rightsize 0.1.0

package/dist/modules/clickhouse.js

@@ -0,0 +1,69 @@
+import { GenericContainer } from "../core/generic-container.js";
+import { Wait } from "../core/wait.js";
+const HTTP_PORT = 8123;
+const NATIVE_PORT = 9000;
+/**
+ * A single-node ClickHouse container, ready-checked via `/ping` (returns
+ * the literal body `Ok.` on 200 — `Wait.forHttp`'s status-code check is all
+ * that's needed here). Exposes both the HTTP interface (8123, what the
+ * helpers here use) and the native protocol port (9000) for consumers that
+ * want a native-protocol client instead.
+ *
+ * `CLICKHOUSE_USER`/`CLICKHOUSE_PASSWORD`/`CLICKHOUSE_DB` (verified against
+ * the entrypoint's own logging: `create new user 'test' instead 'default'`,
+ * `create database 'test'`) replace the image's default `default` user
+ * entirely — once set, the unauthenticated `default` user's usual
+ * passwordless access is gone, and every query needs the configured
+ * credentials.
+ */
+export class ClickHouseContainer extends GenericContainer {
+    usernameState = "test";
+    passwordState = "test";
+    databaseState = "test";
+    constructor(image = "clickhouse/clickhouse-server:25.8") {
+        super(image);
+        this.withExposedPorts(HTTP_PORT, NATIVE_PORT)
+            .withEnv("CLICKHOUSE_USER", this.usernameState)
+            .withEnv("CLICKHOUSE_PASSWORD", this.passwordState)
+            .withEnv("CLICKHOUSE_DB", this.databaseState)
+            .waitingFor(Wait.forHttp("/ping").forPort(HTTP_PORT));
+        // No withMemoryLimit override: measured ~524MB resident at rest well
+        // under msb's default ~450MB-and-up microVM sizing headroom in
+        // practice (verified booting and answering /ping on msb's default).
+    }
+    static async start(image = "clickhouse/clickhouse-server:25.8") {
+        return (await new ClickHouseContainer(image).start());
+    }
+    /** Overrides `CLICKHOUSE_USER` (default `test`). */
+    withUsername(username) {
+        this.usernameState = username;
+        return this.withEnv("CLICKHOUSE_USER", username);
+    }
+    /** Overrides `CLICKHOUSE_PASSWORD` (default `test`). */
+    withPassword(password) {
+        this.passwordState = password;
+        return this.withEnv("CLICKHOUSE_PASSWORD", password);
+    }
+    /** Overrides `CLICKHOUSE_DB` (default `test`). */
+    withDatabase(database) {
+        this.databaseState = database;
+        return this.withEnv("CLICKHOUSE_DB", database);
+    }
+    /** The configured user (default `test`). */
+    get username() {
+        return this.usernameState;
+    }
+    /** The configured password (default `test`). */
+    get password() {
+        return this.passwordState;
+    }
+    /** The configured database name (default `test`). */
+    get databaseName() {
+        return this.databaseState;
+    }
+    /** The HTTP interface's base URL for the running container. */
+    get httpUrl() {
+        return `http://${this.host}:${this.getMappedPort(HTTP_PORT)}`;
+    }
+}
+//# sourceMappingURL=clickhouse.js.map

package/dist/modules/clickhouse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clickhouse.js","sourceRoot":"","sources":["../../src/modules/clickhouse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,mBAAoB,SAAQ,gBAAgB;IAC/C,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IAE/B,YAAY,KAAK,GAAG,mCAAmC;QACrD,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,WAAW,CAAC;aAC1C,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC;aAC9C,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,aAAa,CAAC;aAClD,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;aAC5C,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,qEAAqE;QACrE,+DAA+D;QAC/D,oEAAoE;IACtE,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,mCAAmC;QACrE,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAwB,CAAC;IAC/E,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,kDAAkD;IAClD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,4CAA4C;IAC5C,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,gDAAgD;IAChD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,qDAAqD;IACrD,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,+DAA+D;IAC/D,IAAI,OAAO;QACT,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC;CACF"}

package/dist/modules/flink.d.ts

@@ -0,0 +1,65 @@
+import { GenericContainer } from "../core/generic-container.js";
+import type { SandboxBackend } from "../core/backend.js";
+/**
+ * A Flink JobManager container (REST 8081, RPC 6123), with an optional
+ * companion TaskManager on Docker only — see `withTaskManager()`.
+ *
+ * `FLINK_PROPERTIES` must set `jobmanager.rpc.address` on the JobManager
+ * itself (not just the TaskManager): the JobManager's own Pekko/Akka actor
+ * system binds its external address from this property too, and the image's
+ * default (`localhost`) doesn't resolve to anything reachable from a sibling
+ * container. Both roles get `withMemoryLimit(1024)` — verified booting
+ * cleanly on this machine at that floor for a bare JobManager and for the
+ * two-container topology on docker.
+ *
+ * ### `withTaskManager()` — docker-only (KNOWN, adjudicated msb limitation)
+ *
+ * A real Flink session cluster needs a TaskManager to actually run
+ * anything; it registers with the JobManager over a **persistent
+ * bidirectional Pekko/Akka RPC connection**. msb's network-link emulation
+ * (`ExecTunnel`) only carries **client-speaks-first, one-exchange-at-a-time**
+ * traffic through an in-guest `nc` listener — and the `flink` image ships
+ * neither `nc` nor `busybox` at all (confirmed: `command -v nc` and
+ * `command -v busybox` both exit 127 in `flink:1.20.5`), so the tunnel's
+ * `installNetworkLinks` step can't even probe for the listener it would
+ * need, let alone carry Pekko's long-lived duplex traffic if it somehow
+ * could. `withTaskManager()` therefore throws `UnsupportedByBackendError`
+ * from `containerIsStarting()` — the instant `start()` has resolved the msb
+ * backend, before `ensureNetwork`, port allocation, or the JobManager
+ * container is created/booted at all — rather than attempting a boot that
+ * would hang or fail deep inside Flink's own registration timeout. On
+ * docker, the same builder produces a real two-container session cluster on
+ * a shared `Network`, and the TaskManager registers successfully (verified:
+ * `/taskmanagers` reports one registered TM with a live heartbeat).
+ */
+export declare class FlinkContainer extends GenericContainer {
+    private readonly imageTag;
+    private taskManagerRequested;
+    private taskManagerContainer;
+    private taskManagerNetwork;
+    private ownedNetwork;
+    constructor(image?: string);
+    static start(image?: string): Promise<FlinkContainer>;
+    /**
+     * Requests a companion TaskManager, started on a shared `Network` once
+     * the JobManager is ready. Docker only — see the class doc for why msb
+     * can't carry this topology; calling `start()` after this on msb throws
+     * `UnsupportedByBackendError` from `containerIsStarting()`, before any
+     * boot work (network, ports, or the JobManager container itself) begins.
+     */
+    withTaskManager(): this;
+    /**
+     * Fires the instant `start()` resolves a backend — before `ensureNetwork`,
+     * port allocation, or the JobManager container is created/booted at all.
+     * Rejecting an msb + withTaskManager() combination here, instead of in
+     * `containerIsStarted()` after the JobManager has already fully booted,
+     * means the caller never pays for (or has to clean up after) a boot this
+     * backend was never going to be able to complete.
+     */
+    protected containerIsStarting(backend: SandboxBackend): Promise<void>;
+    protected containerIsStarted(): Promise<void>;
+    stop(): Promise<void>;
+    /** The REST base URL for the running JobManager. */
+    get restUrl(): string;
+}
+//# sourceMappingURL=flink.d.ts.map

package/dist/modules/flink.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flink.d.ts","sourceRoot":"","sources":["../../src/modules/flink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAIhE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,oBAAoB,CAA+B;IAC3D,OAAO,CAAC,kBAAkB,CAAsB;IAChD,OAAO,CAAC,YAAY,CAAsB;gBAE9B,KAAK,SAAiB;WAWZ,KAAK,CAAC,KAAK,SAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;IAI5E;;;;;;OAMG;IACH,eAAe,IAAI,IAAI;IASvB;;;;;;;OAOG;cACsB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;cAU3D,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAqB7C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAYpC,oDAAoD;IACpD,IAAI,OAAO,IAAI,MAAM,CAEpB;CACF"}

package/dist/modules/flink.js

@@ -0,0 +1,125 @@
+import { GenericContainer } from "../core/generic-container.js";
+import { Network } from "../core/network.js";
+import { Wait } from "../core/wait.js";
+import { UnsupportedByBackendError } from "../core/errors.js";
+const RPC_PORT = 6123;
+const REST_PORT = 8081;
+const JOBMANAGER_MEMORY_MB = 1024;
+const TASKMANAGER_MEMORY_MB = 1024;
+const JOBMANAGER_ALIAS = "flink-jobmanager";
+/**
+ * A Flink JobManager container (REST 8081, RPC 6123), with an optional
+ * companion TaskManager on Docker only — see `withTaskManager()`.
+ *
+ * `FLINK_PROPERTIES` must set `jobmanager.rpc.address` on the JobManager
+ * itself (not just the TaskManager): the JobManager's own Pekko/Akka actor
+ * system binds its external address from this property too, and the image's
+ * default (`localhost`) doesn't resolve to anything reachable from a sibling
+ * container. Both roles get `withMemoryLimit(1024)` — verified booting
+ * cleanly on this machine at that floor for a bare JobManager and for the
+ * two-container topology on docker.
+ *
+ * ### `withTaskManager()` — docker-only (KNOWN, adjudicated msb limitation)
+ *
+ * A real Flink session cluster needs a TaskManager to actually run
+ * anything; it registers with the JobManager over a **persistent
+ * bidirectional Pekko/Akka RPC connection**. msb's network-link emulation
+ * (`ExecTunnel`) only carries **client-speaks-first, one-exchange-at-a-time**
+ * traffic through an in-guest `nc` listener — and the `flink` image ships
+ * neither `nc` nor `busybox` at all (confirmed: `command -v nc` and
+ * `command -v busybox` both exit 127 in `flink:1.20.5`), so the tunnel's
+ * `installNetworkLinks` step can't even probe for the listener it would
+ * need, let alone carry Pekko's long-lived duplex traffic if it somehow
+ * could. `withTaskManager()` therefore throws `UnsupportedByBackendError`
+ * from `containerIsStarting()` — the instant `start()` has resolved the msb
+ * backend, before `ensureNetwork`, port allocation, or the JobManager
+ * container is created/booted at all — rather than attempting a boot that
+ * would hang or fail deep inside Flink's own registration timeout. On
+ * docker, the same builder produces a real two-container session cluster on
+ * a shared `Network`, and the TaskManager registers successfully (verified:
+ * `/taskmanagers` reports one registered TM with a live heartbeat).
+ */
+export class FlinkContainer extends GenericContainer {
+    imageTag;
+    taskManagerRequested = false;
+    taskManagerContainer;
+    taskManagerNetwork;
+    ownedNetwork;
+    constructor(image = "flink:1.20.5") {
+        super(image);
+        this.imageTag = image;
+        this.withExposedPorts(RPC_PORT, REST_PORT)
+            .withEnv("FLINK_PROPERTIES", `jobmanager.rpc.address: ${JOBMANAGER_ALIAS}`)
+            .withCommand("jobmanager")
+            .withMemoryLimit(JOBMANAGER_MEMORY_MB)
+            .withNetworkAliases(JOBMANAGER_ALIAS)
+            .waitingFor(Wait.forHttp("/overview").forPort(REST_PORT).withStartupTimeout(120_000));
+    }
+    static async start(image = "flink:1.20.5") {
+        return (await new FlinkContainer(image).start());
+    }
+    /**
+     * Requests a companion TaskManager, started on a shared `Network` once
+     * the JobManager is ready. Docker only — see the class doc for why msb
+     * can't carry this topology; calling `start()` after this on msb throws
+     * `UnsupportedByBackendError` from `containerIsStarting()`, before any
+     * boot work (network, ports, or the JobManager container itself) begins.
+     */
+    withTaskManager() {
+        this.taskManagerRequested = true;
+        const net = Network.newNetwork();
+        this.ownedNetwork = net;
+        this.taskManagerNetwork = net;
+        this.withNetwork(net);
+        return this;
+    }
+    /**
+     * Fires the instant `start()` resolves a backend — before `ensureNetwork`,
+     * port allocation, or the JobManager container is created/booted at all.
+     * Rejecting an msb + withTaskManager() combination here, instead of in
+     * `containerIsStarted()` after the JobManager has already fully booted,
+     * means the caller never pays for (or has to clean up after) a boot this
+     * backend was never going to be able to complete.
+     */
+    async containerIsStarting(backend) {
+        if (this.taskManagerRequested && backend.name === "microsandbox") {
+            throw new UnsupportedByBackendError("Flink TaskManager registration", backend.name, "the flink image ships no nc/busybox for the network-link exec-tunnel, and TaskManager registration is a persistent bidirectional RPC the tunnel can't carry anyway — run this with RIGHTSIZE_BACKEND=docker instead");
+        }
+    }
+    async containerIsStarted() {
+        if (!this.taskManagerRequested) {
+            return;
+        }
+        const backend = this.currentBackend();
+        const network = this.taskManagerNetwork;
+        if (network === undefined) {
+            throw new Error("withTaskManager() requires a network, but none was set");
+        }
+        const taskManager = new GenericContainer(this.imageTag)
+            .withEnv("FLINK_PROPERTIES", `jobmanager.rpc.address: ${JOBMANAGER_ALIAS}`)
+            .withCommand("taskmanager")
+            .withMemoryLimit(TASKMANAGER_MEMORY_MB)
+            .withNetwork(network)
+            // Use the SAME backend this JobManager actually resolved (test
+            // doubles and an explicit RIGHTSIZE_BACKEND override must both carry
+            // through to the companion container, not re-resolve independently).
+            .withBackend(backend);
+        this.taskManagerContainer = await taskManager.start();
+    }
+    async stop() {
+        if (this.taskManagerContainer !== undefined) {
+            await this.taskManagerContainer.stop();
+            this.taskManagerContainer = undefined;
+        }
+        await super.stop();
+        if (this.ownedNetwork !== undefined) {
+            await this.ownedNetwork.close();
+            this.ownedNetwork = undefined;
+        }
+    }
+    /** The REST base URL for the running JobManager. */
+    get restUrl() {
+        return `http://${this.host}:${this.getMappedPort(REST_PORT)}`;
+    }
+}
+//# sourceMappingURL=flink.js.map

package/dist/modules/flink.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flink.js","sourceRoot":"","sources":["../../src/modules/flink.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AAG9D,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AACnC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IACjC,QAAQ,CAAS;IAC1B,oBAAoB,GAAG,KAAK,CAAC;IAC7B,oBAAoB,CAA+B;IACnD,kBAAkB,CAAsB;IACxC,YAAY,CAAsB;IAE1C,YAAY,KAAK,GAAG,cAAc;QAChC,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC;aACvC,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,gBAAgB,EAAE,CAAC;aAC1E,WAAW,CAAC,YAAY,CAAC;aACzB,eAAe,CAAC,oBAAoB,CAAC;aACrC,kBAAkB,CAAC,gBAAgB,CAAC;aACpC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,cAAc;QAChD,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAmB,CAAC;IACrE,CAAC;IAED;;;;;;OAMG;IACH,eAAe;QACb,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QACxB,IAAI,CAAC,kBAAkB,GAAG,GAAG,CAAC;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACgB,KAAK,CAAC,mBAAmB,CAAC,OAAuB;QAClE,IAAI,IAAI,CAAC,oBAAoB,IAAI,OAAO,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACjE,MAAM,IAAI,yBAAyB,CACjC,gCAAgC,EAChC,OAAO,CAAC,IAAI,EACZ,qNAAqN,CACtN,CAAC;QACJ,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,kBAAkB;QACzC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;aACpD,OAAO,CAAC,kBAAkB,EAAE,2BAA2B,gBAAgB,EAAE,CAAC;aAC1E,WAAW,CAAC,aAAa,CAAC;aAC1B,eAAe,CAAC,qBAAqB,CAAC;aACtC,WAAW,CAAC,OAAO,CAAC;YACrB,+DAA+D;YAC/D,qEAAqE;YACrE,qEAAqE;aACpE,WAAW,CAAC,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,oBAAoB,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IAEQ,KAAK,CAAC,IAAI;QACjB,IAAI,IAAI,CAAC,oBAAoB,KAAK,SAAS,EAAE,CAAC;YAC5C,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,CAAC,oBAAoB,GAAG,SAAS,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAChC,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO;QACT,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;IAChE,CAAC;CACF"}

package/dist/modules/floci.d.ts

@@ -0,0 +1,46 @@
+import { GenericContainer } from "../core/generic-container.js";
+/**
+ * A [floci.io](https://floci.io) cloud emulator — one native Quarkus image
+ * per cloud provider, each speaking that provider's REST APIs against an
+ * in-memory backing store. One module type covers all three variants; pick
+ * one via the `FlociContainer.aws()`/`.azure()`/`.gcp()` factory functions
+ * (there is no bare `new FlociContainer(...)` or `static start()` — each
+ * factory pins the provider's own image and guest port, so it's the only
+ * entry point) and call `.start()` on the result, e.g. `await
+ * FlociContainer.aws().start()`.
+ *
+ * ### Readiness — `/health` works uniformly, unlike the AWS-flavored `/_localstack/health`
+ *
+ * All three variants answer a plain `GET /health` with `200` and a small
+ * JSON status body the moment the embedded Quarkus HTTP listener is up
+ * (verified against real boots of `floci/floci:1.5.30`,
+ * `floci/floci-az:0.8.0`, and `floci/floci-gcp:0.4.0`) — pinned as the one
+ * wait path that works across all three; no log-wait fallback was needed.
+ *
+ * ### No signing needed — verified against the AWS variant's S3 surface
+ *
+ * The AWS variant's S3-shaped REST endpoints accept unsigned requests with
+ * no `Authorization` header at all: `PUT /<bucket>` (create-bucket), `PUT
+ * /<bucket>/<key>` (put-object), and `GET /<bucket>/<key>` (get-object) all
+ * round-trip successfully with a bare HTTP client call — no SigV4, no AWS
+ * SDK dependency required.
+ *
+ * ### Memory — tiny, no ladder needed
+ *
+ * All three images are native (GraalVM) Quarkus binaries; a real boot
+ * settles under 150MiB RSS, and each variant boots and answers `/health`
+ * under msb's default microVM RAM with no `withMemoryLimit` override.
+ */
+export declare class FlociContainer extends GenericContainer {
+    private readonly guestPort;
+    private constructor();
+    /** The AWS emulator (`floci/floci:1.5.30`), guest port 4566 — S3, DynamoDB, SQS, etc. */
+    static aws(image?: string): FlociContainer;
+    /** The Azure emulator (`floci/floci-az:0.8.0`), guest port 4577. */
+    static azure(image?: string): FlociContainer;
+    /** The GCP emulator (`floci/floci-gcp:0.4.0`), guest port 4588. */
+    static gcp(image?: string): FlociContainer;
+    /** This variant's REST endpoint — the base URL for every emulated API call. */
+    get endpointUrl(): string;
+}
+//# sourceMappingURL=floci.d.ts.map

package/dist/modules/floci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floci.d.ts","sourceRoot":"","sources":["../../src/modules/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAOhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IAClD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,OAAO;IAMP,yFAAyF;IACzF,MAAM,CAAC,GAAG,CAAC,KAAK,SAAuB,GAAG,cAAc;IAIxD,oEAAoE;IACpE,MAAM,CAAC,KAAK,CAAC,KAAK,SAAyB,GAAG,cAAc;IAI5D,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,KAAK,SAA0B,GAAG,cAAc;IAI3D,+EAA+E;IAC/E,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/modules/floci.js

@@ -0,0 +1,62 @@
+import { GenericContainer } from "../core/generic-container.js";
+import { Wait } from "../core/wait.js";
+const AWS_PORT = 4566;
+const AZURE_PORT = 4577;
+const GCP_PORT = 4588;
+/**
+ * A [floci.io](https://floci.io) cloud emulator — one native Quarkus image
+ * per cloud provider, each speaking that provider's REST APIs against an
+ * in-memory backing store. One module type covers all three variants; pick
+ * one via the `FlociContainer.aws()`/`.azure()`/`.gcp()` factory functions
+ * (there is no bare `new FlociContainer(...)` or `static start()` — each
+ * factory pins the provider's own image and guest port, so it's the only
+ * entry point) and call `.start()` on the result, e.g. `await
+ * FlociContainer.aws().start()`.
+ *
+ * ### Readiness — `/health` works uniformly, unlike the AWS-flavored `/_localstack/health`
+ *
+ * All three variants answer a plain `GET /health` with `200` and a small
+ * JSON status body the moment the embedded Quarkus HTTP listener is up
+ * (verified against real boots of `floci/floci:1.5.30`,
+ * `floci/floci-az:0.8.0`, and `floci/floci-gcp:0.4.0`) — pinned as the one
+ * wait path that works across all three; no log-wait fallback was needed.
+ *
+ * ### No signing needed — verified against the AWS variant's S3 surface
+ *
+ * The AWS variant's S3-shaped REST endpoints accept unsigned requests with
+ * no `Authorization` header at all: `PUT /<bucket>` (create-bucket), `PUT
+ * /<bucket>/<key>` (put-object), and `GET /<bucket>/<key>` (get-object) all
+ * round-trip successfully with a bare HTTP client call — no SigV4, no AWS
+ * SDK dependency required.
+ *
+ * ### Memory — tiny, no ladder needed
+ *
+ * All three images are native (GraalVM) Quarkus binaries; a real boot
+ * settles under 150MiB RSS, and each variant boots and answers `/health`
+ * under msb's default microVM RAM with no `withMemoryLimit` override.
+ */
+export class FlociContainer extends GenericContainer {
+    guestPort;
+    constructor(image, port) {
+        super(image);
+        this.guestPort = port;
+        this.withExposedPorts(port).waitingFor(Wait.forHttp("/health").forPort(port));
+    }
+    /** The AWS emulator (`floci/floci:1.5.30`), guest port 4566 — S3, DynamoDB, SQS, etc. */
+    static aws(image = "floci/floci:1.5.30") {
+        return new FlociContainer(image, AWS_PORT);
+    }
+    /** The Azure emulator (`floci/floci-az:0.8.0`), guest port 4577. */
+    static azure(image = "floci/floci-az:0.8.0") {
+        return new FlociContainer(image, AZURE_PORT);
+    }
+    /** The GCP emulator (`floci/floci-gcp:0.4.0`), guest port 4588. */
+    static gcp(image = "floci/floci-gcp:0.4.0") {
+        return new FlociContainer(image, GCP_PORT);
+    }
+    /** This variant's REST endpoint — the base URL for every emulated API call. */
+    get endpointUrl() {
+        return `http://${this.host}:${this.getMappedPort(this.guestPort)}`;
+    }
+}
+//# sourceMappingURL=floci.js.map

package/dist/modules/floci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"floci.js","sourceRoot":"","sources":["../../src/modules/floci.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,IAAI,CAAC;AAEtB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IACjC,SAAS,CAAS;IAEnC,YAAoB,KAAa,EAAE,IAAY;QAC7C,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,yFAAyF;IACzF,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,oBAAoB;QACrC,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,sBAAsB;QACzC,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAC/C,CAAC;IAED,mEAAmE;IACnE,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,uBAAuB;QACxC,OAAO,IAAI,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED,+EAA+E;IAC/E,IAAI,WAAW;QACb,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IACrE,CAAC;CACF"}

package/dist/modules/index.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `rightsize/modules` — eighteen preconfigured containers.
+ *
+ * Each module is a `GenericContainer` subclass with sensible defaults (image
+ * tag, exposed ports, wait strategy, and any memory floor its image needs)
+ * plus typed connection helpers, so `await using redis = await RedisContainer.start()`
+ * is immediately usable without hand-assembling a `GenericContainer`. Every
+ * builder method from the base class (`withEnv`, `withExposedPorts`,
+ * `waitingFor`, …) remains available on every module.
+ *
+ * @packageDocumentation
+ */
+export { RedisContainer } from "./redis.js";
+export { MemcachedContainer, MemcachedRespondsStrategy } from "./memcached.js";
+export { ArangoContainer } from "./arango.js";
+export { MongoDBContainer } from "./mongodb.js";
+export { RedpandaContainer } from "./redpanda.js";
+export { KafkaContainer } from "./kafka.js";
+export { SpringCloudConfigContainer } from "./spring-cloud-config.js";
+export { PostgresContainer } from "./postgres.js";
+export { MySQLContainer } from "./mysql.js";
+export { PinotContainer } from "./pinot.js";
+export { RabbitMQContainer } from "./rabbitmq.js";
+export { MariaDBContainer } from "./mariadb.js";
+export { FlinkContainer } from "./flink.js";
+export { WireMockContainer } from "./wiremock.js";
+export { KeycloakContainer } from "./keycloak.js";
+export { ClickHouseContainer } from "./clickhouse.js";
+export { Neo4jContainer } from "./neo4j.js";
+export { FlociContainer } from "./floci.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/modules/index.js

@@ -0,0 +1,31 @@
+/**
+ * `rightsize/modules` — eighteen preconfigured containers.
+ *
+ * Each module is a `GenericContainer` subclass with sensible defaults (image
+ * tag, exposed ports, wait strategy, and any memory floor its image needs)
+ * plus typed connection helpers, so `await using redis = await RedisContainer.start()`
+ * is immediately usable without hand-assembling a `GenericContainer`. Every
+ * builder method from the base class (`withEnv`, `withExposedPorts`,
+ * `waitingFor`, …) remains available on every module.
+ *
+ * @packageDocumentation
+ */
+export { RedisContainer } from "./redis.js";
+export { MemcachedContainer, MemcachedRespondsStrategy } from "./memcached.js";
+export { ArangoContainer } from "./arango.js";
+export { MongoDBContainer } from "./mongodb.js";
+export { RedpandaContainer } from "./redpanda.js";
+export { KafkaContainer } from "./kafka.js";
+export { SpringCloudConfigContainer } from "./spring-cloud-config.js";
+export { PostgresContainer } from "./postgres.js";
+export { MySQLContainer } from "./mysql.js";
+export { PinotContainer } from "./pinot.js";
+export { RabbitMQContainer } from "./rabbitmq.js";
+export { MariaDBContainer } from "./mariadb.js";
+export { FlinkContainer } from "./flink.js";
+export { WireMockContainer } from "./wiremock.js";
+export { KeycloakContainer } from "./keycloak.js";
+export { ClickHouseContainer } from "./clickhouse.js";
+export { Neo4jContainer } from "./neo4j.js";
+export { FlociContainer } from "./floci.js";
+//# sourceMappingURL=index.js.map

package/dist/modules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/modules/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/modules/kafka.d.ts

@@ -0,0 +1,11 @@
+import { GenericContainer } from "../core/generic-container.js";
+import type { ContainerSpec } from "../core/model.js";
+/** A single-node Kafka broker (KRaft mode, no ZooKeeper). */
+export declare class KafkaContainer extends GenericContainer {
+    constructor(image?: string);
+    static start(image?: string): Promise<KafkaContainer>;
+    protected customizeSpec(spec: ContainerSpec, mapped: (guest: number) => number): ContainerSpec;
+    /** The `PLAINTEXT://` bootstrap-servers address for the running broker. */
+    get bootstrapServers(): string;
+}
+//# sourceMappingURL=kafka.d.ts.map

package/dist/modules/kafka.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kafka.d.ts","sourceRoot":"","sources":["../../src/modules/kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,6DAA6D;AAC7D,qBAAa,cAAe,SAAQ,gBAAgB;gBACtC,KAAK,SAAuB;WAoBlB,KAAK,CAAC,KAAK,SAAuB,GAAG,OAAO,CAAC,cAAc,CAAC;cAM/D,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,aAAa;IAOvG,2EAA2E;IAC3E,IAAI,gBAAgB,IAAI,MAAM,CAE7B;CACF"}

package/dist/modules/kafka.js

@@ -0,0 +1,41 @@
+import { GenericContainer } from "../core/generic-container.js";
+import { Wait } from "../core/wait.js";
+const GUEST_PORT = 9092;
+/** A single-node Kafka broker (KRaft mode, no ZooKeeper). */
+export class KafkaContainer extends GenericContainer {
+    constructor(image = "apache/kafka:4.0.0") {
+        super(image);
+        this.withExposedPorts(GUEST_PORT)
+            .withEnv("KAFKA_NODE_ID", "1")
+            .withEnv("KAFKA_PROCESS_ROLES", "broker,controller")
+            .withEnv("KAFKA_CONTROLLER_QUORUM_VOTERS", "1@localhost:9091")
+            .withEnv("KAFKA_LISTENERS", "PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9091")
+            .withEnv("KAFKA_CONTROLLER_LISTENER_NAMES", "CONTROLLER")
+            .withEnv("KAFKA_LISTENER_SECURITY_PROTOCOL_MAP", "PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT")
+            .withEnv("KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR", "1")
+            .withEnv("KAFKA_GROUP_INITIAL_REBALANCE_DELAY_MS", "0")
+            // The apache/kafka image defaults KAFKA_HEAP_OPTS to -Xmx1G, which
+            // exceeds the microsandbox microVM's default RAM and aborts the JVM
+            // ("insufficient memory"). A single-node KRaft dev broker runs
+            // comfortably in a 256M heap; harmless on the Docker backend, which
+            // is not memory-constrained here.
+            .withEnv("KAFKA_HEAP_OPTS", "-Xmx256M -Xms256M")
+            .waitingFor(Wait.forLogMessage(".*Kafka Server started.*"));
+    }
+    static async start(image = "apache/kafka:4.0.0") {
+        return (await new KafkaContainer(image).start());
+    }
+    // Rewrites the advertised listener to carry the mapped host port; see
+    // RedpandaContainer.customizeSpec for why this needs the mapped callback.
+    customizeSpec(spec, mapped) {
+        return {
+            ...spec,
+            env: [...spec.env, ["KAFKA_ADVERTISED_LISTENERS", `PLAINTEXT://127.0.0.1:${mapped(GUEST_PORT)}`]],
+        };
+    }
+    /** The `PLAINTEXT://` bootstrap-servers address for the running broker. */
+    get bootstrapServers() {
+        return `PLAINTEXT://${this.host}:${this.getMappedPort(GUEST_PORT)}`;
+    }
+}
+//# sourceMappingURL=kafka.js.map

package/dist/modules/kafka.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kafka.js","sourceRoot":"","sources":["../../src/modules/kafka.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAGvC,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,6DAA6D;AAC7D,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IAClD,YAAY,KAAK,GAAG,oBAAoB;QACtC,KAAK,CAAC,KAAK,CAAC,CAAC;QACb,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;aAC9B,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;aAC7B,OAAO,CAAC,qBAAqB,EAAE,mBAAmB,CAAC;aACnD,OAAO,CAAC,gCAAgC,EAAE,kBAAkB,CAAC;aAC7D,OAAO,CAAC,iBAAiB,EAAE,oDAAoD,CAAC;aAChF,OAAO,CAAC,iCAAiC,EAAE,YAAY,CAAC;aACxD,OAAO,CAAC,sCAAsC,EAAE,0CAA0C,CAAC;aAC3F,OAAO,CAAC,wCAAwC,EAAE,GAAG,CAAC;aACtD,OAAO,CAAC,wCAAwC,EAAE,GAAG,CAAC;YACvD,mEAAmE;YACnE,oEAAoE;YACpE,+DAA+D;YAC/D,oEAAoE;YACpE,kCAAkC;aACjC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,CAAC;aAC/C,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,oBAAoB;QACtD,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAmB,CAAC;IACrE,CAAC;IAED,sEAAsE;IACtE,0EAA0E;IACvD,aAAa,CAAC,IAAmB,EAAE,MAAiC;QACrF,OAAO;YACL,GAAG,IAAI;YACP,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,4BAA4B,EAAE,yBAAyB,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;SAClG,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,IAAI,gBAAgB;QAClB,OAAO,eAAe,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;IACtE,CAAC;CACF"}

package/dist/modules/keycloak.d.ts

@@ -0,0 +1,40 @@
+import { GenericContainer } from "../core/generic-container.js";
+/**
+ * A single-node Keycloak container started with `start-dev` (an
+ * in-memory/dev-mode boot — no external database wiring needed for tests).
+ *
+ * Two pins here are version-sensitive and were verified against 26.0.8
+ * specifically:
+ *
+ * - **Env var names**: 26.x renamed the bootstrap-admin variables to
+ *   `KC_BOOTSTRAP_ADMIN_USERNAME`/`KC_BOOTSTRAP_ADMIN_PASSWORD` (older
+ *   releases used `KEYCLOAK_ADMIN`/`KEYCLOAK_ADMIN_PASSWORD`, which 26.x
+ *   does not recognize). Confirmed by the boot log: `KC-SERVICES0077:
+ *   Created temporary admin user with username admin`.
+ * - **Health lives on the management port, not the app port.** 26.x splits
+ *   HTTP (8080) from a separate management interface (9000, confirmed by
+ *   the boot log: "Management interface listening on http://0.0.0.0:9000")
+ *   that serves `/health/ready`; `KC_HEALTH_ENABLED=true` is required for
+ *   that endpoint to exist at all.
+ *
+ * A four-JVM-adjacent Quarkus boot (Keycloak on Quarkus, with Infinispan +
+ * an embedded H2) fits comfortably in `withMemoryLimit(1024)` (measured
+ * ~55% utilization at rest) — set by default here.
+ */
+export declare class KeycloakContainer extends GenericContainer {
+    private adminUsernameState;
+    private adminPasswordState;
+    constructor(image?: string);
+    static start(image?: string): Promise<KeycloakContainer>;
+    /** Overrides `KC_BOOTSTRAP_ADMIN_USERNAME` (default `admin`). */
+    withAdminUsername(username: string): this;
+    /** Overrides `KC_BOOTSTRAP_ADMIN_PASSWORD` (default `admin`). */
+    withAdminPassword(password: string): this;
+    /** The configured bootstrap admin username (default `admin`). */
+    get adminUsername(): string;
+    /** The configured bootstrap admin password (default `admin`). */
+    get adminPassword(): string;
+    /** The auth server's base URL (the app HTTP port, 8080). */
+    get authServerUrl(): string;
+}
+//# sourceMappingURL=keycloak.d.ts.map

package/dist/modules/keycloak.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycloak.d.ts","sourceRoot":"","sources":["../../src/modules/keycloak.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAOhE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAkB,SAAQ,gBAAgB;IACrD,OAAO,CAAC,kBAAkB,CAAW;IACrC,OAAO,CAAC,kBAAkB,CAAW;gBAEzB,KAAK,SAAmC;WAW9B,KAAK,CAAC,KAAK,SAAmC,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIjG,iEAAiE;IACjE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKzC,iEAAiE;IACjE,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKzC,iEAAiE;IACjE,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,iEAAiE;IACjE,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,4DAA4D;IAC5D,IAAI,aAAa,IAAI,MAAM,CAE1B;CACF"}