niceeval 0.18.0 → 0.19.0

package/dist/sandbox/docker-profile/schema.cjs

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dockerProfileDigestOf = exports.createDockerExecutionProfileV1 = exports.decodeDockerExecutionProfileV1 = exports.parseDockerExecutionProfile = exports.dockerProfileSemanticPolicyRevisionOf = exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema = exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS = exports.DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL = exports.DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY = exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = exports.DOCKER_PROFILE_SCHEMA_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = void 0;
+exports.dockerProfileDigestOf = exports.dockerProfileSemanticPolicyRevisionOf = exports.DockerExecutionProfileSchema = exports.DockerExecutionProfileV1Schema = exports.DOCKER_PROFILE_NETWORK_DENY_CIDRS = exports.DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL = exports.DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY = exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = void 0;
 exports.dockerExecutionProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;
-exports.parseDockerExecutionProfileV1 = parseDockerExecutionProfileV1;
-exports.makeDockerExecutionProfileV1 = makeDockerExecutionProfileV1;
+exports.decodeDockerExecutionProfile = decodeDockerExecutionProfile;
+exports.defineDockerExecutionProfile = defineDockerExecutionProfile;
 exports.isDockerExecutionProfileV1 = isDockerExecutionProfileV1;
 exports.dockerExecutionProfileV1Digest = dockerExecutionProfileV1Digest;
 exports.dockerProfilePublicSummaryOf = dockerProfilePublicSummaryOf;
@@ -13,7 +13,6 @@ const node_path_1 = require("node:path");
 const identity_ts_1 = require("../identity.cjs");
 const errors_ts_1 = require("./errors.cjs");
 exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION = 1;
-exports.DOCKER_PROFILE_SCHEMA_VERSION = exports.DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;
 exports.DOCKER_PROFILE_NETWORK_POLICY_VERSION = 1;
 exports.DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY = "niceeval-docker-profile-state/docker-data-snapshot/v1";
 exports.DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL = exports.DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY;
@@ -362,10 +361,10 @@ function schemaError(value, error) {
             : `${path} ${issue.message}`,
     });
 }
-// @concord-code ne-sandbox-docker-profile-parse
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/library.md
 // @concord-implements docs/feature/sandbox-docker-profiles/architecture.md
-function parseDockerExecutionProfileV1(value) {
+function decodeDockerExecutionProfile(value) {
     const decoded = effect_1.Schema.decodeUnknownResult(exports.DockerExecutionProfileV1Schema, ParseOptions)(value);
     if (effect_1.Result.isFailure(decoded))
         throw schemaError(value, decoded.failure.issue);
@@ -415,20 +414,17 @@ function parseDockerExecutionProfileV1(value) {
     }
     return profile;
 }
-exports.parseDockerExecutionProfile = parseDockerExecutionProfileV1;
-exports.decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;
-// @concord-code ne-sandbox-docker-profile-make
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/library.md
-function makeDockerExecutionProfileV1(input) {
-    return parseDockerExecutionProfileV1({
+function defineDockerExecutionProfile(input) {
+    return decodeDockerExecutionProfile({
         ...input,
         semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),
     });
 }
-exports.createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;
 function isDockerExecutionProfileV1(value) {
     try {
-        parseDockerExecutionProfileV1(value);
+        decodeDockerExecutionProfile(value);
         return true;
     }
     catch {
@@ -513,14 +509,14 @@ function canonicalJson(profile) {
         },
     };
 }
-// @concord-code ne-sandbox-docker-profile-digest
+// @concord-code
 // @concord-implements docs/feature/sandbox-docker-profiles/architecture.md
 function dockerExecutionProfileV1Digest(profile) {
-    return `sha256:${(0, identity_ts_1.digestOf)(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;
+    return `sha256:${(0, identity_ts_1.digestOf)(canonicalJson(decodeDockerExecutionProfile(profile)))}`;
 }
 exports.dockerProfileDigestOf = dockerExecutionProfileV1Digest;
 function dockerProfilePublicSummaryOf(profile) {
-    const normalized = parseDockerExecutionProfileV1(profile);
+    const normalized = decodeDockerExecutionProfile(profile);
     return Object.freeze({
         schemaVersion: 1,
         profileId: normalized.profileId,

package/dist/sandbox/docker-profile/schema.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AA2dA,wGAEC;AAmDD,sEAiDC;AAKD,oEAKC;AAED,gEAQC;AAiFD,wEAEC;AAED,oEAYC;AAtrBD,mCAA0E;AAC1E,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA0E;AAC7D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,6BAA6B,GAAG,+CAAuC,CAAC;AACxE,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,sCAAsC,GAAG,uDAAgE,CAAC;AAC1G,QAAA,4CAA4C,GAAG,8CAAsC,CAAC;AACtF,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAC3E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACjE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa;IACnE,aAAa,EAAE,MAAM;CACxB,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC,CAAC;AACH,MAAM,gCAAgC,GAKlC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAuJlF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,KAAc;IACtB,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAgB;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAM,CAAC,OAAO,CAAc,CAAC,KAAK,EAAwB,EAAE;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC,EAAE;IACC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,yCAAyC;CACzD,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5I,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3N,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpO,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,sBAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3K,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7N,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC;AACrN,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5M,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,OAAO,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QACV,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,eAAe,GAAG,cAAc,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE;IAC1H,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,0DAA0D;CAC1E,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,WAAW,GAAG,eAAM,CAAC,aAAa,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;IAC5J,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7K,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC,yBAAyB,CAAC;IAC7C,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,WAAW,CAAC;IAC9B,OAAO,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;QACb,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,eAAM,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;IACF,MAAM,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,6BAA6B,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,GAAG,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;CACL,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC,2BAA2B,CAAC;IACjD,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;IACpE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,mBAAmB,CAAC,gCAAgC,CAAC;IAChE,kBAAkB,EAAE,mBAAmB,CAAC,yCAAyC,CAAC;IAClF,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,cAAc,CAAC,4BAA4B,CAAC;QAClD,WAAW,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;QACrE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,mBAAmB,CAAC,4BAA4B,CAAC;KAC1D,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;IAChF,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,kFAAkF;CAClG,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,mCAAmC,GAAG,WAAW,CAAC;IACpD,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oDAA4C,CAAC;IACtE,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IACtC,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3C,cAAc,EAAE,cAAc,CAAC,wCAAwC,CAAC;IACxE,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;IAC5C,YAAY,EAAE,cAAc,CAAC,sCAAsC,CAAC;IACpE,eAAe,EAAE,cAAc,CAAC,yCAAyC,CAAC;IAC1E,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC;IAClE,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACpD,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC;IAC7E,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;IACtE,cAAc,EAAE,eAAM,CAAC,OAAO,CAAC,uCAAuC,CAAC;IACvE,gBAAgB,EAAE,cAAc,CAAC,0CAA0C,CAAC;IAC5E,eAAe,EAAE,cAAc,CAAC,yCAAyC,CAAC;IAC1E,mBAAmB,EAAE,mBAAmB,CAAC,6CAA6C,CAAC;IACvF,kBAAkB,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAChK,cAAc,EAAE,mBAAmB,CAAC,wCAAwC,CAAC;IAC7E,kBAAkB,EAAE,cAAc,CAAC,4CAA4C,CAAC;CACnF,CAAC,CAAC;AACH,mGAAmG;AACtF,QAAA,8BAA8B,GAAwD,WAAW,CAAC;IAC3G,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC5C,aAAa,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC7E,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,mBAAmB,EAAE,cAAc,CAAC,kCAAkC,CAAC;QACvE,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,WAAW,CAAC;YACvB,IAAI,EAAE,YAAY,CAAC,gCAAgC,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,CAAC;YAC9D,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;SACjE,CAAC;KACL,CAAC;IACF,OAAO,EAAE,WAAW,CAAC;QACjB,IAAI,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC9D,eAAe,EAAE,cAAc,CAAC,qCAAqC,CAAC;QACtE,KAAK,EAAE,WAAW,CAAC;YACf,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;YACpD,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;SACvD,CAAC;QACF,UAAU,EAAE,WAAW,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,iCAAiC,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,wBAAwB,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,UAAU,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;YACpE,cAAc,EAAE,WAAW,CAAC;gBACxB,KAAK,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;gBAC9D,kBAAkB,EAAE,mBAAmB,CAAC,6CAA6C,CAAC;gBACtF,WAAW,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,wBAAwB,EAAE,iCAAiC,CAAC,CAAC;aAC9F,CAAC;YACF,WAAW,EAAE,eAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,WAAW,CAAC;YAChB,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,cAAc,EAAE,cAAc,CAAC,mCAAmC,CAAC;YACnE,WAAW,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;SACvG,CAAC;KACL,CAAC;IACF,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;YAC1B,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC5C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;SACpE,CAAC,EAAE,WAAW,CAAC;YACZ,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC5C,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,iBAAiB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACxC,oBAAoB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACxD,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACnD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;YACjE,OAAO,EAAE,aAAa;SACzB,CAAC,CAAC,CAAC;CACX,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,+FAA+F;AAC/F,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,OAAO;QACV,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,OAAO,CAAC,SAAS;YACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;4BACvB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW;4BACzC,kBAAkB,EAAE,gCAAgC;yBACvD,CAAC;qBACL,CAAC;aACT,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,OAAO,CAAC,QAAQ;YACnB,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACZ,GAAG,OAAO,CAAC,MAAM;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACnB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO;oBACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;wBACf,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;wBAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;qBACrE,CAAC;oBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;wBAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;wBAChC,gBAAgB,EAAE,yBAAyB;wBAC3C,SAAS,EAAE,yCAAiC;qBAC/C,CAAC;iBACL,CAAC;aACL,CAAC;KACT,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACnD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;SACtC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAC5F,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,gBAAgB,CAAC,IAA4E;IAClG,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7E,OAAO,OAAO,OAAO,KAAK,QAAQ;YAC9B,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;YACjC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAAwB;IACzD,MAAM,KAAK,GAAG,oBAAW,CAAC,6BAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAA,8BAAkB,EAAC;gBACtB,IAAI,EAAE,uCAAuC;gBAC7C,IAAI;gBACJ,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,wCAAwC;YAC9C,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,mDAAmD;YACzD,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;SACxG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,uCAAuC;QAC7C,IAAI;QACJ,OAAO,EAAE,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC,CAAC;AACP,CAAC;AACD,gDAAgD;AAChD,sEAAsE;AACtE,2EAA2E;AAC3E,SAAgB,6BAA6B,CAAC,KAAc;IACxD,MAAM,OAAO,GAAG,eAAM,CAAC,mBAAmB,CAAC,sCAA8B,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,eAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa;QAChF,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK;YAC3C,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,2CAA2C;YACjD,OAAO,EAAE,qFAAqF;SACjG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS;QACzB,CAAC,WAAW,CAAC,mBAAmB;YAC5B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,kBAAkB;YAC5D,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,mBAAmB;YAC5D,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,mBAAmB,KAAK,CAAC;YAClE,WAAW,CAAC,eAAe;gBACvB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,yGAAyG;SACrH,CAAC,CAAC;IACP,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,KAAK,qBAAqB,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;QAC9C,CAAC,UAAU;YACP,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,aAAa;YACxD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACpE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,mDAAmD;YACzD,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sFAAsF;SAClG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,QAAQ,EAAE;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACY,QAAA,2BAA2B,GAAG,6BAA6B,CAAC;AAC5D,QAAA,8BAA8B,GAAG,6BAA6B,CAAC;AAC5E,+CAA+C;AAC/C,sEAAsE;AACtE,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,OAAO,6BAA6B,CAAC;QACjC,GAAG,KAAK;QACR,sBAAsB,EAAE,8CAA8C,CAAC,KAAK,CAAC;KAChF,CAAC,CAAC;AACP,CAAC;AACY,QAAA,8BAA8B,GAAG,4BAA4B,CAAC;AAC3E,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YACnD,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE;SACxD;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS;gBAC/C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa;gBACvD,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU;gBACjD,cAAc,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE;gBAChE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,WAAW,EAAE;4BACT,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ;4BACzD,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ;4BACzD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa;4BACnE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY;4BACjE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY;4BACjE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU;4BAC7D,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,mBAAmB;4BAC/E,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB;4BACzE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB;4BACzE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,mBAAmB;4BAC/E,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC;4BAClF,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB;yBAChF;qBACJ,CAAC;aACT;YACD,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;SAC9F;QACD,QAAQ,EAAE;YACN,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;SAC/C;QACD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACrD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;SACxC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;YACrC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAChG,MAAM,EAAE;oBACJ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1D;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,iDAAiD;AACjD,2EAA2E;AAC3E,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,6BAA6B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACvF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,UAAU,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Result, Schema, SchemaIssue, type StandardSchema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SCHEMA_VERSION = DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY = \"niceeval-docker-profile-state/docker-data-snapshot/v1\" as const;\nexport const DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL = DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n    string,\n    ...string[]\n] = Object.freeze([\n    \"0.0.0.0/8\", \"10.0.0.0/8\", \"100.64.0.0/10\", \"127.0.0.0/8\", \"169.254.0.0/16\",\n    \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.2.0/24\", \"192.168.0.0/16\",\n    \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"224.0.0.0/4\",\n    \"240.0.0.0/4\", \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n    \"dns\",\n    \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n    \"cpu\",\n    \"memory\",\n    \"pids\"\n] = Object.freeze([\n    \"cpu\", \"memory\", \"pids\",\n]);\nconst SETUP_PREFIX_FILESYSTEM_FEATURES: readonly [\n    \"ext4\",\n    \"fixed-size\",\n    \"fully-allocated\",\n    \"independent-image\"\n] = Object.freeze([\"ext4\", \"fixed-size\", \"fully-allocated\", \"independent-image\"]);\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"raw-dind-storage/v1\";\nexport interface DockerProfileUnixEndpoint {\n    readonly path: string;\n    readonly peerUid: number;\n}\n/** Callback-free descriptor data that crosses the host deployment trust boundary. */\nexport interface DockerProfileNetworkPolicy {\n    readonly version: 1;\n    readonly dns: {\n        readonly mode: \"explicit\";\n        readonly servers: readonly [\n            string,\n            ...string[]\n        ];\n    };\n    readonly egress: {\n        readonly mode: \"rootless-nat\";\n        readonly allowedProtocols: readonly [\n            \"dns\",\n            \"https\"\n        ];\n        readonly denyPrivateNetworks: true;\n        readonly denySiblingSyntheticEndpoints: true;\n        readonly denyCidrs: readonly [\n            string,\n            ...string[]\n        ];\n        readonly ipv6: \"disabled\";\n        readonly disableHostLoopback: true;\n        readonly portDriver: \"none\";\n        readonly daemonBridge: \"none\";\n        readonly exclusiveNetwork: true;\n        readonly icc: false;\n    };\n}\nexport interface DockerRawStoragePolicy {\n    readonly level: \"raw-dind-storage/v1\";\n    readonly privilegedTranslation: \"host-daemon\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n}\nexport interface DockerManagedRootlessPolicy {\n    readonly level: \"managed-rootless/v1\";\n    readonly hostLoopback: false;\n    readonly tcpDockerEndpoint: false;\n    readonly outerSocketInjection: false;\n    readonly privilegedTranslation: \"rootless-userns\";\n    readonly writableRoot: \"declared-tmpfs-only\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n    readonly network: DockerProfileNetworkPolicy;\n}\n/**\n * Opt-in host capability for copying the complete profile-owned SetupPrefix\n * state. Absence is intentional and keeps the historical structured\n * Unsupported result for raw and managed profiles.\n */\nexport interface DockerProfileSetupPrefixFullCopyCapabilityV1 {\n    readonly protocol: typeof DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL;\n    readonly coverage: \"dockerData\";\n    readonly requiredState: \"dockerData\";\n    readonly helperRevision: string;\n    readonly copyProtocol: \"raw-image/v1\";\n    readonly copyRevision: string;\n    readonly quiesceRevision: string;\n    readonly slotAttestation: \"independent-fixed-filesystem/v1\";\n    readonly seedPolicy: \"immutable-unmounted/v1\";\n    readonly publicationRevision: \"prepared-copy-client-commit-publish/v4\";\n    readonly recoveryRevision: \"epoch-capsule-no-guess-recovery/v3\";\n    readonly manifestSchema: \"niceeval-docker-profile-activation/v3\";\n    readonly providerIdentity: string;\n    readonly executionDomain: string;\n    readonly filesystemSizeBytes: number;\n    readonly filesystemFeatures: readonly [\n        \"ext4\",\n        \"fixed-size\",\n        \"fully-allocated\",\n        \"independent-image\"\n    ];\n    readonly seedLimitBytes: number;\n    readonly filesystemIdentity: string;\n}\nexport interface DockerExecutionProfileV1 {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly transport: {\n        readonly kind: \"unix\";\n        readonly hostMachineIdentity: string;\n        readonly dockerSocket: DockerProfileUnixEndpoint;\n        readonly controlSocket: DockerProfileUnixEndpoint & {\n            readonly protocol: \"niceeval-docker-profile-control/v1\";\n        };\n    };\n    readonly backend: {\n        readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n        readonly machineIdentity: string;\n        readonly owner: {\n            readonly uid: number;\n            readonly gid: number;\n        };\n        readonly filesystem: {\n            readonly identity: string;\n            readonly mountPath: string;\n            readonly dockerRootDir: string;\n            readonly limitBytes: number;\n            readonly dockerDataPool: {\n                readonly count: number;\n                readonly bytesPerAllocation: number;\n                readonly attestation: \"linux-project-quota/v1\" | \"independent-fixed-filesystem/v1\";\n            };\n            /** Presence is the descriptor's explicit, default-off full-copy capability. */\n            readonly setupPrefix?: DockerProfileSetupPrefixFullCopyCapabilityV1;\n        };\n        readonly cgroup: {\n            readonly aggregatePath: string;\n            readonly policyRevision: string;\n            readonly controllers: readonly [\n                \"cpu\",\n                \"memory\",\n                \"pids\"\n            ];\n        };\n    };\n    readonly capacity: {\n        readonly cpus: number;\n        readonly memoryBytes: number;\n        readonly memorySwapBytes: 0;\n        readonly pids: number;\n        readonly maxContainers: number;\n        readonly maxBuilds: number;\n        readonly ephemeralDiskBytes: number;\n        readonly aggregate: {\n            readonly cpus: number;\n            readonly memoryBytes: number;\n            readonly memorySwapBytes: 0;\n            readonly pids: number;\n        };\n    };\n    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\n/** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */\nexport interface DockerProfilePublicSummary {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly capacity: DockerExecutionProfileV1[\"capacity\"];\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nconst ParseOptions = Object.freeze({\n    errors: \"all\" as const,\n    exact: true,\n    onExcessProperty: \"error\" as const,\n});\ntype PlainObject = Readonly<Record<PropertyKey, unknown>>;\nconst PlainObjectSchema = Schema.declare<PlainObject>((value): value is PlainObject => {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}, {\n    identifier: \"DockerProfilePlainObject\",\n    description: \"a plain object or null-prototype record\",\n});\nconst plainStruct = <Fields extends Schema.Struct.Fields>(fields: Fields) => PlainObjectSchema.pipe(Schema.decodeTo(Schema.Struct(fields)));\nconst nonEmptyString = (identifier: string) => Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.trim() !== \"\" && !value.includes(\"\\0\"), { identifier, description: \"a non-empty string without NUL\" })));\nconst sha256Identity = (identifier: string) => nonEmptyString(identifier).pipe(Schema.check(Schema.makeFilter((value) => /^sha256:[a-f0-9]{64}$/u.test(value), { identifier, description: \"an exact lowercase sha256 identity\" })));\nconst absolutePath = (identifier: string) => nonEmptyString(identifier).pipe(Schema.check(Schema.makeFilter(isAbsolute, { identifier, description: \"an absolute path\" })));\nconst nonNegativeSafeInteger = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: \"a non-negative safe integer\" })));\nconst positiveSafeInteger = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: \"a positive safe integer\" })));\nconst positiveFinite = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isFinite(value) && value > 0, { identifier, description: \"a positive finite number\" })));\nfunction isPublicDnsServer(value: string): boolean {\n    const kind = isIP(value);\n    if (kind === 4) {\n        const [first, second, third] = value.split(\".\").map(Number);\n        if (first === undefined || second === undefined || third === undefined)\n            return false;\n        if (first === 0 || first === 10 || first === 127 || first >= 224)\n            return false;\n        if (first === 100 && second >= 64 && second <= 127)\n            return false;\n        if (first === 169 && second === 254)\n            return false;\n        if (first === 172 && second >= 16 && second <= 31)\n            return false;\n        if (first === 192 && second === 168)\n            return false;\n        if (first === 192 && second === 0 && (third === 0 || third === 2))\n            return false;\n        if (first === 198 && (second === 18 || second === 19))\n            return false;\n        if (first === 198 && second === 51 && third === 100)\n            return false;\n        return !(first === 203 && second === 0 && third === 113);\n    }\n    if (kind !== 6)\n        return false;\n    const normalized = value.toLowerCase();\n    if (normalized.startsWith(\"::ffff:\")) {\n        return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n    }\n    return normalized !== \"::\" && normalized !== \"::1\" &&\n        !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n        !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n        !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n        !normalized.startsWith(\"ff\") && !normalized.startsWith(\"2001:db8:\");\n}\nconst DnsServerSchema = nonEmptyString(\"DockerProfilePublicDnsServer\").pipe(Schema.check(Schema.makeFilter(isPublicDnsServer, {\n    identifier: \"DockerProfilePublicDnsServer\",\n    description: \"a public IP address, not a private or synthetic endpoint\",\n})));\nconst CidrsSchema = Schema.NonEmptyArray(Schema.String).pipe(Schema.check(Schema.makeFilter((value) => value.length === DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&\n    value.every((cidr, index) => cidr === DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: \"DockerProfileDenyCidrs\", description: \"the v1 fail-closed CIDR set\" })));\nconst EndpointSchema = plainStruct({\n    path: absolutePath(\"DockerProfileSocketPath\"),\n    peerUid: nonNegativeSafeInteger(\"DockerProfilePeerUid\"),\n});\nconst NetworkSchema = plainStruct({\n    version: Schema.Literal(1),\n    dns: plainStruct({\n        mode: Schema.Literal(\"explicit\"),\n        servers: Schema.NonEmptyArray(DnsServerSchema),\n    }),\n    egress: plainStruct({\n        mode: Schema.Literal(\"rootless-nat\"),\n        allowedProtocols: Schema.Tuple([Schema.Literal(\"dns\"), Schema.Literal(\"https\")]),\n        denyPrivateNetworks: Schema.Literal(true),\n        denySiblingSyntheticEndpoints: Schema.Literal(true),\n        denyCidrs: CidrsSchema,\n        ipv6: Schema.Literal(\"disabled\"),\n        disableHostLoopback: Schema.Literal(true),\n        portDriver: Schema.Literal(\"none\"),\n        daemonBridge: Schema.Literal(\"none\"),\n        exclusiveNetwork: Schema.Literal(true),\n        icc: Schema.Literal(false),\n    }),\n});\nconst CapacitySchema = plainStruct({\n    cpus: positiveFinite(\"DockerProfileCapacityCpus\"),\n    memoryBytes: positiveSafeInteger(\"DockerProfileCapacityMemoryBytes\"),\n    memorySwapBytes: Schema.Literal(0),\n    pids: positiveSafeInteger(\"DockerProfileCapacityPids\"),\n    maxContainers: positiveSafeInteger(\"DockerProfileCapacityMaxContainers\"),\n    maxBuilds: positiveSafeInteger(\"DockerProfileCapacityMaxBuilds\"),\n    ephemeralDiskBytes: positiveSafeInteger(\"DockerProfileCapacityEphemeralDiskBytes\"),\n    aggregate: plainStruct({\n        cpus: positiveFinite(\"DockerProfileAggregateCpus\"),\n        memoryBytes: positiveSafeInteger(\"DockerProfileAggregateMemoryBytes\"),\n        memorySwapBytes: Schema.Literal(0),\n        pids: positiveSafeInteger(\"DockerProfileAggregatePids\"),\n    }),\n}).pipe(Schema.check(Schema.makeFilter((value) => value.aggregate.cpus >= value.cpus &&\n    value.aggregate.memoryBytes >= value.memoryBytes &&\n    value.aggregate.pids >= value.pids, {\n    identifier: \"DockerProfileCapacity\",\n    description: \"aggregate capacity at least as large as allocatable CPU, memory and PID capacity\",\n})));\nconst SetupPrefixFullCopyCapabilitySchema = plainStruct({\n    protocol: Schema.Literal(DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL),\n    coverage: Schema.Literal(\"dockerData\"),\n    requiredState: Schema.Literal(\"dockerData\"),\n    helperRevision: nonEmptyString(\"DockerProfileSetupPrefixHelperRevision\"),\n    copyProtocol: Schema.Literal(\"raw-image/v1\"),\n    copyRevision: nonEmptyString(\"DockerProfileSetupPrefixCopyRevision\"),\n    quiesceRevision: nonEmptyString(\"DockerProfileSetupPrefixQuiesceRevision\"),\n    slotAttestation: Schema.Literal(\"independent-fixed-filesystem/v1\"),\n    seedPolicy: Schema.Literal(\"immutable-unmounted/v1\"),\n    publicationRevision: Schema.Literal(\"prepared-copy-client-commit-publish/v4\"),\n    recoveryRevision: Schema.Literal(\"epoch-capsule-no-guess-recovery/v3\"),\n    manifestSchema: Schema.Literal(\"niceeval-docker-profile-activation/v3\"),\n    providerIdentity: sha256Identity(\"DockerProfileSetupPrefixProviderIdentity\"),\n    executionDomain: sha256Identity(\"DockerProfileSetupPrefixExecutionDomain\"),\n    filesystemSizeBytes: positiveSafeInteger(\"DockerProfileSetupPrefixFilesystemSizeBytes\"),\n    filesystemFeatures: Schema.Tuple([Schema.Literal(\"ext4\"), Schema.Literal(\"fixed-size\"), Schema.Literal(\"fully-allocated\"), Schema.Literal(\"independent-image\")]),\n    seedLimitBytes: positiveSafeInteger(\"DockerProfileSetupPrefixSeedLimitBytes\"),\n    filesystemIdentity: nonEmptyString(\"DockerProfileSetupPrefixFilesystemIdentity\"),\n});\n/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */\nexport const DockerExecutionProfileV1Schema: Schema.Codec<DockerExecutionProfileV1, PlainObject> = plainStruct({\n    schemaVersion: Schema.Literal(1),\n    profileId: nonEmptyString(\"DockerProfileId\"),\n    securityLevel: Schema.Literals([\"managed-rootless/v1\", \"raw-dind-storage/v1\"]),\n    semanticPolicyRevision: nonEmptyString(\"DockerProfileSemanticPolicyRevision\"),\n    transport: plainStruct({\n        kind: Schema.Literal(\"unix\"),\n        hostMachineIdentity: nonEmptyString(\"DockerProfileHostMachineIdentity\"),\n        dockerSocket: EndpointSchema,\n        controlSocket: plainStruct({\n            path: absolutePath(\"DockerProfileControlSocketPath\"),\n            peerUid: nonNegativeSafeInteger(\"DockerProfileControlPeerUid\"),\n            protocol: Schema.Literal(\"niceeval-docker-profile-control/v1\"),\n        }),\n    }),\n    backend: plainStruct({\n        kind: Schema.Literals([\"local-systemd\", \"dedicated-linux-vm\"]),\n        machineIdentity: nonEmptyString(\"DockerProfileBackendMachineIdentity\"),\n        owner: plainStruct({\n            uid: nonNegativeSafeInteger(\"DockerProfileOwnerUid\"),\n            gid: nonNegativeSafeInteger(\"DockerProfileOwnerGid\"),\n        }),\n        filesystem: plainStruct({\n            identity: nonEmptyString(\"DockerProfileFilesystemIdentity\"),\n            mountPath: absolutePath(\"DockerProfileMountPath\"),\n            dockerRootDir: absolutePath(\"DockerProfileDockerRootDir\"),\n            limitBytes: positiveSafeInteger(\"DockerProfileFilesystemLimitBytes\"),\n            dockerDataPool: plainStruct({\n                count: positiveSafeInteger(\"DockerProfileDockerDataSlotCount\"),\n                bytesPerAllocation: positiveSafeInteger(\"DockerProfileDockerDataAllocationLimitBytes\"),\n                attestation: Schema.Literals([\"linux-project-quota/v1\", \"independent-fixed-filesystem/v1\"]),\n            }),\n            setupPrefix: Schema.optional(SetupPrefixFullCopyCapabilitySchema),\n        }),\n        cgroup: plainStruct({\n            aggregatePath: absolutePath(\"DockerProfileAggregatePath\"),\n            policyRevision: nonEmptyString(\"DockerProfileCgroupPolicyRevision\"),\n            controllers: Schema.Tuple([Schema.Literal(\"cpu\"), Schema.Literal(\"memory\"), Schema.Literal(\"pids\")]),\n        }),\n    }),\n    capacity: CapacitySchema,\n    policy: Schema.Union([plainStruct({\n            level: Schema.Literal(\"raw-dind-storage/v1\"),\n            privilegedTranslation: Schema.Literal(\"host-daemon\"),\n            dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n        }), plainStruct({\n            level: Schema.Literal(\"managed-rootless/v1\"),\n            hostLoopback: Schema.Literal(false),\n            tcpDockerEndpoint: Schema.Literal(false),\n            outerSocketInjection: Schema.Literal(false),\n            privilegedTranslation: Schema.Literal(\"rootless-userns\"),\n            writableRoot: Schema.Literal(\"declared-tmpfs-only\"),\n            dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n            network: NetworkSchema,\n        })]),\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n    string,\n    ...string[]\n] {\n    const [first, ...rest] = values;\n    if (first === undefined)\n        throw new Error(\"expected a non-empty string tuple\");\n    return Object.freeze([first, ...rest]);\n}\n/** Canonicalize only after structural decoding; nested containers are immutable to callers. */\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n    return Object.freeze({\n        ...profile,\n        transport: Object.freeze({\n            ...profile.transport,\n            dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n            controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n        }),\n        backend: Object.freeze({\n            ...profile.backend,\n            owner: Object.freeze({ ...profile.backend.owner }),\n            filesystem: Object.freeze({\n                ...profile.backend.filesystem,\n                dockerDataPool: Object.freeze({ ...profile.backend.filesystem.dockerDataPool }),\n                ...(profile.backend.filesystem.setupPrefix === undefined\n                    ? {}\n                    : {\n                        setupPrefix: Object.freeze({\n                            ...profile.backend.filesystem.setupPrefix,\n                            filesystemFeatures: SETUP_PREFIX_FILESYSTEM_FEATURES,\n                        }),\n                    }),\n            }),\n            cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),\n        }),\n        capacity: Object.freeze({\n            ...profile.capacity,\n            memorySwapBytes: 0,\n            aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),\n        }),\n        policy: profile.policy.level === \"raw-dind-storage/v1\"\n            ? Object.freeze({ ...profile.policy })\n            : Object.freeze({\n                ...profile.policy,\n                network: Object.freeze({\n                    ...profile.policy.network,\n                    dns: Object.freeze({\n                        ...profile.policy.network.dns,\n                        servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n                    }),\n                    egress: Object.freeze({\n                        ...profile.policy.network.egress,\n                        allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n                        denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n                    }),\n                }),\n            }),\n    });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n    return {\n        schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n        securityLevel: input.securityLevel,\n        backend: {\n            kind: input.backend.kind,\n            cgroup: {\n                policyRevision: input.backend.cgroup.policyRevision,\n                controllers: [...input.backend.cgroup.controllers],\n            },\n        },\n        policy: input.policy.level === \"raw-dind-storage/v1\" ? {\n            level: input.policy.level,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            dockerData: input.policy.dockerData,\n        } : {\n            level: input.policy.level,\n            hostLoopback: input.policy.hostLoopback,\n            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n            outerSocketInjection: input.policy.outerSocketInjection,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            writableRoot: input.policy.writableRoot,\n            dockerData: input.policy.dockerData,\n            network: {\n                version: input.policy.network.version,\n                dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },\n                egress: {\n                    mode: input.policy.network.egress.mode,\n                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n                    denyCidrs: [...input.policy.network.egress.denyCidrs],\n                    ipv6: input.policy.network.egress.ipv6,\n                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n                    portDriver: input.policy.network.egress.portDriver,\n                    daemonBridge: input.policy.network.egress.daemonBridge,\n                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n                    icc: input.policy.network.egress.icc,\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n    return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction formatSchemaPath(path: readonly (PropertyKey | StandardSchema.StandardSchemaV1.PathSegment)[]): string {\n    return path.reduce<string>((result, rawSegment) => {\n        const segment = typeof rawSegment === \"object\" ? rawSegment.key : rawSegment;\n        return typeof segment === \"number\" ||\n            (typeof segment === \"string\" && /^\\\\d+$/.test(segment))\n            ? `${result}[${String(segment)}]`\n            : `${result}.${String(segment)}`;\n    }, \"profile\");\n}\nfunction schemaError(value: unknown, error: SchemaIssue.Issue): DockerProfileError {\n    const issue = SchemaIssue.makeFormatterStandardSchemaV1()(error).issues[0];\n    const path = issue === undefined ? \"profile\" : formatSchemaPath(issue.path ?? []);\n    const root = typeof value === \"object\" && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined;\n    if (path === \"profile.schemaVersion\") {\n        if (root?.schemaVersion === undefined) {\n            return dockerProfileError({\n                code: \"sandbox.docker-profile-schema-invalid\",\n                path,\n                message: \"profile.schemaVersion is required\",\n            });\n        }\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-unknown-version\",\n            path,\n            message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n        });\n    }\n    if (path === \"profile.securityLevel\") {\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path,\n            message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,\n        });\n    }\n    return dockerProfileError({\n        code: path === \"profile.capacity\"\n            ? \"sandbox.docker-profile-capacity-invalid\"\n            : \"sandbox.docker-profile-schema-invalid\",\n        path,\n        message: issue === undefined\n            ? \"profile is not a valid Docker execution profile v1\"\n            : `${path} ${issue.message}`,\n    });\n}\n// @concord-code ne-sandbox-docker-profile-parse\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1 {\n    const decoded = Schema.decodeUnknownResult(DockerExecutionProfileV1Schema, ParseOptions)(value);\n    if (Result.isFailure(decoded))\n        throw schemaError(value, decoded.failure.issue);\n    const profile = freezeProfile(decoded.success);\n    if (profile.backend.filesystem.dockerDataPool.count < profile.capacity.maxContainers ||\n        profile.backend.filesystem.dockerDataPool.count *\n            profile.backend.filesystem.dockerDataPool.bytesPerAllocation < profile.capacity.ephemeralDiskBytes) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-capacity-invalid\",\n            path: \"profile.backend.filesystem.dockerDataPool\",\n            message: \"Docker data allocations must cover maxContainers and allocatable ephemeralDiskBytes\",\n        });\n    }\n    const setupPrefix = profile.backend.filesystem.setupPrefix;\n    if (setupPrefix !== undefined &&\n        (setupPrefix.filesystemSizeBytes !==\n            profile.backend.filesystem.dockerDataPool.bytesPerAllocation ||\n            setupPrefix.seedLimitBytes < setupPrefix.filesystemSizeBytes ||\n            setupPrefix.seedLimitBytes % setupPrefix.filesystemSizeBytes !== 0 ||\n            setupPrefix.slotAttestation !==\n                profile.backend.filesystem.dockerDataPool.attestation)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-schema-invalid\",\n            path: \"profile.backend.filesystem.setupPrefix\",\n            message: \"Docker profile setup-prefix capability must fit one independently attested fixed Docker data allocation\",\n        });\n    }\n    const rawStorage = profile.securityLevel === \"raw-dind-storage/v1\";\n    if (profile.policy.level !== profile.securityLevel ||\n        (rawStorage\n            ? profile.policy.privilegedTranslation !== \"host-daemon\"\n            : profile.policy.privilegedTranslation !== \"rootless-userns\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path: \"profile.policy\",\n            message: \"Docker profile policy level and privileged translation must match its security level\",\n        });\n    }\n    const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n    if (profile.semanticPolicyRevision !== expected) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n            path: \"profile.semanticPolicyRevision\",\n            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,\n            details: { expected, actual: profile.semanticPolicyRevision },\n        });\n    }\n    return profile;\n}\nexport const parseDockerExecutionProfile = parseDockerExecutionProfileV1;\nexport const decodeDockerExecutionProfileV1 = parseDockerExecutionProfileV1;\n// @concord-code ne-sandbox-docker-profile-make\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n    return parseDockerExecutionProfileV1({\n        ...input,\n        semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),\n    });\n}\nexport const createDockerExecutionProfileV1 = makeDockerExecutionProfileV1;\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n    try {\n        parseDockerExecutionProfileV1(value);\n        return true;\n    }\n    catch {\n        return false;\n    }\n}\n/** Digest the fixed v1 wire shape, not incidental object insertion order. */\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n    return {\n        schemaVersion: profile.schemaVersion,\n        profileId: profile.profileId,\n        securityLevel: profile.securityLevel,\n        semanticPolicyRevision: profile.semanticPolicyRevision,\n        transport: {\n            kind: profile.transport.kind,\n            hostMachineIdentity: profile.transport.hostMachineIdentity,\n            dockerSocket: { ...profile.transport.dockerSocket },\n            controlSocket: { ...profile.transport.controlSocket },\n        },\n        backend: {\n            kind: profile.backend.kind,\n            machineIdentity: profile.backend.machineIdentity,\n            owner: { ...profile.backend.owner },\n            filesystem: {\n                identity: profile.backend.filesystem.identity,\n                mountPath: profile.backend.filesystem.mountPath,\n                dockerRootDir: profile.backend.filesystem.dockerRootDir,\n                limitBytes: profile.backend.filesystem.limitBytes,\n                dockerDataPool: { ...profile.backend.filesystem.dockerDataPool },\n                ...(profile.backend.filesystem.setupPrefix === undefined\n                    ? {}\n                    : {\n                        setupPrefix: {\n                            protocol: profile.backend.filesystem.setupPrefix.protocol,\n                            coverage: profile.backend.filesystem.setupPrefix.coverage,\n                            requiredState: profile.backend.filesystem.setupPrefix.requiredState,\n                            helperRevision: profile.backend.filesystem.setupPrefix.helperRevision,\n                            copyProtocol: profile.backend.filesystem.setupPrefix.copyProtocol,\n                            copyRevision: profile.backend.filesystem.setupPrefix.copyRevision,\n                            quiesceRevision: profile.backend.filesystem.setupPrefix.quiesceRevision,\n                            slotAttestation: profile.backend.filesystem.setupPrefix.slotAttestation,\n                            seedPolicy: profile.backend.filesystem.setupPrefix.seedPolicy,\n                            publicationRevision: profile.backend.filesystem.setupPrefix.publicationRevision,\n                            recoveryRevision: profile.backend.filesystem.setupPrefix.recoveryRevision,\n                            manifestSchema: profile.backend.filesystem.setupPrefix.manifestSchema,\n                            providerIdentity: profile.backend.filesystem.setupPrefix.providerIdentity,\n                            executionDomain: profile.backend.filesystem.setupPrefix.executionDomain,\n                            filesystemSizeBytes: profile.backend.filesystem.setupPrefix.filesystemSizeBytes,\n                            filesystemFeatures: [...profile.backend.filesystem.setupPrefix.filesystemFeatures],\n                            seedLimitBytes: profile.backend.filesystem.setupPrefix.seedLimitBytes,\n                            filesystemIdentity: profile.backend.filesystem.setupPrefix.filesystemIdentity,\n                        },\n                    }),\n            },\n            cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },\n        },\n        capacity: {\n            ...profile.capacity,\n            aggregate: { ...profile.capacity.aggregate },\n        },\n        policy: profile.policy.level === \"raw-dind-storage/v1\" ? {\n            level: profile.policy.level,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            dockerData: profile.policy.dockerData,\n        } : {\n            level: profile.policy.level,\n            hostLoopback: profile.policy.hostLoopback,\n            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n            outerSocketInjection: profile.policy.outerSocketInjection,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            writableRoot: profile.policy.writableRoot,\n            dockerData: profile.policy.dockerData,\n            network: {\n                version: profile.policy.network.version,\n                dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },\n                egress: {\n                    ...profile.policy.network.egress,\n                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n                    denyCidrs: [...profile.policy.network.egress.denyCidrs],\n                },\n            },\n        },\n    };\n}\n// @concord-code ne-sandbox-docker-profile-digest\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n    return `sha256:${digestOf(canonicalJson(parseDockerExecutionProfileV1(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n    const normalized = parseDockerExecutionProfileV1(profile);\n    return Object.freeze({\n        schemaVersion: 1,\n        profileId: normalized.profileId,\n        securityLevel: normalized.securityLevel,\n        semanticPolicyRevision: normalized.semanticPolicyRevision,\n        capacity: Object.freeze({\n            ...normalized.capacity,\n            aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n        }),\n    });\n}\n"]}
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":";;;AA0dA,wGAEC;AAmDD,oEAiDC;AAGD,oEAKC;AACD,gEAQC;AAiFD,wEAEC;AAED,oEAYC;AAlrBD,mCAA0E;AAC1E,uCAAgC;AAChC,yCAAuC;AACvC,gDAA0C;AAE1C,2CAA0E;AAC7D,QAAA,uCAAuC,GAAM,CAAC,CAAC;AAC/C,QAAA,qCAAqC,GAAM,CAAC,CAAC;AAC7C,QAAA,sCAAsC,GAAG,uDAAgE,CAAC;AAC1G,QAAA,4CAA4C,GAAG,8CAAsC,CAAC;AACtF,QAAA,iCAAiC,GAG1C,MAAM,CAAC,MAAM,CAAC;IACd,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAC3E,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB;IACjE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,aAAa;IACnE,aAAa,EAAE,MAAM;CACxB,CAAC,CAAC;AACH,MAAM,yBAAyB,GAG3B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AACpC,MAAM,mBAAmB,GAIrB,MAAM,CAAC,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,MAAM;CAC1B,CAAC,CAAC;AACH,MAAM,gCAAgC,GAKlC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAuJlF,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,KAAc;IACtB,KAAK,EAAE,IAAI;IACX,gBAAgB,EAAE,OAAgB;CACrC,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,eAAM,CAAC,OAAO,CAAc,CAAC,KAAK,EAAwB,EAAE;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACnE,OAAO,KAAK,CAAC;IACjB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAChE,CAAC,EAAE;IACC,UAAU,EAAE,0BAA0B;IACtC,WAAW,EAAE,yCAAyC;CACzD,CAAC,CAAC;AACH,MAAM,WAAW,GAAG,CAAsC,MAAc,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,eAAM,CAAC,QAAQ,CAAC,eAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5I,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3N,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,oCAAoC,EAAE,CAAC,CAAC,CAAC,CAAC;AACpO,MAAM,YAAY,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,sBAAU,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3K,MAAM,sBAAsB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7N,MAAM,mBAAmB,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC,CAAC;AACrN,MAAM,cAAc,GAAG,CAAC,UAAkB,EAAE,EAAE,CAAC,eAAM,CAAC,MAAM,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC5M,SAAS,iBAAiB,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,IAAA,eAAI,EAAC,KAAK,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAClE,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG;YAC5D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,GAAG;YAC9C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,IAAI,EAAE,IAAI,MAAM,IAAI,EAAE;YAC7C,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;YAC/B,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK,EAAE,CAAC;YACjD,OAAO,KAAK,CAAC;QACjB,IAAI,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG;YAC/C,OAAO,KAAK,CAAC;QACjB,OAAO,CAAC,CAAC,KAAK,KAAK,GAAG,IAAI,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,IAAI,KAAK,CAAC;QACV,OAAO,KAAK,CAAC;IACjB,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACnC,OAAO,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,KAAK;QAC9C,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC;QAC5D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC;QAC9D,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;AAC5E,CAAC;AACD,MAAM,eAAe,GAAG,cAAc,CAAC,8BAA8B,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE;IAC1H,UAAU,EAAE,8BAA8B;IAC1C,WAAW,EAAE,0DAA0D;CAC1E,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,WAAW,GAAG,eAAM,CAAC,aAAa,CAAC,eAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,yCAAiC,CAAC,MAAM;IAC5J,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,yCAAiC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,UAAU,EAAE,wBAAwB,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7K,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,YAAY,CAAC,yBAAyB,CAAC;IAC7C,OAAO,EAAE,sBAAsB,CAAC,sBAAsB,CAAC;CAC1D,CAAC,CAAC;AACH,MAAM,aAAa,GAAG,WAAW,CAAC;IAC9B,OAAO,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1B,GAAG,EAAE,WAAW,CAAC;QACb,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,OAAO,EAAE,eAAM,CAAC,aAAa,CAAC,eAAe,CAAC;KACjD,CAAC;IACF,MAAM,EAAE,WAAW,CAAC;QAChB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAChF,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,6BAA6B,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACnD,SAAS,EAAE,WAAW;QACtB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QAChC,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACzC,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAClC,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QACpC,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,IAAI,CAAC;QACtC,GAAG,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;KAC7B,CAAC;CACL,CAAC,CAAC;AACH,MAAM,cAAc,GAAG,WAAW,CAAC;IAC/B,IAAI,EAAE,cAAc,CAAC,2BAA2B,CAAC;IACjD,WAAW,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;IACpE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,IAAI,EAAE,mBAAmB,CAAC,2BAA2B,CAAC;IACtD,aAAa,EAAE,mBAAmB,CAAC,oCAAoC,CAAC;IACxE,SAAS,EAAE,mBAAmB,CAAC,gCAAgC,CAAC;IAChE,kBAAkB,EAAE,mBAAmB,CAAC,yCAAyC,CAAC;IAClF,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,cAAc,CAAC,4BAA4B,CAAC;QAClD,WAAW,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;QACrE,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,mBAAmB,CAAC,4BAA4B,CAAC;KAC1D,CAAC;CACL,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,KAAK,CAAC,eAAM,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI;IAChF,KAAK,CAAC,SAAS,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW;IAChD,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;IACpC,UAAU,EAAE,uBAAuB;IACnC,WAAW,EAAE,kFAAkF;CAClG,CAAC,CAAC,CAAC,CAAC;AACL,MAAM,mCAAmC,GAAG,WAAW,CAAC;IACpD,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oDAA4C,CAAC;IACtE,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IACtC,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC;IAC3C,cAAc,EAAE,cAAc,CAAC,wCAAwC,CAAC;IACxE,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,cAAc,CAAC;IAC5C,YAAY,EAAE,cAAc,CAAC,sCAAsC,CAAC;IACpE,eAAe,EAAE,cAAc,CAAC,yCAAyC,CAAC;IAC1E,eAAe,EAAE,eAAM,CAAC,OAAO,CAAC,iCAAiC,CAAC;IAClE,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACpD,mBAAmB,EAAE,eAAM,CAAC,OAAO,CAAC,wCAAwC,CAAC;IAC7E,gBAAgB,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;IACtE,cAAc,EAAE,eAAM,CAAC,OAAO,CAAC,uCAAuC,CAAC;IACvE,gBAAgB,EAAE,cAAc,CAAC,0CAA0C,CAAC;IAC5E,eAAe,EAAE,cAAc,CAAC,yCAAyC,CAAC;IAC1E,mBAAmB,EAAE,mBAAmB,CAAC,6CAA6C,CAAC;IACvF,kBAAkB,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAChK,cAAc,EAAE,mBAAmB,CAAC,wCAAwC,CAAC;IAC7E,kBAAkB,EAAE,cAAc,CAAC,4CAA4C,CAAC;CACnF,CAAC,CAAC;AACH,mGAAmG;AACtF,QAAA,8BAA8B,GAAwD,WAAW,CAAC;IAC3G,aAAa,EAAE,eAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChC,SAAS,EAAE,cAAc,CAAC,iBAAiB,CAAC;IAC5C,aAAa,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;IAC9E,sBAAsB,EAAE,cAAc,CAAC,qCAAqC,CAAC;IAC7E,SAAS,EAAE,WAAW,CAAC;QACnB,IAAI,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC5B,mBAAmB,EAAE,cAAc,CAAC,kCAAkC,CAAC;QACvE,YAAY,EAAE,cAAc;QAC5B,aAAa,EAAE,WAAW,CAAC;YACvB,IAAI,EAAE,YAAY,CAAC,gCAAgC,CAAC;YACpD,OAAO,EAAE,sBAAsB,CAAC,6BAA6B,CAAC;YAC9D,QAAQ,EAAE,eAAM,CAAC,OAAO,CAAC,oCAAoC,CAAC;SACjE,CAAC;KACL,CAAC;IACF,OAAO,EAAE,WAAW,CAAC;QACjB,IAAI,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,oBAAoB,CAAC,CAAC;QAC9D,eAAe,EAAE,cAAc,CAAC,qCAAqC,CAAC;QACtE,KAAK,EAAE,WAAW,CAAC;YACf,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;YACpD,GAAG,EAAE,sBAAsB,CAAC,uBAAuB,CAAC;SACvD,CAAC;QACF,UAAU,EAAE,WAAW,CAAC;YACpB,QAAQ,EAAE,cAAc,CAAC,iCAAiC,CAAC;YAC3D,SAAS,EAAE,YAAY,CAAC,wBAAwB,CAAC;YACjD,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,UAAU,EAAE,mBAAmB,CAAC,mCAAmC,CAAC;YACpE,cAAc,EAAE,WAAW,CAAC;gBACxB,KAAK,EAAE,mBAAmB,CAAC,kCAAkC,CAAC;gBAC9D,kBAAkB,EAAE,mBAAmB,CAAC,6CAA6C,CAAC;gBACtF,WAAW,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,wBAAwB,EAAE,iCAAiC,CAAC,CAAC;aAC9F,CAAC;YACF,WAAW,EAAE,eAAM,CAAC,QAAQ,CAAC,mCAAmC,CAAC;SACpE,CAAC;QACF,MAAM,EAAE,WAAW,CAAC;YAChB,aAAa,EAAE,YAAY,CAAC,4BAA4B,CAAC;YACzD,cAAc,EAAE,cAAc,CAAC,mCAAmC,CAAC;YACnE,WAAW,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,eAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;SACvG,CAAC;KACL,CAAC;IACF,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,eAAM,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC;YAC1B,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC5C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;SACpE,CAAC,EAAE,WAAW,CAAC;YACZ,KAAK,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YAC5C,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACnC,iBAAiB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YACxC,oBAAoB,EAAE,eAAM,CAAC,OAAO,CAAC,KAAK,CAAC;YAC3C,qBAAqB,EAAE,eAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;YACxD,YAAY,EAAE,eAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC;YACnD,UAAU,EAAE,eAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC;YACjE,OAAO,EAAE,aAAa;SACzB,CAAC,CAAC,CAAC;CACX,CAAC,CAAC;AACU,QAAA,4BAA4B,GAAG,sCAA8B,CAAC;AAC3E,SAAS,qBAAqB,CAAC,MAAyB;IAIpD,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AACD,+FAA+F;AAC/F,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,OAAO;QACV,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,GAAG,OAAO,CAAC,SAAS;YACpB,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;YAClE,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;SACvE,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,GAAG,OAAO,CAAC,OAAO;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAClD,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU;gBAC7B,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;4BACvB,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW;4BACzC,kBAAkB,EAAE,gCAAgC;yBACvD,CAAC;qBACL,CAAC;aACT,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;SACzF,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,OAAO,CAAC,QAAQ;YACnB,eAAe,EAAE,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;SAClF,CAAC;QACF,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB;YAClD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;gBACZ,GAAG,OAAO,CAAC,MAAM;gBACjB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;oBACnB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO;oBACzB,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;wBACf,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG;wBAC7B,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;qBACrE,CAAC;oBACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;wBAClB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;wBAChC,gBAAgB,EAAE,yBAAyB;wBAC3C,SAAS,EAAE,yCAAiC;qBAC/C,CAAC;iBACL,CAAC;aACL,CAAC;KACT,CAAC,CAAC;AACP,CAAC;AACD,SAAS,kBAAkB,CAAC,KAA0C;IAClE,OAAO;QACH,aAAa,EAAE,+CAAuC;QACtD,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,OAAO,EAAE;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI;YACxB,MAAM,EAAE;gBACJ,cAAc,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc;gBACnD,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;aACrD;SACJ;QACD,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACnD,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;SACtC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;YACzB,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,iBAAiB;YACjD,oBAAoB,EAAE,KAAK,CAAC,MAAM,CAAC,oBAAoB;YACvD,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,qBAAqB;YACzD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,YAAY;YACvC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;YACnC,OAAO,EAAE;gBACL,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACrC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAC5F,MAAM,EAAE;oBACJ,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,gBAAgB,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACnE,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,6BAA6B,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,6BAA6B;oBACxF,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;oBACrD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;oBACtC,mBAAmB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;oBACpE,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU;oBAClD,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY;oBACtD,gBAAgB,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB;oBAC9D,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG;iBACvC;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,SAAgB,8CAA8C,CAAC,KAA0C;IACrG,OAAO,IAAA,sBAAQ,EAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AACY,QAAA,qCAAqC,GAAG,8CAA8C,CAAC;AACpG,SAAS,gBAAgB,CAAC,IAA4E;IAClG,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE;QAC9C,MAAM,OAAO,GAAG,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7E,OAAO,OAAO,OAAO,KAAK,QAAQ;YAC9B,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG;YACjC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,CAAC,EAAE,SAAS,CAAC,CAAC;AAClB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc,EAAE,KAAwB;IACzD,MAAM,KAAK,GAAG,oBAAW,CAAC,6BAA6B,EAAE,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC3E,MAAM,IAAI,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7E,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,IAAI,IAAI,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,IAAA,8BAAkB,EAAC;gBACtB,IAAI,EAAE,uCAAuC;gBAC7C,IAAI;gBACJ,OAAO,EAAE,mCAAmC;aAC/C,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,wCAAwC;YAC9C,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,cAAc;SACnH,CAAC,CAAC;IACP,CAAC;IACD,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;QACnC,OAAO,IAAA,8BAAkB,EAAC;YACtB,IAAI,EAAE,mDAAmD;YACzD,IAAI;YACJ,OAAO,EAAE,uDAAuD,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE;SACxG,CAAC,CAAC;IACP,CAAC;IACD,OAAO,IAAA,8BAAkB,EAAC;QACtB,IAAI,EAAE,IAAI,KAAK,kBAAkB;YAC7B,CAAC,CAAC,yCAAyC;YAC3C,CAAC,CAAC,uCAAuC;QAC7C,IAAI;QACJ,OAAO,EAAE,KAAK,KAAK,SAAS;YACxB,CAAC,CAAC,oDAAoD;YACtD,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,OAAO,EAAE;KACnC,CAAC,CAAC;AACP,CAAC;AACD,gBAAgB;AAChB,sEAAsE;AACtE,2EAA2E;AAC3E,SAAgB,4BAA4B,CAAC,KAAc;IACvD,MAAM,OAAO,GAAG,eAAM,CAAC,mBAAmB,CAAC,sCAA8B,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC;IAChG,IAAI,eAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QACzB,MAAM,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,aAAa;QAChF,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK;YAC3C,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC;QACzG,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,yCAAyC;YAC/C,IAAI,EAAE,2CAA2C;YACjD,OAAO,EAAE,qFAAqF;SACjG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;IAC3D,IAAI,WAAW,KAAK,SAAS;QACzB,CAAC,WAAW,CAAC,mBAAmB;YAC5B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,kBAAkB;YAC5D,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,mBAAmB;YAC5D,WAAW,CAAC,cAAc,GAAG,WAAW,CAAC,mBAAmB,KAAK,CAAC;YAClE,WAAW,CAAC,eAAe;gBACvB,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,uCAAuC;YAC7C,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,yGAAyG;SACrH,CAAC,CAAC;IACP,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,KAAK,qBAAqB,CAAC;IACnE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,OAAO,CAAC,aAAa;QAC9C,CAAC,UAAU;YACP,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,aAAa;YACxD,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,KAAK,iBAAiB,CAAC,EAAE,CAAC;QACpE,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,mDAAmD;YACzD,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,sFAAsF;SAClG,CAAC,CAAC;IACP,CAAC;IACD,MAAM,QAAQ,GAAG,8CAA8C,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAA,8BAAkB,EAAC;YACrB,IAAI,EAAE,iDAAiD;YACvD,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,wFAAwF,QAAQ,EAAE;YAC3G,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE;SAChE,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AACD,gBAAgB;AAChB,sEAAsE;AACtE,SAAgB,4BAA4B,CAAC,KAAoC;IAC7E,OAAO,4BAA4B,CAAC;QAChC,GAAG,KAAK;QACR,sBAAsB,EAAE,8CAA8C,CAAC,KAAK,CAAC;KAChF,CAAC,CAAC;AACP,CAAC;AACD,SAAgB,0BAA0B,CAAC,KAAc;IACrD,IAAI,CAAC;QACD,4BAA4B,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,CAAC;QACH,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AACD,6EAA6E;AAC7E,SAAS,aAAa,CAAC,OAAiC;IACpD,OAAO;QACH,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,sBAAsB,EAAE,OAAO,CAAC,sBAAsB;QACtD,SAAS,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,IAAI;YAC5B,mBAAmB,EAAE,OAAO,CAAC,SAAS,CAAC,mBAAmB;YAC1D,YAAY,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE;YACnD,aAAa,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,aAAa,EAAE;SACxD;QACD,OAAO,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;YAC1B,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,eAAe;YAChD,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE;YACnC,UAAU,EAAE;gBACR,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ;gBAC7C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS;gBAC/C,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa;gBACvD,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU;gBACjD,cAAc,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE;gBAChE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,KAAK,SAAS;oBACpD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC;wBACE,WAAW,EAAE;4BACT,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ;4BACzD,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ;4BACzD,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,aAAa;4BACnE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY;4BACjE,YAAY,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,YAAY;4BACjE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,UAAU;4BAC7D,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,mBAAmB;4BAC/E,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB;4BACzE,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,gBAAgB;4BACzE,eAAe,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,eAAe;4BACvE,mBAAmB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,mBAAmB;4BAC/E,kBAAkB,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB,CAAC;4BAClF,cAAc,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,cAAc;4BACrE,kBAAkB,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,kBAAkB;yBAChF;qBACJ,CAAC;aACT;YACD,MAAM,EAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE;SAC9F;QACD,QAAQ,EAAE;YACN,GAAG,OAAO,CAAC,QAAQ;YACnB,SAAS,EAAE,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE;SAC/C;QACD,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,qBAAqB,CAAC,CAAC,CAAC;YACrD,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;SACxC,CAAC,CAAC,CAAC;YACA,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK;YAC3B,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB;YACnD,oBAAoB,EAAE,OAAO,CAAC,MAAM,CAAC,oBAAoB;YACzD,qBAAqB,EAAE,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAC3D,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;YACzC,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU;YACrC,OAAO,EAAE;gBACL,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO;gBACvC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;gBAChG,MAAM,EAAE;oBACJ,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM;oBAChC,gBAAgB,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;oBACrE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC;iBAC1D;aACJ;SACJ;KACJ,CAAC;AACN,CAAC;AACD,gBAAgB;AAChB,2EAA2E;AAC3E,SAAgB,8BAA8B,CAAC,OAAiC;IAC5E,OAAO,UAAU,IAAA,sBAAQ,EAAC,aAAa,CAAC,4BAA4B,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AACY,QAAA,qBAAqB,GAAG,8BAA8B,CAAC;AACpE,SAAgB,4BAA4B,CAAC,OAAiC;IAC1E,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACzD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,aAAa,EAAE,CAAC;QAChB,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,sBAAsB,EAAE,UAAU,CAAC,sBAAsB;QACzD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,GAAG,UAAU,CAAC,QAAQ;YACtB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;SACjE,CAAC;KACL,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Result, Schema, SchemaIssue, type StandardSchema } from \"effect\";\nimport { isIP } from \"node:net\";\nimport { isAbsolute } from \"node:path\";\nimport { digestOf } from \"../identity.ts\";\nimport type { JsonValue } from \"../../shared/types.ts\";\nimport { dockerProfileError, type DockerProfileError } from \"./errors.ts\";\nexport const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1 = 1;\nexport const DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY = \"niceeval-docker-profile-state/docker-data-snapshot/v1\" as const;\nexport const DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL = DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY;\nexport const DOCKER_PROFILE_NETWORK_DENY_CIDRS: readonly [\n    string,\n    ...string[]\n] = Object.freeze([\n    \"0.0.0.0/8\", \"10.0.0.0/8\", \"100.64.0.0/10\", \"127.0.0.0/8\", \"169.254.0.0/16\",\n    \"172.16.0.0/12\", \"192.0.0.0/24\", \"192.0.2.0/24\", \"192.168.0.0/16\",\n    \"198.18.0.0/15\", \"198.51.100.0/24\", \"203.0.113.0/24\", \"224.0.0.0/4\",\n    \"240.0.0.0/4\", \"::/0\",\n]);\nconst NETWORK_ALLOWED_PROTOCOLS: readonly [\n    \"dns\",\n    \"https\"\n] = Object.freeze([\"dns\", \"https\"]);\nconst PROFILE_CONTROLLERS: readonly [\n    \"cpu\",\n    \"memory\",\n    \"pids\"\n] = Object.freeze([\n    \"cpu\", \"memory\", \"pids\",\n]);\nconst SETUP_PREFIX_FILESYSTEM_FEATURES: readonly [\n    \"ext4\",\n    \"fixed-size\",\n    \"fully-allocated\",\n    \"independent-image\"\n] = Object.freeze([\"ext4\", \"fixed-size\", \"fully-allocated\", \"independent-image\"]);\nexport type DockerExecutionProfileSecurityLevel = \"managed-rootless/v1\" | \"raw-dind-storage/v1\";\nexport interface DockerProfileUnixEndpoint {\n    readonly path: string;\n    readonly peerUid: number;\n}\n/** Callback-free descriptor data that crosses the host deployment trust boundary. */\nexport interface DockerProfileNetworkPolicy {\n    readonly version: 1;\n    readonly dns: {\n        readonly mode: \"explicit\";\n        readonly servers: readonly [\n            string,\n            ...string[]\n        ];\n    };\n    readonly egress: {\n        readonly mode: \"rootless-nat\";\n        readonly allowedProtocols: readonly [\n            \"dns\",\n            \"https\"\n        ];\n        readonly denyPrivateNetworks: true;\n        readonly denySiblingSyntheticEndpoints: true;\n        readonly denyCidrs: readonly [\n            string,\n            ...string[]\n        ];\n        readonly ipv6: \"disabled\";\n        readonly disableHostLoopback: true;\n        readonly portDriver: \"none\";\n        readonly daemonBridge: \"none\";\n        readonly exclusiveNetwork: true;\n        readonly icc: false;\n    };\n}\nexport interface DockerRawStoragePolicy {\n    readonly level: \"raw-dind-storage/v1\";\n    readonly privilegedTranslation: \"host-daemon\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n}\nexport interface DockerManagedRootlessPolicy {\n    readonly level: \"managed-rootless/v1\";\n    readonly hostLoopback: false;\n    readonly tcpDockerEndpoint: false;\n    readonly outerSocketInjection: false;\n    readonly privilegedTranslation: \"rootless-userns\";\n    readonly writableRoot: \"declared-tmpfs-only\";\n    readonly dockerData: \"private-project-quota-allocation/v1\";\n    readonly network: DockerProfileNetworkPolicy;\n}\n/**\n * Opt-in host capability for copying the complete profile-owned SetupPrefix\n * state. Absence is intentional and keeps the historical structured\n * Unsupported result for raw and managed profiles.\n */\nexport interface DockerProfileSetupPrefixFullCopyCapabilityV1 {\n    readonly protocol: typeof DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL;\n    readonly coverage: \"dockerData\";\n    readonly requiredState: \"dockerData\";\n    readonly helperRevision: string;\n    readonly copyProtocol: \"raw-image/v1\";\n    readonly copyRevision: string;\n    readonly quiesceRevision: string;\n    readonly slotAttestation: \"independent-fixed-filesystem/v1\";\n    readonly seedPolicy: \"immutable-unmounted/v1\";\n    readonly publicationRevision: \"prepared-copy-client-commit-publish/v4\";\n    readonly recoveryRevision: \"epoch-capsule-no-guess-recovery/v3\";\n    readonly manifestSchema: \"niceeval-docker-profile-activation/v3\";\n    readonly providerIdentity: string;\n    readonly executionDomain: string;\n    readonly filesystemSizeBytes: number;\n    readonly filesystemFeatures: readonly [\n        \"ext4\",\n        \"fixed-size\",\n        \"fully-allocated\",\n        \"independent-image\"\n    ];\n    readonly seedLimitBytes: number;\n    readonly filesystemIdentity: string;\n}\nexport interface DockerExecutionProfileV1 {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly transport: {\n        readonly kind: \"unix\";\n        readonly hostMachineIdentity: string;\n        readonly dockerSocket: DockerProfileUnixEndpoint;\n        readonly controlSocket: DockerProfileUnixEndpoint & {\n            readonly protocol: \"niceeval-docker-profile-control/v1\";\n        };\n    };\n    readonly backend: {\n        readonly kind: \"local-systemd\" | \"dedicated-linux-vm\";\n        readonly machineIdentity: string;\n        readonly owner: {\n            readonly uid: number;\n            readonly gid: number;\n        };\n        readonly filesystem: {\n            readonly identity: string;\n            readonly mountPath: string;\n            readonly dockerRootDir: string;\n            readonly limitBytes: number;\n            readonly dockerDataPool: {\n                readonly count: number;\n                readonly bytesPerAllocation: number;\n                readonly attestation: \"linux-project-quota/v1\" | \"independent-fixed-filesystem/v1\";\n            };\n            /** Presence is the descriptor's explicit, default-off full-copy capability. */\n            readonly setupPrefix?: DockerProfileSetupPrefixFullCopyCapabilityV1;\n        };\n        readonly cgroup: {\n            readonly aggregatePath: string;\n            readonly policyRevision: string;\n            readonly controllers: readonly [\n                \"cpu\",\n                \"memory\",\n                \"pids\"\n            ];\n        };\n    };\n    readonly capacity: {\n        readonly cpus: number;\n        readonly memoryBytes: number;\n        readonly memorySwapBytes: 0;\n        readonly pids: number;\n        readonly maxContainers: number;\n        readonly maxBuilds: number;\n        readonly ephemeralDiskBytes: number;\n        readonly aggregate: {\n            readonly cpus: number;\n            readonly memoryBytes: number;\n            readonly memorySwapBytes: 0;\n            readonly pids: number;\n        };\n    };\n    readonly policy: DockerRawStoragePolicy | DockerManagedRootlessPolicy;\n}\nexport type DockerExecutionProfileV1Draft = Omit<DockerExecutionProfileV1, \"semanticPolicyRevision\">;\n/** A deliberately narrow view: never exposes host endpoints, paths, owners, or policy. */\nexport interface DockerProfilePublicSummary {\n    readonly schemaVersion: 1;\n    readonly profileId: string;\n    readonly securityLevel: DockerExecutionProfileSecurityLevel;\n    readonly semanticPolicyRevision: string;\n    readonly capacity: DockerExecutionProfileV1[\"capacity\"];\n}\ntype DockerExecutionProfileSemanticInput = Pick<DockerExecutionProfileV1, \"securityLevel\" | \"backend\" | \"policy\">;\nconst ParseOptions = Object.freeze({\n    errors: \"all\" as const,\n    exact: true,\n    onExcessProperty: \"error\" as const,\n});\ntype PlainObject = Readonly<Record<PropertyKey, unknown>>;\nconst PlainObjectSchema = Schema.declare<PlainObject>((value): value is PlainObject => {\n    if (typeof value !== \"object\" || value === null || Array.isArray(value))\n        return false;\n    const prototype = Object.getPrototypeOf(value);\n    return prototype === Object.prototype || prototype === null;\n}, {\n    identifier: \"DockerProfilePlainObject\",\n    description: \"a plain object or null-prototype record\",\n});\nconst plainStruct = <Fields extends Schema.Struct.Fields>(fields: Fields) => PlainObjectSchema.pipe(Schema.decodeTo(Schema.Struct(fields)));\nconst nonEmptyString = (identifier: string) => Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.trim() !== \"\" && !value.includes(\"\\0\"), { identifier, description: \"a non-empty string without NUL\" })));\nconst sha256Identity = (identifier: string) => nonEmptyString(identifier).pipe(Schema.check(Schema.makeFilter((value) => /^sha256:[a-f0-9]{64}$/u.test(value), { identifier, description: \"an exact lowercase sha256 identity\" })));\nconst absolutePath = (identifier: string) => nonEmptyString(identifier).pipe(Schema.check(Schema.makeFilter(isAbsolute, { identifier, description: \"an absolute path\" })));\nconst nonNegativeSafeInteger = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value >= 0, { identifier, description: \"a non-negative safe integer\" })));\nconst positiveSafeInteger = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isSafeInteger(value) && value > 0, { identifier, description: \"a positive safe integer\" })));\nconst positiveFinite = (identifier: string) => Schema.Number.pipe(Schema.check(Schema.makeFilter((value) => Number.isFinite(value) && value > 0, { identifier, description: \"a positive finite number\" })));\nfunction isPublicDnsServer(value: string): boolean {\n    const kind = isIP(value);\n    if (kind === 4) {\n        const [first, second, third] = value.split(\".\").map(Number);\n        if (first === undefined || second === undefined || third === undefined)\n            return false;\n        if (first === 0 || first === 10 || first === 127 || first >= 224)\n            return false;\n        if (first === 100 && second >= 64 && second <= 127)\n            return false;\n        if (first === 169 && second === 254)\n            return false;\n        if (first === 172 && second >= 16 && second <= 31)\n            return false;\n        if (first === 192 && second === 168)\n            return false;\n        if (first === 192 && second === 0 && (third === 0 || third === 2))\n            return false;\n        if (first === 198 && (second === 18 || second === 19))\n            return false;\n        if (first === 198 && second === 51 && third === 100)\n            return false;\n        return !(first === 203 && second === 0 && third === 113);\n    }\n    if (kind !== 6)\n        return false;\n    const normalized = value.toLowerCase();\n    if (normalized.startsWith(\"::ffff:\")) {\n        return isPublicDnsServer(normalized.slice(\"::ffff:\".length));\n    }\n    return normalized !== \"::\" && normalized !== \"::1\" &&\n        !normalized.startsWith(\"fc\") && !normalized.startsWith(\"fd\") &&\n        !normalized.startsWith(\"fe8\") && !normalized.startsWith(\"fe9\") &&\n        !normalized.startsWith(\"fea\") && !normalized.startsWith(\"feb\") &&\n        !normalized.startsWith(\"ff\") && !normalized.startsWith(\"2001:db8:\");\n}\nconst DnsServerSchema = nonEmptyString(\"DockerProfilePublicDnsServer\").pipe(Schema.check(Schema.makeFilter(isPublicDnsServer, {\n    identifier: \"DockerProfilePublicDnsServer\",\n    description: \"a public IP address, not a private or synthetic endpoint\",\n})));\nconst CidrsSchema = Schema.NonEmptyArray(Schema.String).pipe(Schema.check(Schema.makeFilter((value) => value.length === DOCKER_PROFILE_NETWORK_DENY_CIDRS.length &&\n    value.every((cidr, index) => cidr === DOCKER_PROFILE_NETWORK_DENY_CIDRS[index]), { identifier: \"DockerProfileDenyCidrs\", description: \"the v1 fail-closed CIDR set\" })));\nconst EndpointSchema = plainStruct({\n    path: absolutePath(\"DockerProfileSocketPath\"),\n    peerUid: nonNegativeSafeInteger(\"DockerProfilePeerUid\"),\n});\nconst NetworkSchema = plainStruct({\n    version: Schema.Literal(1),\n    dns: plainStruct({\n        mode: Schema.Literal(\"explicit\"),\n        servers: Schema.NonEmptyArray(DnsServerSchema),\n    }),\n    egress: plainStruct({\n        mode: Schema.Literal(\"rootless-nat\"),\n        allowedProtocols: Schema.Tuple([Schema.Literal(\"dns\"), Schema.Literal(\"https\")]),\n        denyPrivateNetworks: Schema.Literal(true),\n        denySiblingSyntheticEndpoints: Schema.Literal(true),\n        denyCidrs: CidrsSchema,\n        ipv6: Schema.Literal(\"disabled\"),\n        disableHostLoopback: Schema.Literal(true),\n        portDriver: Schema.Literal(\"none\"),\n        daemonBridge: Schema.Literal(\"none\"),\n        exclusiveNetwork: Schema.Literal(true),\n        icc: Schema.Literal(false),\n    }),\n});\nconst CapacitySchema = plainStruct({\n    cpus: positiveFinite(\"DockerProfileCapacityCpus\"),\n    memoryBytes: positiveSafeInteger(\"DockerProfileCapacityMemoryBytes\"),\n    memorySwapBytes: Schema.Literal(0),\n    pids: positiveSafeInteger(\"DockerProfileCapacityPids\"),\n    maxContainers: positiveSafeInteger(\"DockerProfileCapacityMaxContainers\"),\n    maxBuilds: positiveSafeInteger(\"DockerProfileCapacityMaxBuilds\"),\n    ephemeralDiskBytes: positiveSafeInteger(\"DockerProfileCapacityEphemeralDiskBytes\"),\n    aggregate: plainStruct({\n        cpus: positiveFinite(\"DockerProfileAggregateCpus\"),\n        memoryBytes: positiveSafeInteger(\"DockerProfileAggregateMemoryBytes\"),\n        memorySwapBytes: Schema.Literal(0),\n        pids: positiveSafeInteger(\"DockerProfileAggregatePids\"),\n    }),\n}).pipe(Schema.check(Schema.makeFilter((value) => value.aggregate.cpus >= value.cpus &&\n    value.aggregate.memoryBytes >= value.memoryBytes &&\n    value.aggregate.pids >= value.pids, {\n    identifier: \"DockerProfileCapacity\",\n    description: \"aggregate capacity at least as large as allocatable CPU, memory and PID capacity\",\n})));\nconst SetupPrefixFullCopyCapabilitySchema = plainStruct({\n    protocol: Schema.Literal(DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL),\n    coverage: Schema.Literal(\"dockerData\"),\n    requiredState: Schema.Literal(\"dockerData\"),\n    helperRevision: nonEmptyString(\"DockerProfileSetupPrefixHelperRevision\"),\n    copyProtocol: Schema.Literal(\"raw-image/v1\"),\n    copyRevision: nonEmptyString(\"DockerProfileSetupPrefixCopyRevision\"),\n    quiesceRevision: nonEmptyString(\"DockerProfileSetupPrefixQuiesceRevision\"),\n    slotAttestation: Schema.Literal(\"independent-fixed-filesystem/v1\"),\n    seedPolicy: Schema.Literal(\"immutable-unmounted/v1\"),\n    publicationRevision: Schema.Literal(\"prepared-copy-client-commit-publish/v4\"),\n    recoveryRevision: Schema.Literal(\"epoch-capsule-no-guess-recovery/v3\"),\n    manifestSchema: Schema.Literal(\"niceeval-docker-profile-activation/v3\"),\n    providerIdentity: sha256Identity(\"DockerProfileSetupPrefixProviderIdentity\"),\n    executionDomain: sha256Identity(\"DockerProfileSetupPrefixExecutionDomain\"),\n    filesystemSizeBytes: positiveSafeInteger(\"DockerProfileSetupPrefixFilesystemSizeBytes\"),\n    filesystemFeatures: Schema.Tuple([Schema.Literal(\"ext4\"), Schema.Literal(\"fixed-size\"), Schema.Literal(\"fully-allocated\"), Schema.Literal(\"independent-image\")]),\n    seedLimitBytes: positiveSafeInteger(\"DockerProfileSetupPrefixSeedLimitBytes\"),\n    filesystemIdentity: nonEmptyString(\"DockerProfileSetupPrefixFilesystemIdentity\"),\n});\n/** Wire structure only; semantic revision and frozen canonical values are checked after decode. */\nexport const DockerExecutionProfileV1Schema: Schema.Codec<DockerExecutionProfileV1, PlainObject> = plainStruct({\n    schemaVersion: Schema.Literal(1),\n    profileId: nonEmptyString(\"DockerProfileId\"),\n    securityLevel: Schema.Literals([\"managed-rootless/v1\", \"raw-dind-storage/v1\"]),\n    semanticPolicyRevision: nonEmptyString(\"DockerProfileSemanticPolicyRevision\"),\n    transport: plainStruct({\n        kind: Schema.Literal(\"unix\"),\n        hostMachineIdentity: nonEmptyString(\"DockerProfileHostMachineIdentity\"),\n        dockerSocket: EndpointSchema,\n        controlSocket: plainStruct({\n            path: absolutePath(\"DockerProfileControlSocketPath\"),\n            peerUid: nonNegativeSafeInteger(\"DockerProfileControlPeerUid\"),\n            protocol: Schema.Literal(\"niceeval-docker-profile-control/v1\"),\n        }),\n    }),\n    backend: plainStruct({\n        kind: Schema.Literals([\"local-systemd\", \"dedicated-linux-vm\"]),\n        machineIdentity: nonEmptyString(\"DockerProfileBackendMachineIdentity\"),\n        owner: plainStruct({\n            uid: nonNegativeSafeInteger(\"DockerProfileOwnerUid\"),\n            gid: nonNegativeSafeInteger(\"DockerProfileOwnerGid\"),\n        }),\n        filesystem: plainStruct({\n            identity: nonEmptyString(\"DockerProfileFilesystemIdentity\"),\n            mountPath: absolutePath(\"DockerProfileMountPath\"),\n            dockerRootDir: absolutePath(\"DockerProfileDockerRootDir\"),\n            limitBytes: positiveSafeInteger(\"DockerProfileFilesystemLimitBytes\"),\n            dockerDataPool: plainStruct({\n                count: positiveSafeInteger(\"DockerProfileDockerDataSlotCount\"),\n                bytesPerAllocation: positiveSafeInteger(\"DockerProfileDockerDataAllocationLimitBytes\"),\n                attestation: Schema.Literals([\"linux-project-quota/v1\", \"independent-fixed-filesystem/v1\"]),\n            }),\n            setupPrefix: Schema.optional(SetupPrefixFullCopyCapabilitySchema),\n        }),\n        cgroup: plainStruct({\n            aggregatePath: absolutePath(\"DockerProfileAggregatePath\"),\n            policyRevision: nonEmptyString(\"DockerProfileCgroupPolicyRevision\"),\n            controllers: Schema.Tuple([Schema.Literal(\"cpu\"), Schema.Literal(\"memory\"), Schema.Literal(\"pids\")]),\n        }),\n    }),\n    capacity: CapacitySchema,\n    policy: Schema.Union([plainStruct({\n            level: Schema.Literal(\"raw-dind-storage/v1\"),\n            privilegedTranslation: Schema.Literal(\"host-daemon\"),\n            dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n        }), plainStruct({\n            level: Schema.Literal(\"managed-rootless/v1\"),\n            hostLoopback: Schema.Literal(false),\n            tcpDockerEndpoint: Schema.Literal(false),\n            outerSocketInjection: Schema.Literal(false),\n            privilegedTranslation: Schema.Literal(\"rootless-userns\"),\n            writableRoot: Schema.Literal(\"declared-tmpfs-only\"),\n            dockerData: Schema.Literal(\"private-project-quota-allocation/v1\"),\n            network: NetworkSchema,\n        })]),\n});\nexport const DockerExecutionProfileSchema = DockerExecutionProfileV1Schema;\nfunction frozenNonEmptyStrings(values: readonly string[]): readonly [\n    string,\n    ...string[]\n] {\n    const [first, ...rest] = values;\n    if (first === undefined)\n        throw new Error(\"expected a non-empty string tuple\");\n    return Object.freeze([first, ...rest]);\n}\n/** Canonicalize only after structural decoding; nested containers are immutable to callers. */\nfunction freezeProfile(profile: DockerExecutionProfileV1): DockerExecutionProfileV1 {\n    return Object.freeze({\n        ...profile,\n        transport: Object.freeze({\n            ...profile.transport,\n            dockerSocket: Object.freeze({ ...profile.transport.dockerSocket }),\n            controlSocket: Object.freeze({ ...profile.transport.controlSocket }),\n        }),\n        backend: Object.freeze({\n            ...profile.backend,\n            owner: Object.freeze({ ...profile.backend.owner }),\n            filesystem: Object.freeze({\n                ...profile.backend.filesystem,\n                dockerDataPool: Object.freeze({ ...profile.backend.filesystem.dockerDataPool }),\n                ...(profile.backend.filesystem.setupPrefix === undefined\n                    ? {}\n                    : {\n                        setupPrefix: Object.freeze({\n                            ...profile.backend.filesystem.setupPrefix,\n                            filesystemFeatures: SETUP_PREFIX_FILESYSTEM_FEATURES,\n                        }),\n                    }),\n            }),\n            cgroup: Object.freeze({ ...profile.backend.cgroup, controllers: PROFILE_CONTROLLERS }),\n        }),\n        capacity: Object.freeze({\n            ...profile.capacity,\n            memorySwapBytes: 0,\n            aggregate: Object.freeze({ ...profile.capacity.aggregate, memorySwapBytes: 0 }),\n        }),\n        policy: profile.policy.level === \"raw-dind-storage/v1\"\n            ? Object.freeze({ ...profile.policy })\n            : Object.freeze({\n                ...profile.policy,\n                network: Object.freeze({\n                    ...profile.policy.network,\n                    dns: Object.freeze({\n                        ...profile.policy.network.dns,\n                        servers: frozenNonEmptyStrings(profile.policy.network.dns.servers),\n                    }),\n                    egress: Object.freeze({\n                        ...profile.policy.network.egress,\n                        allowedProtocols: NETWORK_ALLOWED_PROTOCOLS,\n                        denyCidrs: DOCKER_PROFILE_NETWORK_DENY_CIDRS,\n                    }),\n                }),\n            }),\n    });\n}\nfunction semanticPolicyJson(input: DockerExecutionProfileSemanticInput): JsonValue {\n    return {\n        schemaVersion: DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION,\n        securityLevel: input.securityLevel,\n        backend: {\n            kind: input.backend.kind,\n            cgroup: {\n                policyRevision: input.backend.cgroup.policyRevision,\n                controllers: [...input.backend.cgroup.controllers],\n            },\n        },\n        policy: input.policy.level === \"raw-dind-storage/v1\" ? {\n            level: input.policy.level,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            dockerData: input.policy.dockerData,\n        } : {\n            level: input.policy.level,\n            hostLoopback: input.policy.hostLoopback,\n            tcpDockerEndpoint: input.policy.tcpDockerEndpoint,\n            outerSocketInjection: input.policy.outerSocketInjection,\n            privilegedTranslation: input.policy.privilegedTranslation,\n            writableRoot: input.policy.writableRoot,\n            dockerData: input.policy.dockerData,\n            network: {\n                version: input.policy.network.version,\n                dns: { mode: input.policy.network.dns.mode, servers: [...input.policy.network.dns.servers] },\n                egress: {\n                    mode: input.policy.network.egress.mode,\n                    allowedProtocols: [...input.policy.network.egress.allowedProtocols],\n                    denyPrivateNetworks: input.policy.network.egress.denyPrivateNetworks,\n                    denySiblingSyntheticEndpoints: input.policy.network.egress.denySiblingSyntheticEndpoints,\n                    denyCidrs: [...input.policy.network.egress.denyCidrs],\n                    ipv6: input.policy.network.egress.ipv6,\n                    disableHostLoopback: input.policy.network.egress.disableHostLoopback,\n                    portDriver: input.policy.network.egress.portDriver,\n                    daemonBridge: input.policy.network.egress.daemonBridge,\n                    exclusiveNetwork: input.policy.network.egress.exclusiveNetwork,\n                    icc: input.policy.network.egress.icc,\n                },\n            },\n        },\n    };\n}\nexport function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string {\n    return digestOf(semanticPolicyJson(input)).slice(0, 8);\n}\nexport const dockerProfileSemanticPolicyRevisionOf = dockerExecutionProfileSemanticPolicyRevisionOf;\nfunction formatSchemaPath(path: readonly (PropertyKey | StandardSchema.StandardSchemaV1.PathSegment)[]): string {\n    return path.reduce<string>((result, rawSegment) => {\n        const segment = typeof rawSegment === \"object\" ? rawSegment.key : rawSegment;\n        return typeof segment === \"number\" ||\n            (typeof segment === \"string\" && /^\\\\d+$/.test(segment))\n            ? `${result}[${String(segment)}]`\n            : `${result}.${String(segment)}`;\n    }, \"profile\");\n}\nfunction schemaError(value: unknown, error: SchemaIssue.Issue): DockerProfileError {\n    const issue = SchemaIssue.makeFormatterStandardSchemaV1()(error).issues[0];\n    const path = issue === undefined ? \"profile\" : formatSchemaPath(issue.path ?? []);\n    const root = typeof value === \"object\" && value !== null && !Array.isArray(value)\n        ? value as Record<string, unknown>\n        : undefined;\n    if (path === \"profile.schemaVersion\") {\n        if (root?.schemaVersion === undefined) {\n            return dockerProfileError({\n                code: \"sandbox.docker-profile-schema-invalid\",\n                path,\n                message: \"profile.schemaVersion is required\",\n            });\n        }\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-unknown-version\",\n            path,\n            message: `Unsupported Docker execution profile schema version ${JSON.stringify(root.schemaVersion)}; expected 1`,\n        });\n    }\n    if (path === \"profile.securityLevel\") {\n        return dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path,\n            message: `Unsupported Docker execution profile security level ${JSON.stringify(root?.securityLevel)}`,\n        });\n    }\n    return dockerProfileError({\n        code: path === \"profile.capacity\"\n            ? \"sandbox.docker-profile-capacity-invalid\"\n            : \"sandbox.docker-profile-schema-invalid\",\n        path,\n        message: issue === undefined\n            ? \"profile is not a valid Docker execution profile v1\"\n            : `${path} ${issue.message}`,\n    });\n}\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function decodeDockerExecutionProfile(value: unknown): DockerExecutionProfileV1 {\n    const decoded = Schema.decodeUnknownResult(DockerExecutionProfileV1Schema, ParseOptions)(value);\n    if (Result.isFailure(decoded))\n        throw schemaError(value, decoded.failure.issue);\n    const profile = freezeProfile(decoded.success);\n    if (profile.backend.filesystem.dockerDataPool.count < profile.capacity.maxContainers ||\n        profile.backend.filesystem.dockerDataPool.count *\n            profile.backend.filesystem.dockerDataPool.bytesPerAllocation < profile.capacity.ephemeralDiskBytes) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-capacity-invalid\",\n            path: \"profile.backend.filesystem.dockerDataPool\",\n            message: \"Docker data allocations must cover maxContainers and allocatable ephemeralDiskBytes\",\n        });\n    }\n    const setupPrefix = profile.backend.filesystem.setupPrefix;\n    if (setupPrefix !== undefined &&\n        (setupPrefix.filesystemSizeBytes !==\n            profile.backend.filesystem.dockerDataPool.bytesPerAllocation ||\n            setupPrefix.seedLimitBytes < setupPrefix.filesystemSizeBytes ||\n            setupPrefix.seedLimitBytes % setupPrefix.filesystemSizeBytes !== 0 ||\n            setupPrefix.slotAttestation !==\n                profile.backend.filesystem.dockerDataPool.attestation)) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-schema-invalid\",\n            path: \"profile.backend.filesystem.setupPrefix\",\n            message: \"Docker profile setup-prefix capability must fit one independently attested fixed Docker data allocation\",\n        });\n    }\n    const rawStorage = profile.securityLevel === \"raw-dind-storage/v1\";\n    if (profile.policy.level !== profile.securityLevel ||\n        (rawStorage\n            ? profile.policy.privilegedTranslation !== \"host-daemon\"\n            : profile.policy.privilegedTranslation !== \"rootless-userns\")) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-security-level-unsupported\",\n            path: \"profile.policy\",\n            message: \"Docker profile policy level and privileged translation must match its security level\",\n        });\n    }\n    const expected = dockerExecutionProfileSemanticPolicyRevisionOf(profile);\n    if (profile.semanticPolicyRevision !== expected) {\n        throw dockerProfileError({\n            code: \"sandbox.docker-profile-semantic-policy-mismatch\",\n            path: \"profile.semanticPolicyRevision\",\n            message: `profile.semanticPolicyRevision does not match the canonical semantic policy revision ${expected}`,\n            details: { expected, actual: profile.semanticPolicyRevision },\n        });\n    }\n    return profile;\n}\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/library.md\nexport function defineDockerExecutionProfile(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1 {\n    return decodeDockerExecutionProfile({\n        ...input,\n        semanticPolicyRevision: dockerExecutionProfileSemanticPolicyRevisionOf(input),\n    });\n}\nexport function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1 {\n    try {\n        decodeDockerExecutionProfile(value);\n        return true;\n    }\n    catch {\n        return false;\n    }\n}\n/** Digest the fixed v1 wire shape, not incidental object insertion order. */\nfunction canonicalJson(profile: DockerExecutionProfileV1): JsonValue {\n    return {\n        schemaVersion: profile.schemaVersion,\n        profileId: profile.profileId,\n        securityLevel: profile.securityLevel,\n        semanticPolicyRevision: profile.semanticPolicyRevision,\n        transport: {\n            kind: profile.transport.kind,\n            hostMachineIdentity: profile.transport.hostMachineIdentity,\n            dockerSocket: { ...profile.transport.dockerSocket },\n            controlSocket: { ...profile.transport.controlSocket },\n        },\n        backend: {\n            kind: profile.backend.kind,\n            machineIdentity: profile.backend.machineIdentity,\n            owner: { ...profile.backend.owner },\n            filesystem: {\n                identity: profile.backend.filesystem.identity,\n                mountPath: profile.backend.filesystem.mountPath,\n                dockerRootDir: profile.backend.filesystem.dockerRootDir,\n                limitBytes: profile.backend.filesystem.limitBytes,\n                dockerDataPool: { ...profile.backend.filesystem.dockerDataPool },\n                ...(profile.backend.filesystem.setupPrefix === undefined\n                    ? {}\n                    : {\n                        setupPrefix: {\n                            protocol: profile.backend.filesystem.setupPrefix.protocol,\n                            coverage: profile.backend.filesystem.setupPrefix.coverage,\n                            requiredState: profile.backend.filesystem.setupPrefix.requiredState,\n                            helperRevision: profile.backend.filesystem.setupPrefix.helperRevision,\n                            copyProtocol: profile.backend.filesystem.setupPrefix.copyProtocol,\n                            copyRevision: profile.backend.filesystem.setupPrefix.copyRevision,\n                            quiesceRevision: profile.backend.filesystem.setupPrefix.quiesceRevision,\n                            slotAttestation: profile.backend.filesystem.setupPrefix.slotAttestation,\n                            seedPolicy: profile.backend.filesystem.setupPrefix.seedPolicy,\n                            publicationRevision: profile.backend.filesystem.setupPrefix.publicationRevision,\n                            recoveryRevision: profile.backend.filesystem.setupPrefix.recoveryRevision,\n                            manifestSchema: profile.backend.filesystem.setupPrefix.manifestSchema,\n                            providerIdentity: profile.backend.filesystem.setupPrefix.providerIdentity,\n                            executionDomain: profile.backend.filesystem.setupPrefix.executionDomain,\n                            filesystemSizeBytes: profile.backend.filesystem.setupPrefix.filesystemSizeBytes,\n                            filesystemFeatures: [...profile.backend.filesystem.setupPrefix.filesystemFeatures],\n                            seedLimitBytes: profile.backend.filesystem.setupPrefix.seedLimitBytes,\n                            filesystemIdentity: profile.backend.filesystem.setupPrefix.filesystemIdentity,\n                        },\n                    }),\n            },\n            cgroup: { ...profile.backend.cgroup, controllers: [...profile.backend.cgroup.controllers] },\n        },\n        capacity: {\n            ...profile.capacity,\n            aggregate: { ...profile.capacity.aggregate },\n        },\n        policy: profile.policy.level === \"raw-dind-storage/v1\" ? {\n            level: profile.policy.level,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            dockerData: profile.policy.dockerData,\n        } : {\n            level: profile.policy.level,\n            hostLoopback: profile.policy.hostLoopback,\n            tcpDockerEndpoint: profile.policy.tcpDockerEndpoint,\n            outerSocketInjection: profile.policy.outerSocketInjection,\n            privilegedTranslation: profile.policy.privilegedTranslation,\n            writableRoot: profile.policy.writableRoot,\n            dockerData: profile.policy.dockerData,\n            network: {\n                version: profile.policy.network.version,\n                dns: { mode: profile.policy.network.dns.mode, servers: [...profile.policy.network.dns.servers] },\n                egress: {\n                    ...profile.policy.network.egress,\n                    allowedProtocols: [...profile.policy.network.egress.allowedProtocols],\n                    denyCidrs: [...profile.policy.network.egress.denyCidrs],\n                },\n            },\n        },\n    };\n}\n// @concord-code\n// @concord-implements docs/feature/sandbox-docker-profiles/architecture.md\nexport function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string {\n    return `sha256:${digestOf(canonicalJson(decodeDockerExecutionProfile(profile)))}`;\n}\nexport const dockerProfileDigestOf = dockerExecutionProfileV1Digest;\nexport function dockerProfilePublicSummaryOf(profile: DockerExecutionProfileV1): DockerProfilePublicSummary {\n    const normalized = decodeDockerExecutionProfile(profile);\n    return Object.freeze({\n        schemaVersion: 1,\n        profileId: normalized.profileId,\n        securityLevel: normalized.securityLevel,\n        semanticPolicyRevision: normalized.semanticPolicyRevision,\n        capacity: Object.freeze({\n            ...normalized.capacity,\n            aggregate: Object.freeze({ ...normalized.capacity.aggregate }),\n        }),\n    });\n}\n"]}

package/dist/sandbox/docker-profile/schema.d.cts

@@ -1,6 +1,5 @@
 import { Schema } from "effect";
 export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
-export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY: "niceeval-docker-profile-state/docker-data-snapshot/v1";
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL: "niceeval-docker-profile-state/docker-data-snapshot/v1";
@@ -148,11 +147,8 @@ export declare const DockerExecutionProfileV1Schema: Schema.Codec<DockerExecutio
 export declare const DockerExecutionProfileSchema: Schema.Codec<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never, never>;
 export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
 export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
-export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
-export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
-export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
-export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
-export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
+export declare function decodeDockerExecutionProfile(value: unknown): DockerExecutionProfileV1;
+export declare function defineDockerExecutionProfile(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
 export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
 export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
 export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;

package/dist/sandbox/docker-profile/schema.d.mts

@@ -1,6 +1,5 @@
 import { Schema } from "effect";
 export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
-export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY: "niceeval-docker-profile-state/docker-data-snapshot/v1";
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL: "niceeval-docker-profile-state/docker-data-snapshot/v1";
@@ -148,11 +147,8 @@ export declare const DockerExecutionProfileV1Schema: Schema.Codec<DockerExecutio
 export declare const DockerExecutionProfileSchema: Schema.Codec<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never, never>;
 export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
 export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
-export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
-export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
-export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
-export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
-export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
+export declare function decodeDockerExecutionProfile(value: unknown): DockerExecutionProfileV1;
+export declare function defineDockerExecutionProfile(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
 export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
 export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
 export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;

package/dist/sandbox/docker-profile/schema.d.ts

@@ -1,6 +1,5 @@
 import { Schema } from "effect";
 export declare const DOCKER_EXECUTION_PROFILE_SCHEMA_VERSION: 1;
-export declare const DOCKER_PROFILE_SCHEMA_VERSION: 1;
 export declare const DOCKER_PROFILE_NETWORK_POLICY_VERSION: 1;
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY: "niceeval-docker-profile-state/docker-data-snapshot/v1";
 export declare const DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL: "niceeval-docker-profile-state/docker-data-snapshot/v1";
@@ -148,11 +147,8 @@ export declare const DockerExecutionProfileV1Schema: Schema.Codec<DockerExecutio
 export declare const DockerExecutionProfileSchema: Schema.Codec<DockerExecutionProfileV1, Readonly<Record<PropertyKey, unknown>>, never, never>;
 export declare function dockerExecutionProfileSemanticPolicyRevisionOf(input: DockerExecutionProfileSemanticInput): string;
 export declare const dockerProfileSemanticPolicyRevisionOf: typeof dockerExecutionProfileSemanticPolicyRevisionOf;
-export declare function parseDockerExecutionProfileV1(value: unknown): DockerExecutionProfileV1;
-export declare const parseDockerExecutionProfile: typeof parseDockerExecutionProfileV1;
-export declare const decodeDockerExecutionProfileV1: typeof parseDockerExecutionProfileV1;
-export declare function makeDockerExecutionProfileV1(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
-export declare const createDockerExecutionProfileV1: typeof makeDockerExecutionProfileV1;
+export declare function decodeDockerExecutionProfile(value: unknown): DockerExecutionProfileV1;
+export declare function defineDockerExecutionProfile(input: DockerExecutionProfileV1Draft): DockerExecutionProfileV1;
 export declare function isDockerExecutionProfileV1(value: unknown): value is DockerExecutionProfileV1;
 export declare function dockerExecutionProfileV1Digest(profile: DockerExecutionProfileV1): string;
 export declare const dockerProfileDigestOf: typeof dockerExecutionProfileV1Digest;

package/dist/sandbox/docker-profile/schema.js

@@ -7,36 +7,28 @@ const __niceevalExport1 = __niceevalCanonical["DOCKER_PROFILE_NETWORK_DENY_CIDRS
 export { __niceevalExport1 as DOCKER_PROFILE_NETWORK_DENY_CIDRS };
 const __niceevalExport2 = __niceevalCanonical["DOCKER_PROFILE_NETWORK_POLICY_VERSION"];
 export { __niceevalExport2 as DOCKER_PROFILE_NETWORK_POLICY_VERSION };
-const __niceevalExport3 = __niceevalCanonical["DOCKER_PROFILE_SCHEMA_VERSION"];
-export { __niceevalExport3 as DOCKER_PROFILE_SCHEMA_VERSION };
-const __niceevalExport4 = __niceevalCanonical["DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY"];
-export { __niceevalExport4 as DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY };
-const __niceevalExport5 = __niceevalCanonical["DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL"];
-export { __niceevalExport5 as DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL };
-const __niceevalExport6 = __niceevalCanonical["DockerExecutionProfileSchema"];
-export { __niceevalExport6 as DockerExecutionProfileSchema };
-const __niceevalExport7 = __niceevalCanonical["DockerExecutionProfileV1Schema"];
-export { __niceevalExport7 as DockerExecutionProfileV1Schema };
-const __niceevalExport8 = __niceevalCanonical["createDockerExecutionProfileV1"];
-export { __niceevalExport8 as createDockerExecutionProfileV1 };
-const __niceevalExport9 = __niceevalCanonical["decodeDockerExecutionProfileV1"];
-export { __niceevalExport9 as decodeDockerExecutionProfileV1 };
-const __niceevalExport10 = __niceevalCanonical["dockerExecutionProfileSemanticPolicyRevisionOf"];
-export { __niceevalExport10 as dockerExecutionProfileSemanticPolicyRevisionOf };
-const __niceevalExport11 = __niceevalCanonical["dockerExecutionProfileV1Digest"];
-export { __niceevalExport11 as dockerExecutionProfileV1Digest };
-const __niceevalExport12 = __niceevalCanonical["dockerProfileDigestOf"];
-export { __niceevalExport12 as dockerProfileDigestOf };
-const __niceevalExport13 = __niceevalCanonical["dockerProfilePublicSummaryOf"];
-export { __niceevalExport13 as dockerProfilePublicSummaryOf };
-const __niceevalExport14 = __niceevalCanonical["dockerProfileSemanticPolicyRevisionOf"];
-export { __niceevalExport14 as dockerProfileSemanticPolicyRevisionOf };
-const __niceevalExport15 = __niceevalCanonical["isDockerExecutionProfileV1"];
-export { __niceevalExport15 as isDockerExecutionProfileV1 };
-const __niceevalExport16 = __niceevalCanonical["makeDockerExecutionProfileV1"];
-export { __niceevalExport16 as makeDockerExecutionProfileV1 };
-const __niceevalExport17 = __niceevalCanonical["parseDockerExecutionProfile"];
-export { __niceevalExport17 as parseDockerExecutionProfile };
-const __niceevalExport18 = __niceevalCanonical["parseDockerExecutionProfileV1"];
-export { __niceevalExport18 as parseDockerExecutionProfileV1 };
+const __niceevalExport3 = __niceevalCanonical["DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY"];
+export { __niceevalExport3 as DOCKER_PROFILE_SETUP_PREFIX_CAPABILITY };
+const __niceevalExport4 = __niceevalCanonical["DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL"];
+export { __niceevalExport4 as DOCKER_PROFILE_SETUP_PREFIX_CONTROL_PROTOCOL };
+const __niceevalExport5 = __niceevalCanonical["DockerExecutionProfileSchema"];
+export { __niceevalExport5 as DockerExecutionProfileSchema };
+const __niceevalExport6 = __niceevalCanonical["DockerExecutionProfileV1Schema"];
+export { __niceevalExport6 as DockerExecutionProfileV1Schema };
+const __niceevalExport7 = __niceevalCanonical["decodeDockerExecutionProfile"];
+export { __niceevalExport7 as decodeDockerExecutionProfile };
+const __niceevalExport8 = __niceevalCanonical["defineDockerExecutionProfile"];
+export { __niceevalExport8 as defineDockerExecutionProfile };
+const __niceevalExport9 = __niceevalCanonical["dockerExecutionProfileSemanticPolicyRevisionOf"];
+export { __niceevalExport9 as dockerExecutionProfileSemanticPolicyRevisionOf };
+const __niceevalExport10 = __niceevalCanonical["dockerExecutionProfileV1Digest"];
+export { __niceevalExport10 as dockerExecutionProfileV1Digest };
+const __niceevalExport11 = __niceevalCanonical["dockerProfileDigestOf"];
+export { __niceevalExport11 as dockerProfileDigestOf };
+const __niceevalExport12 = __niceevalCanonical["dockerProfilePublicSummaryOf"];
+export { __niceevalExport12 as dockerProfilePublicSummaryOf };
+const __niceevalExport13 = __niceevalCanonical["dockerProfileSemanticPolicyRevisionOf"];
+export { __niceevalExport13 as dockerProfileSemanticPolicyRevisionOf };
+const __niceevalExport14 = __niceevalCanonical["isDockerExecutionProfileV1"];
+export { __niceevalExport14 as isDockerExecutionProfileV1 };
 //# sourceMappingURL=schema.js.map

package/dist/sandbox/incus.cjs

@@ -65,7 +65,7 @@ function imageOf(value) {
         throw new TypeError(cause instanceof Error ? cause.message : String(cause));
     }
 }
-// @concord-code ne-sandbox-incus-options
+// @concord-code
 // @concord-implements docs/feature/sandbox-nested-docker/library.md
 // @concord-implements docs/feature/sandbox-nested-docker/architecture.md
 function normalizeIncusSandboxOptions(options) {
@@ -100,7 +100,7 @@ function resourcesJson(resources) {
         ...(resources.dockerDataBytes === undefined ? {} : { dockerDataBytes: resources.dockerDataBytes }),
     };
 }
-// @concord-code ne-sandbox-incus-factory
+// @concord-code
 // @concord-implements docs/feature/sandbox-nested-docker/README.md
 // @concord-implements docs/feature/sandbox-nested-docker/library.md
 // @concord-implements docs/feature/sandbox-nested-docker/use-case/nested-docker-capability.md

package/dist/sandbox/incus.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"incus.js","sourceRoot":"","sources":["incus.ts"],"names":[],"mappings":";;;AA+DA,oEAgBC;AAoBD,oCAwFC;AA3LD,mCAAgC;AAEhC,+CAA+C;AAC/C,yCAA0H;AAC1H,2DAAsG;AACtG,+CAAsG;AACtG,6CAAoJ;AAEpJ,+CAA8K;AAArK,gHAAA,mBAAmB,OAAA;AAAE,sHAAA,yBAAyB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,oHAAA,uBAAuB,OAAA;AAChG,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACrD,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAA8B,EAAE,OAA0B,EAAE,IAAY;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,mBAAmB,CAAC,CAAC;IAC/D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,uBAAuB,CAAC,KAAc,EAAE,IAAY;IACzD,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,SAAS,CAAC;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,qCAAqC,CAAC,KAAK,SAAS;YACxF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAc,EAAE,CAAC;QACrC,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,4CAA4C,CAAC,KAAK,SAAS;YACtG,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAqB,EAAE,CAAC;QACnD,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,eAAe,EAAE,gDAAgD,CAAC,KAAK,SAAS;YAC9G,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAyB,EAAE,CAAC;KAC9D,CAAC,CAAC;AACP,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC3B,IAAI,CAAC;QACD,OAAO,IAAA,iCAAsB,EAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;AACL,CAAC;AACD,yCAAyC;AACzC,oEAAoE;AACpE,yEAAyE;AACzE,SAAgB,4BAA4B,CAAC,OAA4B;IACrE,YAAY,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC9C,cAAc,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7H,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,KAAK,SAAS;QACzE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC;IAC/C,IAAI,OAAO,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACxE,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,kCAAkC,CAAC;QACpF,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,uBAAuB;KAC1B,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,OAA2C;IAC9D,OAAO,IAAI,uCAA4B,CAAC;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC/C,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,SAAgC;IACnD,OAAO;QACH,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACtF,GAAG,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC;KACrG,CAAC;AACN,CAAC;AACD,yCAAyC;AACzC,mEAAmE;AACnE,oEAAoE;AACpE,8FAA8F;AAC9F,SAAgB,YAAY,CAAC,OAA4B;IACrD,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAA,6BAAkB,EAAC;QAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;KACtC,CAAC,CAAC;IACH,MAAM,eAAe,GAAc;QAC/B,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,MAAM;KACT,CAAC;IACF,MAAM,mBAAmB,GAAc;QACnC,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;KACjD,CAAC;IACF,OAAO,IAAA,gCAAqB,EAAC;QACzB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI;QACV,mBAAmB;QACnB,0BAA0B,EAAE,eAAe;QAC3C,kBAAkB,EAAE;YAChB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;SAC/D;QACD,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAsB,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,8BAAmB,EAAC;YAC5F,QAAQ,EAAE,OAAO;YACjB,eAAe,EAAE,uCAAsB;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,EAAE,OAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC;gBAC5G,MAAM,EAAE,mBAA4B;aACvC,CAAC;YACF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;gBACnD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;oBAChB,GAAG,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACpE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;iBACrC,CAAC;gBACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;aACxD,CAAC;YACF,MAAM,EAAE,IAAA,oCAAmB,EAAC,OAAO,CAAC,eAAe,CAAC;YACpD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAe;gBACrB,OAAO,EAAE,IAAA,4BAAc,EAAC;oBACpB,QAAQ,EAAE,UAAU;oBACpB,oBAAoB,EAAE,uCAAsB;oBAC5C,SAAS,EAAE,EAAE;oBACb,UAAU,EAAE,eAAe;iBAC9B,CAAC;gBACF,SAAS,EAAE,EAAW;aACzB,CAAC;YACF,mBAAmB,EAAE;gBACjB,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;gBAC3D,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAAe;gBACxD,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,iBAAiB;gBAC5D,MAAM;aACT;YACD,0BAA0B,EAAE;gBACxB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC9C,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;gBAC3D,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,iBAAiB;gBAC5D,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBAC3C,MAAM;aACT;SACJ,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAA,gCAAe,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC1E,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Effect } from \"effect\";\nimport type { JsonValue } from \"../shared/types.ts\";\nimport { computeCaseKey } from \"./identity.ts\";\nimport { defineSandboxTemplate, sandboxProviderPlan, SandboxProviderPlanningError, type SandboxLayer, } from \"./layer.ts\";\nimport { INCUS_PLANNER_REVISION, incusProviderModule, toPlanningError } from \"./incus/materialize.ts\";\nimport { displayIncusOrigin, parseIncusImageLocator, type IncusImageLocator } from \"./incus/image.ts\";\nimport { planIncusSandboxEffect, type IncusSandboxOptions, type IncusSandboxResources, type NormalizedIncusSandboxOptions, } from \"./incus/plan.ts\";\nexport type { IncusSandboxOptions, IncusSandboxResources } from \"./incus/plan.ts\";\nexport { doctorIncusProvider, doctorIncusProviderEffect, doctorExitCode, renderIncusDoctorReport, type IncusDoctorOptions, type IncusDoctorReport, } from \"./incus/doctor.ts\";\nfunction assertRecord(value: unknown, path: string): asserts value is Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n        throw new TypeError(`${path} must be an object`);\n    }\n}\nfunction assertOnlyKeys(value: Record<string, unknown>, allowed: readonly string[], path: string): void {\n    const known = new Set(allowed);\n    for (const key of Object.keys(value)) {\n        if (!known.has(key))\n            throw new TypeError(`${path}.${key} is not supported`);\n    }\n}\nfunction nonEmptyString(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw new TypeError(`${path} must be a non-empty string`);\n    }\n    return value;\n}\nfunction optionalPositiveInteger(value: unknown, path: string): number | undefined {\n    if (value === undefined)\n        return undefined;\n    if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n        throw new TypeError(`${path} must be a positive safe integer`);\n    }\n    return value;\n}\nfunction resourcesOf(value: unknown): IncusSandboxResources {\n    if (value === undefined)\n        return Object.freeze({});\n    assertRecord(value, \"incusSandbox options.resources\");\n    assertOnlyKeys(value, [\"cpus\", \"memoryBytes\", \"dockerDataBytes\"], \"incusSandbox options.resources\");\n    return Object.freeze({\n        ...(optionalPositiveInteger(value.cpus, \"incusSandbox options.resources.cpus\") === undefined\n            ? {}\n            : { cpus: value.cpus as number }),\n        ...(optionalPositiveInteger(value.memoryBytes, \"incusSandbox options.resources.memoryBytes\") === undefined\n            ? {}\n            : { memoryBytes: value.memoryBytes as number }),\n        ...(optionalPositiveInteger(value.dockerDataBytes, \"incusSandbox options.resources.dockerDataBytes\") === undefined\n            ? {}\n            : { dockerDataBytes: value.dockerDataBytes as number }),\n    });\n}\nfunction imageOf(value: unknown): IncusImageLocator {\n    try {\n        return parseIncusImageLocator(value, \"incusSandbox options.image\");\n    }\n    catch (cause) {\n        throw new TypeError(cause instanceof Error ? cause.message : String(cause));\n    }\n}\n// @concord-code ne-sandbox-incus-options\n// @concord-implements docs/feature/sandbox-nested-docker/library.md\n// @concord-implements docs/feature/sandbox-nested-docker/architecture.md\nexport function normalizeIncusSandboxOptions(options: IncusSandboxOptions): NormalizedIncusSandboxOptions {\n    assertRecord(options, \"incusSandbox options\");\n    assertOnlyKeys(options, [\"image\", \"project\", \"storagePool\", \"resources\", \"acceptDevelopmentDomain\"], \"incusSandbox options\");\n    const acceptDevelopmentDomain = options.acceptDevelopmentDomain === undefined\n        ? false\n        : options.acceptDevelopmentDomain === true;\n    if (options.acceptDevelopmentDomain !== undefined && typeof options.acceptDevelopmentDomain !== \"boolean\") {\n        throw new TypeError(\"incusSandbox options.acceptDevelopmentDomain must be a boolean\");\n    }\n    return Object.freeze({\n        image: imageOf(options.image),\n        project: nonEmptyString(options.project, \"incusSandbox options.project\"),\n        storagePool: nonEmptyString(options.storagePool, \"incusSandbox options.storagePool\"),\n        resources: resourcesOf(options.resources),\n        acceptDevelopmentDomain,\n    });\n}\nfunction planningError(failure: ReturnType<typeof toPlanningError>): SandboxProviderPlanningError {\n    return new SandboxProviderPlanningError({\n        code: failure.code,\n        provider: \"incus\",\n        summary: failure.summary,\n        actions: Object.freeze([...failure.actions]),\n    });\n}\nfunction resourcesJson(resources: IncusSandboxResources): JsonValue {\n    return {\n        ...(resources.cpus === undefined ? {} : { cpus: resources.cpus }),\n        ...(resources.memoryBytes === undefined ? {} : { memoryBytes: resources.memoryBytes }),\n        ...(resources.dockerDataBytes === undefined ? {} : { dockerDataBytes: resources.dockerDataBytes }),\n    };\n}\n// @concord-code ne-sandbox-incus-factory\n// @concord-implements docs/feature/sandbox-nested-docker/README.md\n// @concord-implements docs/feature/sandbox-nested-docker/library.md\n// @concord-implements docs/feature/sandbox-nested-docker/use-case/nested-docker-capability.md\nexport function incusSandbox(options: IncusSandboxOptions): SandboxLayer<\"template-bearing\"> {\n    const normalized = normalizeIncusSandboxOptions(options);\n    const origin = displayIncusOrigin({\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n    });\n    const privateIdentity: JsonValue = {\n        provider: \"incus\",\n        kind: \"vm\",\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n        resources: resourcesJson(normalized.resources),\n        acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n        origin,\n    };\n    const publishableIdentity: JsonValue = {\n        kind: \"vm\",\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n        acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n        resources: resourcesJson(normalized.resources),\n    };\n    return defineSandboxTemplate({\n        provider: \"incus\",\n        kind: \"vm\",\n        publishableIdentity,\n        privateFingerprintIdentity: privateIdentity,\n        commandPlanLocator: {\n            _tag: \"Exact\",\n            fields: [{ name: \"image\", value: normalized.image.locator }],\n        },\n        leakGate: { _tag: \"None\" },\n        plan: () => planIncusSandboxEffect(normalized).pipe(Effect.map((planned) => sandboxProviderPlan({\n            provider: \"incus\",\n            plannerRevision: INCUS_PLANNER_REVISION,\n            caseKind: \"prebuilt\",\n            target: Object.freeze({\n                platform: Object.freeze({ _tag: \"Linux\" as const, os: \"linux\" as const, arch: \"x64\", libc: \"gnu\" as const }),\n                source: \"provider-standard\" as const,\n            }),\n            scheduling: Object.freeze({\n                recommendedConcurrency: planned.domain.maxInstances,\n                lane: Object.freeze({\n                    key: `incus:${planned.domain.project}:${planned.domain.storagePool}`,\n                    limit: planned.domain.maxInstances,\n                }),\n                admission: Object.freeze({ _tag: \"Shared\" as const }),\n            }),\n            module: incusProviderModule(planned.dockerExecution),\n            runtimePlan: planned.runtime,\n            build: Object.freeze({\n                _tag: \"None\" as const,\n                caseKey: computeCaseKey({\n                    caseKind: \"prebuilt\",\n                    materializerRevision: INCUS_PLANNER_REVISION,\n                    buildKeys: [],\n                    caseParams: privateIdentity,\n                }),\n                buildKeys: [] as const,\n            }),\n            publishableIdentity: {\n                kind: \"vm\",\n                image: normalized.image.locator,\n                project: normalized.project,\n                storagePool: normalized.storagePool,\n                acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n                resources: resourcesJson(normalized.resources),\n                executionDomain: planned.dockerExecution.executionDomain,\n                executionDomainId: planned.dockerExecution.executionDomainId,\n                origin,\n            },\n            privateFingerprintIdentity: {\n                provider: \"incus\",\n                kind: \"vm\",\n                image: normalized.image.locator,\n                project: normalized.project,\n                storagePool: normalized.storagePool,\n                resources: resourcesJson(normalized.resources),\n                acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n                executionDomainId: planned.dockerExecution.executionDomainId,\n                imageFingerprint: planned.image.fingerprint,\n                origin,\n            },\n        })), Effect.mapError((cause) => planningError(toPlanningError(cause)))),\n    });\n}\n"]}
+{"version":3,"file":"incus.js","sourceRoot":"","sources":["incus.ts"],"names":[],"mappings":";;;AA+DA,oEAgBC;AAoBD,oCAwFC;AA3LD,mCAAgC;AAEhC,+CAA+C;AAC/C,yCAA0H;AAC1H,2DAAsG;AACtG,+CAAsG;AACtG,6CAAoJ;AAEpJ,+CAA8K;AAArK,gHAAA,mBAAmB,OAAA;AAAE,sHAAA,yBAAyB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,oHAAA,uBAAuB,OAAA;AAChG,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,oBAAoB,CAAC,CAAC;IACrD,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAA8B,EAAE,OAA0B,EAAE,IAAY;IAC5F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;YACf,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,IAAI,GAAG,mBAAmB,CAAC,CAAC;IAC/D,CAAC;AACL,CAAC;AACD,SAAS,cAAc,CAAC,KAAc,EAAE,IAAY;IAChD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,uBAAuB,CAAC,KAAc,EAAE,IAAY;IACzD,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,SAAS,CAAC;IACrB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1E,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,kCAAkC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AACD,SAAS,WAAW,CAAC,KAAc;IAC/B,IAAI,KAAK,KAAK,SAAS;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7B,YAAY,CAAC,KAAK,EAAE,gCAAgC,CAAC,CAAC;IACtD,cAAc,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB,CAAC,EAAE,gCAAgC,CAAC,CAAC;IACpG,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,qCAAqC,CAAC,KAAK,SAAS;YACxF,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAc,EAAE,CAAC;QACrC,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,WAAW,EAAE,4CAA4C,CAAC,KAAK,SAAS;YACtG,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAqB,EAAE,CAAC;QACnD,GAAG,CAAC,uBAAuB,CAAC,KAAK,CAAC,eAAe,EAAE,gDAAgD,CAAC,KAAK,SAAS;YAC9G,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAyB,EAAE,CAAC;KAC9D,CAAC,CAAC;AACP,CAAC;AACD,SAAS,OAAO,CAAC,KAAc;IAC3B,IAAI,CAAC;QACD,OAAO,IAAA,iCAAsB,EAAC,KAAK,EAAE,4BAA4B,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAChF,CAAC;AACL,CAAC;AACD,gBAAgB;AAChB,oEAAoE;AACpE,yEAAyE;AACzE,SAAgB,4BAA4B,CAAC,OAA4B;IACrE,YAAY,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC9C,cAAc,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,yBAAyB,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC7H,MAAM,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,KAAK,SAAS;QACzE,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,OAAO,CAAC,uBAAuB,KAAK,IAAI,CAAC;IAC/C,IAAI,OAAO,CAAC,uBAAuB,KAAK,SAAS,IAAI,OAAO,OAAO,CAAC,uBAAuB,KAAK,SAAS,EAAE,CAAC;QACxG,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACjB,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QAC7B,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,8BAA8B,CAAC;QACxE,WAAW,EAAE,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,kCAAkC,CAAC;QACpF,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;QACzC,uBAAuB;KAC1B,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,OAA2C;IAC9D,OAAO,IAAI,uCAA4B,CAAC;QACpC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KAC/C,CAAC,CAAC;AACP,CAAC;AACD,SAAS,aAAa,CAAC,SAAgC;IACnD,OAAO;QACH,GAAG,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QACjE,GAAG,CAAC,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,WAAW,EAAE,CAAC;QACtF,GAAG,CAAC,SAAS,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,eAAe,EAAE,CAAC;KACrG,CAAC;AACN,CAAC;AACD,gBAAgB;AAChB,mEAAmE;AACnE,oEAAoE;AACpE,8FAA8F;AAC9F,SAAgB,YAAY,CAAC,OAA4B;IACrD,MAAM,UAAU,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,IAAA,6BAAkB,EAAC;QAC9B,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;KACtC,CAAC,CAAC;IACH,MAAM,eAAe,GAAc;QAC/B,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;QAC9C,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,MAAM;KACT,CAAC;IACF,MAAM,mBAAmB,GAAc;QACnC,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;QAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;QAC3D,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;KACjD,CAAC;IACF,OAAO,IAAA,gCAAqB,EAAC;QACzB,QAAQ,EAAE,OAAO;QACjB,IAAI,EAAE,IAAI;QACV,mBAAmB;QACnB,0BAA0B,EAAE,eAAe;QAC3C,kBAAkB,EAAE;YAChB,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;SAC/D;QACD,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;QAC1B,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,gCAAsB,EAAC,UAAU,CAAC,CAAC,IAAI,CAAC,eAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAA,8BAAmB,EAAC;YAC5F,QAAQ,EAAE,OAAO;YACjB,eAAe,EAAE,uCAAsB;YACvC,QAAQ,EAAE,UAAU;YACpB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAgB,EAAE,EAAE,EAAE,OAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAc,EAAE,CAAC;gBAC5G,MAAM,EAAE,mBAA4B;aACvC,CAAC;YACF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,sBAAsB,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;gBACnD,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;oBAChB,GAAG,EAAE,SAAS,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;oBACpE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,YAAY;iBACrC,CAAC;gBACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;aACxD,CAAC;YACF,MAAM,EAAE,IAAA,oCAAmB,EAAC,OAAO,CAAC,eAAe,CAAC;YACpD,WAAW,EAAE,OAAO,CAAC,OAAO;YAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;gBACjB,IAAI,EAAE,MAAe;gBACrB,OAAO,EAAE,IAAA,4BAAc,EAAC;oBACpB,QAAQ,EAAE,UAAU;oBACpB,oBAAoB,EAAE,uCAAsB;oBAC5C,SAAS,EAAE,EAAE;oBACb,UAAU,EAAE,eAAe;iBAC9B,CAAC;gBACF,SAAS,EAAE,EAAW;aACzB,CAAC;YACF,mBAAmB,EAAE;gBACjB,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;gBAC3D,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC9C,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,eAAe;gBACxD,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,iBAAiB;gBAC5D,MAAM;aACT;YACD,0BAA0B,EAAE;gBACxB,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,IAAI;gBACV,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO;gBAC/B,OAAO,EAAE,UAAU,CAAC,OAAO;gBAC3B,WAAW,EAAE,UAAU,CAAC,WAAW;gBACnC,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;gBAC9C,uBAAuB,EAAE,UAAU,CAAC,uBAAuB;gBAC3D,iBAAiB,EAAE,OAAO,CAAC,eAAe,CAAC,iBAAiB;gBAC5D,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW;gBAC3C,MAAM;aACT;SACJ,CAAC,CAAC,EAAE,eAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,IAAA,gCAAe,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC;KAC1E,CAAC,CAAC;AACP,CAAC","sourcesContent":["import { Effect } from \"effect\";\nimport type { JsonValue } from \"../shared/types.ts\";\nimport { computeCaseKey } from \"./identity.ts\";\nimport { defineSandboxTemplate, sandboxProviderPlan, SandboxProviderPlanningError, type SandboxLayer, } from \"./layer.ts\";\nimport { INCUS_PLANNER_REVISION, incusProviderModule, toPlanningError } from \"./incus/materialize.ts\";\nimport { displayIncusOrigin, parseIncusImageLocator, type IncusImageLocator } from \"./incus/image.ts\";\nimport { planIncusSandboxEffect, type IncusSandboxOptions, type IncusSandboxResources, type NormalizedIncusSandboxOptions, } from \"./incus/plan.ts\";\nexport type { IncusSandboxOptions, IncusSandboxResources } from \"./incus/plan.ts\";\nexport { doctorIncusProvider, doctorIncusProviderEffect, doctorExitCode, renderIncusDoctorReport, type IncusDoctorOptions, type IncusDoctorReport, } from \"./incus/doctor.ts\";\nfunction assertRecord(value: unknown, path: string): asserts value is Record<string, unknown> {\n    if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n        throw new TypeError(`${path} must be an object`);\n    }\n}\nfunction assertOnlyKeys(value: Record<string, unknown>, allowed: readonly string[], path: string): void {\n    const known = new Set(allowed);\n    for (const key of Object.keys(value)) {\n        if (!known.has(key))\n            throw new TypeError(`${path}.${key} is not supported`);\n    }\n}\nfunction nonEmptyString(value: unknown, path: string): string {\n    if (typeof value !== \"string\" || value.trim() === \"\") {\n        throw new TypeError(`${path} must be a non-empty string`);\n    }\n    return value;\n}\nfunction optionalPositiveInteger(value: unknown, path: string): number | undefined {\n    if (value === undefined)\n        return undefined;\n    if (typeof value !== \"number\" || !Number.isSafeInteger(value) || value <= 0) {\n        throw new TypeError(`${path} must be a positive safe integer`);\n    }\n    return value;\n}\nfunction resourcesOf(value: unknown): IncusSandboxResources {\n    if (value === undefined)\n        return Object.freeze({});\n    assertRecord(value, \"incusSandbox options.resources\");\n    assertOnlyKeys(value, [\"cpus\", \"memoryBytes\", \"dockerDataBytes\"], \"incusSandbox options.resources\");\n    return Object.freeze({\n        ...(optionalPositiveInteger(value.cpus, \"incusSandbox options.resources.cpus\") === undefined\n            ? {}\n            : { cpus: value.cpus as number }),\n        ...(optionalPositiveInteger(value.memoryBytes, \"incusSandbox options.resources.memoryBytes\") === undefined\n            ? {}\n            : { memoryBytes: value.memoryBytes as number }),\n        ...(optionalPositiveInteger(value.dockerDataBytes, \"incusSandbox options.resources.dockerDataBytes\") === undefined\n            ? {}\n            : { dockerDataBytes: value.dockerDataBytes as number }),\n    });\n}\nfunction imageOf(value: unknown): IncusImageLocator {\n    try {\n        return parseIncusImageLocator(value, \"incusSandbox options.image\");\n    }\n    catch (cause) {\n        throw new TypeError(cause instanceof Error ? cause.message : String(cause));\n    }\n}\n// @concord-code\n// @concord-implements docs/feature/sandbox-nested-docker/library.md\n// @concord-implements docs/feature/sandbox-nested-docker/architecture.md\nexport function normalizeIncusSandboxOptions(options: IncusSandboxOptions): NormalizedIncusSandboxOptions {\n    assertRecord(options, \"incusSandbox options\");\n    assertOnlyKeys(options, [\"image\", \"project\", \"storagePool\", \"resources\", \"acceptDevelopmentDomain\"], \"incusSandbox options\");\n    const acceptDevelopmentDomain = options.acceptDevelopmentDomain === undefined\n        ? false\n        : options.acceptDevelopmentDomain === true;\n    if (options.acceptDevelopmentDomain !== undefined && typeof options.acceptDevelopmentDomain !== \"boolean\") {\n        throw new TypeError(\"incusSandbox options.acceptDevelopmentDomain must be a boolean\");\n    }\n    return Object.freeze({\n        image: imageOf(options.image),\n        project: nonEmptyString(options.project, \"incusSandbox options.project\"),\n        storagePool: nonEmptyString(options.storagePool, \"incusSandbox options.storagePool\"),\n        resources: resourcesOf(options.resources),\n        acceptDevelopmentDomain,\n    });\n}\nfunction planningError(failure: ReturnType<typeof toPlanningError>): SandboxProviderPlanningError {\n    return new SandboxProviderPlanningError({\n        code: failure.code,\n        provider: \"incus\",\n        summary: failure.summary,\n        actions: Object.freeze([...failure.actions]),\n    });\n}\nfunction resourcesJson(resources: IncusSandboxResources): JsonValue {\n    return {\n        ...(resources.cpus === undefined ? {} : { cpus: resources.cpus }),\n        ...(resources.memoryBytes === undefined ? {} : { memoryBytes: resources.memoryBytes }),\n        ...(resources.dockerDataBytes === undefined ? {} : { dockerDataBytes: resources.dockerDataBytes }),\n    };\n}\n// @concord-code\n// @concord-implements docs/feature/sandbox-nested-docker/README.md\n// @concord-implements docs/feature/sandbox-nested-docker/library.md\n// @concord-implements docs/feature/sandbox-nested-docker/use-case/nested-docker-capability.md\nexport function incusSandbox(options: IncusSandboxOptions): SandboxLayer<\"template-bearing\"> {\n    const normalized = normalizeIncusSandboxOptions(options);\n    const origin = displayIncusOrigin({\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n    });\n    const privateIdentity: JsonValue = {\n        provider: \"incus\",\n        kind: \"vm\",\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n        resources: resourcesJson(normalized.resources),\n        acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n        origin,\n    };\n    const publishableIdentity: JsonValue = {\n        kind: \"vm\",\n        image: normalized.image.locator,\n        project: normalized.project,\n        storagePool: normalized.storagePool,\n        acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n        resources: resourcesJson(normalized.resources),\n    };\n    return defineSandboxTemplate({\n        provider: \"incus\",\n        kind: \"vm\",\n        publishableIdentity,\n        privateFingerprintIdentity: privateIdentity,\n        commandPlanLocator: {\n            _tag: \"Exact\",\n            fields: [{ name: \"image\", value: normalized.image.locator }],\n        },\n        leakGate: { _tag: \"None\" },\n        plan: () => planIncusSandboxEffect(normalized).pipe(Effect.map((planned) => sandboxProviderPlan({\n            provider: \"incus\",\n            plannerRevision: INCUS_PLANNER_REVISION,\n            caseKind: \"prebuilt\",\n            target: Object.freeze({\n                platform: Object.freeze({ _tag: \"Linux\" as const, os: \"linux\" as const, arch: \"x64\", libc: \"gnu\" as const }),\n                source: \"provider-standard\" as const,\n            }),\n            scheduling: Object.freeze({\n                recommendedConcurrency: planned.domain.maxInstances,\n                lane: Object.freeze({\n                    key: `incus:${planned.domain.project}:${planned.domain.storagePool}`,\n                    limit: planned.domain.maxInstances,\n                }),\n                admission: Object.freeze({ _tag: \"Shared\" as const }),\n            }),\n            module: incusProviderModule(planned.dockerExecution),\n            runtimePlan: planned.runtime,\n            build: Object.freeze({\n                _tag: \"None\" as const,\n                caseKey: computeCaseKey({\n                    caseKind: \"prebuilt\",\n                    materializerRevision: INCUS_PLANNER_REVISION,\n                    buildKeys: [],\n                    caseParams: privateIdentity,\n                }),\n                buildKeys: [] as const,\n            }),\n            publishableIdentity: {\n                kind: \"vm\",\n                image: normalized.image.locator,\n                project: normalized.project,\n                storagePool: normalized.storagePool,\n                acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n                resources: resourcesJson(normalized.resources),\n                executionDomain: planned.dockerExecution.executionDomain,\n                executionDomainId: planned.dockerExecution.executionDomainId,\n                origin,\n            },\n            privateFingerprintIdentity: {\n                provider: \"incus\",\n                kind: \"vm\",\n                image: normalized.image.locator,\n                project: normalized.project,\n                storagePool: normalized.storagePool,\n                resources: resourcesJson(normalized.resources),\n                acceptDevelopmentDomain: normalized.acceptDevelopmentDomain,\n                executionDomainId: planned.dockerExecution.executionDomainId,\n                imageFingerprint: planned.image.fingerprint,\n                origin,\n            },\n        })), Effect.mapError((cause) => planningError(toPlanningError(cause)))),\n    });\n}\n"]}