portDriver: Schema.Literal(\"none\"),\n        daemonBridge: Schema.Literal(\"none\"),\n        exclusiveNetwork: Schema.Literal(true),\n        icc: Schema.Literal(false),\n    }),\n});\nconst CapacitySchema = plainStruct({\n    cpus: positiveFinite(\"DockerProfileCapacityCpus\"),\n    memoryBytes: positiveSafeInteger(\"DockerProfileCapacityMemoryBytes\"),\n    memorySwapBytes: Schema.Literal(0),\n    pids: positiveSafeInteger(\"DockerProfileCapacityPids\"),\n    maxContainers: positiveSafeInteger(\"DockerProfileCapacityMaxContainers\"),\n    maxBuilds: positiveSafeInteger(\"DockerProfileCapacityMaxBuilds\"),\n    ephemeralDiskBytes: positiveSafeInteger(\"DockerProfileCapacityEphemeralDiskBytes\"),\n    aggregate: plainStruct({\n        cpus: positiveFinite(\"DockerProfileAggregateCpus\"),\n        memoryBytes: positiveSafeInteger(\"DockerProfileAggregateMemoryBytes\"),\n        memorySwapBytes: Schema.Literal(0),\n        pids: positiveSafeInteger(\"DockerProfileAggregatePids\"),\n    }),\n}).pipe(Schema.filter((value) => value.aggregate.cpus >= value.cpus &&\n    value.aggregate.memoryBytes >= value.memoryBytes &&\n    value.aggregate.pids >= value.pids, {\n    identifier: \"DockerProfileCapacity\",\n    description: \"aggregate capacity at least as large as allocatable CPU, memory and PID capacity\",\n}));\n/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */\nexport const DockerExecutionProfileV1Schema: Schema.Schema<DockerExecutionProfileV1, PlainObject> = plainStruct({\n    schemaVersion: Schema.Literal(1),\n    profileId: nonEmptyString(\"DockerProfileId\"),\n    securityLevel: Schema.Literal(\"managed-rootless/v1\", \"raw-dind-storage/v1\"),\n    semanticPolicyRevision: nonEmptyString(\"DockerProfileSemanticPolicyRevision\"),\n    transport: plainStruct({\n        kind: Schema.Literal(\"unix\"),\n        hostMachineIdentity: nonEmptyString(\"DockerProfileHostMachineIdentity\"),\n        dockerSocket: EndpointSchema,\n        controlSocket: plainStruct({\n            path: absolutePath(\"DockerProfileControlSocketPath\"),\n            peerUid: nonNegativeSafeInteger(\"DockerProfileControlPeerUid\"),\n            protocol: Schema.Literal(\"niceeval-docker-profile-control/v1\"),\n        }),\n    }),\n    backend: plainStruct({\n        kind: Schema.Literal(\"local-systemd\", \"dedicated-linux-vm\"),\n        machineIdentity: nonEmptyString(\"DockerProfileBackendMachineIdentity\"),\n        owner: plainStruct({\n            uid: nonNegativeSafeInteger(\"DockerProfileOwnerUid\"),\n            gid: nonNegativeSafeInteger(\"DockerProfileOwnerGid\"),\n        }),\n        filesystem: plainStruct({\n            identity: nonEmptyString(\"DockerProfileFilesystemIdentity\"),\n            mountPath: absolutePath(\"DockerProfileMountPath\"),\n            dockerRootDir: absolutePath(\"DockerProfileDockerRootDir\"),\n            limitBytes: positiveSafeInteger(\"DockerProfileFilesystemLimitBytes\"),\n            dockerDataPool: plainStruct({\n                count: positiveSafeInteger(\"DockerProfileDockerDataSlotCount\"),\n                bytesPerAllocation: positiveSafeInteger(\"DockerProfileDockerDataAllocationLimitBytes\"),\n                attestation: Schema.Literal(\"linux-project-quota/v1\"),\n            }),\n        }),\n        cgroup: plainStruct({\n            aggregatePath: absolutePath(\"DockerProfileAggregatePath\"),\n            policyRevision: nonEmptyString(\"DockerProfileCgroupPolicyRevision\"),\n            controllers: Schema.Tuple(Schema.Literal(\"cpu\"), Schema.Literal(\"memory\"), Schema.Literal(\"pids\")),\n        }),\n    }),\n    capacity: CapacitySchema,\n    policy: Schema.Union(plainStruct({\n        level: Schema.Literal(\"raw-dind-storage/v1\"),\n        privilegedTranslation: Schema.Literal(\"host-daemon\"),\n        dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n    }), plainStruct({\n        level: Schema.Literal(\"managed-rootless/v1\"),\n        hostLoopback: Schema.Literal(false),\n        tcpDockerEndpoint: Schema.Literal(false),\n        outerSocketInjection: Schema.Literal(false),\n        privilegedTranslation: Schema.Literal(\"rootless-userns\"),\n        writableRoot: Schema.Literal(\"declared-tmpfs-only\"),\n        dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n        network: NetworkSchema,\n    })),\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n    string,\n    ...string[]\n] {\n    const [first, ...rest] = values;\n    if (first === undefined)\n        throw new Error(\"expected a non-empty string tuple\");\n    return Object.freeze([first, ...rest]);\n}\n/** Canonicalize only after structural decoding; nested containers are immutable to callers. */\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n    return Object.freeze({\n        ...profile,\n        transport: Object.freeze({\n            ...profile.transport,\n            dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n            controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n        }),\n        backend: Object.freeze({\n            ...profile.backend,\n            owner: Object.freeze({ ...profile.backend.owner }),\n            filesystem: Object.freeze({\n                ...profile.backend.filesystem,\n                dockerDataPool: Object.freeze({ ...profile.backend.filesystem.dockerDataPool }),\n            }),\n            cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),\n        }),\n        capacity: Object.freeze({\n            ...profile.capacity,\n            memorySwapBytes: 0,\n            aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),\n        }),\n        policy: profile.policy.level === \"raw-dind-storage/v1\"\n            ? Object.freeze({ ...profile.policy })\n            : Object.freeze({\n                ...profile.policy,\n                network: Object.freeze({\n                    ...profile.policy.network,\n                    dns: Object.freeze({\n                        ...profile.policy.network.dns,\n                        servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n                    }),\n                    egress: Object.freeze({\n                        ...profile.policy.network.egress,\n                        allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n                        denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n                    }),\n                }),\n            }),\n    });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n    return {\n        schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n        securityLevel: input.securityLevel,\n        backend: {\n            kind: input.backend.kind,\n            cgroup: {\n                policyRevision: input.backend.cgroup.policyRevision,\n                controllers: [...input.backend.cgroup.controllers],\n            },\n        },\n        policy: input.policy.level === \"raw-dind-storage/v1\" ? {\n            level: input.policy.level,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            dockerData: input.policy.dockerData,\n        } : {\n            level: input.policy.level,\n            hostLoopback: input.policy.hostLoopback,\n            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n            outerSocketInjection: input.policy.outerSocketInjection,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            writableRoot: input.policy.writableRoot,\n            dockerData: input.policy.dockerData,\n            network: {\n                version: input.policy.network.version,\n                dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },\n                egress: {\n                    mode: input.policy.network.egress.mode,\n                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n                    denyCidrs: [...input.policy.network.egress.denyCidrs],\n                    ipv6: input.policy.network.egress.ipv6,\n                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n                    portDriver: input.policy.network.egress.portDriver,\n                    daemonBridge: input.policy.network.egress.daemonBridge,\n                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n                    icc: input.policy.network.egress.icc,\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n    return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction formatSchemaPath(path: readonly PropertyKey[]): string {\n    return path.reduce<string>((result, segment) => typeof segment === \"number\" ||\n        (typeof segment === \"string\" && /^\\\\d+$/.test(segment))\n        ? `${result}[${String(segment)}]`\n        : `${result}.${String(segment)}`, \"profile\");\n}\nfunction schemaError(value: unknown, error: ParseResult.ParseError): DockerProfileError {\n    const issue = ParseResult.ArrayFormatter.formatErrorSync(error)[0];\n    const path = issue === undefined ? \"profile\" : formatSchemaPath(issue.path);\n    const root = typeof value === \"object\" && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined;\n    if (path === \"profile.schemaVersion\") {\n        if (root?.schemaVersion === undefined) {\n            return dockerProfileError({\n                code: \"sandbox.docker-profile-schema-invalid\",\n                path,\n                message: \"profile.schemaVersion is required\",\n            });\n        }\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-unknown-version\",\n            path,\n            message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n        });\n    }\n    if (path === \"profile.securityLevel\") {\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path,\n            message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,\n        });\n    }\n    return dockerProfileError({\n        code: path === \"profile.capacity\"\n            ? \"sandbox.docker-profile-capacity-invalid\"\n            : \"sandbox.docker-profile-schema-invalid\",\n        path,\n        message: issue === undefined\n            ? \"profile is not a valid Docker execution profile v1\"\n            : `${path} ${issue.message}`,\n    });\n}\nexport function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1 {\n    const decoded = Schema.decodeUnknownEither(DockerExecutionProfileV1Schema, ParseOptions)(value);\n    if (Either.isLeft(decoded))\n        throw schemaError(value, decoded.left);\n    const profile = freezeProfile(decoded.right);\n    if (profile.backend.filesystem.dockerDataPool.count < profile.capacity.maxContainers ||\n        profile.backend.filesystem.dockerDataPool.count *\n            profile.backend.filesystem.dockerDataPool.bytesPerAllocation < profile.capacity.ephemeralDiskBytes) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-capacity-invalid\",\n            path: \"profile.backend.filesystem.dockerDataPool\",\n            message: \"Docker data allocations must cover maxContainers and allocatable ephemeralDiskBytes\",\n        });\n    }\n    const rawStorage = profile.securityLevel === \"raw-dind-storage/v1\";\n    if (profile.policy.level !== profile.securityLevel ||\n        (rawStorage\n            ? profile.policy.privilegedTranslation !== \"host-daemon\"\n            : profile.policy.privilegedTranslation !== \"rootless-userns\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path: \"profile.policy\",\n            message: \"Docker profile policy level and privileged translation must match its security level\",\n        });\n    }\n    const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n    if (profile.semanticPolicyRevision !== expected) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n            path: \"profile.semanticPolicyRevision\",\n            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,\n            details: { expected, actual: profile.semanticPolicyRevision },\n        });\n    }\n    return profile;\n}\nexport const parseDockerExecutionProfile = parseDockerExecutionProfileV1;\nexport const decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;\nexport function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n    return parseDockerExecutionProfileV1({\n        ...input,\n        semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),\n    });\n}\nexport const createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n    try {\n        parseDockerExecutionProfileV1(value);\n        return true;\n    }\n    catch {\n        return false;\n    }\n}\n/** Digest the fixed v1 wire shape, not incidental object insertion order. */\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n    return {\n        schemaVersion: profile.schemaVersion,\n        profileId: profile.profileId,\n        securityLevel: profile.securityLevel,\n        semanticPolicyRevision: profile.semanticPolicyRevision,\n        transport: {\n            kind: profile.transport.kind,\n            hostMachineIdentity: profile.transport.hostMachineIdentity,\n            dockerSocket: { ...profile.transport.dockerSocket },\n            controlSocket: { ...profile.transport.controlSocket },\n        },\n        backend: {\n            kind: profile.backend.kind,\n            machineIdentity: profile.backend.machineIdentity,\n            owner: { ...profile.backend.owner },\n            filesystem: { ...profile.backend.filesystem },\n            cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },\n        },\n        capacity: {\n            ...profile.capacity,\n            aggregate: { ...profile.capacity.aggregate },\n        },\n        policy: profile.policy.level === \"raw-dind-storage/v1\" ? {\n            level: profile.policy.level,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            dockerData: profile.policy.dockerData,\n        } : {\n            level: profile.policy.level,\n            hostLoopback: profile.policy.hostLoopback,\n            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n            outerSocketInjection: profile.policy.outerSocketInjection,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            writableRoot: profile.policy.writableRoot,\n            dockerData: profile.policy.dockerData,\n            network: {\n                version: profile.policy.network.version,\n                dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },\n                egress: {\n                    ...profile.policy.network.egress,\n                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n                    denyCidrs: [...profile.policy.network.egress.denyCidrs],\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n    return `sha256:${digestOf(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n    const normalized = parseDockerExecutionProfileV1(profile);\n    return Object.freeze({\n        schemaVersion: 1,\n        profileId: normalized.profileId,\n        securityLevel: normalized.securityLevel,\n        semanticPolicyRevision: normalized.semanticPolicyRevision,\n        capacity: Object.freeze({\n            ...normalized.capacity,\n            aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n        }),\n    });\n}\n"]}

package/dist/sandbox/docker-profile/schema.d.cts

@@ -3,7 +3,7 @@ export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [string, ...string[]];
-export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "managed-vm-rootless/v1";
+export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "raw-dind-storage/v1";
 export interface DockerProfileUnixEndpoint {
     readonly path: string;
     readonly peerUid: number;
@@ -29,6 +29,21 @@ export interface DockerProfileNetworkPolicy {
         readonly icc: false;
     };
 }
+export interface DockerRawStoragePolicy {
+    readonly level: "raw-dind-storage/v1";
+    readonly privilegedTranslation: "host-daemon";
+    readonly dockerData: "private-project-quota-allocation/v1";
+}
+export interface DockerManagedRootlessPolicy {
+    readonly level: "managed-rootless/v1";
+    readonly hostLoopback: false;
+    readonly tcpDockerEndpoint: false;
+    readonly outerSocketInjection: false;
+    readonly privilegedTranslation: "rootless-userns";
+    readonly writableRoot: "declared-tmpfs-only";
+    readonly dockerData: "private-project-quota-allocation/v1";
+    readonly network: DockerProfileNetworkPolicy;
+}
 export interface DockerExecutionProfileV1 {
     readonly schemaVersion: 1;
     readonly profileId: string;
@@ -54,6 +69,11 @@ export interface DockerExecutionProfileV1 {
             readonly mountPath: string;
             readonly dockerRootDir: string;
             readonly limitBytes: number;
+            readonly dockerDataPool: {
+                readonly count: number;
+                readonly bytesPerAllocation: number;
+                readonly attestation: "linux-project-quota/v1";
+            };
         };
         readonly cgroup: {
             readonly aggregatePath: string;
@@ -68,6 +88,7 @@ export interface DockerExecutionProfileV1 {
         readonly pids: number;
         readonly maxContainers: number;
         readonly maxBuilds: number;
+        readonly ephemeralDiskBytes: number;
         readonly aggregate: {
             readonly cpus: number;
             readonly memoryBytes: number;
@@ -75,14 +96,7 @@ export interface DockerExecutionProfileV1 {
             readonly pids: number;
         };
     };
-    readonly policy: {
-        readonly hostLoopback: false;
-        readonly tcpDockerEndpoint: false;
-        readonly outerSocketInjection: false;
-        readonly privilegedTranslation: "rootless-userns";
-        readonly writableRoot: "declared-tmpfs-only";
-        readonly network: DockerProfileNetworkPolicy;
-    };
+    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;
 }
 export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
 /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */

package/dist/sandbox/docker-profile/schema.d.mts

@@ -3,7 +3,7 @@ export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [string, ...string[]];
-export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "managed-vm-rootless/v1";
+export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "raw-dind-storage/v1";
 export interface DockerProfileUnixEndpoint {
     readonly path: string;
     readonly peerUid: number;
@@ -29,6 +29,21 @@ export interface DockerProfileNetworkPolicy {
         readonly icc: false;
     };
 }
+export interface DockerRawStoragePolicy {
+    readonly level: "raw-dind-storage/v1";
+    readonly privilegedTranslation: "host-daemon";
+    readonly dockerData: "private-project-quota-allocation/v1";
+}
+export interface DockerManagedRootlessPolicy {
+    readonly level: "managed-rootless/v1";
+    readonly hostLoopback: false;
+    readonly tcpDockerEndpoint: false;
+    readonly outerSocketInjection: false;
+    readonly privilegedTranslation: "rootless-userns";
+    readonly writableRoot: "declared-tmpfs-only";
+    readonly dockerData: "private-project-quota-allocation/v1";
+    readonly network: DockerProfileNetworkPolicy;
+}
 export interface DockerExecutionProfileV1 {
     readonly schemaVersion: 1;
     readonly profileId: string;
@@ -54,6 +69,11 @@ export interface DockerExecutionProfileV1 {
             readonly mountPath: string;
             readonly dockerRootDir: string;
             readonly limitBytes: number;
+            readonly dockerDataPool: {
+                readonly count: number;
+                readonly bytesPerAllocation: number;
+                readonly attestation: "linux-project-quota/v1";
+            };
         };
         readonly cgroup: {
             readonly aggregatePath: string;
@@ -68,6 +88,7 @@ export interface DockerExecutionProfileV1 {
         readonly pids: number;
         readonly maxContainers: number;
         readonly maxBuilds: number;
+        readonly ephemeralDiskBytes: number;
         readonly aggregate: {
             readonly cpus: number;
             readonly memoryBytes: number;
@@ -75,14 +96,7 @@ export interface DockerExecutionProfileV1 {
             readonly pids: number;
         };
     };
-    readonly policy: {
-        readonly hostLoopback: false;
-        readonly tcpDockerEndpoint: false;
-        readonly outerSocketInjection: false;
-        readonly privilegedTranslation: "rootless-userns";
-        readonly writableRoot: "declared-tmpfs-only";
-        readonly network: DockerProfileNetworkPolicy;
-    };
+    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;
 }
 export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
 /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */

package/dist/sandbox/docker-profile/schema.d.ts

@@ -3,7 +3,7 @@ export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [string, ...string[]];
-export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "managed-vm-rootless/v1";
+export type DockerExecutionProfileSecurityLevel = "managed-rootless/v1" | "raw-dind-storage/v1";
 export interface DockerProfileUnixEndpoint {
     readonly path: string;
     readonly peerUid: number;
@@ -29,6 +29,21 @@ export interface DockerProfileNetworkPolicy {
         readonly icc: false;
     };
 }
+export interface DockerRawStoragePolicy {
+    readonly level: "raw-dind-storage/v1";
+    readonly privilegedTranslation: "host-daemon";
+    readonly dockerData: "private-project-quota-allocation/v1";
+}
+export interface DockerManagedRootlessPolicy {
+    readonly level: "managed-rootless/v1";
+    readonly hostLoopback: false;
+    readonly tcpDockerEndpoint: false;
+    readonly outerSocketInjection: false;
+    readonly privilegedTranslation: "rootless-userns";
+    readonly writableRoot: "declared-tmpfs-only";
+    readonly dockerData: "private-project-quota-allocation/v1";
+    readonly network: DockerProfileNetworkPolicy;
+}
 export interface DockerExecutionProfileV1 {
     readonly schemaVersion: 1;
     readonly profileId: string;
@@ -54,6 +69,11 @@ export interface DockerExecutionProfileV1 {
             readonly mountPath: string;
             readonly dockerRootDir: string;
             readonly limitBytes: number;
+            readonly dockerDataPool: {
+                readonly count: number;
+                readonly bytesPerAllocation: number;
+                readonly attestation: "linux-project-quota/v1";
+            };
         };
         readonly cgroup: {
             readonly aggregatePath: string;
@@ -68,6 +88,7 @@ export interface DockerExecutionProfileV1 {
         readonly pids: number;
         readonly maxContainers: number;
         readonly maxBuilds: number;
+        readonly ephemeralDiskBytes: number;
         readonly aggregate: {
             readonly cpus: number;
             readonly memoryBytes: number;
@@ -75,14 +96,7 @@ export interface DockerExecutionProfileV1 {
             readonly pids: number;
         };
     };
-    readonly policy: {
-        readonly hostLoopback: false;
-        readonly tcpDockerEndpoint: false;
-        readonly outerSocketInjection: false;
-        readonly privilegedTranslation: "rootless-userns";
-        readonly writableRoot: "declared-tmpfs-only";
-        readonly network: DockerProfileNetworkPolicy;
-    };
+    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;
 }
 export type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, "semanticPolicyRevision">;
 /** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */