niceeval 0.14.3-canary.52 → 0.14.3

package/dist/sandbox/backend.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"backend.js","sourceRoot":"","sources":["backend.ts"],"names":[],"mappings":";;;AAuLA,kFAEC;AASD,gEAEC;AAED,gEAEC;AAKD,wDAOC;AAOD,oEAOC;AAED,oDAqCC;AAED,kEAEC;AAED,gEAIC;AACD,kDAMC;AAED,kEAEC;AAOD,0EAMC;AAED,wDAGC;AAhTD,mDAAmD;AACnD,mCAAsC;AA0DtC,MAAa,oCAAqC,SAAQ,aAAI,CAAC,WAAW,CAAC,sCAAsC,CAAqC;CACrJ;AADD,oFACC;AACD,MAAa,kCAAmC,SAAQ,aAAI,CAAC,WAAW,CAAC,oCAAoC,CAAqC;CACjJ;AADD,gFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,sCAAuC,SAAQ,aAAI,CAAC,WAAW,CAAC,wCAAwC,CAAqC;CACzJ;AADD,wFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,qCAAsC,SAAQ,aAAI,CAAC,WAAW,CAAC,uCAAuC,CAIjH;CACD;AALD,sFAKC;AACD,MAAa,wCAAyC,SAAQ,aAAI,CAAC,WAAW,CAAC,0CAA0C,CAGvH;CACD;AAJD,4FAIC;AAkGY,QAAA,4BAA4B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACpF,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,iDAAiD;CAC5D,CAAC,CAAC;AACH,SAAgB,mCAAmC,CAAC,MAAc;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AACY,QAAA,4BAA4B,GAA+B,MAAM,CAAC,MAAM,CAAC;IAClF,YAAY,EAAE,oCAA4B;IAC1C,SAAS,EAAE,oCAA4B;IACvC,OAAO,EAAE,oCAA4B;IACrC,cAAc,EAAE,oCAA4B;IAC5C,kBAAkB,EAAE,oCAA4B;IAChD,cAAc,EAAE,oCAA4B;CAC/C,CAAC,CAAC;AACH,SAAgB,0BAA0B,CAAI,KAAQ;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AACD,8EAA8E;AAC9E,SAAgB,0BAA0B,CAAC,YAAwC;IAC/E,OAAO,YAAY,CAAC,gBAAgB,IAAI,mCAAmC,CAAC,yEAAyE,CAAC,CAAC;AAC3J,CAAC;AACD,SAAS,qBAAqB,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,+EAA+E;AAC/E,SAAgB,sBAAsB,CAAI,SAA8C;IACpF,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,6DAA6D;QAC7D,+BAA+B;QAC/B,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,qBAAqB;KAC/B,CAAC,CAAC;AACP,CAAC;AACD;;;;;GAKG;AACI,KAAK,UAAU,4BAA4B,CAAI,SAA2B;IAC7E,IAAI,CAAC;QACD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;AACL,CAAC;AACD,8DAA8D;AAC9D,SAAgB,oBAAoB,CAAC,OAAgB;IACjD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI;QACpD,GAAG,oCAA4B;QAC/B,cAAc,EAAE,mCAAmC,CAAC,+EAA+E,CAAC;KACvI,CAAC;IACF,OAAO;QACH,IAAI,OAAO;YACP,OAAO,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QACD,YAAY,EAAE;YACV,GAAG,UAAU;YACb,SAAS,EAAE,SAAS,KAAK,SAAS;gBAC9B,CAAC,CAAC,oCAA4B;gBAC9B,CAAC,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC5E;QACD,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC;QAClF,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QAChE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;QAC9D,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QAC5C,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;QAChE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC;QAC1E,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC1G,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;QAC9E,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC9G,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;KAC7B,CAAC;AACN,CAAC;AACD,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAuC,CAAC;AAChF,SAAgB,2BAA2B,CAAC,OAAgB,EAAE,YAAwC;IAClG,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AACD,4DAA4D;AAC5D,SAAgB,0BAA0B,CAAC,MAAe,EAAE,MAAe;IACvE,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,YAAY,KAAK,SAAS;QAC1B,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AACD,SAAgB,mBAAmB,CAAC,OAAgB;IAChD,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,SAAS,6CAA6C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,YAAY,CAAC;AACxB,CAAC;AACD,8DAA8D;AAC9D,SAAgB,2BAA2B,CAAC,OAAgB;IACxD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,IAAI,KAAK,WAAW,CAAC;AAChF,CAAC;AACD,MAAa,oCAAqC,SAAQ,KAAK;IAEtC;IAAwB;IAA4B;IADhE,IAAI,GAAG,sCAAsC,CAAC;IACvD,YAAqB,KAAa,EAAW,SAAiB,EAAW,MAAc;QACnF,KAAK,CAAC,SAAS,KAAK,iEAAiE,SAAS,yBAAyB,MAAM,EAAE,CAAC,CAAC;QADhH,UAAK,GAAL,KAAK,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;IAEvF,CAAC;CACJ;AALD,oFAKC;AACD,SAAgB,+BAA+B,CAAC,OAAgB,EAAE,KAAa;IAC3E,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,oCAAoC,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC5B,CAAC;AACD,+DAA+D;AAC/D,SAAgB,sBAAsB,CAAC,OAAgB;IACnD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;IAC/D,OAAO,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC","sourcesContent":["// Provider Promise SDK 与公共 Sandbox facade 之间的唯一边界。\nimport { Data, Effect } from \"effect\";\nimport type { SandboxActionState } from \"./action.ts\";\nimport type { CommandOptions, CommandResult, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations, } from \"./types.ts\";\nexport type SandboxBackendSupport<T> = {\n    readonly _tag: \"Supported\";\n    readonly value: T;\n} | {\n    readonly _tag: \"Unsupported\";\n    readonly reason: string;\n};\nexport type SandboxSetupPrefixCacheUnsupportedCode = \"provider-unsupported\" | \"profile-managed\" | \"compose\" | \"host-socket\" | \"read-only-rootfs\" | \"base-image-unverified\" | \"dynamic-runner-tools\" | \"mounted-state\" | \"sensitive-state\" | \"profile-backed-dind\";\nexport type SandboxSetupPrefixCacheEligibility = {\n    readonly _tag: \"Eligible\";\n    readonly persistence: \"persistent\";\n    readonly dependency: \"parent-backed\";\n    /** Complete action-state surface this provider captures and restores. */\n    readonly coverage: SandboxActionState;\n    /** Exact immutable Base resolved and verified during provider initialization. */\n    readonly baseImageId: string;\n    /** Provider-owned key scope; omission preserves the ordinary Docker rootfs identity exactly. */\n    readonly keyScope?: {\n        readonly protocol: string;\n        readonly storageSchemaRevision: string;\n        readonly artifactFormatRevision: string;\n        readonly semanticIdentity: import(\"../shared/types.ts\").JsonValue;\n    };\n} | {\n    readonly _tag: \"Unsupported\";\n    readonly code: SandboxSetupPrefixCacheUnsupportedCode;\n    readonly reason: string;\n};\nexport interface SandboxSetupPrefixCacheManifest {\n    /** Exact immutable Base identity; floating source references never enter the durable root key alone. */\n    readonly baseImageId: string;\n    /** Content-addressed key planned by the provider-neutral runtime. */\n    readonly setupPrefixKey: string;\n    readonly setupManifestDigest: string;\n    /** Cumulative state required by this exact logical prefix. */\n    readonly requiredState: SandboxActionState;\n    readonly storageSchemaRevision: string;\n    readonly artifactFormatRevision: string;\n    readonly changeFrequency: number;\n    /** Frozen, non-sensitive declaration metadata used for bidirectional registry validation. */\n    readonly declarationMetadata: unknown;\n}\nexport interface SandboxSetupPrefixCacheOperation {\n    readonly operationId: string;\n    readonly manifest: SandboxSetupPrefixCacheManifest;\n    /** Defense-in-depth only; values are checked before an image is published and are never persisted. */\n    readonly knownSensitiveValues?: readonly string[];\n}\ninterface SandboxSetupPrefixCacheErrorFields {\n    readonly operation: string;\n    readonly reason: string;\n    readonly setupPrefixKey?: string;\n    readonly domainId?: string;\n    readonly cause?: unknown;\n}\nexport class SandboxSetupPrefixCacheRegistryError extends Data.TaggedError(\"SandboxSetupPrefixCacheRegistryError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheLookupError extends Data.TaggedError(\"SandboxSetupPrefixCacheLookupError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheCaptureError extends Data.TaggedError(\"SandboxSetupPrefixCacheCaptureError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheRestoreError extends Data.TaggedError(\"SandboxSetupPrefixCacheRestoreError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheValidationError extends Data.TaggedError(\"SandboxSetupPrefixCacheValidationError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheCleanupError extends Data.TaggedError(\"SandboxSetupPrefixCacheCleanupError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheAmbiguityError extends Data.TaggedError(\"SandboxSetupPrefixCacheAmbiguityError\")<SandboxSetupPrefixCacheErrorFields & {\n    readonly operationId: string;\n    readonly terminal: \"unresolved\";\n    readonly diagnosticCommand: string;\n}> {\n}\nexport class SandboxSetupPrefixCacheCancellationError extends Data.TaggedError(\"SandboxSetupPrefixCacheCancellationError\")<SandboxSetupPrefixCacheErrorFields & {\n    readonly operationId: string;\n    readonly terminal: \"cancel-fenced\";\n}> {\n}\nexport type SandboxSetupPrefixCacheError = SandboxSetupPrefixCacheRegistryError | SandboxSetupPrefixCacheLookupError | SandboxSetupPrefixCacheCaptureError | SandboxSetupPrefixCacheRestoreError | SandboxSetupPrefixCacheValidationError | SandboxSetupPrefixCacheCleanupError | SandboxSetupPrefixCacheAmbiguityError | SandboxSetupPrefixCacheCancellationError;\nexport type SandboxSetupPrefixCacheLookupResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"Miss\";\n    readonly setupPrefixKey: string;\n    /** A failed hit was scrubbed in the same private slot before this clean miss receipt. */\n    readonly recovery?: \"restore-failed-replayed\";\n} | {\n    readonly _tag: \"Restored\";\n    readonly setupPrefixKey: string;\n    readonly entryId: string;\n    readonly generation: number;\n    /** Provider-neutral immutable artifact identity. */\n    readonly artifactId: string;\n    /** Present only when the provider artifact is an exact Docker image. */\n    readonly imageId?: string;\n    readonly sandboxId: string;\n};\nexport type SandboxSetupPrefixCacheCaptureResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"Contended\";\n    readonly setupPrefixKey: string;\n    readonly reason: \"active-writer\" | \"indexed-generation\";\n} | {\n    /**\n     * The action already succeeded and the same private sandbox is still a\n     * verified active continuation. The Runner must never clean-base/replay\n     * that action and must disable publication for the remainder of Attempt.\n     */\n    readonly _tag: \"ContinuedUncached\";\n    readonly setupPrefixKey: string;\n    readonly reason: \"capture-failed\" | \"publish-failed\";\n    readonly sandboxId: string;\n} | {\n    readonly _tag: \"Captured\";\n    readonly setupPrefixKey: string;\n    readonly entryId: string;\n    readonly generation: number;\n    /** Provider-neutral immutable artifact identity. */\n    readonly artifactId: string;\n    /** Present only when the provider artifact is an exact Docker image. */\n    readonly imageId?: string;\n    readonly sandboxId: string;\n};\nexport type SandboxSetupPrefixCacheRecoveryResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"RecoveredCleanBase\";\n    readonly baseImageId: string;\n    readonly sandboxId: string;\n};\nexport interface SandboxSetupPrefixCacheCapability {\n    eligibility(): SandboxSetupPrefixCacheEligibility;\n    lookupAndRebase(input: SandboxSetupPrefixCacheOperation): Effect.Effect<SandboxSetupPrefixCacheLookupResult, SandboxSetupPrefixCacheError>;\n    captureAndRebase(input: SandboxSetupPrefixCacheOperation): Effect.Effect<SandboxSetupPrefixCacheCaptureResult, SandboxSetupPrefixCacheError>;\n    /**\n     * One-shot degraded-path seam, only valid before any Action has succeeded in\n     * the current Attempt. The provider DestroyOnly-retires a failed lookup\n     * instance and rebases this stable backend onto the exact Base. Capture\n     * failure paths must return ContinuedUncached or fail; they must never call\n     * this seam and replay an already-successful Action.\n     */\n    recoverCleanBase(): Effect.Effect<SandboxSetupPrefixCacheRecoveryResult, SandboxSetupPrefixCacheError>;\n}\nexport interface SandboxBackendCapabilities {\n    /** Provider 能否兑现 CommandOptions.user 的 root 覆盖；runner 私有基础设施按这项能力选择身份。 */\n    readonly rootCommands: SandboxBackendSupport<true>;\n    readonly appendLog: SandboxBackendSupport<(line: string) => Promise<void>>;\n    readonly suspend: SandboxBackendSupport<() => Promise<void>>;\n    readonly ensureLifetime: SandboxBackendSupport<(minRemainingMs: number) => Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }>>;\n    readonly setCommandDeadline: SandboxBackendSupport<(deadlineAt?: number) => void>;\n    readonly managedProcess: SandboxBackendSupport<(input: ManagedProcessStart) => Promise<ManagedProcess>>;\n    /** Missing providers are normalized to an explicit Unsupported result by setupPrefixCacheCapability(). */\n    readonly setupPrefixCache?: SandboxBackendSupport<SandboxSetupPrefixCacheCapability>;\n}\nexport interface SandboxProviderBackend extends Omit<SandboxTransferOperations, \"upload\"> {\n    readonly workdir: string;\n    readonly sandboxId: string;\n    readonly otlpHost: string | null;\n    readonly capabilities: SandboxBackendCapabilities;\n    runCommand(command: string, args?: readonly string[], options?: CommandOptions): Promise<CommandResult>;\n    runShell(script: string, options?: CommandOptions): Promise<CommandResult>;\n    readText(path: string): Promise<string>;\n    writeText(path: string, content: string): Promise<void>;\n    readBytes(path: string): Promise<Uint8Array>;\n    writeBytes(path: string, content: Uint8Array): Promise<void>;\n    pathExists(path: string): Promise<boolean>;\n    stop(): Promise<void>;\n}\nexport const unsupportedBackendCapability: SandboxBackendSupport<never> = Object.freeze({\n    _tag: \"Unsupported\",\n    reason: \"the provider does not implement this capability\",\n});\nexport function unsupportedBackendCapabilityBecause(reason: string): SandboxBackendSupport<never> {\n    return Object.freeze({ _tag: \"Unsupported\", reason });\n}\nexport const noSandboxBackendCapabilities: SandboxBackendCapabilities = Object.freeze({\n    rootCommands: unsupportedBackendCapability,\n    appendLog: unsupportedBackendCapability,\n    suspend: unsupportedBackendCapability,\n    ensureLifetime: unsupportedBackendCapability,\n    setCommandDeadline: unsupportedBackendCapability,\n    managedProcess: unsupportedBackendCapability,\n});\nexport function supportedBackendCapability<T>(value: T): SandboxBackendSupport<T> {\n    return Object.freeze({ _tag: \"Supported\", value });\n}\n/** Provider-neutral query seam; absence never masquerades as a cache miss. */\nexport function setupPrefixCacheCapability(capabilities: SandboxBackendCapabilities): SandboxBackendSupport<SandboxSetupPrefixCacheCapability> {\n    return capabilities.setupPrefixCache ?? unsupportedBackendCapabilityBecause(\"the provider does not implement persistent sandbox setup-prefix caching\");\n}\nfunction providerBoundaryError(cause: unknown): Error {\n    return cause instanceof Error ? cause : new Error(String(cause));\n}\n/** Promise provider SDK 在这一处 lift 成 typed-error Effect；Error 实例原样保留给现有归因逻辑。 */\nexport function providerBoundaryEffect<T>(operation: (signal: AbortSignal) => Promise<T>): Effect.Effect<T, Error> {\n    return Effect.tryPromise({\n        // 保留 Effect 运行时的取消信号，供真正支持 AbortSignal 的 SDK adapter 接入；不把中断\n        // 编码成 Error，也不在这里启动嵌套 runtime。\n        try: (signal) => operation(signal),\n        catch: providerBoundaryError,\n    });\n}\n/**\n * 公开 Sandbox Promise 接口唯一的兼容入口。\n *\n * 这不是内部 Effect runner：它只把 provider Promise 原样留在公开兼容面，并归一化非 Error\n * rejection。runtime / resource lifecycle 必须改用 providerBoundaryEffect() 组合 Effect。\n */\nexport async function providerCompatibilityPromise<T>(operation: () => Promise<T>): Promise<T> {\n    try {\n        return await operation();\n    }\n    catch (cause) {\n        throw providerBoundaryError(cause);\n    }\n}\n/** defineSandbox() 的公共新接口实现显式降成 provider backend；不探测任何旧方法。 */\nexport function customSandboxBackend(sandbox: Sandbox): SandboxProviderBackend {\n    const appendLog = sandbox.appendLog;\n    // Provider facade 产出的 Sandbox 再经 runtime 归一化时必须保留 provider-only capabilities；\n    // 作者直接返回的普通 Sandbox 没有登记项，仍严格退回 Unsupported，不能靠鸭子类型猜能力。\n    const registered = SANDBOX_CAPABILITIES.get(sandbox) ?? {\n        ...noSandboxBackendCapabilities,\n        managedProcess: unsupportedBackendCapabilityBecause(\"custom Sandbox facades do not declare the internal managed-process capability\"),\n    };\n    return {\n        get workdir() {\n            return sandbox.workdir;\n        },\n        get sandboxId() {\n            return sandbox.sandboxId;\n        },\n        get otlpHost() {\n            return sandbox.otlpHost;\n        },\n        capabilities: {\n            ...registered,\n            appendLog: appendLog === undefined\n                ? unsupportedBackendCapability\n                : supportedBackendCapability((line) => appendLog.call(sandbox, line)),\n        },\n        runCommand: (command, args, options) => sandbox.runCommand(command, args, options),\n        runShell: (script, options) => sandbox.runShell(script, options),\n        readText: (path) => sandbox.readText(path),\n        writeText: (path, content) => sandbox.writeText(path, content),\n        readBytes: (path) => sandbox.readBytes(path),\n        writeBytes: (path, content) => sandbox.writeBytes(path, content),\n        pathExists: (path) => sandbox.pathExists(path),\n        uploadFile: (source, targetPath) => sandbox.uploadFile(source, targetPath),\n        uploadDirectory: (sourceDir, targetDir, options) => sandbox.uploadDirectory(sourceDir, targetDir, options),\n        downloadFile: (sourcePath, target) => sandbox.downloadFile(sourcePath, target),\n        downloadDirectory: (sourceDir, targetDir, options) => sandbox.downloadDirectory(sourceDir, targetDir, options),\n        stop: () => sandbox.stop(),\n    };\n}\nconst SANDBOX_CAPABILITIES = new WeakMap<Sandbox, SandboxBackendCapabilities>();\nexport function registerSandboxCapabilities(sandbox: Sandbox, capabilities: SandboxBackendCapabilities): void {\n    SANDBOX_CAPABILITIES.set(sandbox, capabilities);\n}\n/** 装饰器产生新 Sandbox 对象时显式继承同一份 provider-only 能力，不靠接口外成员探测。 */\nexport function inheritSandboxCapabilities(source: Sandbox, target: Sandbox): void {\n    const capabilities = SANDBOX_CAPABILITIES.get(source);\n    if (capabilities !== undefined)\n        SANDBOX_CAPABILITIES.set(target, capabilities);\n}\nexport function sandboxCapabilities(sandbox: Sandbox): SandboxBackendCapabilities {\n    const capabilities = SANDBOX_CAPABILITIES.get(sandbox);\n    if (capabilities === undefined) {\n        throw new Error(`sandbox ${sandbox.sandboxId} was not constructed by the provider facade`);\n    }\n    return capabilities;\n}\n/** 未经 provider facade 登记的普通自定义 Sandbox 保守视为不支持提权，不做鸭子类型猜测。 */\nexport function sandboxSupportsRootCommands(sandbox: Sandbox): boolean {\n    return SANDBOX_CAPABILITIES.get(sandbox)?.rootCommands._tag === \"Supported\";\n}\nexport class SandboxManagedProcessCapabilityError extends Error {\n    readonly name = \"SandboxManagedProcessCapabilityError\";\n    constructor(readonly agent: string, readonly sandboxId: string, readonly reason: string) {\n        super(`Agent ${agent} requires the sandbox managed-process capability, but sandbox ${sandboxId} does not support it: ${reason}`);\n    }\n}\nexport function requireManagedProcessCapability(sandbox: Sandbox, agent: string): (input: ManagedProcessStart) => Promise<ManagedProcess> {\n    const capability = sandboxCapabilities(sandbox).managedProcess;\n    if (capability._tag === \"Unsupported\") {\n        throw new SandboxManagedProcessCapabilityError(agent, sandbox.sandboxId, capability.reason);\n    }\n    return capability.value;\n}\n/** Provider facade 登记的复用寿命能力；不存在时保持显式 Unsupported，不做鸭子类型探测。 */\nexport function sandboxReuseCapability(sandbox: Sandbox): SandboxReuseCapability | undefined {\n    const capability = sandboxCapabilities(sandbox).ensureLifetime;\n    return capability._tag === \"Supported\" ? { ensureLifetime: capability.value } : undefined;\n}\n"]}
+{"version":3,"file":"backend.js","sourceRoot":"","sources":["backend.ts"],"names":[],"mappings":";;;AAuLA,kFAEC;AASD,gEAEC;AAED,gEAEC;AAKD,wDAOC;AAOD,oEAOC;AAED,oDAqCC;AAED,kEAEC;AAED,gEAIC;AACD,kDAMC;AAED,kEAEC;AAOD,0EAMC;AAED,wDAGC;AAhTD,mDAAmD;AACnD,mCAAsC;AA0DtC,MAAa,oCAAqC,SAAQ,aAAI,CAAC,WAAW,CAAC,sCAAsC,CAAqC;CACrJ;AADD,oFACC;AACD,MAAa,kCAAmC,SAAQ,aAAI,CAAC,WAAW,CAAC,oCAAoC,CAAqC;CACjJ;AADD,gFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,sCAAuC,SAAQ,aAAI,CAAC,WAAW,CAAC,wCAAwC,CAAqC;CACzJ;AADD,wFACC;AACD,MAAa,mCAAoC,SAAQ,aAAI,CAAC,WAAW,CAAC,qCAAqC,CAAqC;CACnJ;AADD,kFACC;AACD,MAAa,qCAAsC,SAAQ,aAAI,CAAC,WAAW,CAAC,uCAAuC,CAIjH;CACD;AALD,sFAKC;AACD,MAAa,wCAAyC,SAAQ,aAAI,CAAC,WAAW,CAAC,0CAA0C,CAGvH;CACD;AAJD,4FAIC;AAkGY,QAAA,4BAA4B,GAAiC,MAAM,CAAC,MAAM,CAAC;IACpF,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,iDAAiD;CAC5D,CAAC,CAAC;AACH,SAAgB,mCAAmC,CAAC,MAAc;IAC9D,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1D,CAAC;AACY,QAAA,4BAA4B,GAA+B,MAAM,CAAC,MAAM,CAAC;IAClF,YAAY,EAAE,oCAA4B;IAC1C,SAAS,EAAE,oCAA4B;IACvC,OAAO,EAAE,oCAA4B;IACrC,cAAc,EAAE,oCAA4B;IAC5C,kBAAkB,EAAE,oCAA4B;IAChD,cAAc,EAAE,oCAA4B;CAC/C,CAAC,CAAC;AACH,SAAgB,0BAA0B,CAAI,KAAQ;IAClD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;AACvD,CAAC;AACD,8EAA8E;AAC9E,SAAgB,0BAA0B,CAAC,YAAwC;IAC/E,OAAO,YAAY,CAAC,gBAAgB,IAAI,mCAAmC,CAAC,yEAAyE,CAAC,CAAC;AAC3J,CAAC;AACD,SAAS,qBAAqB,CAAC,KAAc;IACzC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AACrE,CAAC;AACD,+EAA+E;AAC/E,SAAgB,sBAAsB,CAAI,SAA8C;IACpF,OAAO,eAAM,CAAC,UAAU,CAAC;QACrB,6DAA6D;QAC7D,+BAA+B;QAC/B,GAAG,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC;QAClC,KAAK,EAAE,qBAAqB;KAC/B,CAAC,CAAC;AACP,CAAC;AACD;;;;;GAKG;AACI,KAAK,UAAU,4BAA4B,CAAI,SAA2B;IAC7E,IAAI,CAAC;QACD,OAAO,MAAM,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;AACL,CAAC;AACD,8DAA8D;AAC9D,SAAgB,oBAAoB,CAAC,OAA8B;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACpC,8EAA8E;IAC9E,wDAAwD;IACxD,MAAM,UAAU,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI;QACpD,GAAG,oCAA4B;QAC/B,cAAc,EAAE,mCAAmC,CAAC,+EAA+E,CAAC;KACvI,CAAC;IACF,OAAO;QACH,IAAI,OAAO;YACP,OAAO,OAAO,CAAC,OAAO,CAAC;QAC3B,CAAC;QACD,IAAI,SAAS;YACT,OAAO,OAAO,CAAC,SAAS,CAAC;QAC7B,CAAC;QACD,IAAI,QAAQ;YACR,OAAO,OAAO,CAAC,QAAQ,CAAC;QAC5B,CAAC;QACD,YAAY,EAAE;YACV,GAAG,UAAU;YACb,SAAS,EAAE,SAAS,KAAK,SAAS;gBAC9B,CAAC,CAAC,oCAA4B;gBAC9B,CAAC,CAAC,0BAA0B,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;SAC5E;QACD,UAAU,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC;QAClF,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QAChE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC1C,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC;QAC9D,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC;QAC5C,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC;QAChE,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9C,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC;QAC1E,eAAe,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC1G,YAAY,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;QAC9E,iBAAiB,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC;QAC9G,IAAI,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE;KAC7B,CAAC;AACN,CAAC;AACD,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAAqD,CAAC;AAC9F,SAAgB,2BAA2B,CAAC,OAAgB,EAAE,YAAwC;IAClG,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AACD,4DAA4D;AAC5D,SAAgB,0BAA0B,CAAC,MAAe,EAAE,MAAe;IACvE,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,YAAY,KAAK,SAAS;QAC1B,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AACvD,CAAC;AACD,SAAgB,mBAAmB,CAAC,OAAgB;IAChD,MAAM,YAAY,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,OAAO,CAAC,SAAS,6CAA6C,CAAC,CAAC;IAC/F,CAAC;IACD,OAAO,YAAY,CAAC;AACxB,CAAC;AACD,8DAA8D;AAC9D,SAAgB,2BAA2B,CAAC,OAAgB;IACxD,OAAO,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,IAAI,KAAK,WAAW,CAAC;AAChF,CAAC;AACD,MAAa,oCAAqC,SAAQ,KAAK;IAEtC;IAAwB;IAA4B;IADhE,IAAI,GAAG,sCAAsC,CAAC;IACvD,YAAqB,KAAa,EAAW,SAAiB,EAAW,MAAc;QACnF,KAAK,CAAC,SAAS,KAAK,iEAAiE,SAAS,yBAAyB,MAAM,EAAE,CAAC,CAAC;QADhH,UAAK,GAAL,KAAK,CAAQ;QAAW,cAAS,GAAT,SAAS,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;IAEvF,CAAC;CACJ;AALD,oFAKC;AACD,SAAgB,+BAA+B,CAAC,OAAgB,EAAE,KAAa;IAC3E,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;IAC/D,IAAI,UAAU,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACpC,MAAM,IAAI,oCAAoC,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC;AAC5B,CAAC;AACD,+DAA+D;AAC/D,SAAgB,sBAAsB,CAAC,OAAgB;IACnD,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC;IAC/D,OAAO,UAAU,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9F,CAAC","sourcesContent":["// Provider Promise SDK 与公共 Sandbox facade 之间的唯一边界。\nimport { Data, Effect } from \"effect\";\nimport type { SandboxActionState } from \"./action.ts\";\nimport type { CommandOptions, CommandResult, CustomProviderSandbox, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations, } from \"./types.ts\";\nexport type SandboxBackendSupport<T> = {\n    readonly _tag: \"Supported\";\n    readonly value: T;\n} | {\n    readonly _tag: \"Unsupported\";\n    readonly reason: string;\n};\nexport type SandboxSetupPrefixCacheUnsupportedCode = \"provider-unsupported\" | \"profile-managed\" | \"compose\" | \"host-socket\" | \"read-only-rootfs\" | \"base-image-unverified\" | \"dynamic-runner-tools\" | \"mounted-state\" | \"sensitive-state\" | \"profile-backed-dind\";\nexport type SandboxSetupPrefixCacheEligibility = {\n    readonly _tag: \"Eligible\";\n    readonly persistence: \"persistent\";\n    readonly dependency: \"parent-backed\";\n    /** Complete action-state surface this provider captures and restores. */\n    readonly coverage: SandboxActionState;\n    /** Exact immutable Base resolved and verified during provider initialization. */\n    readonly baseImageId: string;\n    /** Provider-owned key scope; omission preserves the ordinary Docker rootfs identity exactly. */\n    readonly keyScope?: {\n        readonly protocol: string;\n        readonly storageSchemaRevision: string;\n        readonly artifactFormatRevision: string;\n        readonly semanticIdentity: import(\"../shared/types.ts\").JsonValue;\n    };\n} | {\n    readonly _tag: \"Unsupported\";\n    readonly code: SandboxSetupPrefixCacheUnsupportedCode;\n    readonly reason: string;\n};\nexport interface SandboxSetupPrefixCacheManifest {\n    /** Exact immutable Base identity; floating source references never enter the durable root key alone. */\n    readonly baseImageId: string;\n    /** Content-addressed key planned by the provider-neutral runtime. */\n    readonly setupPrefixKey: string;\n    readonly setupManifestDigest: string;\n    /** Cumulative state required by this exact logical prefix. */\n    readonly requiredState: SandboxActionState;\n    readonly storageSchemaRevision: string;\n    readonly artifactFormatRevision: string;\n    readonly changeFrequency: number;\n    /** Frozen, non-sensitive declaration metadata used for bidirectional registry validation. */\n    readonly declarationMetadata: unknown;\n}\nexport interface SandboxSetupPrefixCacheOperation {\n    readonly operationId: string;\n    readonly manifest: SandboxSetupPrefixCacheManifest;\n    /** Defense-in-depth only; values are checked before an image is published and are never persisted. */\n    readonly knownSensitiveValues?: readonly string[];\n}\ninterface SandboxSetupPrefixCacheErrorFields {\n    readonly operation: string;\n    readonly reason: string;\n    readonly setupPrefixKey?: string;\n    readonly domainId?: string;\n    readonly cause?: unknown;\n}\nexport class SandboxSetupPrefixCacheRegistryError extends Data.TaggedError(\"SandboxSetupPrefixCacheRegistryError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheLookupError extends Data.TaggedError(\"SandboxSetupPrefixCacheLookupError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheCaptureError extends Data.TaggedError(\"SandboxSetupPrefixCacheCaptureError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheRestoreError extends Data.TaggedError(\"SandboxSetupPrefixCacheRestoreError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheValidationError extends Data.TaggedError(\"SandboxSetupPrefixCacheValidationError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheCleanupError extends Data.TaggedError(\"SandboxSetupPrefixCacheCleanupError\")<SandboxSetupPrefixCacheErrorFields> {\n}\nexport class SandboxSetupPrefixCacheAmbiguityError extends Data.TaggedError(\"SandboxSetupPrefixCacheAmbiguityError\")<SandboxSetupPrefixCacheErrorFields & {\n    readonly operationId: string;\n    readonly terminal: \"unresolved\";\n    readonly diagnosticCommand: string;\n}> {\n}\nexport class SandboxSetupPrefixCacheCancellationError extends Data.TaggedError(\"SandboxSetupPrefixCacheCancellationError\")<SandboxSetupPrefixCacheErrorFields & {\n    readonly operationId: string;\n    readonly terminal: \"cancel-fenced\";\n}> {\n}\nexport type SandboxSetupPrefixCacheError = SandboxSetupPrefixCacheRegistryError | SandboxSetupPrefixCacheLookupError | SandboxSetupPrefixCacheCaptureError | SandboxSetupPrefixCacheRestoreError | SandboxSetupPrefixCacheValidationError | SandboxSetupPrefixCacheCleanupError | SandboxSetupPrefixCacheAmbiguityError | SandboxSetupPrefixCacheCancellationError;\nexport type SandboxSetupPrefixCacheLookupResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"Miss\";\n    readonly setupPrefixKey: string;\n    /** A failed hit was scrubbed in the same private slot before this clean miss receipt. */\n    readonly recovery?: \"restore-failed-replayed\";\n} | {\n    readonly _tag: \"Restored\";\n    readonly setupPrefixKey: string;\n    readonly entryId: string;\n    readonly generation: number;\n    /** Provider-neutral immutable artifact identity. */\n    readonly artifactId: string;\n    /** Present only when the provider artifact is an exact Docker image. */\n    readonly imageId?: string;\n    readonly sandboxId: string;\n};\nexport type SandboxSetupPrefixCacheCaptureResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"Contended\";\n    readonly setupPrefixKey: string;\n    readonly reason: \"active-writer\" | \"indexed-generation\";\n} | {\n    /**\n     * The action already succeeded and the same private sandbox is still a\n     * verified active continuation. The Runner must never clean-base/replay\n     * that action and must disable publication for the remainder of Attempt.\n     */\n    readonly _tag: \"ContinuedUncached\";\n    readonly setupPrefixKey: string;\n    readonly reason: \"capture-failed\" | \"publish-failed\";\n    readonly sandboxId: string;\n} | {\n    readonly _tag: \"Captured\";\n    readonly setupPrefixKey: string;\n    readonly entryId: string;\n    readonly generation: number;\n    /** Provider-neutral immutable artifact identity. */\n    readonly artifactId: string;\n    /** Present only when the provider artifact is an exact Docker image. */\n    readonly imageId?: string;\n    readonly sandboxId: string;\n};\nexport type SandboxSetupPrefixCacheRecoveryResult = Exclude<SandboxSetupPrefixCacheEligibility, {\n    readonly _tag: \"Eligible\";\n}> | {\n    readonly _tag: \"RecoveredCleanBase\";\n    readonly baseImageId: string;\n    readonly sandboxId: string;\n};\nexport interface SandboxSetupPrefixCacheCapability {\n    eligibility(): SandboxSetupPrefixCacheEligibility;\n    lookupAndRebase(input: SandboxSetupPrefixCacheOperation): Effect.Effect<SandboxSetupPrefixCacheLookupResult, SandboxSetupPrefixCacheError>;\n    captureAndRebase(input: SandboxSetupPrefixCacheOperation): Effect.Effect<SandboxSetupPrefixCacheCaptureResult, SandboxSetupPrefixCacheError>;\n    /**\n     * One-shot degraded-path seam, only valid before any Action has succeeded in\n     * the current Attempt. The provider DestroyOnly-retires a failed lookup\n     * instance and rebases this stable backend onto the exact Base. Capture\n     * failure paths must return ContinuedUncached or fail; they must never call\n     * this seam and replay an already-successful Action.\n     */\n    recoverCleanBase(): Effect.Effect<SandboxSetupPrefixCacheRecoveryResult, SandboxSetupPrefixCacheError>;\n}\nexport interface SandboxBackendCapabilities {\n    /** Provider 能否兑现 CommandOptions.user 的 root 覆盖；runner 私有基础设施按这项能力选择身份。 */\n    readonly rootCommands: SandboxBackendSupport<true>;\n    readonly appendLog: SandboxBackendSupport<(line: string) => Promise<void>>;\n    readonly suspend: SandboxBackendSupport<() => Promise<void>>;\n    readonly ensureLifetime: SandboxBackendSupport<(minRemainingMs: number) => Promise<{\n        ready: true;\n        expiresAt?: string;\n    } | {\n        ready: false;\n        reason: string;\n    }>>;\n    readonly setCommandDeadline: SandboxBackendSupport<(deadlineAt?: number) => void>;\n    readonly managedProcess: SandboxBackendSupport<(input: ManagedProcessStart) => Promise<ManagedProcess>>;\n    /** Missing providers are normalized to an explicit Unsupported result by setupPrefixCacheCapability(). */\n    readonly setupPrefixCache?: SandboxBackendSupport<SandboxSetupPrefixCacheCapability>;\n}\nexport interface SandboxProviderBackend extends Omit<SandboxTransferOperations, \"upload\"> {\n    readonly workdir: string;\n    readonly sandboxId: string;\n    readonly otlpHost: string | null;\n    readonly capabilities: SandboxBackendCapabilities;\n    runCommand(command: string, args?: readonly string[], options?: CommandOptions): Promise<CommandResult>;\n    runShell(script: string, options?: CommandOptions): Promise<CommandResult>;\n    readText(path: string): Promise<string>;\n    writeText(path: string, content: string): Promise<void>;\n    readBytes(path: string): Promise<Uint8Array>;\n    writeBytes(path: string, content: Uint8Array): Promise<void>;\n    pathExists(path: string): Promise<boolean>;\n    stop(): Promise<void>;\n}\nexport const unsupportedBackendCapability: SandboxBackendSupport<never> = Object.freeze({\n    _tag: \"Unsupported\",\n    reason: \"the provider does not implement this capability\",\n});\nexport function unsupportedBackendCapabilityBecause(reason: string): SandboxBackendSupport<never> {\n    return Object.freeze({ _tag: \"Unsupported\", reason });\n}\nexport const noSandboxBackendCapabilities: SandboxBackendCapabilities = Object.freeze({\n    rootCommands: unsupportedBackendCapability,\n    appendLog: unsupportedBackendCapability,\n    suspend: unsupportedBackendCapability,\n    ensureLifetime: unsupportedBackendCapability,\n    setCommandDeadline: unsupportedBackendCapability,\n    managedProcess: unsupportedBackendCapability,\n});\nexport function supportedBackendCapability<T>(value: T): SandboxBackendSupport<T> {\n    return Object.freeze({ _tag: \"Supported\", value });\n}\n/** Provider-neutral query seam; absence never masquerades as a cache miss. */\nexport function setupPrefixCacheCapability(capabilities: SandboxBackendCapabilities): SandboxBackendSupport<SandboxSetupPrefixCacheCapability> {\n    return capabilities.setupPrefixCache ?? unsupportedBackendCapabilityBecause(\"the provider does not implement persistent sandbox setup-prefix caching\");\n}\nfunction providerBoundaryError(cause: unknown): Error {\n    return cause instanceof Error ? cause : new Error(String(cause));\n}\n/** Promise provider SDK 在这一处 lift 成 typed-error Effect；Error 实例原样保留给现有归因逻辑。 */\nexport function providerBoundaryEffect<T>(operation: (signal: AbortSignal) => Promise<T>): Effect.Effect<T, Error> {\n    return Effect.tryPromise({\n        // 保留 Effect 运行时的取消信号，供真正支持 AbortSignal 的 SDK adapter 接入；不把中断\n        // 编码成 Error，也不在这里启动嵌套 runtime。\n        try: (signal) => operation(signal),\n        catch: providerBoundaryError,\n    });\n}\n/**\n * 公开 Sandbox Promise 接口唯一的兼容入口。\n *\n * 这不是内部 Effect runner：它只把 provider Promise 原样留在公开兼容面，并归一化非 Error\n * rejection。runtime / resource lifecycle 必须改用 providerBoundaryEffect() 组合 Effect。\n */\nexport async function providerCompatibilityPromise<T>(operation: () => Promise<T>): Promise<T> {\n    try {\n        return await operation();\n    }\n    catch (cause) {\n        throw providerBoundaryError(cause);\n    }\n}\n/** defineSandbox() 的公共新接口实现显式降成 provider backend；不探测任何旧方法。 */\nexport function customSandboxBackend(sandbox: CustomProviderSandbox): SandboxProviderBackend {\n    const appendLog = sandbox.appendLog;\n    // Provider facade 产出的 Sandbox 再经 runtime 归一化时必须保留 provider-only capabilities；\n    // 作者直接返回的普通 Sandbox 没有登记项，仍严格退回 Unsupported，不能靠鸭子类型猜能力。\n    const registered = SANDBOX_CAPABILITIES.get(sandbox) ?? {\n        ...noSandboxBackendCapabilities,\n        managedProcess: unsupportedBackendCapabilityBecause(\"custom Sandbox facades do not declare the internal managed-process capability\"),\n    };\n    return {\n        get workdir() {\n            return sandbox.workdir;\n        },\n        get sandboxId() {\n            return sandbox.sandboxId;\n        },\n        get otlpHost() {\n            return sandbox.otlpHost;\n        },\n        capabilities: {\n            ...registered,\n            appendLog: appendLog === undefined\n                ? unsupportedBackendCapability\n                : supportedBackendCapability((line) => appendLog.call(sandbox, line)),\n        },\n        runCommand: (command, args, options) => sandbox.runCommand(command, args, options),\n        runShell: (script, options) => sandbox.runShell(script, options),\n        readText: (path) => sandbox.readText(path),\n        writeText: (path, content) => sandbox.writeText(path, content),\n        readBytes: (path) => sandbox.readBytes(path),\n        writeBytes: (path, content) => sandbox.writeBytes(path, content),\n        pathExists: (path) => sandbox.pathExists(path),\n        uploadFile: (source, targetPath) => sandbox.uploadFile(source, targetPath),\n        uploadDirectory: (sourceDir, targetDir, options) => sandbox.uploadDirectory(sourceDir, targetDir, options),\n        downloadFile: (sourcePath, target) => sandbox.downloadFile(sourcePath, target),\n        downloadDirectory: (sourceDir, targetDir, options) => sandbox.downloadDirectory(sourceDir, targetDir, options),\n        stop: () => sandbox.stop(),\n    };\n}\nconst SANDBOX_CAPABILITIES = new WeakMap<CustomProviderSandbox, SandboxBackendCapabilities>();\nexport function registerSandboxCapabilities(sandbox: Sandbox, capabilities: SandboxBackendCapabilities): void {\n    SANDBOX_CAPABILITIES.set(sandbox, capabilities);\n}\n/** 装饰器产生新 Sandbox 对象时显式继承同一份 provider-only 能力，不靠接口外成员探测。 */\nexport function inheritSandboxCapabilities(source: Sandbox, target: Sandbox): void {\n    const capabilities = SANDBOX_CAPABILITIES.get(source);\n    if (capabilities !== undefined)\n        SANDBOX_CAPABILITIES.set(target, capabilities);\n}\nexport function sandboxCapabilities(sandbox: Sandbox): SandboxBackendCapabilities {\n    const capabilities = SANDBOX_CAPABILITIES.get(sandbox);\n    if (capabilities === undefined) {\n        throw new Error(`sandbox ${sandbox.sandboxId} was not constructed by the provider facade`);\n    }\n    return capabilities;\n}\n/** 未经 provider facade 登记的普通自定义 Sandbox 保守视为不支持提权，不做鸭子类型猜测。 */\nexport function sandboxSupportsRootCommands(sandbox: Sandbox): boolean {\n    return SANDBOX_CAPABILITIES.get(sandbox)?.rootCommands._tag === \"Supported\";\n}\nexport class SandboxManagedProcessCapabilityError extends Error {\n    readonly name = \"SandboxManagedProcessCapabilityError\";\n    constructor(readonly agent: string, readonly sandboxId: string, readonly reason: string) {\n        super(`Agent ${agent} requires the sandbox managed-process capability, but sandbox ${sandboxId} does not support it: ${reason}`);\n    }\n}\nexport function requireManagedProcessCapability(sandbox: Sandbox, agent: string): (input: ManagedProcessStart) => Promise<ManagedProcess> {\n    const capability = sandboxCapabilities(sandbox).managedProcess;\n    if (capability._tag === \"Unsupported\") {\n        throw new SandboxManagedProcessCapabilityError(agent, sandbox.sandboxId, capability.reason);\n    }\n    return capability.value;\n}\n/** Provider facade 登记的复用寿命能力；不存在时保持显式 Unsupported，不做鸭子类型探测。 */\nexport function sandboxReuseCapability(sandbox: Sandbox): SandboxReuseCapability | undefined {\n    const capability = sandboxCapabilities(sandbox).ensureLifetime;\n    return capability._tag === \"Supported\" ? { ensureLifetime: capability.value } : undefined;\n}\n"]}

package/dist/sandbox/backend.d.cts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 import type { SandboxActionState } from "./action.cjs";
-import type { CommandOptions, CommandResult, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.cjs";
+import type { CommandOptions, CommandResult, CustomProviderSandbox, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.cjs";
 export type SandboxBackendSupport<T> = {
     readonly _tag: "Supported";
     readonly value: T;
@@ -216,7 +216,7 @@ export declare function providerBoundaryEffect<T>(operation: (signal: AbortSigna
  */
 export declare function providerCompatibilityPromise<T>(operation: () => Promise<T>): Promise<T>;
 /** defineSandbox() 的公共新接口实现显式降成 provider backend；不探测任何旧方法。 */
-export declare function customSandboxBackend(sandbox: Sandbox): SandboxProviderBackend;
+export declare function customSandboxBackend(sandbox: CustomProviderSandbox): SandboxProviderBackend;
 export declare function registerSandboxCapabilities(sandbox: Sandbox, capabilities: SandboxBackendCapabilities): void;
 /** 装饰器产生新 Sandbox 对象时显式继承同一份 provider-only 能力，不靠接口外成员探测。 */
 export declare function inheritSandboxCapabilities(source: Sandbox, target: Sandbox): void;

package/dist/sandbox/backend.d.mts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 import type { SandboxActionState } from "./action.mjs";
-import type { CommandOptions, CommandResult, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.mjs";
+import type { CommandOptions, CommandResult, CustomProviderSandbox, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.mjs";
 export type SandboxBackendSupport<T> = {
     readonly _tag: "Supported";
     readonly value: T;
@@ -216,7 +216,7 @@ export declare function providerBoundaryEffect<T>(operation: (signal: AbortSigna
  */
 export declare function providerCompatibilityPromise<T>(operation: () => Promise<T>): Promise<T>;
 /** defineSandbox() 的公共新接口实现显式降成 provider backend；不探测任何旧方法。 */
-export declare function customSandboxBackend(sandbox: Sandbox): SandboxProviderBackend;
+export declare function customSandboxBackend(sandbox: CustomProviderSandbox): SandboxProviderBackend;
 export declare function registerSandboxCapabilities(sandbox: Sandbox, capabilities: SandboxBackendCapabilities): void;
 /** 装饰器产生新 Sandbox 对象时显式继承同一份 provider-only 能力，不靠接口外成员探测。 */
 export declare function inheritSandboxCapabilities(source: Sandbox, target: Sandbox): void;

package/dist/sandbox/backend.d.ts

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 import type { SandboxActionState } from "./action.js";
-import type { CommandOptions, CommandResult, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.js";
+import type { CommandOptions, CommandResult, CustomProviderSandbox, Sandbox, ManagedProcess, ManagedProcessStart, SandboxReuseCapability, SandboxTransferOperations } from "./types.js";
 export type SandboxBackendSupport<T> = {
     readonly _tag: "Supported";
     readonly value: T;
@@ -216,7 +216,7 @@ export declare function providerBoundaryEffect<T>(operation: (signal: AbortSigna
  */
 export declare function providerCompatibilityPromise<T>(operation: () => Promise<T>): Promise<T>;
 /** defineSandbox() 的公共新接口实现显式降成 provider backend；不探测任何旧方法。 */
-export declare function customSandboxBackend(sandbox: Sandbox): SandboxProviderBackend;
+export declare function customSandboxBackend(sandbox: CustomProviderSandbox): SandboxProviderBackend;
 export declare function registerSandboxCapabilities(sandbox: Sandbox, capabilities: SandboxBackendCapabilities): void;
 /** 装饰器产生新 Sandbox 对象时显式继承同一份 provider-only 能力，不靠接口外成员探测。 */
 export declare function inheritSandboxCapabilities(source: Sandbox, target: Sandbox): void;

package/dist/sandbox/incus/ledger.cjs

@@ -249,7 +249,40 @@ async function reconcileDomain(repository, control, scope) {
     for (const volume of reconciledVolumes) {
         if (volume.config[control_ts_1.INCUS_METADATA.executionDomainId] !== scope.executionDomainId)
             continue;
-        const owned = next.some((intent) => isActiveIntent(intent) && volumeMetadataMatchesIntent(volume, intent));
+        let owned = next.some((intent) => isActiveIntent(intent)
+            && intent.executionDomainId === scope.executionDomainId
+            && intent.project === scope.project
+            && volumeMetadataMatchesIntent(volume, intent));
+        if (!owned) {
+            for (const observed of next) {
+                if (observed.executionDomainId !== scope.executionDomainId || observed.project !== scope.project
+                    || (observed.state !== "reserved" && observed.state !== "creating"))
+                    continue;
+                // Inventory requests are separate snapshots: a copy can appear after
+                // listInstances, and its disk keeps source metadata until PATCH.
+                // Re-read the exact allocation and object instead of treating that
+                // acceptance window as an unregistered resource.
+                const current = await readAllocationIntent(repository, observed.allocationId);
+                if (current === undefined || current.generation !== observed.generation
+                    || current.executionDomainId !== scope.executionDomainId || current.project !== scope.project
+                    || current.storagePool !== scope.storagePool
+                    || current.dockerDataVolume !== volume.name || current.providerLocator === undefined)
+                    continue;
+                if (current.state === "creating") {
+                    const instance = await control.getInstance(scope.project, current.providerLocator);
+                    owned = instance !== undefined && instance.name === current.providerLocator
+                        && volumeIsDependentOnExactInstance(instance, volume, current);
+                }
+                else if (isActiveIntent(current)) {
+                    // A completed PATCH may also have overtaken the volume snapshot.
+                    // Stable allocations must still present their own exact metadata.
+                    const refreshed = await control.getVolume(scope.project, scope.storagePool, volume.name);
+                    owned = refreshed !== undefined && volumeMetadataMatchesIntent(refreshed, current);
+                }
+                if (owned)
+                    break;
+            }
+        }
         if (owned)
             continue;
         throw (0, errors_ts_1.incusError)("sandbox-allocation-lost", `Incus volume ${JSON.stringify(volume.name)} claims execution domain ${JSON.stringify(scope.executionDomainId)} but has no exact IncusRepository allocation intent.`, ["Keep the volume in place and restore or explicitly maintain the durable registry; never infer ownership from a name or delete an unregistered object."]);

package/dist/sandbox/incus/ledger.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ledger.js","sourceRoot":"","sources":["ledger.ts"],"names":[],"mappings":";;;AAkBA,0DAEC;AACD,gEAEC;AACD,oDAEC;AACD,sDAEC;AACD,0CAGC;AACD,sCAGC;AACD,wCAEC;AACD,oCAMC;AACD,gCAsCC;AACD,sDAQC;AAID,4DA+BC;AACD,wDAKC;AACD,kEAaC;AAmBD,0CA0FC;AACD,8CAkEC;AACD,wCAEC;AACD,wCAEC;AAMD,gEAiCC;AACD,kDAEC;AAtXD,qCAAmC;AACnC,wDAAyD;AACzD,6CAAuG;AACvG,2CAAkE;AAElE,iDAAoD;AAA3C,kHAAA,iBAAiB,OAAA;AAE1B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAkB;IAC9C,UAAU;IACV,UAAU;IACV,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,MAAM;CACT,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,SAAgB,uBAAuB,CAAC,UAA2B,EAAE,MAAwB;IACzF,OAAO,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AACD,SAAgB,0BAA0B,CAAC,UAA2B,EAAE,OAAyB,EAAE,IAAsB;IACrH,OAAO,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AACD,SAAgB,oBAAoB,CAAC,UAA2B,EAAE,YAAoB;IAClF,OAAO,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;AAClD,CAAC;AACD,SAAgB,qBAAqB,CAAC,UAA2B;IAC7D,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AACD,SAAgB,eAAe,CAAC,YAAoB;IAChD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAgB,aAAa,CAAC,YAAoB;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AAC3C,CAAC;AACD,SAAgB,cAAc,CAAC,YAAoB;IAC/C,OAAO,QAAQ,YAAY,EAAE,CAAC;AAClC,CAAC;AACD,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,IAAA,kBAAQ,GAAE;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,UAAU,CAAC,QAAuB;IAW9C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO;QACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,KAAK,SAAS;YACzD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;YAC/D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,SAAS,CAAC,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,SAAS,CAAC,EAAE,CAAC;KAClE,CAAC;AACN,CAAC;AACD,SAAgB,qBAAqB,CAAC,QAAuB,EAAE,MAAwB;IACnF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WACzC,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;WACrC,IAAI,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WACnD,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WAC7C,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WAC7C,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;AACnD,CAAC;AACD,SAAS,eAAe,CAAC,KAAsB;IAC3C,OAAO,IAAA,qCAAmB,EAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;AACnD,CAAC;AACD,SAAgB,wBAAwB,CAAC,OAAoC,EAAE,SAAmC,EAAE,KAGnH,EAAE,UAAkC,EAAE;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;eAC/B,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACpD,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;eAC5B,IAAI,CAAC,UAAU,KAAK,SAAS;eAC7B,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eAClD,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,YAAY,KAAK,SAAS,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AACD,SAAgB,sBAAsB,CAAC,OAAoC,EAAE,SAAmC,EAAE,iBAAyB,EAAE,OAAe,EAAE,UAAkC,EAAE;IAC9L,OAAO,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE;QAChD,iBAAiB;QACjB,OAAO;KACV,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,SAAgB,2BAA2B,CAAC,MAAmB,EAAE,MAAwB;IACrF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,YAAY,KAAK,MAAM,CAAC,YAAY;WACpC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;WACxC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WAC9C,cAAc,KAAK,MAAM,CAAC,cAAc;WACxC,cAAc,KAAK,MAAM,CAAC,cAAc;WACxC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;AAC9C,CAAC;AACD;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,QAAuB,EAAE,MAAmB,EAAE,MAAwB;IAC5G,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;WACxB,MAAM,CAAC,WAAW,KAAK,OAAO;WAC9B,UAAU,EAAE,IAAI,KAAK,MAAM;WAC3B,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW;WACtC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI;WACjC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC;AAC3C,CAAC;AACM,KAAK,UAAU,eAAe,CAAC,UAA2B,EAAE,OAAqB,EAAE,KAIzF;IAIG,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,+DAA+D;YAC/D,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvF,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtF,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;YAClD,SAAS;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;eACnD,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACpD,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eAChC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK;YACL,SAAS;QACb,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,sDAAsD,EAAE,CAAC,yJAAyJ,CAAC,CAAC,CAAC;IACvX,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,KAAK,KAAK,CAAC,iBAAiB;YAC3E,SAAS;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3G,IAAI,KAAK;YACL,SAAS;QACb,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,sDAAsD,EAAE,CAAC,uJAAuJ,CAAC,CAAC,CAAC;IACjX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,mBAAmB;KACjC,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,iBAAiB,CAAC,UAA2B,EAAE,OAAqB,EAAE,MAAwB,EAAE,OAAe;IACjI,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,8CAA8C,EAAE,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC5M,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,qCAAqC,OAAO,CAAC,UAAU,qCAAqC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC1N,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACxF,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,wEAAwE,EAAE,CAAC,4DAA4D,CAAC,CAAC,CAAC;IAC7L,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,mBAAmB;QACnD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,0BAA0B,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,gBAAgB,EAAE,IAAI,IAAI,SAAS,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpH,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,IAAI,SAAS,CAAC,gBAAgB,IAAI,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,gBAAgB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IACzG,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACjG,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC;QAClF,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,uCAAuC,EAAE,CAAC,gGAAgG,CAAC,CAAC,CAAC;IAClQ,CAAC;IACD,MAAM,oBAAoB,GAAG,aAAa,KAAK,SAAS;WACjD,WAAW,KAAK,SAAS;WACzB,gCAAgC,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,WAAW,KAAK,SAAS;WACtB,CAAC,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC;WACpD,CAAC,oBAAoB,EAAE,CAAC;QAC3B,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,uCAAuC,EAAE,CAAC,8FAA8F,CAAC,CAAC,CAAC;IAC5P,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,SAAS,CAAC,iBAAiB,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;QACpG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,oDAAoD,EAAE,CAAC,iHAAiH,CAAC,CAAC,CAAC;QACxR,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACD,IAAI,aAAa,KAAK,SAAS;YAC3B,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS;YACzB,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC5C,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC1E,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC3F,IAAI,gBAAgB,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjE,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,mCAAmC,EAAE,CAAC,0FAA0F,CAAC,CAAC,CAAC;YAChP,CAAC;QACL,CAAC,CAAC;QACF,MAAM,aAAa,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,4IAA4I,CAAC,EAAE,KAAK,CAAC,CAAC;IACnS,CAAC;IACD,OAAO,0BAA0B,CAAC,UAAU,EAAE,SAAS,EAAE;QACrD,GAAG,SAAS;QACZ,KAAK,EAAE,WAAW;QAClB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,WAAW,EAAE,SAAS;QACtB,iBAAiB,EAAE,SAAS;KAC/B,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,cAAc,CAAC,QAAsC;IACjE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;AAChE,CAAC;AACD,SAAgB,cAAc,CAAC,MAAwB;IACnD,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAMM,KAAK,UAAU,0BAA0B,CAAC,UAA2B,EAAE,iBAAyB,EAAE,UAErG,EAAE;IACF,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,QAAyC,CAAC;IAC9C,SAAS,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO;gBACH,iBAAiB;gBACjB,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY;gBACzC,OAAO,EAAE,KAAK,IAAI,EAAE;oBAChB,IAAI,QAAQ;wBACR,OAAO;oBACX,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAA,sBAAU,EAAC,8BAA8B,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,yCAAyC,EAAE,CAAC,2EAA2E,CAAC,CAAC,CAAC;oBACxO,CAAC;gBACL,CAAC;aACJ,CAAC;QACN,CAAC;QACD,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAA,sBAAU,EAAC,8BAA8B,EAAE,6DAA6D,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,mFAAmF,CAAC,CAAC,CAAC;QAC/O,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACvE,CAAC;AACL,CAAC;AACD,SAAgB,mBAAmB,CAAC,YAAoB;IACpD,OAAO,IAAA,sBAAU,EAAC,yBAAyB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,qDAAqD,EAAE,CAAC,6FAA6F,CAAC,CAAC,CAAC;AAC3P,CAAC","sourcesContent":["import { hostname } from \"node:os\";\nimport { classifyRunIdentity } from \"../run-identity.ts\";\nimport { INCUS_METADATA, type IncusControl, type IncusInstance, type IncusVolume } from \"./control.ts\";\nimport { incusError, type IncusProviderError } from \"./errors.ts\";\nimport { type AllocationIntent, type AllocationOwner, type AllocationState, type IncusAdmissionLease, type IncusRepository, } from \"./repository.ts\";\nexport { ALLOCATION_STATES } from \"./repository.ts\";\nexport type { AllocationIntent, AllocationOwner, AllocationState } from \"./repository.ts\";\nconst RELEASED_STATES = new Set<AllocationState>([\"destroyed\"]);\nconst OCCUPYING_STATES = new Set<AllocationState>([\n    \"reserved\",\n    \"creating\",\n    \"ready\",\n    \"handed-off\",\n    \"destroy-requested\",\n    \"lost\",\n]);\nconst LOCK_WAIT_MS = 15000;\nconst LOCK_RETRY_MS = 50;\nexport function reserveAllocationIntent(repository: IncusRepository, intent: AllocationIntent): Promise<AllocationIntent> {\n    return repository.reserveAllocation(intent);\n}\nexport function transitionAllocationIntent(repository: IncusRepository, current: AllocationIntent, next: AllocationIntent): Promise<AllocationIntent> {\n    return repository.transitionAllocation(current, next);\n}\nexport function readAllocationIntent(repository: IncusRepository, allocationId: string): Promise<AllocationIntent | undefined> {\n    return repository.getAllocation(allocationId);\n}\nexport function listAllocationIntents(repository: IncusRepository): Promise<readonly AllocationIntent[]> {\n    return repository.listAllocations();\n}\nexport function instanceNameFor(allocationId: string): string {\n    const compact = allocationId.replaceAll(\"-\", \"\").toLowerCase();\n    return `ne-${compact.slice(0, 20)}`;\n}\nexport function volumeNameFor(allocationId: string): string {\n    const compact = allocationId.replaceAll(\"-\", \"\").toLowerCase();\n    return `ne-${compact.slice(0, 18)}-dd`;\n}\nexport function executionIdFor(allocationId: string): string {\n    return `exec-${allocationId}`;\n}\nexport function currentOwner(): AllocationOwner {\n    return Object.freeze({\n        host: hostname(),\n        pid: process.pid,\n        startedAt: new Date().toISOString(),\n    });\n}\nexport function metadataOf(instance: IncusInstance): {\n    readonly allocationId?: string;\n    readonly executionId?: string;\n    readonly generation?: number;\n    readonly artifactDigest?: string;\n    readonly executionDomainId?: string;\n    readonly provisionToken?: string;\n    readonly host?: string;\n    readonly pid?: number;\n    readonly startedAt?: string;\n} {\n    const generationRaw = instance.config[INCUS_METADATA.generation];\n    const generation = generationRaw === undefined ? undefined : Number(generationRaw);\n    const pidRaw = instance.config[INCUS_METADATA.pid];\n    const pid = pidRaw === undefined ? undefined : Number(pidRaw);\n    return {\n        ...(instance.config[INCUS_METADATA.allocationId] === undefined\n            ? {}\n            : { allocationId: instance.config[INCUS_METADATA.allocationId] }),\n        ...(instance.config[INCUS_METADATA.executionId] === undefined\n            ? {}\n            : { executionId: instance.config[INCUS_METADATA.executionId] }),\n        ...(generation !== undefined && Number.isSafeInteger(generation) ? { generation } : {}),\n        ...(instance.config[INCUS_METADATA.artifactDigest] === undefined\n            ? {}\n            : { artifactDigest: instance.config[INCUS_METADATA.artifactDigest] }),\n        ...(instance.config[INCUS_METADATA.executionDomainId] === undefined\n            ? {}\n            : { executionDomainId: instance.config[INCUS_METADATA.executionDomainId] }),\n        ...(instance.config[INCUS_METADATA.provisionToken] === undefined\n            ? {}\n            : { provisionToken: instance.config[INCUS_METADATA.provisionToken] }),\n        ...(instance.config[INCUS_METADATA.host] === undefined ? {} : { host: instance.config[INCUS_METADATA.host] }),\n        ...(pid !== undefined && Number.isSafeInteger(pid) ? { pid } : {}),\n        ...(instance.config[INCUS_METADATA.startedAt] === undefined\n            ? {}\n            : { startedAt: instance.config[INCUS_METADATA.startedAt] }),\n    };\n}\nexport function metadataMatchesIntent(instance: IncusInstance, intent: AllocationIntent): boolean {\n    const meta = metadataOf(instance);\n    return meta.allocationId === intent.allocationId\n        && meta.generation === intent.generation\n        && meta.executionDomainId === intent.executionDomainId\n        && meta.artifactDigest === intent.artifactDigest\n        && meta.provisionToken === intent.provisionToken\n        && meta.executionId === intent.executionId;\n}\nfunction ownerProvenDead(owner: AllocationOwner): boolean {\n    return classifyRunIdentity(owner) === \"orphan\";\n}\nexport function unionActiveAllocationIds(intents: readonly AllocationIntent[], instances: readonly IncusInstance[], scope: {\n    readonly executionDomainId: string;\n    readonly project: string;\n}, volumes: readonly IncusVolume[] = []): ReadonlySet<string> {\n    const ids = new Set<string>();\n    for (const intent of intents) {\n        if (OCCUPYING_STATES.has(intent.state)\n            && intent.executionDomainId === scope.executionDomainId\n            && intent.project === scope.project) {\n            ids.add(intent.allocationId);\n        }\n    }\n    for (const instance of instances) {\n        const meta = metadataOf(instance);\n        if (meta.allocationId !== undefined\n            && meta.generation !== undefined\n            && meta.executionDomainId === scope.executionDomainId\n            && meta.artifactDigest !== undefined\n            && meta.provisionToken !== undefined\n            && meta.executionId !== undefined) {\n            ids.add(meta.allocationId);\n        }\n    }\n    for (const volume of volumes) {\n        const allocationId = volume.config[INCUS_METADATA.allocationId];\n        const executionDomainId = volume.config[INCUS_METADATA.executionDomainId];\n        if (allocationId !== undefined && executionDomainId === scope.executionDomainId) {\n            ids.add(allocationId);\n        }\n    }\n    return ids;\n}\nexport function countActiveAllocations(intents: readonly AllocationIntent[], instances: readonly IncusInstance[], executionDomainId: string, project: string, volumes: readonly IncusVolume[] = []): number {\n    return unionActiveAllocationIds(intents, instances, {\n        executionDomainId,\n        project,\n    }, volumes).size;\n}\nexport function volumeMetadataMatchesIntent(volume: IncusVolume, intent: AllocationIntent): boolean {\n    const allocationId = volume.config[INCUS_METADATA.allocationId];\n    const generation = volume.config[INCUS_METADATA.generation];\n    const executionDomainId = volume.config[INCUS_METADATA.executionDomainId];\n    const artifactDigest = volume.config[INCUS_METADATA.artifactDigest];\n    const provisionToken = volume.config[INCUS_METADATA.provisionToken];\n    const executionId = volume.config[INCUS_METADATA.executionId];\n    return allocationId === intent.allocationId\n        && generation === String(intent.generation)\n        && executionDomainId === intent.executionDomainId\n        && artifactDigest === intent.artifactDigest\n        && provisionToken === intent.provisionToken\n        && executionId === intent.executionId;\n}\n/**\n * Incus creates a cross-project copy's dependent volume atomically with its\n * VM. There is a narrow acceptance window before the follow-up volume PATCH\n * can replace the source artifact metadata. During that window, the VM is\n * still the durable allocation's exact object, and its expanded `dockerdata`\n * device is the only evidence that permits deleting the copied volume.\n */\nfunction volumeIsDependentOnExactInstance(instance: IncusInstance, volume: IncusVolume, intent: AllocationIntent): boolean {\n    if (!metadataMatchesIntent(instance, intent))\n        return false;\n    const dockerData = instance.expandedDevices?.dockerdata;\n    return volume.type === \"custom\"\n        && volume.contentType === \"block\"\n        && dockerData?.type === \"disk\"\n        && dockerData.pool === intent.storagePool\n        && dockerData.source === volume.name\n        && dockerData.dependent === \"true\";\n}\nexport async function reconcileDomain(repository: IncusRepository, control: IncusControl, scope: {\n    readonly executionDomainId: string;\n    readonly project: string;\n    readonly storagePool: string;\n}): Promise<{\n    readonly intents: readonly AllocationIntent[];\n    readonly instances: readonly IncusInstance[];\n}> {\n    const intents = await listAllocationIntents(repository);\n    const instances = await control.listInstances(scope.project);\n    const volumes = await control.listVolumes(scope.project, scope.storagePool);\n    const next: AllocationIntent[] = [];\n    for (const intent of intents) {\n        if (intent.executionDomainId !== scope.executionDomainId || intent.project !== scope.project) {\n            next.push(intent);\n            continue;\n        }\n        if (RELEASED_STATES.has(intent.state)) {\n            next.push(intent);\n            continue;\n        }\n        const instance = instances.find((candidate) => metadataMatchesIntent(candidate, intent));\n        const volume = volumes.find((candidate) => volumeMetadataMatchesIntent(candidate, intent));\n        const ownerAlive = !ownerProvenDead(intent.owner);\n        if (instance === undefined && volume === undefined) {\n            if (intent.quarantined === true) {\n                next.push(intent);\n                continue;\n            }\n            if (ownerAlive && (intent.state === \"reserved\" || intent.state === \"creating\")) {\n                next.push(intent);\n                continue;\n            }\n            if (ownerAlive) {\n                next.push(intent);\n                continue;\n            }\n            // Even an absent allocation must cross the repository's fenced\n            // destroy-requested state.  In particular, a process can die after the\n            // allocation became ready while an operator independently removes the\n            // exact VM and volume; skipping the destroy protocol would attempt the\n            // invalid ready -> destroyed transition.\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        if (intent.state === \"destroy-requested\") {\n            const awaitedObject = intent.acceptanceUnknown === \"volume-create\" ? volume : instance;\n            if (intent.quarantined === true && awaitedObject === undefined) {\n                next.push(intent);\n                continue;\n            }\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        if (ownerProvenDead(intent.owner)) {\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        next.push(intent);\n    }\n    // Re-read after detached destroy. The initial inventory can contain an\n    // accepted clone whose dependent volume still has the source artifact's\n    // metadata; classifying that already-destroyed snapshot as unregistered\n    // would turn successful reconciliation into a false lost-allocation error.\n    const reconciledInstances = await control.listInstances(scope.project);\n    const reconciledVolumes = await control.listVolumes(scope.project, scope.storagePool);\n    for (const instance of reconciledInstances) {\n        const meta = metadataOf(instance);\n        if (meta.executionDomainId !== scope.executionDomainId)\n            continue;\n        const owned = next.some((intent) => isActiveIntent(intent)\n            && intent.executionDomainId === scope.executionDomainId\n            && intent.project === scope.project\n            && metadataMatchesIntent(instance, intent));\n        if (owned)\n            continue;\n        throw incusError(\"sandbox-allocation-lost\", `Incus instance ${JSON.stringify(instance.name)} claims execution domain ${JSON.stringify(scope.executionDomainId)} but has no exact IncusRepository allocation intent.`, [\"Keep the instance in place and restore or explicitly maintain the durable registry; never infer ownership from a name or delete an unregistered object.\"]);\n    }\n    for (const volume of reconciledVolumes) {\n        if (volume.config[INCUS_METADATA.executionDomainId] !== scope.executionDomainId)\n            continue;\n        const owned = next.some((intent) => isActiveIntent(intent) && volumeMetadataMatchesIntent(volume, intent));\n        if (owned)\n            continue;\n        throw incusError(\"sandbox-allocation-lost\", `Incus volume ${JSON.stringify(volume.name)} claims execution domain ${JSON.stringify(scope.executionDomainId)} but has no exact IncusRepository allocation intent.`, [\"Keep the volume in place and restore or explicitly maintain the durable registry; never infer ownership from a name or delete an unregistered object.\"]);\n    }\n    return Object.freeze({\n        intents: Object.freeze(next),\n        instances: reconciledInstances,\n    });\n}\nexport async function destroyAllocation(repository: IncusRepository, control: IncusControl, intent: AllocationIntent, project: string): Promise<AllocationIntent> {\n    const current = await readAllocationIntent(repository, intent.allocationId);\n    if (current === undefined) {\n        throw incusError(\"sandbox-allocation-lost\", `Sandbox allocation ${JSON.stringify(intent.allocationId)} disappeared from the ledger before destroy.`, [\"Reconcile the ledger against Incus inventory.\"]);\n    }\n    if (current.generation !== intent.generation) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Destroy fenced: ledger generation ${current.generation} does not match caller generation ${intent.generation}.`, [\"Retry destroy from the current generation only.\"]);\n    }\n    if (current.executionDomainId !== intent.executionDomainId || current.project !== project) {\n        throw incusError(\"sandbox-destroy-incomplete\", \"Destroy fenced: execution domain or project does not match the caller.\", [\"Destroy only from the owning execution domain and project.\"]);\n    }\n    const requested = current.state === \"destroy-requested\"\n        ? current\n        : await transitionAllocationIntent(repository, current, { ...current, state: \"destroy-requested\" });\n    const instances = await control.listInstances(project);\n    const volumes = await control.listVolumes(project, requested.storagePool);\n    const matchingInstance = instances.find((candidate) => metadataMatchesIntent(candidate, requested));\n    const matchingVolume = volumes.find((candidate) => volumeMetadataMatchesIntent(candidate, requested));\n    const instanceName = matchingInstance?.name ?? requested.providerLocator ?? instanceNameFor(requested.allocationId);\n    const volumeName = matchingVolume?.name ?? requested.dockerDataVolume ?? volumeNameFor(requested.allocationId);\n    const namedInstance = matchingInstance ?? instances.find((candidate) => candidate.name === instanceName);\n    const namedVolume = matchingVolume ?? volumes.find((candidate) => candidate.name === volumeName);\n    if (namedInstance !== undefined && !metadataMatchesIntent(namedInstance, requested)) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Refusing to destroy Incus instance ${JSON.stringify(instanceName)} with mismatched allocation metadata.`, [\"Inspect the instance identity; NiceEval only destroys the exact allocation generation it owns.\"]);\n    }\n    const inheritedCloneVolume = namedInstance !== undefined\n        && namedVolume !== undefined\n        && volumeIsDependentOnExactInstance(namedInstance, namedVolume, requested);\n    if (namedVolume !== undefined\n        && !volumeMetadataMatchesIntent(namedVolume, requested)\n        && !inheritedCloneVolume) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Refusing to destroy Incus volume ${JSON.stringify(volumeName)} with mismatched allocation metadata.`, [\"Inspect the volume identity; NiceEval only destroys the exact allocation generation it owns.\"]);\n    }\n    if (requested.quarantined === true) {\n        const awaitedObject = requested.acceptanceUnknown === \"volume-create\" ? namedVolume : namedInstance;\n        if (awaitedObject === undefined) {\n            throw incusError(\"sandbox-destroy-incomplete\", `Incus allocation ${JSON.stringify(requested.allocationId)} still has an acceptance-unknown create operation.`, [\"Keep the allocation quarantined until the expected Incus object appears and can be destroyed by exact metadata.\"]);\n        }\n    }\n    try {\n        if (namedInstance !== undefined)\n            await control.deleteInstance(project, namedInstance.name);\n        if (namedVolume !== undefined)\n            await control.deleteVolume(project, requested.storagePool, namedVolume.name);\n        await control.waitAbsent(project, instanceName);\n        await control.waitVolumeAbsent(project, requested.storagePool, volumeName);\n        const confirmAbsent = async (): Promise<void> => {\n            const leftoverInstance = await control.getInstance(project, instanceName);\n            const leftoverVolume = await control.getVolume(project, requested.storagePool, volumeName);\n            if (leftoverInstance !== undefined || leftoverVolume !== undefined) {\n                throw incusError(\"sandbox-destroy-incomplete\", `Incus allocation ${JSON.stringify(requested.allocationId)} still has a VM or custom volume.`, [\"Retry destroy; do not mark destroyed without absent receipts for both the VM and volume.\"]);\n            }\n        };\n        await confirmAbsent();\n    }\n    catch (cause) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Failed to prove Incus allocation ${JSON.stringify(requested.allocationId)} is absent.`, [\"Retry destroy from the Incus control plane; NiceEval will not mark the allocation destroyed without absent receipts for the VM and volume.\"], cause);\n    }\n    return transitionAllocationIntent(repository, requested, {\n        ...requested,\n        state: \"destroyed\",\n        providerLocator: undefined,\n        dockerDataVolume: undefined,\n        quarantined: undefined,\n        acceptanceUnknown: undefined,\n    });\n}\nexport function nextGeneration(existing: AllocationIntent | undefined): number {\n    return existing === undefined ? 1 : existing.generation + 1;\n}\nexport function isActiveIntent(intent: AllocationIntent): boolean {\n    return OCCUPYING_STATES.has(intent.state);\n}\nexport interface AdmissionLock {\n    readonly executionDomainId: string;\n    readonly fencingToken: number;\n    release(): Promise<void>;\n}\nexport async function acquireDomainAdmissionLock(repository: IncusRepository, executionDomainId: string, options: {\n    readonly waitMs?: number;\n} = {}): Promise<AdmissionLock> {\n    const owner = currentOwner();\n    const waitMs = options.waitMs ?? LOCK_WAIT_MS;\n    if (!Number.isFinite(waitMs) || waitMs < 0) {\n        throw new TypeError(\"Incus admission lock waitMs must be a finite non-negative number.\");\n    }\n    const deadline = Date.now() + waitMs;\n    let expected: IncusAdmissionLease | undefined;\n    for (;;) {\n        const acquired = await repository.acquireAdmission(executionDomainId, owner, expected);\n        if (acquired.acquired) {\n            let released = false;\n            return {\n                executionDomainId,\n                fencingToken: acquired.lease.fencingToken,\n                release: async () => {\n                    if (released)\n                        return;\n                    released = true;\n                    if (!(await repository.releaseAdmission(acquired.lease))) {\n                        throw incusError(\"sandbox-capacity-unavailable\", `Incus admission lock ${JSON.stringify(executionDomainId)} lost its fencing token before release.`, [\"Stop new admission and reconcile the current IncusRepository lease owner.\"]);\n                    }\n                },\n            };\n        }\n        expected = ownerProvenDead(acquired.lease.owner) ? acquired.lease : undefined;\n        if (Date.now() >= deadline) {\n            throw incusError(\"sandbox-capacity-unavailable\", `Timed out waiting for the Incus admission lock for domain ${JSON.stringify(executionDomainId)}.`, [\"Retry after the owning control process exits; do not break a live admission lock.\"]);\n        }\n        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));\n    }\n}\nexport function lostAllocationError(allocationId: string): IncusProviderError {\n    return incusError(\"sandbox-allocation-lost\", `Sandbox allocation ${JSON.stringify(allocationId)} is active in the ledger but has no Incus instance.`, [\"Reconcile again after Incus inventory is available; do not recreate from a guessed locator.\"]);\n}\n"]}
+{"version":3,"file":"ledger.js","sourceRoot":"","sources":["ledger.ts"],"names":[],"mappings":";;;AAkBA,0DAEC;AACD,gEAEC;AACD,oDAEC;AACD,sDAEC;AACD,0CAGC;AACD,sCAGC;AACD,wCAEC;AACD,oCAMC;AACD,gCAsCC;AACD,sDAQC;AAID,4DA+BC;AACD,wDAKC;AACD,kEAaC;AAmBD,0CA2HC;AACD,8CAkEC;AACD,wCAEC;AACD,wCAEC;AAMD,gEAiCC;AACD,kDAEC;AAvZD,qCAAmC;AACnC,wDAAyD;AACzD,6CAAuG;AACvG,2CAAkE;AAElE,iDAAoD;AAA3C,kHAAA,iBAAiB,OAAA;AAE1B,MAAM,eAAe,GAAG,IAAI,GAAG,CAAkB,CAAC,WAAW,CAAC,CAAC,CAAC;AAChE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAkB;IAC9C,UAAU;IACV,UAAU;IACV,OAAO;IACP,YAAY;IACZ,mBAAmB;IACnB,MAAM;CACT,CAAC,CAAC;AACH,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,SAAgB,uBAAuB,CAAC,UAA2B,EAAE,MAAwB;IACzF,OAAO,UAAU,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AACD,SAAgB,0BAA0B,CAAC,UAA2B,EAAE,OAAyB,EAAE,IAAsB;IACrH,OAAO,UAAU,CAAC,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AACD,SAAgB,oBAAoB,CAAC,UAA2B,EAAE,YAAoB;IAClF,OAAO,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;AAClD,CAAC;AACD,SAAgB,qBAAqB,CAAC,UAA2B;IAC7D,OAAO,UAAU,CAAC,eAAe,EAAE,CAAC;AACxC,CAAC;AACD,SAAgB,eAAe,CAAC,YAAoB;IAChD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACxC,CAAC;AACD,SAAgB,aAAa,CAAC,YAAoB;IAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,OAAO,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;AAC3C,CAAC;AACD,SAAgB,cAAc,CAAC,YAAoB;IAC/C,OAAO,QAAQ,YAAY,EAAE,CAAC;AAClC,CAAC;AACD,SAAgB,YAAY;IACxB,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,IAAI,EAAE,IAAA,kBAAQ,GAAE;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,UAAU,CAAC,QAAuB;IAW9C,MAAM,aAAa,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,UAAU,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9D,OAAO;QACH,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,KAAK,SAAS;YAC1D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,KAAK,SAAS;YACzD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,KAAK,SAAS;YAC/D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,KAAK,SAAS;YAC5D,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7G,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,SAAS,CAAC,KAAK,SAAS;YACvD,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,2BAAc,CAAC,SAAS,CAAC,EAAE,CAAC;KAClE,CAAC;AACN,CAAC;AACD,SAAgB,qBAAqB,CAAC,QAAuB,EAAE,MAAwB;IACnF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;WACzC,IAAI,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;WACrC,IAAI,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WACnD,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WAC7C,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC,cAAc;WAC7C,IAAI,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;AACnD,CAAC;AACD,SAAS,eAAe,CAAC,KAAsB;IAC3C,OAAO,IAAA,qCAAmB,EAAC,KAAK,CAAC,KAAK,QAAQ,CAAC;AACnD,CAAC;AACD,SAAgB,wBAAwB,CAAC,OAAoC,EAAE,SAAmC,EAAE,KAGnH,EAAE,UAAkC,EAAE;IACnC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;eAC/B,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACpD,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YACtC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACjC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS;eAC5B,IAAI,CAAC,UAAU,KAAK,SAAS;eAC7B,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eAClD,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,cAAc,KAAK,SAAS;eACjC,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,YAAY,KAAK,SAAS,IAAI,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC9E,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AACD,SAAgB,sBAAsB,CAAC,OAAoC,EAAE,SAAmC,EAAE,iBAAyB,EAAE,OAAe,EAAE,UAAkC,EAAE;IAC9L,OAAO,wBAAwB,CAAC,OAAO,EAAE,SAAS,EAAE;QAChD,iBAAiB;QACjB,OAAO;KACV,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;AACrB,CAAC;AACD,SAAgB,2BAA2B,CAAC,MAAmB,EAAE,MAAwB;IACrF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,YAAY,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,CAAC;IAC1E,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,cAAc,CAAC,CAAC;IACpE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,WAAW,CAAC,CAAC;IAC9D,OAAO,YAAY,KAAK,MAAM,CAAC,YAAY;WACpC,UAAU,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;WACxC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB;WAC9C,cAAc,KAAK,MAAM,CAAC,cAAc;WACxC,cAAc,KAAK,MAAM,CAAC,cAAc;WACxC,WAAW,KAAK,MAAM,CAAC,WAAW,CAAC;AAC9C,CAAC;AACD;;;;;;GAMG;AACH,SAAS,gCAAgC,CAAC,QAAuB,EAAE,MAAmB,EAAE,MAAwB;IAC5G,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC;QACxC,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,QAAQ,CAAC,eAAe,EAAE,UAAU,CAAC;IACxD,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;WACxB,MAAM,CAAC,WAAW,KAAK,OAAO;WAC9B,UAAU,EAAE,IAAI,KAAK,MAAM;WAC3B,UAAU,CAAC,IAAI,KAAK,MAAM,CAAC,WAAW;WACtC,UAAU,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI;WACjC,UAAU,CAAC,SAAS,KAAK,MAAM,CAAC;AAC3C,CAAC;AACM,KAAK,UAAU,eAAe,CAAC,UAA2B,EAAE,OAAqB,EAAE,KAIzF;IAIG,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,IAAI,GAAuB,EAAE,CAAC;IACpC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3F,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2BAA2B,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,CAAC,EAAE,CAAC;gBAC7E,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,+DAA+D;YAC/D,uEAAuE;YACvE,sEAAsE;YACtE,uEAAuE;YACvE,yCAAyC;YACzC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACvC,MAAM,aAAa,GAAG,MAAM,CAAC,iBAAiB,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;YACvF,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAClB,SAAS;YACb,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,IAAI,CAAC,MAAM,iBAAiB,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/E,SAAS;QACb,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,uEAAuE;IACvE,wEAAwE;IACxE,wEAAwE;IACxE,2EAA2E;IAC3E,MAAM,mBAAmB,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACtF,KAAK,MAAM,QAAQ,IAAI,mBAAmB,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;YAClD,SAAS;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;eACnD,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACpD,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eAChC,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAChD,IAAI,KAAK;YACL,SAAS;QACb,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,kBAAkB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,sDAAsD,EAAE,CAAC,yJAAyJ,CAAC,CAAC,CAAC;IACvX,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,MAAM,CAAC,2BAAc,CAAC,iBAAiB,CAAC,KAAK,KAAK,CAAC,iBAAiB;YAC3E,SAAS;QACb,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC;eACjD,MAAM,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB;eACpD,MAAM,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;eAChC,2BAA2B,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACT,KAAK,MAAM,QAAQ,IAAI,IAAI,EAAE,CAAC;gBAC1B,IAAI,QAAQ,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;uBACzF,CAAC,QAAQ,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,KAAK,KAAK,UAAU,CAAC;oBACnE,SAAS;gBACb,qEAAqE;gBACrE,iEAAiE;gBACjE,mEAAmE;gBACnE,iDAAiD;gBACjD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;gBAC9E,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,CAAC,UAAU;uBAChE,OAAO,CAAC,iBAAiB,KAAK,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO;uBAC1F,OAAO,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;uBACzC,OAAO,CAAC,gBAAgB,KAAK,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,KAAK,SAAS;oBACpF,SAAS;gBACb,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;oBAC/B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;oBACnF,KAAK,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,eAAe;2BACpE,gCAAgC,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBACvE,CAAC;qBACI,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/B,iEAAiE;oBACjE,kEAAkE;oBAClE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzF,KAAK,GAAG,SAAS,KAAK,SAAS,IAAI,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACvF,CAAC;gBACD,IAAI,KAAK;oBACL,MAAM;YACd,CAAC;QACL,CAAC;QACD,IAAI,KAAK;YACL,SAAS;QACb,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,sDAAsD,EAAE,CAAC,uJAAuJ,CAAC,CAAC,CAAC;IACjX,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,mBAAmB;KACjC,CAAC,CAAC;AACP,CAAC;AACM,KAAK,UAAU,iBAAiB,CAAC,UAA2B,EAAE,OAAqB,EAAE,MAAwB,EAAE,OAAe;IACjI,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAA,sBAAU,EAAC,yBAAyB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,8CAA8C,EAAE,CAAC,+CAA+C,CAAC,CAAC,CAAC;IAC5M,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,EAAE,CAAC;QAC3C,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,qCAAqC,OAAO,CAAC,UAAU,qCAAqC,MAAM,CAAC,UAAU,GAAG,EAAE,CAAC,iDAAiD,CAAC,CAAC,CAAC;IAC1N,CAAC;IACD,IAAI,OAAO,CAAC,iBAAiB,KAAK,MAAM,CAAC,iBAAiB,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACxF,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,wEAAwE,EAAE,CAAC,4DAA4D,CAAC,CAAC,CAAC;IAC7L,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,mBAAmB;QACnD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,MAAM,0BAA0B,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IAC1E,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,2BAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,gBAAgB,EAAE,IAAI,IAAI,SAAS,CAAC,eAAe,IAAI,eAAe,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpH,MAAM,UAAU,GAAG,cAAc,EAAE,IAAI,IAAI,SAAS,CAAC,gBAAgB,IAAI,aAAa,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC/G,MAAM,aAAa,GAAG,gBAAgB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;IACzG,MAAM,WAAW,GAAG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACjG,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,CAAC;QAClF,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,sCAAsC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,uCAAuC,EAAE,CAAC,gGAAgG,CAAC,CAAC,CAAC;IAClQ,CAAC;IACD,MAAM,oBAAoB,GAAG,aAAa,KAAK,SAAS;WACjD,WAAW,KAAK,SAAS;WACzB,gCAAgC,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAC/E,IAAI,WAAW,KAAK,SAAS;WACtB,CAAC,2BAA2B,CAAC,WAAW,EAAE,SAAS,CAAC;WACpD,CAAC,oBAAoB,EAAE,CAAC;QAC3B,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,uCAAuC,EAAE,CAAC,8FAA8F,CAAC,CAAC,CAAC;IAC5P,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,MAAM,aAAa,GAAG,SAAS,CAAC,iBAAiB,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC;QACpG,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,oDAAoD,EAAE,CAAC,iHAAiH,CAAC,CAAC,CAAC;QACxR,CAAC;IACL,CAAC;IACD,IAAI,CAAC;QACD,IAAI,aAAa,KAAK,SAAS;YAC3B,MAAM,OAAO,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,WAAW,KAAK,SAAS;YACzB,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAChD,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3E,MAAM,aAAa,GAAG,KAAK,IAAmB,EAAE;YAC5C,MAAM,gBAAgB,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC1E,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;YAC3F,IAAI,gBAAgB,KAAK,SAAS,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjE,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oBAAoB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,mCAAmC,EAAE,CAAC,0FAA0F,CAAC,CAAC,CAAC;YAChP,CAAC;QACL,CAAC,CAAC;QACF,MAAM,aAAa,EAAE,CAAC;IAC1B,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,IAAA,sBAAU,EAAC,4BAA4B,EAAE,oCAAoC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,aAAa,EAAE,CAAC,4IAA4I,CAAC,EAAE,KAAK,CAAC,CAAC;IACnS,CAAC;IACD,OAAO,0BAA0B,CAAC,UAAU,EAAE,SAAS,EAAE;QACrD,GAAG,SAAS;QACZ,KAAK,EAAE,WAAW;QAClB,eAAe,EAAE,SAAS;QAC1B,gBAAgB,EAAE,SAAS;QAC3B,WAAW,EAAE,SAAS;QACtB,iBAAiB,EAAE,SAAS;KAC/B,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,cAAc,CAAC,QAAsC;IACjE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC;AAChE,CAAC;AACD,SAAgB,cAAc,CAAC,MAAwB;IACnD,OAAO,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAMM,KAAK,UAAU,0BAA0B,CAAC,UAA2B,EAAE,iBAAyB,EAAE,UAErG,EAAE;IACF,MAAM,KAAK,GAAG,YAAY,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,YAAY,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CAAC,mEAAmE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,QAAyC,CAAC;IAC9C,SAAS,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,iBAAiB,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvF,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACpB,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,OAAO;gBACH,iBAAiB;gBACjB,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY;gBACzC,OAAO,EAAE,KAAK,IAAI,EAAE;oBAChB,IAAI,QAAQ;wBACR,OAAO;oBACX,QAAQ,GAAG,IAAI,CAAC;oBAChB,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAA,sBAAU,EAAC,8BAA8B,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,yCAAyC,EAAE,CAAC,2EAA2E,CAAC,CAAC,CAAC;oBACxO,CAAC;gBACL,CAAC;aACJ,CAAC;QACN,CAAC;QACD,QAAQ,GAAG,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAA,sBAAU,EAAC,8BAA8B,EAAE,6DAA6D,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,mFAAmF,CAAC,CAAC,CAAC;QAC/O,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACvE,CAAC;AACL,CAAC;AACD,SAAgB,mBAAmB,CAAC,YAAoB;IACpD,OAAO,IAAA,sBAAU,EAAC,yBAAyB,EAAE,sBAAsB,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,qDAAqD,EAAE,CAAC,6FAA6F,CAAC,CAAC,CAAC;AAC3P,CAAC","sourcesContent":["import { hostname } from \"node:os\";\nimport { classifyRunIdentity } from \"../run-identity.ts\";\nimport { INCUS_METADATA, type IncusControl, type IncusInstance, type IncusVolume } from \"./control.ts\";\nimport { incusError, type IncusProviderError } from \"./errors.ts\";\nimport { type AllocationIntent, type AllocationOwner, type AllocationState, type IncusAdmissionLease, type IncusRepository, } from \"./repository.ts\";\nexport { ALLOCATION_STATES } from \"./repository.ts\";\nexport type { AllocationIntent, AllocationOwner, AllocationState } from \"./repository.ts\";\nconst RELEASED_STATES = new Set<AllocationState>([\"destroyed\"]);\nconst OCCUPYING_STATES = new Set<AllocationState>([\n    \"reserved\",\n    \"creating\",\n    \"ready\",\n    \"handed-off\",\n    \"destroy-requested\",\n    \"lost\",\n]);\nconst LOCK_WAIT_MS = 15000;\nconst LOCK_RETRY_MS = 50;\nexport function reserveAllocationIntent(repository: IncusRepository, intent: AllocationIntent): Promise<AllocationIntent> {\n    return repository.reserveAllocation(intent);\n}\nexport function transitionAllocationIntent(repository: IncusRepository, current: AllocationIntent, next: AllocationIntent): Promise<AllocationIntent> {\n    return repository.transitionAllocation(current, next);\n}\nexport function readAllocationIntent(repository: IncusRepository, allocationId: string): Promise<AllocationIntent | undefined> {\n    return repository.getAllocation(allocationId);\n}\nexport function listAllocationIntents(repository: IncusRepository): Promise<readonly AllocationIntent[]> {\n    return repository.listAllocations();\n}\nexport function instanceNameFor(allocationId: string): string {\n    const compact = allocationId.replaceAll(\"-\", \"\").toLowerCase();\n    return `ne-${compact.slice(0, 20)}`;\n}\nexport function volumeNameFor(allocationId: string): string {\n    const compact = allocationId.replaceAll(\"-\", \"\").toLowerCase();\n    return `ne-${compact.slice(0, 18)}-dd`;\n}\nexport function executionIdFor(allocationId: string): string {\n    return `exec-${allocationId}`;\n}\nexport function currentOwner(): AllocationOwner {\n    return Object.freeze({\n        host: hostname(),\n        pid: process.pid,\n        startedAt: new Date().toISOString(),\n    });\n}\nexport function metadataOf(instance: IncusInstance): {\n    readonly allocationId?: string;\n    readonly executionId?: string;\n    readonly generation?: number;\n    readonly artifactDigest?: string;\n    readonly executionDomainId?: string;\n    readonly provisionToken?: string;\n    readonly host?: string;\n    readonly pid?: number;\n    readonly startedAt?: string;\n} {\n    const generationRaw = instance.config[INCUS_METADATA.generation];\n    const generation = generationRaw === undefined ? undefined : Number(generationRaw);\n    const pidRaw = instance.config[INCUS_METADATA.pid];\n    const pid = pidRaw === undefined ? undefined : Number(pidRaw);\n    return {\n        ...(instance.config[INCUS_METADATA.allocationId] === undefined\n            ? {}\n            : { allocationId: instance.config[INCUS_METADATA.allocationId] }),\n        ...(instance.config[INCUS_METADATA.executionId] === undefined\n            ? {}\n            : { executionId: instance.config[INCUS_METADATA.executionId] }),\n        ...(generation !== undefined && Number.isSafeInteger(generation) ? { generation } : {}),\n        ...(instance.config[INCUS_METADATA.artifactDigest] === undefined\n            ? {}\n            : { artifactDigest: instance.config[INCUS_METADATA.artifactDigest] }),\n        ...(instance.config[INCUS_METADATA.executionDomainId] === undefined\n            ? {}\n            : { executionDomainId: instance.config[INCUS_METADATA.executionDomainId] }),\n        ...(instance.config[INCUS_METADATA.provisionToken] === undefined\n            ? {}\n            : { provisionToken: instance.config[INCUS_METADATA.provisionToken] }),\n        ...(instance.config[INCUS_METADATA.host] === undefined ? {} : { host: instance.config[INCUS_METADATA.host] }),\n        ...(pid !== undefined && Number.isSafeInteger(pid) ? { pid } : {}),\n        ...(instance.config[INCUS_METADATA.startedAt] === undefined\n            ? {}\n            : { startedAt: instance.config[INCUS_METADATA.startedAt] }),\n    };\n}\nexport function metadataMatchesIntent(instance: IncusInstance, intent: AllocationIntent): boolean {\n    const meta = metadataOf(instance);\n    return meta.allocationId === intent.allocationId\n        && meta.generation === intent.generation\n        && meta.executionDomainId === intent.executionDomainId\n        && meta.artifactDigest === intent.artifactDigest\n        && meta.provisionToken === intent.provisionToken\n        && meta.executionId === intent.executionId;\n}\nfunction ownerProvenDead(owner: AllocationOwner): boolean {\n    return classifyRunIdentity(owner) === \"orphan\";\n}\nexport function unionActiveAllocationIds(intents: readonly AllocationIntent[], instances: readonly IncusInstance[], scope: {\n    readonly executionDomainId: string;\n    readonly project: string;\n}, volumes: readonly IncusVolume[] = []): ReadonlySet<string> {\n    const ids = new Set<string>();\n    for (const intent of intents) {\n        if (OCCUPYING_STATES.has(intent.state)\n            && intent.executionDomainId === scope.executionDomainId\n            && intent.project === scope.project) {\n            ids.add(intent.allocationId);\n        }\n    }\n    for (const instance of instances) {\n        const meta = metadataOf(instance);\n        if (meta.allocationId !== undefined\n            && meta.generation !== undefined\n            && meta.executionDomainId === scope.executionDomainId\n            && meta.artifactDigest !== undefined\n            && meta.provisionToken !== undefined\n            && meta.executionId !== undefined) {\n            ids.add(meta.allocationId);\n        }\n    }\n    for (const volume of volumes) {\n        const allocationId = volume.config[INCUS_METADATA.allocationId];\n        const executionDomainId = volume.config[INCUS_METADATA.executionDomainId];\n        if (allocationId !== undefined && executionDomainId === scope.executionDomainId) {\n            ids.add(allocationId);\n        }\n    }\n    return ids;\n}\nexport function countActiveAllocations(intents: readonly AllocationIntent[], instances: readonly IncusInstance[], executionDomainId: string, project: string, volumes: readonly IncusVolume[] = []): number {\n    return unionActiveAllocationIds(intents, instances, {\n        executionDomainId,\n        project,\n    }, volumes).size;\n}\nexport function volumeMetadataMatchesIntent(volume: IncusVolume, intent: AllocationIntent): boolean {\n    const allocationId = volume.config[INCUS_METADATA.allocationId];\n    const generation = volume.config[INCUS_METADATA.generation];\n    const executionDomainId = volume.config[INCUS_METADATA.executionDomainId];\n    const artifactDigest = volume.config[INCUS_METADATA.artifactDigest];\n    const provisionToken = volume.config[INCUS_METADATA.provisionToken];\n    const executionId = volume.config[INCUS_METADATA.executionId];\n    return allocationId === intent.allocationId\n        && generation === String(intent.generation)\n        && executionDomainId === intent.executionDomainId\n        && artifactDigest === intent.artifactDigest\n        && provisionToken === intent.provisionToken\n        && executionId === intent.executionId;\n}\n/**\n * Incus creates a cross-project copy's dependent volume atomically with its\n * VM. There is a narrow acceptance window before the follow-up volume PATCH\n * can replace the source artifact metadata. During that window, the VM is\n * still the durable allocation's exact object, and its expanded `dockerdata`\n * device is the only evidence that permits deleting the copied volume.\n */\nfunction volumeIsDependentOnExactInstance(instance: IncusInstance, volume: IncusVolume, intent: AllocationIntent): boolean {\n    if (!metadataMatchesIntent(instance, intent))\n        return false;\n    const dockerData = instance.expandedDevices?.dockerdata;\n    return volume.type === \"custom\"\n        && volume.contentType === \"block\"\n        && dockerData?.type === \"disk\"\n        && dockerData.pool === intent.storagePool\n        && dockerData.source === volume.name\n        && dockerData.dependent === \"true\";\n}\nexport async function reconcileDomain(repository: IncusRepository, control: IncusControl, scope: {\n    readonly executionDomainId: string;\n    readonly project: string;\n    readonly storagePool: string;\n}): Promise<{\n    readonly intents: readonly AllocationIntent[];\n    readonly instances: readonly IncusInstance[];\n}> {\n    const intents = await listAllocationIntents(repository);\n    const instances = await control.listInstances(scope.project);\n    const volumes = await control.listVolumes(scope.project, scope.storagePool);\n    const next: AllocationIntent[] = [];\n    for (const intent of intents) {\n        if (intent.executionDomainId !== scope.executionDomainId || intent.project !== scope.project) {\n            next.push(intent);\n            continue;\n        }\n        if (RELEASED_STATES.has(intent.state)) {\n            next.push(intent);\n            continue;\n        }\n        const instance = instances.find((candidate) => metadataMatchesIntent(candidate, intent));\n        const volume = volumes.find((candidate) => volumeMetadataMatchesIntent(candidate, intent));\n        const ownerAlive = !ownerProvenDead(intent.owner);\n        if (instance === undefined && volume === undefined) {\n            if (intent.quarantined === true) {\n                next.push(intent);\n                continue;\n            }\n            if (ownerAlive && (intent.state === \"reserved\" || intent.state === \"creating\")) {\n                next.push(intent);\n                continue;\n            }\n            if (ownerAlive) {\n                next.push(intent);\n                continue;\n            }\n            // Even an absent allocation must cross the repository's fenced\n            // destroy-requested state.  In particular, a process can die after the\n            // allocation became ready while an operator independently removes the\n            // exact VM and volume; skipping the destroy protocol would attempt the\n            // invalid ready -> destroyed transition.\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        if (intent.state === \"destroy-requested\") {\n            const awaitedObject = intent.acceptanceUnknown === \"volume-create\" ? volume : instance;\n            if (intent.quarantined === true && awaitedObject === undefined) {\n                next.push(intent);\n                continue;\n            }\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        if (ownerProvenDead(intent.owner)) {\n            next.push(await destroyAllocation(repository, control, intent, scope.project));\n            continue;\n        }\n        next.push(intent);\n    }\n    // Re-read after detached destroy. The initial inventory can contain an\n    // accepted clone whose dependent volume still has the source artifact's\n    // metadata; classifying that already-destroyed snapshot as unregistered\n    // would turn successful reconciliation into a false lost-allocation error.\n    const reconciledInstances = await control.listInstances(scope.project);\n    const reconciledVolumes = await control.listVolumes(scope.project, scope.storagePool);\n    for (const instance of reconciledInstances) {\n        const meta = metadataOf(instance);\n        if (meta.executionDomainId !== scope.executionDomainId)\n            continue;\n        const owned = next.some((intent) => isActiveIntent(intent)\n            && intent.executionDomainId === scope.executionDomainId\n            && intent.project === scope.project\n            && metadataMatchesIntent(instance, intent));\n        if (owned)\n            continue;\n        throw incusError(\"sandbox-allocation-lost\", `Incus instance ${JSON.stringify(instance.name)} claims execution domain ${JSON.stringify(scope.executionDomainId)} but has no exact IncusRepository allocation intent.`, [\"Keep the instance in place and restore or explicitly maintain the durable registry; never infer ownership from a name or delete an unregistered object.\"]);\n    }\n    for (const volume of reconciledVolumes) {\n        if (volume.config[INCUS_METADATA.executionDomainId] !== scope.executionDomainId)\n            continue;\n        let owned = next.some((intent) => isActiveIntent(intent)\n            && intent.executionDomainId === scope.executionDomainId\n            && intent.project === scope.project\n            && volumeMetadataMatchesIntent(volume, intent));\n        if (!owned) {\n            for (const observed of next) {\n                if (observed.executionDomainId !== scope.executionDomainId || observed.project !== scope.project\n                    || (observed.state !== \"reserved\" && observed.state !== \"creating\"))\n                    continue;\n                // Inventory requests are separate snapshots: a copy can appear after\n                // listInstances, and its disk keeps source metadata until PATCH.\n                // Re-read the exact allocation and object instead of treating that\n                // acceptance window as an unregistered resource.\n                const current = await readAllocationIntent(repository, observed.allocationId);\n                if (current === undefined || current.generation !== observed.generation\n                    || current.executionDomainId !== scope.executionDomainId || current.project !== scope.project\n                    || current.storagePool !== scope.storagePool\n                    || current.dockerDataVolume !== volume.name || current.providerLocator === undefined)\n                    continue;\n                if (current.state === \"creating\") {\n                    const instance = await control.getInstance(scope.project, current.providerLocator);\n                    owned = instance !== undefined && instance.name === current.providerLocator\n                        && volumeIsDependentOnExactInstance(instance, volume, current);\n                }\n                else if (isActiveIntent(current)) {\n                    // A completed PATCH may also have overtaken the volume snapshot.\n                    // Stable allocations must still present their own exact metadata.\n                    const refreshed = await control.getVolume(scope.project, scope.storagePool, volume.name);\n                    owned = refreshed !== undefined && volumeMetadataMatchesIntent(refreshed, current);\n                }\n                if (owned)\n                    break;\n            }\n        }\n        if (owned)\n            continue;\n        throw incusError(\"sandbox-allocation-lost\", `Incus volume ${JSON.stringify(volume.name)} claims execution domain ${JSON.stringify(scope.executionDomainId)} but has no exact IncusRepository allocation intent.`, [\"Keep the volume in place and restore or explicitly maintain the durable registry; never infer ownership from a name or delete an unregistered object.\"]);\n    }\n    return Object.freeze({\n        intents: Object.freeze(next),\n        instances: reconciledInstances,\n    });\n}\nexport async function destroyAllocation(repository: IncusRepository, control: IncusControl, intent: AllocationIntent, project: string): Promise<AllocationIntent> {\n    const current = await readAllocationIntent(repository, intent.allocationId);\n    if (current === undefined) {\n        throw incusError(\"sandbox-allocation-lost\", `Sandbox allocation ${JSON.stringify(intent.allocationId)} disappeared from the ledger before destroy.`, [\"Reconcile the ledger against Incus inventory.\"]);\n    }\n    if (current.generation !== intent.generation) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Destroy fenced: ledger generation ${current.generation} does not match caller generation ${intent.generation}.`, [\"Retry destroy from the current generation only.\"]);\n    }\n    if (current.executionDomainId !== intent.executionDomainId || current.project !== project) {\n        throw incusError(\"sandbox-destroy-incomplete\", \"Destroy fenced: execution domain or project does not match the caller.\", [\"Destroy only from the owning execution domain and project.\"]);\n    }\n    const requested = current.state === \"destroy-requested\"\n        ? current\n        : await transitionAllocationIntent(repository, current, { ...current, state: \"destroy-requested\" });\n    const instances = await control.listInstances(project);\n    const volumes = await control.listVolumes(project, requested.storagePool);\n    const matchingInstance = instances.find((candidate) => metadataMatchesIntent(candidate, requested));\n    const matchingVolume = volumes.find((candidate) => volumeMetadataMatchesIntent(candidate, requested));\n    const instanceName = matchingInstance?.name ?? requested.providerLocator ?? instanceNameFor(requested.allocationId);\n    const volumeName = matchingVolume?.name ?? requested.dockerDataVolume ?? volumeNameFor(requested.allocationId);\n    const namedInstance = matchingInstance ?? instances.find((candidate) => candidate.name === instanceName);\n    const namedVolume = matchingVolume ?? volumes.find((candidate) => candidate.name === volumeName);\n    if (namedInstance !== undefined && !metadataMatchesIntent(namedInstance, requested)) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Refusing to destroy Incus instance ${JSON.stringify(instanceName)} with mismatched allocation metadata.`, [\"Inspect the instance identity; NiceEval only destroys the exact allocation generation it owns.\"]);\n    }\n    const inheritedCloneVolume = namedInstance !== undefined\n        && namedVolume !== undefined\n        && volumeIsDependentOnExactInstance(namedInstance, namedVolume, requested);\n    if (namedVolume !== undefined\n        && !volumeMetadataMatchesIntent(namedVolume, requested)\n        && !inheritedCloneVolume) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Refusing to destroy Incus volume ${JSON.stringify(volumeName)} with mismatched allocation metadata.`, [\"Inspect the volume identity; NiceEval only destroys the exact allocation generation it owns.\"]);\n    }\n    if (requested.quarantined === true) {\n        const awaitedObject = requested.acceptanceUnknown === \"volume-create\" ? namedVolume : namedInstance;\n        if (awaitedObject === undefined) {\n            throw incusError(\"sandbox-destroy-incomplete\", `Incus allocation ${JSON.stringify(requested.allocationId)} still has an acceptance-unknown create operation.`, [\"Keep the allocation quarantined until the expected Incus object appears and can be destroyed by exact metadata.\"]);\n        }\n    }\n    try {\n        if (namedInstance !== undefined)\n            await control.deleteInstance(project, namedInstance.name);\n        if (namedVolume !== undefined)\n            await control.deleteVolume(project, requested.storagePool, namedVolume.name);\n        await control.waitAbsent(project, instanceName);\n        await control.waitVolumeAbsent(project, requested.storagePool, volumeName);\n        const confirmAbsent = async (): Promise<void> => {\n            const leftoverInstance = await control.getInstance(project, instanceName);\n            const leftoverVolume = await control.getVolume(project, requested.storagePool, volumeName);\n            if (leftoverInstance !== undefined || leftoverVolume !== undefined) {\n                throw incusError(\"sandbox-destroy-incomplete\", `Incus allocation ${JSON.stringify(requested.allocationId)} still has a VM or custom volume.`, [\"Retry destroy; do not mark destroyed without absent receipts for both the VM and volume.\"]);\n            }\n        };\n        await confirmAbsent();\n    }\n    catch (cause) {\n        throw incusError(\"sandbox-destroy-incomplete\", `Failed to prove Incus allocation ${JSON.stringify(requested.allocationId)} is absent.`, [\"Retry destroy from the Incus control plane; NiceEval will not mark the allocation destroyed without absent receipts for the VM and volume.\"], cause);\n    }\n    return transitionAllocationIntent(repository, requested, {\n        ...requested,\n        state: \"destroyed\",\n        providerLocator: undefined,\n        dockerDataVolume: undefined,\n        quarantined: undefined,\n        acceptanceUnknown: undefined,\n    });\n}\nexport function nextGeneration(existing: AllocationIntent | undefined): number {\n    return existing === undefined ? 1 : existing.generation + 1;\n}\nexport function isActiveIntent(intent: AllocationIntent): boolean {\n    return OCCUPYING_STATES.has(intent.state);\n}\nexport interface AdmissionLock {\n    readonly executionDomainId: string;\n    readonly fencingToken: number;\n    release(): Promise<void>;\n}\nexport async function acquireDomainAdmissionLock(repository: IncusRepository, executionDomainId: string, options: {\n    readonly waitMs?: number;\n} = {}): Promise<AdmissionLock> {\n    const owner = currentOwner();\n    const waitMs = options.waitMs ?? LOCK_WAIT_MS;\n    if (!Number.isFinite(waitMs) || waitMs < 0) {\n        throw new TypeError(\"Incus admission lock waitMs must be a finite non-negative number.\");\n    }\n    const deadline = Date.now() + waitMs;\n    let expected: IncusAdmissionLease | undefined;\n    for (;;) {\n        const acquired = await repository.acquireAdmission(executionDomainId, owner, expected);\n        if (acquired.acquired) {\n            let released = false;\n            return {\n                executionDomainId,\n                fencingToken: acquired.lease.fencingToken,\n                release: async () => {\n                    if (released)\n                        return;\n                    released = true;\n                    if (!(await repository.releaseAdmission(acquired.lease))) {\n                        throw incusError(\"sandbox-capacity-unavailable\", `Incus admission lock ${JSON.stringify(executionDomainId)} lost its fencing token before release.`, [\"Stop new admission and reconcile the current IncusRepository lease owner.\"]);\n                    }\n                },\n            };\n        }\n        expected = ownerProvenDead(acquired.lease.owner) ? acquired.lease : undefined;\n        if (Date.now() >= deadline) {\n            throw incusError(\"sandbox-capacity-unavailable\", `Timed out waiting for the Incus admission lock for domain ${JSON.stringify(executionDomainId)}.`, [\"Retry after the owning control process exits; do not break a live admission lock.\"]);\n        }\n        await new Promise((resolve) => setTimeout(resolve, LOCK_RETRY_MS));\n    }\n}\nexport function lostAllocationError(allocationId: string): IncusProviderError {\n    return incusError(\"sandbox-allocation-lost\", `Sandbox allocation ${JSON.stringify(allocationId)} is active in the ledger but has no Incus instance.`, [\"Reconcile again after Incus inventory is available; do not recreate from a guessed locator.\"]);\n}\n"]}

package/dist/sandbox/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":";;;;AAAA,gDAAgD;AAChD,6EAA6E;AAC7E,qDAAqD;AACrD,0CAA6C;AAApC,0GAAA,aAAa,OAAA;AACtB,uCAAsL;AAA7K,6HAAA,iCAAiC,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,gHAAA,oBAAoB,OAAA;AAAE,sGAAA,UAAU,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAChK,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AACrB,6CAAqE;AAA5D,sGAAA,OAAO,OAAA;AAAE,oGAAA,KAAK,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC7C,yCAAyM;AAAhM,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,sGAAA,SAAS,OAAA;AAClL,6DAA8D;AAArD,+GAAA,QAAQ,OAAA;AAAE,kHAAA,WAAW,OAAA;AAC9B,iDAA0D;AAAjD,wHAAA,uBAAuB,OAAA;AAChC,2CAAsE;AAA7D,oHAAA,sBAAsB,OAAA;AAAE,4GAAA,cAAc,OAAA;AAC/C,2CAAqR;AAA5Q,2HAAA,6BAA6B,OAAA;AAAE,wHAAA,0BAA0B,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,0HAAA,4BAA4B,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,4HAAA,8BAA8B,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,kIAAA,oCAAoC,OAAA;AAC7P,6CAAsK;AAA7J,8GAAA,eAAe,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,sHAAA,uBAAuB,OAAA;AAAE,6HAAA,8BAA8B,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAC7I,+DAA+H;AAAtH,8HAAA,sBAAsB,OAAA;AAAE,4HAAA,oBAAoB,OAAA;AAAE,0HAAA,kBAAkB,OAAA;AAAE,0HAAA,kBAAkB,OAAA;AAC7F,iDAAsE;AAA7D,iHAAA,gBAAgB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAC5C,wDAAkE;AAAzD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAsS;AAA7R,kIAAA,yBAAyB,OAAA;AAAE,0IAAA,iCAAiC,OAAA;AAAE,oIAAA,2BAA2B,OAAA;AAAE,qIAAA,4BAA4B,OAAA;AAAE,uIAAA,8BAA8B,OAAA;AAAE,uIAAA,8BAA8B,OAAA;AAAE,kIAAA,yBAAyB,OAAA;AAAE,+IAAA,sCAAsC,OAAA;AAYnQ,+DAAiF;AAAxE,8HAAA,sBAAsB,OAAA;AAAE,uHAAA,eAAe,OAAA;AAChD,wDAAqF;AAA5E,+GAAA,kBAAkB,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAE/C,wDAA+lB;AAAtlB,oIAAA,uCAAuC,OAAA;AAAE,0HAAA,6BAA6B,OAAA;AAAE,kIAAA,qCAAqC,OAAA;AAAE,8HAAA,iCAAiC,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,2IAAA,8CAA8C,OAAA;AAAE,kIAAA,qCAAqC,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,uHAAA,0BAA0B,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,wHAAA,2BAA2B,OAAA;AAAE,0HAAA,6BAA6B,OAAA;AAEzjB,4DAA2O;AAAlO,0HAAA,2BAA2B,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,yHAAA,0BAA0B,OAAA;AAAE,4HAAA,6BAA6B,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAAE,2HAAA,4BAA4B,OAAA","sourcesContent":["// niceeval/sandbox 公开导出:「在哪里跑」相关的类型 + 工厂 + 扩展点。\n// 具体 provider 实现类(DockerSandbox / VercelSandbox / E2BSandbox)是内部实现细节,不在此导出——\n// 需要自定义 provider 时用 defineSandbox(),不需要直接 new 内置实现类。\nexport { defineSandbox } from \"../define.ts\";\nexport { CustomSandboxMaterializationError, sandboxLayer, sandboxRequirements, dockerSandbox, dockerComposeSandbox, e2bSandbox, vercelSandbox, defineSandboxCase, } from \"./layer.ts\";\nexport { incusSandbox } from \"./incus.ts\";\nexport { command, shell, defineSandboxCommand } from \"./commands.ts\";\nexport { actionRef, changeFrequency, defineSandboxAction, gitCheckout, sandboxStep, sandboxState, SandboxActionDefinitionError, uploadDirectory, uploadFile, writeBytes, writeText, } from \"./action.ts\";\nexport { checkout, installTool } from \"./prepare-commands.ts\";\nexport { SandboxCommandExitError } from \"./operations.ts\";\nexport { registerSandboxContent, sandboxContent } from \"./content.ts\";\nexport { COMPOSE_MATERIALIZER_REVISION, dockerComposeBuildProvider, collectComposeBuilds, leakGateHintsFromComposeFile, inspectComposeYaml, assertComposeBlacklist, findComposeBlacklistViolations, buildComposeOverlay, materializeDockerComposeProviderCase, } from \"./compose.ts\";\nexport { computeBuildKey, computeCaseKey, resolveFloatingImageTag, credentialIdentityContribution, assertPureDataIdentity, looksLikeDigestRef, } from \"./identity.ts\";\nexport { SANDBOX_BUILD_ACTIVITY, prepareSandboxBuilds, startSandboxBuilds, buildFailureOrigin, } from \"./build-coordinator.ts\";\nexport { createCheckpoint, restoreCheckpoint } from \"./checkpoint.ts\";\nexport { normalizeSandboxCapture, } from \"./record/attachment.ts\";\nexport type { SandboxCaptureInput, SandboxCaptureInputError, } from \"./record/attachment.ts\";\nexport { NICEEVAL_BUB_DOCKER_IMAGE, NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE, NICEEVAL_CODEX_DOCKER_IMAGE, NICEEVAL_HERMES_DOCKER_IMAGE, NICEEVAL_OPENCLAW_DOCKER_IMAGE, NICEEVAL_OPENCODE_DOCKER_IMAGE, NICEEVAL_OMP_DOCKER_IMAGE, NICEEVAL_DEEPSEEK_HARNESS_DOCKER_IMAGE, } from \"./docker-agent-image.ts\";\nexport type { SandboxLayer, SandboxLayerKind, SandboxRequirementsOptions, SandboxRequirement, DockerExecutionRequirement, DockerImageSource, DockerfileSource, DockerSandboxSource, DockerSandboxAccess, DockerSandboxOptions, DockerSandboxCommonOptions, DockerSandboxReadiness, ManagedDockerResources, DockerComposeSandboxOptions, DockerSandboxResources, DockerSandboxTmpfsOptions, E2BSandboxOptions, VercelSandboxOptions, CustomProviderSandboxOptions, CustomCaseSandboxOptions, CustomCaseServices, CustomCaseMaterializedServices, CustomCaseMaterializeResult, SandboxTargetPlatform, SandboxLeakGate, } from \"./layer.ts\";\nexport type { IncusSandboxOptions, IncusSandboxResources } from \"./incus.ts\";\nexport type { SandboxCommand, SandboxCommandContext, SandboxCommandTarget, SandboxCleanupCommand, SandboxCommandIdentity, SandboxCommandDefinition, SandboxCommandIdentityValue, SandboxCommandOptions, SandboxExecOptions, CommandActionOptions, CommandAfterActionOptions, CommandActionFactory, ShellActionInput, ShellAfterActionInput, ShellActionFactory, StableSandboxCommand, AttemptRef, } from \"./commands.ts\";\nexport type { CheckoutGitSandboxStepInput, ExecSandboxStepInput, NonEmptySandboxSteps, PutBytesSandboxStepInput, PutTextSandboxStepInput, SandboxAction, SandboxActionDefinition, SandboxActionFamily, SandboxActionFingerprintPlan, SandboxActionPlan, SandboxActionRef, SandboxActionState, SandboxState, SandboxActionInstanceOptions, SandboxAfterAction, SandboxAfterActionOptions, SandboxBeforeActionOptions, SandboxCapability, SandboxChangeFrequency, SandboxStep, SandboxStepPlan, SandboxTransferSource, TransferDirectorySandboxStepInput, TransferFileSandboxStepInput, GitCheckoutActionFactory, GitCheckoutActionInput, GitCheckoutAfterActionInput, UploadDirectoryActionFactory, UploadDirectoryActionInput, UploadDirectoryAfterActionInput, UploadFileActionFactory, UploadFileActionInput, UploadFileAfterActionInput, WriteBytesActionFactory, WriteBytesActionInput, WriteBytesAfterActionInput, WriteTextActionFactory, WriteTextActionInput, WriteTextAfterActionInput, } from \"./action.ts\";\nexport type { CheckoutOptions, InstallToolOptions } from \"./prepare-commands.ts\";\nexport type { RegisteredSandboxContent, SandboxContent, SandboxContentFactory, } from \"./content.ts\";\nexport type { Sandbox, SandboxOperations, SandboxTransferOperations, SandboxProvider, SandboxRuntime, CommandResult, CommandOptions, SuccessfulCommandResult, } from \"../types.ts\";\nexport type { SandboxCaseKind, ServiceController, MaterializedSandboxCase, SandboxGroupEntry, SandboxResourceGroup, SandboxMaterializeContext, } from \"./case-types.ts\";\nexport type { BuildKey, CaseKey, BuildKeyInput, CaseKeyInput, ImageRefResolution, CredentialRef, } from \"./identity.ts\";\nexport type { ComposeBuildCollection, ComposeInspection, ComposeServiceInspection, ComposeBlacklistFinding, ComposeOverlay, MaterializeComposeOpts, } from \"./compose.ts\";\nexport type { SandboxBuildWork, SandboxBuildProvider, SandboxBuildRef, MaterializationScopeId, SandboxBuildLookup, SandboxBuildArtifactSource, SandboxBuildUseHandle, SandboxBuildExecutionContext, SandboxBuildPreparation, SandboxBuildFailure, PrepareSandboxBuildsOptions, } from \"./build-coordinator.ts\";\nexport { materializationScopeId, sandboxBuildRef } from \"./build-coordinator.ts\";\nexport { DockerProfileError, dockerProfileError, } from \"./docker-profile/errors.ts\";\nexport type { DockerProfileErrorCode, DockerProfileErrorOptions, } from \"./docker-profile/errors.ts\";\nexport { DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION, DOCKER_PROFILE_SCHEMA_VERSION, DOCKER_PROFILE_NETWORK_POLICY_VERSION, DOCKER_PROFILE_NETWORK_DENY_CIDRS, DockerExecutionProfileV1Schema, DockerExecutionProfileSchema, createDockerExecutionProfileV1, decodeDockerExecutionProfileV1, dockerExecutionProfileSemanticPolicyRevisionOf, dockerProfileSemanticPolicyRevisionOf, dockerExecutionProfileV1Digest, dockerProfileDigestOf, dockerProfilePublicSummaryOf, isDockerExecutionProfileV1, makeDockerExecutionProfileV1, parseDockerExecutionProfile, parseDockerExecutionProfileV1, } from \"./docker-profile/schema.ts\";\nexport type { DockerExecutionProfileSecurityLevel, DockerExecutionProfileV1, DockerExecutionProfileV1Draft, DockerProfileNetworkPolicy, DockerProfilePublicSummary, DockerProfileUnixEndpoint, } from \"./docker-profile/schema.ts\";\nexport { createDockerProfileRegistry, indexDockerProfiles, parseDockerProfileRegistry, resolveDockerExecutionProfile, resolveDockerProfile, resolveDockerProfileAlias, resolveDockerProfileSelector, } from \"./docker-profile/registry.ts\";\nexport type { DockerProfileRegistryEntry, DockerProfileRegistryFileFacts, DockerProfileRegistryIndex, DockerProfileRegistryInput, DockerProfileRegistryOptions, ResolvedDockerProfileEntry, } from \"./docker-profile/registry.ts\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":";;;;AAAA,gDAAgD;AAChD,6EAA6E;AAC7E,qDAAqD;AACrD,0CAA6C;AAApC,0GAAA,aAAa,OAAA;AACtB,uCAAsL;AAA7K,6HAAA,iCAAiC,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,gHAAA,oBAAoB,OAAA;AAAE,sGAAA,UAAU,OAAA;AAAE,yGAAA,aAAa,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAChK,uCAA0C;AAAjC,wGAAA,YAAY,OAAA;AACrB,6CAAqE;AAA5D,sGAAA,OAAO,OAAA;AAAE,oGAAA,KAAK,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAC7C,yCAAyM;AAAhM,sGAAA,SAAS,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,yGAAA,YAAY,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,uGAAA,UAAU,OAAA;AAAE,sGAAA,SAAS,OAAA;AAClL,6DAA8D;AAArD,+GAAA,QAAQ,OAAA;AAAE,kHAAA,WAAW,OAAA;AAC9B,iDAA0D;AAAjD,wHAAA,uBAAuB,OAAA;AAChC,2CAAsE;AAA7D,oHAAA,sBAAsB,OAAA;AAAE,4GAAA,cAAc,OAAA;AAC/C,2CAAqR;AAA5Q,2HAAA,6BAA6B,OAAA;AAAE,wHAAA,0BAA0B,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,0HAAA,4BAA4B,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,oHAAA,sBAAsB,OAAA;AAAE,4HAAA,8BAA8B,OAAA;AAAE,iHAAA,mBAAmB,OAAA;AAAE,kIAAA,oCAAoC,OAAA;AAC7P,6CAAsK;AAA7J,8GAAA,eAAe,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,sHAAA,uBAAuB,OAAA;AAAE,6HAAA,8BAA8B,OAAA;AAAE,qHAAA,sBAAsB,OAAA;AAAE,iHAAA,kBAAkB,OAAA;AAC7I,+DAA+H;AAAtH,8HAAA,sBAAsB,OAAA;AAAE,4HAAA,oBAAoB,OAAA;AAAE,0HAAA,kBAAkB,OAAA;AAAE,0HAAA,kBAAkB,OAAA;AAC7F,iDAAsE;AAA7D,iHAAA,gBAAgB,OAAA;AAAE,kHAAA,iBAAiB,OAAA;AAC5C,wDAAkE;AAAzD,wHAAA,uBAAuB,OAAA;AAEhC,iEAAsS;AAA7R,kIAAA,yBAAyB,OAAA;AAAE,0IAAA,iCAAiC,OAAA;AAAE,oIAAA,2BAA2B,OAAA;AAAE,qIAAA,4BAA4B,OAAA;AAAE,uIAAA,8BAA8B,OAAA;AAAE,uIAAA,8BAA8B,OAAA;AAAE,kIAAA,yBAAyB,OAAA;AAAE,+IAAA,sCAAsC,OAAA;AAanQ,+DAAiF;AAAxE,8HAAA,sBAAsB,OAAA;AAAE,uHAAA,eAAe,OAAA;AAChD,wDAAqF;AAA5E,+GAAA,kBAAkB,OAAA;AAAE,+GAAA,kBAAkB,OAAA;AAE/C,wDAA+lB;AAAtlB,oIAAA,uCAAuC,OAAA;AAAE,0HAAA,6BAA6B,OAAA;AAAE,kIAAA,qCAAqC,OAAA;AAAE,8HAAA,iCAAiC,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,2IAAA,8CAA8C,OAAA;AAAE,kIAAA,qCAAqC,OAAA;AAAE,2HAAA,8BAA8B,OAAA;AAAE,kHAAA,qBAAqB,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,uHAAA,0BAA0B,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AAAE,wHAAA,2BAA2B,OAAA;AAAE,0HAAA,6BAA6B,OAAA;AAEzjB,4DAA2O;AAAlO,0HAAA,2BAA2B,OAAA;AAAE,kHAAA,mBAAmB,OAAA;AAAE,yHAAA,0BAA0B,OAAA;AAAE,4HAAA,6BAA6B,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAAE,wHAAA,yBAAyB,OAAA;AAAE,2HAAA,4BAA4B,OAAA","sourcesContent":["// niceeval/sandbox 公开导出:「在哪里跑」相关的类型 + 工厂 + 扩展点。\n// 具体 provider 实现类(DockerSandbox / VercelSandbox / E2BSandbox)是内部实现细节,不在此导出——\n// 需要自定义 provider 时用 defineSandbox(),不需要直接 new 内置实现类。\nexport { defineSandbox } from \"../define.ts\";\nexport { CustomSandboxMaterializationError, sandboxLayer, sandboxRequirements, dockerSandbox, dockerComposeSandbox, e2bSandbox, vercelSandbox, defineSandboxCase, } from \"./layer.ts\";\nexport { incusSandbox } from \"./incus.ts\";\nexport { command, shell, defineSandboxCommand } from \"./commands.ts\";\nexport { actionRef, changeFrequency, defineSandboxAction, gitCheckout, sandboxStep, sandboxState, SandboxActionDefinitionError, uploadDirectory, uploadFile, writeBytes, writeText, } from \"./action.ts\";\nexport { checkout, installTool } from \"./prepare-commands.ts\";\nexport { SandboxCommandExitError } from \"./operations.ts\";\nexport { registerSandboxContent, sandboxContent } from \"./content.ts\";\nexport { COMPOSE_MATERIALIZER_REVISION, dockerComposeBuildProvider, collectComposeBuilds, leakGateHintsFromComposeFile, inspectComposeYaml, assertComposeBlacklist, findComposeBlacklistViolations, buildComposeOverlay, materializeDockerComposeProviderCase, } from \"./compose.ts\";\nexport { computeBuildKey, computeCaseKey, resolveFloatingImageTag, credentialIdentityContribution, assertPureDataIdentity, looksLikeDigestRef, } from \"./identity.ts\";\nexport { SANDBOX_BUILD_ACTIVITY, prepareSandboxBuilds, startSandboxBuilds, buildFailureOrigin, } from \"./build-coordinator.ts\";\nexport { createCheckpoint, restoreCheckpoint } from \"./checkpoint.ts\";\nexport { normalizeSandboxCapture, } from \"./record/attachment.ts\";\nexport type { SandboxCaptureInput, SandboxCaptureInputError, } from \"./record/attachment.ts\";\nexport { NICEEVAL_BUB_DOCKER_IMAGE, NICEEVAL_CLAUDE_CODE_DOCKER_IMAGE, NICEEVAL_CODEX_DOCKER_IMAGE, NICEEVAL_HERMES_DOCKER_IMAGE, NICEEVAL_OPENCLAW_DOCKER_IMAGE, NICEEVAL_OPENCODE_DOCKER_IMAGE, NICEEVAL_OMP_DOCKER_IMAGE, NICEEVAL_DEEPSEEK_HARNESS_DOCKER_IMAGE, } from \"./docker-agent-image.ts\";\nexport type { SandboxLayer, SandboxLayerKind, SandboxRequirementsOptions, SandboxRequirement, DockerExecutionRequirement, DockerImageSource, DockerfileSource, DockerSandboxSource, DockerSandboxAccess, DockerSandboxOptions, DockerSandboxCommonOptions, DockerSandboxReadiness, ManagedDockerResources, DockerComposeSandboxOptions, DockerSandboxResources, DockerSandboxTmpfsOptions, E2BSandboxOptions, VercelSandboxOptions, CustomProviderSandboxOptions, CustomCaseSandboxOptions, CustomCaseServices, CustomCaseMaterializedServices, CustomCaseMaterializeResult, SandboxTargetPlatform, SandboxLeakGate, } from \"./layer.ts\";\nexport type { IncusSandboxOptions, IncusSandboxResources } from \"./incus.ts\";\nexport type { SandboxCommand, SandboxCommandContext, SandboxCommandTarget, SandboxCleanupCommand, SandboxCommandIdentity, SandboxCommandDefinition, SandboxCommandIdentityValue, SandboxCommandOptions, SandboxExecOptions, CommandActionOptions, CommandAfterActionOptions, CommandActionFactory, ShellActionInput, ShellAfterActionInput, ShellActionFactory, StableSandboxCommand, AttemptRef, } from \"./commands.ts\";\nexport type { CheckoutGitSandboxStepInput, ExecSandboxStepInput, NonEmptySandboxSteps, PutBytesSandboxStepInput, PutTextSandboxStepInput, SandboxAction, SandboxActionDefinition, SandboxActionFamily, SandboxActionFingerprintPlan, SandboxActionPlan, SandboxActionRef, SandboxActionState, SandboxState, SandboxActionInstanceOptions, SandboxAfterAction, SandboxAfterActionOptions, SandboxBeforeActionOptions, SandboxCapability, SandboxChangeFrequency, SandboxStep, SandboxStepPlan, SandboxTransferSource, TransferDirectorySandboxStepInput, TransferFileSandboxStepInput, GitCheckoutActionFactory, GitCheckoutActionInput, GitCheckoutAfterActionInput, UploadDirectoryActionFactory, UploadDirectoryActionInput, UploadDirectoryAfterActionInput, UploadFileActionFactory, UploadFileActionInput, UploadFileAfterActionInput, WriteBytesActionFactory, WriteBytesActionInput, WriteBytesAfterActionInput, WriteTextActionFactory, WriteTextActionInput, WriteTextAfterActionInput, } from \"./action.ts\";\nexport type { CheckoutOptions, InstallToolOptions } from \"./prepare-commands.ts\";\nexport type { CustomProviderSandbox } from \"./types.ts\";\nexport type { RegisteredSandboxContent, SandboxContent, SandboxContentFactory, } from \"./content.ts\";\nexport type { Sandbox, SandboxOperations, SandboxTransferOperations, SandboxProvider, SandboxRuntime, CommandResult, CommandOptions, SuccessfulCommandResult, } from \"../types.ts\";\nexport type { SandboxCaseKind, ServiceController, MaterializedSandboxCase, SandboxGroupEntry, SandboxResourceGroup, SandboxMaterializeContext, } from \"./case-types.ts\";\nexport type { BuildKey, CaseKey, BuildKeyInput, CaseKeyInput, ImageRefResolution, CredentialRef, } from \"./identity.ts\";\nexport type { ComposeBuildCollection, ComposeInspection, ComposeServiceInspection, ComposeBlacklistFinding, ComposeOverlay, MaterializeComposeOpts, } from \"./compose.ts\";\nexport type { SandboxBuildWork, SandboxBuildProvider, SandboxBuildRef, MaterializationScopeId, SandboxBuildLookup, SandboxBuildArtifactSource, SandboxBuildUseHandle, SandboxBuildExecutionContext, SandboxBuildPreparation, SandboxBuildFailure, PrepareSandboxBuildsOptions, } from \"./build-coordinator.ts\";\nexport { materializationScopeId, sandboxBuildRef } from \"./build-coordinator.ts\";\nexport { DockerProfileError, dockerProfileError, } from \"./docker-profile/errors.ts\";\nexport type { DockerProfileErrorCode, DockerProfileErrorOptions, } from \"./docker-profile/errors.ts\";\nexport { DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION, DOCKER_PROFILE_SCHEMA_VERSION, DOCKER_PROFILE_NETWORK_POLICY_VERSION, DOCKER_PROFILE_NETWORK_DENY_CIDRS, DockerExecutionProfileV1Schema, DockerExecutionProfileSchema, createDockerExecutionProfileV1, decodeDockerExecutionProfileV1, dockerExecutionProfileSemanticPolicyRevisionOf, dockerProfileSemanticPolicyRevisionOf, dockerExecutionProfileV1Digest, dockerProfileDigestOf, dockerProfilePublicSummaryOf, isDockerExecutionProfileV1, makeDockerExecutionProfileV1, parseDockerExecutionProfile, parseDockerExecutionProfileV1, } from \"./docker-profile/schema.ts\";\nexport type { DockerExecutionProfileSecurityLevel, DockerExecutionProfileV1, DockerExecutionProfileV1Draft, DockerProfileNetworkPolicy, DockerProfilePublicSummary, DockerProfileUnixEndpoint, } from \"./docker-profile/schema.ts\";\nexport { createDockerProfileRegistry, indexDockerProfiles, parseDockerProfileRegistry, resolveDockerExecutionProfile, resolveDockerProfile, resolveDockerProfileAlias, resolveDockerProfileSelector, } from \"./docker-profile/registry.ts\";\nexport type { DockerProfileRegistryEntry, DockerProfileRegistryFileFacts, DockerProfileRegistryIndex, DockerProfileRegistryInput, DockerProfileRegistryOptions, ResolvedDockerProfileEntry, } from \"./docker-profile/registry.ts\";\n"]}

package/dist/sandbox/index.d.cts

@@ -18,6 +18,7 @@ export type { IncusSandboxOptions, IncusSandboxResources } from "./incus.cjs";
 export type { SandboxCommand, SandboxCommandContext, SandboxCommandTarget, SandboxCleanupCommand, SandboxCommandIdentity, SandboxCommandDefinition, SandboxCommandIdentityValue, SandboxCommandOptions, SandboxExecOptions, CommandActionOptions, CommandAfterActionOptions, CommandActionFactory, ShellActionInput, ShellAfterActionInput, ShellActionFactory, StableSandboxCommand, AttemptRef, } from "./commands.cjs";
 export type { CheckoutGitSandboxStepInput, ExecSandboxStepInput, NonEmptySandboxSteps, PutBytesSandboxStepInput, PutTextSandboxStepInput, SandboxAction, SandboxActionDefinition, SandboxActionFamily, SandboxActionFingerprintPlan, SandboxActionPlan, SandboxActionRef, SandboxActionState, SandboxState, SandboxActionInstanceOptions, SandboxAfterAction, SandboxAfterActionOptions, SandboxBeforeActionOptions, SandboxCapability, SandboxChangeFrequency, SandboxStep, SandboxStepPlan, SandboxTransferSource, TransferDirectorySandboxStepInput, TransferFileSandboxStepInput, GitCheckoutActionFactory, GitCheckoutActionInput, GitCheckoutAfterActionInput, UploadDirectoryActionFactory, UploadDirectoryActionInput, UploadDirectoryAfterActionInput, UploadFileActionFactory, UploadFileActionInput, UploadFileAfterActionInput, WriteBytesActionFactory, WriteBytesActionInput, WriteBytesAfterActionInput, WriteTextActionFactory, WriteTextActionInput, WriteTextAfterActionInput, } from "./action.cjs";
 export type { CheckoutOptions, InstallToolOptions } from "./prepare-commands.cjs";
+export type { CustomProviderSandbox } from "./types.cjs";
 export type { RegisteredSandboxContent, SandboxContent, SandboxContentFactory, } from "./content.cjs";
 export type { Sandbox, SandboxOperations, SandboxTransferOperations, SandboxProvider, SandboxRuntime, CommandResult, CommandOptions, SuccessfulCommandResult, } from "../types.cjs";
 export type { SandboxCaseKind, ServiceController, MaterializedSandboxCase, SandboxGroupEntry, SandboxResourceGroup, SandboxMaterializeContext, } from "./case-types.cjs";

package/dist/sandbox/index.d.mts

@@ -18,6 +18,7 @@ export type { IncusSandboxOptions, IncusSandboxResources } from "./incus.mjs";
 export type { SandboxCommand, SandboxCommandContext, SandboxCommandTarget, SandboxCleanupCommand, SandboxCommandIdentity, SandboxCommandDefinition, SandboxCommandIdentityValue, SandboxCommandOptions, SandboxExecOptions, CommandActionOptions, CommandAfterActionOptions, CommandActionFactory, ShellActionInput, ShellAfterActionInput, ShellActionFactory, StableSandboxCommand, AttemptRef, } from "./commands.mjs";
 export type { CheckoutGitSandboxStepInput, ExecSandboxStepInput, NonEmptySandboxSteps, PutBytesSandboxStepInput, PutTextSandboxStepInput, SandboxAction, SandboxActionDefinition, SandboxActionFamily, SandboxActionFingerprintPlan, SandboxActionPlan, SandboxActionRef, SandboxActionState, SandboxState, SandboxActionInstanceOptions, SandboxAfterAction, SandboxAfterActionOptions, SandboxBeforeActionOptions, SandboxCapability, SandboxChangeFrequency, SandboxStep, SandboxStepPlan, SandboxTransferSource, TransferDirectorySandboxStepInput, TransferFileSandboxStepInput, GitCheckoutActionFactory, GitCheckoutActionInput, GitCheckoutAfterActionInput, UploadDirectoryActionFactory, UploadDirectoryActionInput, UploadDirectoryAfterActionInput, UploadFileActionFactory, UploadFileActionInput, UploadFileAfterActionInput, WriteBytesActionFactory, WriteBytesActionInput, WriteBytesAfterActionInput, WriteTextActionFactory, WriteTextActionInput, WriteTextAfterActionInput, } from "./action.mjs";
 export type { CheckoutOptions, InstallToolOptions } from "./prepare-commands.mjs";
+export type { CustomProviderSandbox } from "./types.mjs";
 export type { RegisteredSandboxContent, SandboxContent, SandboxContentFactory, } from "./content.mjs";
 export type { Sandbox, SandboxOperations, SandboxTransferOperations, SandboxProvider, SandboxRuntime, CommandResult, CommandOptions, SuccessfulCommandResult, } from "../types.mjs";
 export type { SandboxCaseKind, ServiceController, MaterializedSandboxCase, SandboxGroupEntry, SandboxResourceGroup, SandboxMaterializeContext, } from "./case-types.mjs";

package/dist/sandbox/index.d.ts

@@ -18,6 +18,7 @@ export type { IncusSandboxOptions, IncusSandboxResources } from "./incus.js";
 export type { SandboxCommand, SandboxCommandContext, SandboxCommandTarget, SandboxCleanupCommand, SandboxCommandIdentity, SandboxCommandDefinition, SandboxCommandIdentityValue, SandboxCommandOptions, SandboxExecOptions, CommandActionOptions, CommandAfterActionOptions, CommandActionFactory, ShellActionInput, ShellAfterActionInput, ShellActionFactory, StableSandboxCommand, AttemptRef, } from "./commands.js";
 export type { CheckoutGitSandboxStepInput, ExecSandboxStepInput, NonEmptySandboxSteps, PutBytesSandboxStepInput, PutTextSandboxStepInput, SandboxAction, SandboxActionDefinition, SandboxActionFamily, SandboxActionFingerprintPlan, SandboxActionPlan, SandboxActionRef, SandboxActionState, SandboxState, SandboxActionInstanceOptions, SandboxAfterAction, SandboxAfterActionOptions, SandboxBeforeActionOptions, SandboxCapability, SandboxChangeFrequency, SandboxStep, SandboxStepPlan, SandboxTransferSource, TransferDirectorySandboxStepInput, TransferFileSandboxStepInput, GitCheckoutActionFactory, GitCheckoutActionInput, GitCheckoutAfterActionInput, UploadDirectoryActionFactory, UploadDirectoryActionInput, UploadDirectoryAfterActionInput, UploadFileActionFactory, UploadFileActionInput, UploadFileAfterActionInput, WriteBytesActionFactory, WriteBytesActionInput, WriteBytesAfterActionInput, WriteTextActionFactory, WriteTextActionInput, WriteTextAfterActionInput, } from "./action.js";
 export type { CheckoutOptions, InstallToolOptions } from "./prepare-commands.js";
+export type { CustomProviderSandbox } from "./types.js";
 export type { RegisteredSandboxContent, SandboxContent, SandboxContentFactory, } from "./content.js";
 export type { Sandbox, SandboxOperations, SandboxTransferOperations, SandboxProvider, SandboxRuntime, CommandResult, CommandOptions, SuccessfulCommandResult, } from "../types.js";
 export type { SandboxCaseKind, ServiceController, MaterializedSandboxCase, SandboxGroupEntry, SandboxResourceGroup, SandboxMaterializeContext, } from "./case-types.js";