niceeval 0.18.0 → 0.19.0

package/dist/sandbox/docker-profile/registry.cjs

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveDockerExecutionProfile = exports.parseDockerProfileRegistry = exports.createDockerProfileRegistry = void 0;
 exports.indexDockerProfiles = indexDockerProfiles;
 exports.resolveDockerProfile = resolveDockerProfile;
 exports.resolveDockerProfileSelector = resolveDockerProfileSelector;
@@ -244,7 +243,7 @@ function resolveEntry(entry, index, options) {
     const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);
     checkSourceFacts(entry.fileFacts, `registry.entries[${index}]`, options.expectedOwnerUid ?? 0);
     try {
-        const profile = (0, schema_ts_1.parseDockerExecutionProfileV1)(entry.profile);
+        const profile = (0, schema_ts_1.decodeDockerExecutionProfile)(entry.profile);
         return Object.freeze({
             alias,
             profile,
@@ -260,7 +259,7 @@ function resolveEntry(entry, index, options) {
     }
 }
 /** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */
-// @concord-code ne-sandbox-docker-profile-index
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/library.md
 // @concord-implements docs/feature/sandbox-docker-profiles/architecture.md
 function indexDockerProfiles(input, options = {}) {
@@ -294,8 +293,6 @@ function indexDockerProfiles(input, options = {}) {
     }
     return Object.freeze({ entries: Object.freeze(entries) });
 }
-exports.createDockerProfileRegistry = indexDockerProfiles;
-exports.parseDockerProfileRegistry = indexDockerProfiles;
 function isRegistryIndex(value) {
     return isRecord(value) && Array.isArray(value.entries) && value.entries.every((entry) => isRecord(entry) &&
         typeof entry.alias === "string" &&
@@ -308,7 +305,7 @@ function indexOf(input) {
         const entries = input.entries.map((entry, index) => {
             const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);
             try {
-                const profile = (0, schema_ts_1.parseDockerExecutionProfileV1)(entry.profile);
+                const profile = (0, schema_ts_1.decodeDockerExecutionProfile)(entry.profile);
                 const descriptorDigest = (0, schema_ts_1.dockerExecutionProfileV1Digest)(profile);
                 if (entry.profileId !== profile.profileId || entry.descriptorDigest !== descriptorDigest) {
                     throw (0, errors_ts_1.dockerProfileError)({
@@ -340,7 +337,7 @@ function indexOf(input) {
     return indexDockerProfiles(input);
 }
 /** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */
-// @concord-code ne-sandbox-docker-profile-resolve
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/library.md
 function resolveDockerProfile(registry, alias) {
     const normalizedAlias = requiredAlias(alias, "profile alias");
@@ -355,7 +352,7 @@ function resolveDockerProfile(registry, alias) {
     });
 }
 /** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */
-// @concord-code ne-sandbox-docker-profile-select
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/library.md
 function resolveDockerProfileSelector(registry, selector) {
     const normalizedSelector = requiredSelector(selector, "profile selector");
@@ -379,5 +376,4 @@ function resolveDockerProfileSelector(registry, selector) {
     }
     return first;
 }
-exports.resolveDockerExecutionProfile = resolveDockerProfile;
 //# sourceMappingURL=registry.cjs.map

package/dist/sandbox/docker-profile/registry.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["registry.ts"],"names":[],"mappings":";;;AAmSA,kDA8BC;AAiDD,oDAWC;AAID,oEAqBC;AAtZD,2CAAsE;AACtE,2CAA4H;AAiC5H,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC;AACD,SAAS,MAAM,CAAC,MAA0C,EAAE,GAAW;IACnE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AACD,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,4BAA4B;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,2CAA2C;SAC9D,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,gDAAgD;SACnE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,2CAA2C;SAC9D,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC7C,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,SAAS,CAAC;IACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,yBAAyB;SAC5C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE;YAC9B,OAAO,EAAE,GAAG,IAAI,IAAI,WAAW,mBAAmB;SACrD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,GAAG,IAAI,4BAA4B;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,WAAW;YACxB,OAAO,EAAE,GAAG,IAAI,+CAA+C;SAClE,CAAC,CAAC;IACP,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,OAAO;YACpB,OAAO,EAAE,GAAG,IAAI,+CAA+C;SAClE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,iBAAiB;YAC9B,OAAO,EAAE,GAAG,IAAI,iCAAiC;SACpD,CAAC,CAAC;IACP,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7K,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,OAAO,EAAE,GAAG,IAAI,sCAAsC;SACzD,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QACvF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACP,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAiD,EAAE,IAAY,EAAE,gBAAwB;IAC/G,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO;IACX,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI;YACJ,OAAO,EAAE,uEAAuE;SACnF,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACtE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,kDAAkD,gBAAgB,EAAE;YAC7E,OAAO,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,8CAA8C;YACpD,IAAI;YACJ,OAAO,EAAE,kFAAkF;YAC3F,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI;YACJ,OAAO,EAAE,mFAAmF;SAC/F,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,IAAI,GAAG,oBAAoB,KAAK,GAAG,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,yBAAyB;SAC5C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE;YAC9B,OAAO,EAAE,GAAG,IAAI,IAAI,WAAW,mBAAmB;SACrD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,sDAAsD;SACzE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,qCAAqC;SACxD,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC;QAClD,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC;KAC7G,CAAC,CAAC;AACP,CAAC;AACD,SAAS,cAAc,CAAC,KAAa,EAAE,KAAc;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AACD,SAAS,UAAU,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,oEAAoE;SAChF,CAAC,CAAC;IACP,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;QACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAA,8BAAkB,EAAC;gBACrB,IAAI,EAAE,+CAA+C;gBACrD,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,OAAO,EAAE,YAAY,WAAW,mBAAmB;aACtD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAA,8BAAkB,EAAC;gBACrB,IAAI,EAAE,+CAA+C;gBACrD,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AACD,SAAS,SAAS,CAAC,KAAyB,EAAE,KAAa;IACvD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE;QAC1E,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACrE,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,KAAiC,EAAE,KAAa,EAAE,OAAqC;IACzG,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC;IAC7E,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,oBAAoB,KAAK,GAAG,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,yCAA6B,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,KAAK;YACL,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,IAAA,0CAA8B,EAAC,OAAO,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,KAAK,YAAY,8BAAkB;YACnC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACD,+DAA+D;AAC/D,gDAAgD;AAChD,sEAAsE;AACtE,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,KAA2C,EAAE,UAAwC,EAAE;IACvH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwC,CAAC;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;QACtC,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK;YACL,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YAC9D,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mCAAmC;SAC5F,CAAC,CAAC;IACP,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;QAC1C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,8CAA8C;YACpD,SAAS;YACT,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK;YAC3B,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1D,OAAO,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,+BAA+B;SAChG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AACY,QAAA,2BAA2B,GAAG,mBAAmB,CAAC;AAClD,QAAA,0BAA0B,GAAG,mBAAmB,CAAC;AAC9D,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,OAAO,CAAC,KAAwE;IACrF,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,yCAA6B,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC7D,MAAM,gBAAgB,GAAG,IAAA,0CAA8B,EAAC,OAAO,CAAC,CAAC;gBACjE,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;oBACvF,MAAM,IAAA,8BAAkB,EAAC;wBACrB,IAAI,EAAE,+CAA+C;wBACrD,IAAI,EAAE,oBAAoB,KAAK,GAAG;wBAClC,OAAO,EAAE,4EAA4E;wBACrF,OAAO,EAAE;4BACL,iBAAiB,EAAE,OAAO,CAAC,SAAS;4BACpC,eAAe,EAAE,KAAK,CAAC,SAAS;4BAChC,wBAAwB,EAAE,gBAAgB;4BAC1C,sBAAsB,EAAE,KAAK,CAAC,gBAAgB;yBACjD;qBACJ,CAAC,CAAC;gBACP,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;oBACjB,KAAK;oBACL,OAAO;oBACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,KAAK,UAAU,CAAC,EAAE,CAAC;iBACvH,CAAC,CAAC;YACP,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,YAAY,8BAAkB;oBACnC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,iEAAiE;AACjE,kDAAkD;AAClD,sEAAsE;AACtE,SAAgB,oBAAoB,CAAC,QAA2E,EAAE,KAAa;IAC3H,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,CAAC;IACjB,MAAM,IAAA,8BAAkB,EAAC;QACrB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE;KACpG,CAAC,CAAC;AACP,CAAC;AACD,sEAAsE;AACtE,iDAAiD;AACjD,sEAAsE;AACtE,SAAgB,4BAA4B,CAAC,QAA2E,EAAE,QAAgB;IACtI,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,gDAAgD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE;SAChG,CAAC,CAAC;IACP,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK,EAAE,kBAAkB;YACzB,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,eAAe;SACxF,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACY,QAAA,6BAA6B,GAAG,oBAAoB,CAAC","sourcesContent":["import { dockerProfileError, DockerProfileError, } from \"./errors.ts\";\nimport { dockerExecutionProfileV1Digest, parseDockerExecutionProfileV1, type DockerExecutionProfileV1, } from \"./schema.ts\";\n/** 由宿主 registry loader 提供的文件事实；本模块不会自行读文件或执行路径。 */\nexport interface DockerProfileRegistryFileFacts {\n    readonly isSymlink?: boolean;\n    readonly ownerUid?: number;\n    readonly mode?: number;\n    readonly parentWritable?: boolean;\n    readonly parentModes?: readonly number[];\n}\nexport interface DockerProfileRegistryEntry {\n    readonly alias: string;\n    readonly profile?: unknown;\n    readonly descriptor?: unknown;\n    readonly source?: string;\n    readonly fileFacts?: DockerProfileRegistryFileFacts;\n}\nexport interface DockerProfileRegistryOptions {\n    /** descriptor 必须由 root 持有；未提供 file facts 时纯解析不会臆造权限事实。 */\n    readonly expectedOwnerUid?: number;\n}\nexport interface ResolvedDockerProfileEntry {\n    readonly alias: string;\n    readonly profile: DockerExecutionProfileV1;\n    readonly profileId: string;\n    readonly descriptorDigest: string;\n    readonly source?: string;\n}\nexport interface DockerProfileRegistryIndex {\n    readonly entries: readonly ResolvedDockerProfileEntry[];\n}\nexport type DockerProfileRegistryInput = readonly DockerProfileRegistryEntry[] | Readonly<globalThis.Record<string, unknown>> | {\n    readonly entries: readonly DockerProfileRegistryEntry[];\n};\nfunction isRecord(value: unknown): value is globalThis.Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}\nfunction hasOwn(record: globalThis.Record<string, unknown>, key: string): boolean {\n    return Object.prototype.hasOwnProperty.call(record, key);\n}\nfunction requiredAlias(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty alias`,\n        });\n    }\n    if (value.includes(\"\\u0000\") || value.includes(\"/\") || value.includes(\"\\\\\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a single non-empty alias segment`,\n        });\n    }\n    return value;\n}\nfunction requiredSource(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\" || value.includes(\"\\u0000\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty source string without NUL`,\n        });\n    }\n    return value;\n}\nfunction requiredSelector(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\" || value.includes(\"\\u0000\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty selector without NUL`,\n        });\n    }\n    return value;\n}\nfunction sourceFacts(value: unknown, path: string): DockerProfileRegistryFileFacts | undefined {\n    if (value === undefined)\n        return undefined;\n    if (!isRecord(value)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a plain object`,\n        });\n    }\n    const allowed = new Set([\"isSymlink\", \"ownerUid\", \"mode\", \"parentWritable\", \"parentModes\"]);\n    const unsupported = Object.keys(value).find((key) => !allowed.has(key));\n    if (unsupported !== undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.${unsupported}`,\n            message: `${path}.${unsupported} is not supported`,\n        });\n    }\n    if (value.isSymlink !== undefined && typeof value.isSymlink !== \"boolean\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.isSymlink`,\n            message: `${path}.isSymlink must be boolean`,\n        });\n    }\n    const ownerUid = value.ownerUid;\n    if (ownerUid !== undefined && (typeof ownerUid !== \"number\" || !Number.isSafeInteger(ownerUid) || ownerUid < 0)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.ownerUid`,\n            message: `${path}.ownerUid must be a non-negative safe integer`,\n        });\n    }\n    const mode = value.mode;\n    if (mode !== undefined && (typeof mode !== \"number\" || !Number.isInteger(mode) || mode < 0 || mode > 0o7777)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.mode`,\n            message: `${path}.mode must be an integer between 0 and 0o7777`,\n        });\n    }\n    if (value.parentWritable !== undefined && typeof value.parentWritable !== \"boolean\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.parentWritable`,\n            message: `${path}.parentWritable must be boolean`,\n        });\n    }\n    const parentModes = value.parentModes;\n    if (parentModes !== undefined && (!Array.isArray(parentModes) || parentModes.some((mode) => typeof mode !== \"number\" || !Number.isInteger(mode) || mode < 0 || mode > 0o7777))) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.parentModes`,\n            message: `${path}.parentModes must contain file modes`,\n        });\n    }\n    return Object.freeze({\n        ...(value.isSymlink === undefined ? {} : { isSymlink: value.isSymlink }),\n        ...(ownerUid === undefined ? {} : { ownerUid }),\n        ...(mode === undefined ? {} : { mode }),\n        ...(value.parentWritable === undefined ? {} : { parentWritable: value.parentWritable }),\n        ...(parentModes === undefined ? {} : { parentModes: Object.freeze([...parentModes]) }),\n    });\n}\nfunction checkSourceFacts(facts: DockerProfileRegistryFileFacts | undefined, path: string, expectedOwnerUid: number): void {\n    if (facts === undefined)\n        return;\n    if (facts.isSymlink === true) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-symlink\",\n            path,\n            message: \"Docker profile descriptor must be a regular file, not a symbolic link\",\n        });\n    }\n    if (facts.ownerUid !== undefined && facts.ownerUid !== expectedOwnerUid) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-owner-invalid\",\n            path,\n            message: `Docker profile descriptor must be owned by UID ${expectedOwnerUid}`,\n            details: { expectedOwnerUid, actualOwnerUid: facts.ownerUid },\n        });\n    }\n    if (facts.mode !== undefined && (facts.mode & 0o022) !== 0) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-mode-invalid\",\n            path,\n            message: \"Docker profile descriptor and registry file must not be group- or world-writable\",\n            details: { mode: facts.mode },\n        });\n    }\n    if (facts.parentWritable === true || facts.parentModes?.some((mode) => (mode & 0o022) !== 0) === true) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-parent-writable\",\n            path,\n            message: \"Docker profile descriptor parent directories must not be group- or world-writable\",\n        });\n    }\n}\nfunction entryFromArray(value: unknown, index: number): DockerProfileRegistryEntry {\n    const path = `registry.entries[${index}]`;\n    if (!isRecord(value)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a plain object`,\n        });\n    }\n    const allowed = new Set([\"alias\", \"profile\", \"descriptor\", \"source\", \"fileFacts\"]);\n    const unsupported = Object.keys(value).find((key) => !allowed.has(key));\n    if (unsupported !== undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.${unsupported}`,\n            message: `${path}.${unsupported} is not supported`,\n        });\n    }\n    if (hasOwn(value, \"profile\") && hasOwn(value, \"descriptor\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must provide either profile or descriptor, not both`,\n        });\n    }\n    if (!hasOwn(value, \"profile\") && !hasOwn(value, \"descriptor\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must provide profile or descriptor`,\n        });\n    }\n    const profile = hasOwn(value, \"profile\") ? value.profile : value.descriptor;\n    return Object.freeze({\n        alias: requiredAlias(value.alias, `${path}.alias`),\n        profile,\n        ...(value.source === undefined ? {} : { source: requiredSource(value.source, `${path}.source`) }),\n        ...(value.fileFacts === undefined ? {} : { fileFacts: sourceFacts(value.fileFacts, `${path}.fileFacts`) }),\n    });\n}\nfunction entryFromAlias(alias: string, value: unknown): DockerProfileRegistryEntry[] {\n    const normalizedAlias = requiredAlias(alias, `registry.${alias}`);\n    if (Array.isArray(value)) {\n        return value.map((candidate) => Object.freeze({ alias: normalizedAlias, profile: candidate }));\n    }\n    return [Object.freeze({ alias: normalizedAlias, profile: value })];\n}\nfunction rawEntries(input: unknown): readonly DockerProfileRegistryEntry[] {\n    if (Array.isArray(input))\n        return Object.freeze(input.map(entryFromArray));\n    if (!isRecord(input)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: \"registry\",\n            message: \"registry must be an entries array or an alias-to-descriptor object\",\n        });\n    }\n    if (hasOwn(input, \"entries\")) {\n        const unsupported = Object.keys(input).find((key) => key !== \"entries\");\n        if (unsupported !== undefined) {\n            throw dockerProfileError({\n                code: \"sandbox.docker-profile-registry-entry-invalid\",\n                path: `registry.${unsupported}`,\n                message: `registry.${unsupported} is not supported`,\n            });\n        }\n        if (!Array.isArray(input.entries)) {\n            throw dockerProfileError({\n                code: \"sandbox.docker-profile-registry-entry-invalid\",\n                path: \"registry.entries\",\n                message: \"registry.entries must be an array\",\n            });\n        }\n        return Object.freeze(input.entries.map(entryFromArray));\n    }\n    const entries = Object.entries(input).flatMap(([alias, profile]) => entryFromAlias(alias, profile));\n    return Object.freeze(entries);\n}\nfunction withAlias(error: DockerProfileError, alias: string): DockerProfileError {\n    return dockerProfileError({\n        code: error.code,\n        message: `Docker profile alias ${JSON.stringify(alias)}: ${error.message}`,\n        ...(error.path === undefined ? {} : { path: error.path }),\n        alias,\n        ...(error.profileId === undefined ? {} : { profileId: error.profileId }),\n        ...(error.candidates === undefined ? {} : { candidates: error.candidates }),\n        ...(error.details === undefined ? {} : { details: error.details }),\n    });\n}\nfunction resolveEntry(entry: DockerProfileRegistryEntry, index: number, options: DockerProfileRegistryOptions): ResolvedDockerProfileEntry {\n    const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);\n    checkSourceFacts(entry.fileFacts, `registry.entries[${index}]`, options.expectedOwnerUid ?? 0);\n    try {\n        const profile = parseDockerExecutionProfileV1(entry.profile);\n        return Object.freeze({\n            alias,\n            profile,\n            profileId: profile.profileId,\n            descriptorDigest: dockerExecutionProfileV1Digest(profile),\n            ...(entry.source === undefined ? {} : { source: entry.source }),\n        });\n    }\n    catch (error) {\n        if (error instanceof DockerProfileError)\n            throw withAlias(error, alias);\n        throw error;\n    }\n}\n/** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */\n// @concord-code ne-sandbox-docker-profile-index\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function indexDockerProfiles(input: DockerProfileRegistryInput | unknown, options: DockerProfileRegistryOptions = {}): DockerProfileRegistryIndex {\n    const entries = rawEntries(input).map((entry, index) => resolveEntry(entry, index, options));\n    const byAlias = new Map<string, ResolvedDockerProfileEntry[]>();\n    const byProfileId = new Map<string, ResolvedDockerProfileEntry[]>();\n    for (const entry of entries) {\n        byAlias.set(entry.alias, [...(byAlias.get(entry.alias) ?? []), entry]);\n        byProfileId.set(entry.profileId, [...(byProfileId.get(entry.profileId) ?? []), entry]);\n    }\n    const ambiguous = [...byAlias.entries()].find(([, candidates]) => candidates.length > 1);\n    if (ambiguous !== undefined) {\n        const [alias, candidates] = ambiguous;\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-ambiguous-alias\",\n            alias,\n            candidates: candidates.map((candidate) => candidate.profileId),\n            message: `Docker profile alias ${JSON.stringify(alias)} resolves to multiple descriptors`,\n        });\n    }\n    const duplicate = [...byProfileId.entries()].find(([, candidates]) => candidates.length > 1);\n    if (duplicate !== undefined) {\n        const [profileId, candidates] = duplicate;\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-duplicate-id\",\n            profileId,\n            alias: candidates[0]?.alias,\n            candidates: candidates.map((candidate) => candidate.alias),\n            message: `Docker profile stable ID ${JSON.stringify(profileId)} is registered more than once`,\n        });\n    }\n    return Object.freeze({ entries: Object.freeze(entries) });\n}\nexport const createDockerProfileRegistry = indexDockerProfiles;\nexport const parseDockerProfileRegistry = indexDockerProfiles;\nfunction isRegistryIndex(value: unknown): value is DockerProfileRegistryIndex {\n    return isRecord(value) && Array.isArray(value.entries) && value.entries.every((entry) => isRecord(entry) &&\n        typeof entry.alias === \"string\" &&\n        isRecord(entry.profile) &&\n        typeof entry.profileId === \"string\" &&\n        typeof entry.descriptorDigest === \"string\");\n}\nfunction indexOf(input: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown): DockerProfileRegistryIndex {\n    if (isRegistryIndex(input)) {\n        const entries = input.entries.map((entry, index) => {\n            const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);\n            try {\n                const profile = parseDockerExecutionProfileV1(entry.profile);\n                const descriptorDigest = dockerExecutionProfileV1Digest(profile);\n                if (entry.profileId !== profile.profileId || entry.descriptorDigest !== descriptorDigest) {\n                    throw dockerProfileError({\n                        code: \"sandbox.docker-profile-registry-entry-invalid\",\n                        path: `registry.entries[${index}]`,\n                        message: \"registry index profileId or descriptorDigest does not match its descriptor\",\n                        details: {\n                            expectedProfileId: profile.profileId,\n                            actualProfileId: entry.profileId,\n                            expectedDescriptorDigest: descriptorDigest,\n                            actualDescriptorDigest: entry.descriptorDigest,\n                        },\n                    });\n                }\n                return Object.freeze({\n                    alias,\n                    profile,\n                    ...(entry.source === undefined ? {} : { source: requiredSource(entry.source, `registry.entries[${index}].source`) }),\n                });\n            }\n            catch (error) {\n                if (error instanceof DockerProfileError)\n                    throw withAlias(error, alias);\n                throw error;\n            }\n        });\n        return indexDockerProfiles(entries);\n    }\n    return indexDockerProfiles(input);\n}\n/** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */\n// @concord-code ne-sandbox-docker-profile-resolve\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function resolveDockerProfile(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, alias: string): ResolvedDockerProfileEntry {\n    const normalizedAlias = requiredAlias(alias, \"profile alias\");\n    const index = indexOf(registry);\n    const match = index.entries.find((entry) => entry.alias === normalizedAlias);\n    if (match !== undefined)\n        return match;\n    throw dockerProfileError({\n        code: \"sandbox.docker-profile-registry-alias-not-found\",\n        alias: normalizedAlias,\n        message: `No Docker execution profile is registered for alias ${JSON.stringify(normalizedAlias)}`,\n    });\n}\n/** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */\n// @concord-code ne-sandbox-docker-profile-select\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function resolveDockerProfileSelector(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, selector: string): ResolvedDockerProfileEntry {\n    const normalizedSelector = requiredSelector(selector, \"profile selector\");\n    const index = indexOf(registry);\n    const matches = index.entries.filter((entry) => entry.alias === normalizedSelector || entry.profileId === normalizedSelector);\n    const first = matches[0];\n    if (first === undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-alias-not-found\",\n            alias: normalizedSelector,\n            message: `No Docker execution profile matches selector ${JSON.stringify(normalizedSelector)}`,\n        });\n    }\n    if (matches.length > 1) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-ambiguous-alias\",\n            alias: normalizedSelector,\n            candidates: matches.map((match) => match.alias),\n            message: `Docker profile selector ${JSON.stringify(normalizedSelector)} is ambiguous`,\n        });\n    }\n    return first;\n}\nexport const resolveDockerExecutionProfile = resolveDockerProfile;\n"]}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["registry.ts"],"names":[],"mappings":";;AAmSA,kDA8BC;AA+CD,oDAWC;AAID,oEAqBC;AApZD,2CAAsE;AACtE,2CAA2H;AAiC3H,SAAS,QAAQ,CAAC,KAAc;IAC5B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC;AACD,SAAS,MAAM,CAAC,MAA0C,EAAE,GAAW;IACnE,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AACD,SAAS,aAAa,CAAC,KAAc,EAAE,IAAY;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,4BAA4B;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,2CAA2C;SAC9D,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,gDAAgD;SACnE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,2CAA2C;SAC9D,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,IAAY;IAC7C,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,SAAS,CAAC;IACrB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,yBAAyB;SAC5C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE;YAC9B,OAAO,EAAE,GAAG,IAAI,IAAI,WAAW,mBAAmB;SACrD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,YAAY;YACzB,OAAO,EAAE,GAAG,IAAI,4BAA4B;SAC/C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,WAAW;YACxB,OAAO,EAAE,GAAG,IAAI,+CAA+C;SAClE,CAAC,CAAC;IACP,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC;QAC3G,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,OAAO;YACpB,OAAO,EAAE,GAAG,IAAI,+CAA+C;SAClE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QAClF,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,iBAAiB;YAC9B,OAAO,EAAE,GAAG,IAAI,iCAAiC;SACpD,CAAC,CAAC;IACP,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;QAC7K,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,cAAc;YAC3B,OAAO,EAAE,GAAG,IAAI,sCAAsC;SACzD,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QACvF,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC,CAAC;AACP,CAAC;AACD,SAAS,gBAAgB,CAAC,KAAiD,EAAE,IAAY,EAAE,gBAAwB;IAC/G,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO;IACX,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI;YACJ,OAAO,EAAE,uEAAuE;SACnF,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,gBAAgB,EAAE,CAAC;QACtE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,kDAAkD,gBAAgB,EAAE;YAC7E,OAAO,EAAE,EAAE,gBAAgB,EAAE,cAAc,EAAE,KAAK,CAAC,QAAQ,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzD,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,8CAA8C;YACpD,IAAI;YACJ,OAAO,EAAE,kFAAkF;YAC3F,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;SAChC,CAAC,CAAC;IACP,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACpG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI;YACJ,OAAO,EAAE,mFAAmF;SAC/F,CAAC,CAAC;IACP,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,IAAI,GAAG,oBAAoB,KAAK,GAAG,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,yBAAyB;SAC5C,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACnF,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE;YAC9B,OAAO,EAAE,GAAG,IAAI,IAAI,WAAW,mBAAmB;SACrD,CAAC,CAAC;IACP,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,sDAAsD;SACzE,CAAC,CAAC;IACP,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI;YACJ,OAAO,EAAE,GAAG,IAAI,qCAAqC;SACxD,CAAC,CAAC;IACP,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC5E,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,IAAI,QAAQ,CAAC;QAClD,OAAO;QACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC;QACjG,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC;KAC7G,CAAC,CAAC;AACP,CAAC;AACD,SAAS,cAAc,CAAC,KAAa,EAAE,KAAc;IACjD,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,YAAY,KAAK,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACvE,CAAC;AACD,SAAS,UAAU,CAAC,KAAc;IAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,+CAA+C;YACrD,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,oEAAoE;SAChF,CAAC,CAAC;IACP,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;QACxE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,IAAA,8BAAkB,EAAC;gBACrB,IAAI,EAAE,+CAA+C;gBACrD,IAAI,EAAE,YAAY,WAAW,EAAE;gBAC/B,OAAO,EAAE,YAAY,WAAW,mBAAmB;aACtD,CAAC,CAAC;QACP,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,MAAM,IAAA,8BAAkB,EAAC;gBACrB,IAAI,EAAE,+CAA+C;gBACrD,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAClC,CAAC;AACD,SAAS,SAAS,CAAC,KAAyB,EAAE,KAAa;IACvD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE;QAC1E,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACrE,CAAC,CAAC;AACP,CAAC;AACD,SAAS,YAAY,CAAC,KAAiC,EAAE,KAAa,EAAE,OAAqC;IACzG,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC;IAC7E,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,oBAAoB,KAAK,GAAG,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,IAAA,wCAA4B,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,MAAM,CAAC;YACjB,KAAK;YACL,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,gBAAgB,EAAE,IAAA,0CAA8B,EAAC,OAAO,CAAC;YACzD,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;SAClE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,KAAK,YAAY,8BAAkB;YACnC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACD,+DAA+D;AAC/D,gBAAgB;AAChB,sEAAsE;AACtE,2EAA2E;AAC3E,SAAgB,mBAAmB,CAAC,KAA2C,EAAE,UAAwC,EAAE;IACvH,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwC,CAAC;IAChE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAwC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACvE,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;QACtC,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK;YACL,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC;YAC9D,OAAO,EAAE,wBAAwB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,mCAAmC;SAC5F,CAAC,CAAC;IACP,CAAC;IACD,MAAM,SAAS,GAAG,CAAC,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7F,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,SAAS,CAAC;QAC1C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,8CAA8C;YACpD,SAAS;YACT,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK;YAC3B,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC;YAC1D,OAAO,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,+BAA+B;SAChG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AACD,SAAS,eAAe,CAAC,KAAc;IACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpG,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QACvB,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC;AACpD,CAAC;AACD,SAAS,OAAO,CAAC,KAAwE;IACrF,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/C,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC;YAC7E,IAAI,CAAC;gBACD,MAAM,OAAO,GAAG,IAAA,wCAA4B,EAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC5D,MAAM,gBAAgB,GAAG,IAAA,0CAA8B,EAAC,OAAO,CAAC,CAAC;gBACjE,IAAI,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;oBACvF,MAAM,IAAA,8BAAkB,EAAC;wBACrB,IAAI,EAAE,+CAA+C;wBACrD,IAAI,EAAE,oBAAoB,KAAK,GAAG;wBAClC,OAAO,EAAE,4EAA4E;wBACrF,OAAO,EAAE;4BACL,iBAAiB,EAAE,OAAO,CAAC,SAAS;4BACpC,eAAe,EAAE,KAAK,CAAC,SAAS;4BAChC,wBAAwB,EAAE,gBAAgB;4BAC1C,sBAAsB,EAAE,KAAK,CAAC,gBAAgB;yBACjD;qBACJ,CAAC,CAAC;gBACP,CAAC;gBACD,OAAO,MAAM,CAAC,MAAM,CAAC;oBACjB,KAAK;oBACL,OAAO;oBACP,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,oBAAoB,KAAK,UAAU,CAAC,EAAE,CAAC;iBACvH,CAAC,CAAC;YACP,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;gBACX,IAAI,KAAK,YAAY,8BAAkB;oBACnC,MAAM,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;gBAClC,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC;AACD,iEAAiE;AACjE,gBAAgB;AAChB,sEAAsE;AACtE,SAAgB,oBAAoB,CAAC,QAA2E,EAAE,KAAa;IAC3H,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,eAAe,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,KAAK,CAAC;IACjB,MAAM,IAAA,8BAAkB,EAAC;QACrB,IAAI,EAAE,iDAAiD;QACvD,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE;KACpG,CAAC,CAAC;AACP,CAAC;AACD,sEAAsE;AACtE,gBAAgB;AAChB,sEAAsE;AACtE,SAAgB,4BAA4B,CAAC,QAA2E,EAAE,QAAgB;IACtI,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,SAAS,KAAK,kBAAkB,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,gDAAgD,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,EAAE;SAChG,CAAC,CAAC;IACP,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,KAAK,EAAE,kBAAkB;YACzB,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/C,OAAO,EAAE,2BAA2B,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,eAAe;SACxF,CAAC,CAAC;IACP,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC","sourcesContent":["import { dockerProfileError, DockerProfileError, } from \"./errors.ts\";\nimport { dockerExecutionProfileV1Digest, decodeDockerExecutionProfile, type DockerExecutionProfileV1, } from \"./schema.ts\";\n/** 由宿主 registry loader 提供的文件事实；本模块不会自行读文件或执行路径。 */\nexport interface DockerProfileRegistryFileFacts {\n    readonly isSymlink?: boolean;\n    readonly ownerUid?: number;\n    readonly mode?: number;\n    readonly parentWritable?: boolean;\n    readonly parentModes?: readonly number[];\n}\nexport interface DockerProfileRegistryEntry {\n    readonly alias: string;\n    readonly profile?: unknown;\n    readonly descriptor?: unknown;\n    readonly source?: string;\n    readonly fileFacts?: DockerProfileRegistryFileFacts;\n}\nexport interface DockerProfileRegistryOptions {\n    /** descriptor 必须由 root 持有；未提供 file facts 时纯解析不会臆造权限事实。 */\n    readonly expectedOwnerUid?: number;\n}\nexport interface ResolvedDockerProfileEntry {\n    readonly alias: string;\n    readonly profile: DockerExecutionProfileV1;\n    readonly profileId: string;\n    readonly descriptorDigest: string;\n    readonly source?: string;\n}\nexport interface DockerProfileRegistryIndex {\n    readonly entries: readonly ResolvedDockerProfileEntry[];\n}\nexport type DockerProfileRegistryInput = readonly DockerProfileRegistryEntry[] | Readonly<globalThis.Record<string, unknown>> | {\n    readonly entries: readonly DockerProfileRegistryEntry[];\n};\nfunction isRecord(value: unknown): value is globalThis.Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}\nfunction hasOwn(record: globalThis.Record<string, unknown>, key: string): boolean {\n    return Object.prototype.hasOwnProperty.call(record, key);\n}\nfunction requiredAlias(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty alias`,\n        });\n    }\n    if (value.includes(\"\\u0000\") || value.includes(\"/\") || value.includes(\"\\\\\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a single non-empty alias segment`,\n        });\n    }\n    return value;\n}\nfunction requiredSource(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\" || value.includes(\"\\u0000\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty source string without NUL`,\n        });\n    }\n    return value;\n}\nfunction requiredSelector(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\" || value.includes(\"\\u0000\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a non-empty selector without NUL`,\n        });\n    }\n    return value;\n}\nfunction sourceFacts(value: unknown, path: string): DockerProfileRegistryFileFacts | undefined {\n    if (value === undefined)\n        return undefined;\n    if (!isRecord(value)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a plain object`,\n        });\n    }\n    const allowed = new Set([\"isSymlink\", \"ownerUid\", \"mode\", \"parentWritable\", \"parentModes\"]);\n    const unsupported = Object.keys(value).find((key) => !allowed.has(key));\n    if (unsupported !== undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.${unsupported}`,\n            message: `${path}.${unsupported} is not supported`,\n        });\n    }\n    if (value.isSymlink !== undefined && typeof value.isSymlink !== \"boolean\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.isSymlink`,\n            message: `${path}.isSymlink must be boolean`,\n        });\n    }\n    const ownerUid = value.ownerUid;\n    if (ownerUid !== undefined && (typeof ownerUid !== \"number\" || !Number.isSafeInteger(ownerUid) || ownerUid < 0)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.ownerUid`,\n            message: `${path}.ownerUid must be a non-negative safe integer`,\n        });\n    }\n    const mode = value.mode;\n    if (mode !== undefined && (typeof mode !== \"number\" || !Number.isInteger(mode) || mode < 0 || mode > 0o7777)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.mode`,\n            message: `${path}.mode must be an integer between 0 and 0o7777`,\n        });\n    }\n    if (value.parentWritable !== undefined && typeof value.parentWritable !== \"boolean\") {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.parentWritable`,\n            message: `${path}.parentWritable must be boolean`,\n        });\n    }\n    const parentModes = value.parentModes;\n    if (parentModes !== undefined && (!Array.isArray(parentModes) || parentModes.some((mode) => typeof mode !== \"number\" || !Number.isInteger(mode) || mode < 0 || mode > 0o7777))) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.parentModes`,\n            message: `${path}.parentModes must contain file modes`,\n        });\n    }\n    return Object.freeze({\n        ...(value.isSymlink === undefined ? {} : { isSymlink: value.isSymlink }),\n        ...(ownerUid === undefined ? {} : { ownerUid }),\n        ...(mode === undefined ? {} : { mode }),\n        ...(value.parentWritable === undefined ? {} : { parentWritable: value.parentWritable }),\n        ...(parentModes === undefined ? {} : { parentModes: Object.freeze([...parentModes]) }),\n    });\n}\nfunction checkSourceFacts(facts: DockerProfileRegistryFileFacts | undefined, path: string, expectedOwnerUid: number): void {\n    if (facts === undefined)\n        return;\n    if (facts.isSymlink === true) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-symlink\",\n            path,\n            message: \"Docker profile descriptor must be a regular file, not a symbolic link\",\n        });\n    }\n    if (facts.ownerUid !== undefined && facts.ownerUid !== expectedOwnerUid) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-owner-invalid\",\n            path,\n            message: `Docker profile descriptor must be owned by UID ${expectedOwnerUid}`,\n            details: { expectedOwnerUid, actualOwnerUid: facts.ownerUid },\n        });\n    }\n    if (facts.mode !== undefined && (facts.mode & 0o022) !== 0) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-mode-invalid\",\n            path,\n            message: \"Docker profile descriptor and registry file must not be group- or world-writable\",\n            details: { mode: facts.mode },\n        });\n    }\n    if (facts.parentWritable === true || facts.parentModes?.some((mode) => (mode & 0o022) !== 0) === true) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-parent-writable\",\n            path,\n            message: \"Docker profile descriptor parent directories must not be group- or world-writable\",\n        });\n    }\n}\nfunction entryFromArray(value: unknown, index: number): DockerProfileRegistryEntry {\n    const path = `registry.entries[${index}]`;\n    if (!isRecord(value)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must be a plain object`,\n        });\n    }\n    const allowed = new Set([\"alias\", \"profile\", \"descriptor\", \"source\", \"fileFacts\"]);\n    const unsupported = Object.keys(value).find((key) => !allowed.has(key));\n    if (unsupported !== undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: `${path}.${unsupported}`,\n            message: `${path}.${unsupported} is not supported`,\n        });\n    }\n    if (hasOwn(value, \"profile\") && hasOwn(value, \"descriptor\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must provide either profile or descriptor, not both`,\n        });\n    }\n    if (!hasOwn(value, \"profile\") && !hasOwn(value, \"descriptor\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path,\n            message: `${path} must provide profile or descriptor`,\n        });\n    }\n    const profile = hasOwn(value, \"profile\") ? value.profile : value.descriptor;\n    return Object.freeze({\n        alias: requiredAlias(value.alias, `${path}.alias`),\n        profile,\n        ...(value.source === undefined ? {} : { source: requiredSource(value.source, `${path}.source`) }),\n        ...(value.fileFacts === undefined ? {} : { fileFacts: sourceFacts(value.fileFacts, `${path}.fileFacts`) }),\n    });\n}\nfunction entryFromAlias(alias: string, value: unknown): DockerProfileRegistryEntry[] {\n    const normalizedAlias = requiredAlias(alias, `registry.${alias}`);\n    if (Array.isArray(value)) {\n        return value.map((candidate) => Object.freeze({ alias: normalizedAlias, profile: candidate }));\n    }\n    return [Object.freeze({ alias: normalizedAlias, profile: value })];\n}\nfunction rawEntries(input: unknown): readonly DockerProfileRegistryEntry[] {\n    if (Array.isArray(input))\n        return Object.freeze(input.map(entryFromArray));\n    if (!isRecord(input)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-entry-invalid\",\n            path: \"registry\",\n            message: \"registry must be an entries array or an alias-to-descriptor object\",\n        });\n    }\n    if (hasOwn(input, \"entries\")) {\n        const unsupported = Object.keys(input).find((key) => key !== \"entries\");\n        if (unsupported !== undefined) {\n            throw dockerProfileError({\n                code: \"sandbox.docker-profile-registry-entry-invalid\",\n                path: `registry.${unsupported}`,\n                message: `registry.${unsupported} is not supported`,\n            });\n        }\n        if (!Array.isArray(input.entries)) {\n            throw dockerProfileError({\n                code: \"sandbox.docker-profile-registry-entry-invalid\",\n                path: \"registry.entries\",\n                message: \"registry.entries must be an array\",\n            });\n        }\n        return Object.freeze(input.entries.map(entryFromArray));\n    }\n    const entries = Object.entries(input).flatMap(([alias, profile]) => entryFromAlias(alias, profile));\n    return Object.freeze(entries);\n}\nfunction withAlias(error: DockerProfileError, alias: string): DockerProfileError {\n    return dockerProfileError({\n        code: error.code,\n        message: `Docker profile alias ${JSON.stringify(alias)}: ${error.message}`,\n        ...(error.path === undefined ? {} : { path: error.path }),\n        alias,\n        ...(error.profileId === undefined ? {} : { profileId: error.profileId }),\n        ...(error.candidates === undefined ? {} : { candidates: error.candidates }),\n        ...(error.details === undefined ? {} : { details: error.details }),\n    });\n}\nfunction resolveEntry(entry: DockerProfileRegistryEntry, index: number, options: DockerProfileRegistryOptions): ResolvedDockerProfileEntry {\n    const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);\n    checkSourceFacts(entry.fileFacts, `registry.entries[${index}]`, options.expectedOwnerUid ?? 0);\n    try {\n        const profile = decodeDockerExecutionProfile(entry.profile);\n        return Object.freeze({\n            alias,\n            profile,\n            profileId: profile.profileId,\n            descriptorDigest: dockerExecutionProfileV1Digest(profile),\n            ...(entry.source === undefined ? {} : { source: entry.source }),\n        });\n    }\n    catch (error) {\n        if (error instanceof DockerProfileError)\n            throw withAlias(error, alias);\n        throw error;\n    }\n}\n/** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function indexDockerProfiles(input: DockerProfileRegistryInput | unknown, options: DockerProfileRegistryOptions = {}): DockerProfileRegistryIndex {\n    const entries = rawEntries(input).map((entry, index) => resolveEntry(entry, index, options));\n    const byAlias = new Map<string, ResolvedDockerProfileEntry[]>();\n    const byProfileId = new Map<string, ResolvedDockerProfileEntry[]>();\n    for (const entry of entries) {\n        byAlias.set(entry.alias, [...(byAlias.get(entry.alias) ?? []), entry]);\n        byProfileId.set(entry.profileId, [...(byProfileId.get(entry.profileId) ?? []), entry]);\n    }\n    const ambiguous = [...byAlias.entries()].find(([, candidates]) => candidates.length > 1);\n    if (ambiguous !== undefined) {\n        const [alias, candidates] = ambiguous;\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-ambiguous-alias\",\n            alias,\n            candidates: candidates.map((candidate) => candidate.profileId),\n            message: `Docker profile alias ${JSON.stringify(alias)} resolves to multiple descriptors`,\n        });\n    }\n    const duplicate = [...byProfileId.entries()].find(([, candidates]) => candidates.length > 1);\n    if (duplicate !== undefined) {\n        const [profileId, candidates] = duplicate;\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-duplicate-id\",\n            profileId,\n            alias: candidates[0]?.alias,\n            candidates: candidates.map((candidate) => candidate.alias),\n            message: `Docker profile stable ID ${JSON.stringify(profileId)} is registered more than once`,\n        });\n    }\n    return Object.freeze({ entries: Object.freeze(entries) });\n}\nfunction isRegistryIndex(value: unknown): value is DockerProfileRegistryIndex {\n    return isRecord(value) && Array.isArray(value.entries) && value.entries.every((entry) => isRecord(entry) &&\n        typeof entry.alias === \"string\" &&\n        isRecord(entry.profile) &&\n        typeof entry.profileId === \"string\" &&\n        typeof entry.descriptorDigest === \"string\");\n}\nfunction indexOf(input: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown): DockerProfileRegistryIndex {\n    if (isRegistryIndex(input)) {\n        const entries = input.entries.map((entry, index) => {\n            const alias = requiredAlias(entry.alias, `registry.entries[${index}].alias`);\n            try {\n                const profile = decodeDockerExecutionProfile(entry.profile);\n                const descriptorDigest = dockerExecutionProfileV1Digest(profile);\n                if (entry.profileId !== profile.profileId || entry.descriptorDigest !== descriptorDigest) {\n                    throw dockerProfileError({\n                        code: \"sandbox.docker-profile-registry-entry-invalid\",\n                        path: `registry.entries[${index}]`,\n                        message: \"registry index profileId or descriptorDigest does not match its descriptor\",\n                        details: {\n                            expectedProfileId: profile.profileId,\n                            actualProfileId: entry.profileId,\n                            expectedDescriptorDigest: descriptorDigest,\n                            actualDescriptorDigest: entry.descriptorDigest,\n                        },\n                    });\n                }\n                return Object.freeze({\n                    alias,\n                    profile,\n                    ...(entry.source === undefined ? {} : { source: requiredSource(entry.source, `registry.entries[${index}].source`) }),\n                });\n            }\n            catch (error) {\n                if (error instanceof DockerProfileError)\n                    throw withAlias(error, alias);\n                throw error;\n            }\n        });\n        return indexDockerProfiles(entries);\n    }\n    return indexDockerProfiles(input);\n}\n/** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function resolveDockerProfile(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, alias: string): ResolvedDockerProfileEntry {\n    const normalizedAlias = requiredAlias(alias, \"profile alias\");\n    const index = indexOf(registry);\n    const match = index.entries.find((entry) => entry.alias === normalizedAlias);\n    if (match !== undefined)\n        return match;\n    throw dockerProfileError({\n        code: \"sandbox.docker-profile-registry-alias-not-found\",\n        alias: normalizedAlias,\n        message: `No Docker execution profile is registered for alias ${JSON.stringify(normalizedAlias)}`,\n    });\n}\n/** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function resolveDockerProfileSelector(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, selector: string): ResolvedDockerProfileEntry {\n    const normalizedSelector = requiredSelector(selector, \"profile selector\");\n    const index = indexOf(registry);\n    const matches = index.entries.filter((entry) => entry.alias === normalizedSelector || entry.profileId === normalizedSelector);\n    const first = matches[0];\n    if (first === undefined) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-alias-not-found\",\n            alias: normalizedSelector,\n            message: `No Docker execution profile matches selector ${JSON.stringify(normalizedSelector)}`,\n        });\n    }\n    if (matches.length > 1) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-registry-ambiguous-alias\",\n            alias: normalizedSelector,\n            candidates: matches.map((match) => match.alias),\n            message: `Docker profile selector ${JSON.stringify(normalizedSelector)} is ambiguous`,\n        });\n    }\n    return first;\n}\n"]}

package/dist/sandbox/docker-profile/registry.d.cts

@@ -33,10 +33,7 @@ export type DockerProfileRegistryInput = readonly DockerProfileRegistryEntry[] |
 };
 /** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */
 export declare function indexDockerProfiles(input: DockerProfileRegistryInput | unknown, options?: DockerProfileRegistryOptions): DockerProfileRegistryIndex;
-export declare const createDockerProfileRegistry: typeof indexDockerProfiles;
-export declare const parseDockerProfileRegistry: typeof indexDockerProfiles;
 /** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */
 export declare function resolveDockerProfile(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, alias: string): ResolvedDockerProfileEntry;
 /** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */
 export declare function resolveDockerProfileSelector(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, selector: string): ResolvedDockerProfileEntry;
-export declare const resolveDockerExecutionProfile: typeof resolveDockerProfile;

package/dist/sandbox/docker-profile/registry.d.mts

@@ -33,10 +33,7 @@ export type DockerProfileRegistryInput = readonly DockerProfileRegistryEntry[] |
 };
 /** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */
 export declare function indexDockerProfiles(input: DockerProfileRegistryInput | unknown, options?: DockerProfileRegistryOptions): DockerProfileRegistryIndex;
-export declare const createDockerProfileRegistry: typeof indexDockerProfiles;
-export declare const parseDockerProfileRegistry: typeof indexDockerProfiles;
 /** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */
 export declare function resolveDockerProfile(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, alias: string): ResolvedDockerProfileEntry;
 /** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */
 export declare function resolveDockerProfileSelector(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, selector: string): ResolvedDockerProfileEntry;
-export declare const resolveDockerExecutionProfile: typeof resolveDockerProfile;

package/dist/sandbox/docker-profile/registry.d.ts

@@ -33,10 +33,7 @@ export type DockerProfileRegistryInput = readonly DockerProfileRegistryEntry[] |
 };
 /** 构造只含规范化 descriptor 的 registry index；不读文件、不执行 profile 内容。 */
 export declare function indexDockerProfiles(input: DockerProfileRegistryInput | unknown, options?: DockerProfileRegistryOptions): DockerProfileRegistryIndex;
-export declare const createDockerProfileRegistry: typeof indexDockerProfiles;
-export declare const parseDockerProfileRegistry: typeof indexDockerProfiles;
 /** 只按宿主 alias 查找；没有 alias 时不猜 profile ID 或默认 Docker endpoint。 */
 export declare function resolveDockerProfile(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, alias: string): ResolvedDockerProfileEntry;
 /** detached 读面可显式按 alias 或 stable ID 查找；两者同时命中不同 descriptor 时拒绝猜测。 */
 export declare function resolveDockerProfileSelector(registry: DockerProfileRegistryIndex | DockerProfileRegistryInput | unknown, selector: string): ResolvedDockerProfileEntry;
-export declare const resolveDockerExecutionProfile: typeof resolveDockerProfile;

package/dist/sandbox/docker-profile/registry.js

@@ -1,16 +1,10 @@
 import { createRequire as __niceevalCreateRequire } from "node:module";
 const __niceevalRequire = __niceevalCreateRequire(import.meta.url);
 const __niceevalCanonical = __niceevalRequire("./registry.cjs");
-const __niceevalExport0 = __niceevalCanonical["createDockerProfileRegistry"];
-export { __niceevalExport0 as createDockerProfileRegistry };
-const __niceevalExport1 = __niceevalCanonical["indexDockerProfiles"];
-export { __niceevalExport1 as indexDockerProfiles };
-const __niceevalExport2 = __niceevalCanonical["parseDockerProfileRegistry"];
-export { __niceevalExport2 as parseDockerProfileRegistry };
-const __niceevalExport3 = __niceevalCanonical["resolveDockerExecutionProfile"];
-export { __niceevalExport3 as resolveDockerExecutionProfile };
-const __niceevalExport4 = __niceevalCanonical["resolveDockerProfile"];
-export { __niceevalExport4 as resolveDockerProfile };
-const __niceevalExport5 = __niceevalCanonical["resolveDockerProfileSelector"];
-export { __niceevalExport5 as resolveDockerProfileSelector };
+const __niceevalExport0 = __niceevalCanonical["indexDockerProfiles"];
+export { __niceevalExport0 as indexDockerProfiles };
+const __niceevalExport1 = __niceevalCanonical["resolveDockerProfile"];
+export { __niceevalExport1 as resolveDockerProfile };
+const __niceevalExport2 = __niceevalCanonical["resolveDockerProfileSelector"];
+export { __niceevalExport2 as resolveDockerProfileSelector };
 //# sourceMappingURL=registry.js.map

package/dist/sandbox/docker-profile/runtime.cjs

@@ -233,7 +233,7 @@ async function loadDockerProfileRegistryAt(registryDir) {
 async function loadDockerProfileRegistry() {
     return loadDockerProfileRegistryAt(exports.DOCKER_PROFILE_REGISTRY_DIR);
 }
-// @concord-code ne-sandbox-docker-profile-control
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/architecture.md
 // @concord-implements docs/feature/sandbox-docker-profiles/lifecycle.md
 function dockerProfileControlRequest(path, request, signal, timeoutMs = 10000) {