rightsize 0.1.0

package/dist/core/backends.js

@@ -0,0 +1,127 @@
+// The ServiceLoader analog: an explicit process-global registry. Each
+// backend subpath (`rightsize/backend-msb`, `rightsize/backend-docker`)
+// calls registerBackend at import time — the `sideEffects` entry in
+// package.json exists so bundlers keep that call.
+const registered = [];
+/** Adds a provider to the process-global registry. Called once, at import time, by each backend subpath's `index.ts`. */
+export function registerBackend(provider) {
+    registered.push(provider);
+}
+/** Test seam: clears the process-global registry. Never call from library code. */
+export function _resetRegistryForTests() {
+    registered.length = 0;
+}
+/**
+ * Test seam: snapshot of the currently registered providers, so an impure
+ * suite that wipes the registry can put the real ones back when it finishes —
+ * under a single-process test runner, whatever it leaves behind is what every
+ * later-loaded test file sees.
+ */
+export function _providersSnapshotForTests() {
+    return [...registered];
+}
+function knownNames(providers) {
+    return providers.map((p) => p.name).join(", ");
+}
+/**
+ * Pure resolution: no I/O, no module-global registry access, so it is fully
+ * unit-testable with fake providers. `Backends.active()` is the impure
+ * caller that supplies the real registry and `process.env`.
+ */
+export function resolve(providers, requested) {
+    if (providers.length === 0) {
+        throw new Error("No backend providers are registered. Import 'rightsize/backend-msb' or 'rightsize/backend-docker' to register one.");
+    }
+    if (requested !== undefined) {
+        const wanted = requested.toLowerCase();
+        const match = providers.find((p) => p.name.toLowerCase() === wanted);
+        if (match === undefined) {
+            throw new Error(`Unknown backend '${requested}'. Known backends: ${knownNames(providers)}.`);
+        }
+        if (!match.isSupported()) {
+            throw new Error(`Backend '${match.name}' was requested but is not supported here: ${match.unsupportedReason()}`);
+        }
+        return match.create();
+    }
+    const supported = providers.filter((p) => p.isSupported());
+    if (supported.length === 0) {
+        const reasons = providers.map((p) => `${p.name}: ${p.unsupportedReason()}`).join("; ");
+        throw new Error(`No supported backend found. ${reasons}`);
+    }
+    const winner = supported.reduce((best, candidate) => (candidate.priority > best.priority ? candidate : best));
+    return winner.create();
+}
+let activeBackend;
+let exitHookInstalled = false;
+/**
+ * Resolves once per process (memoized) against the real registry and
+ * `process.env.RIGHTSIZE_BACKEND`, then registers the best-effort exit-path
+ * cleanup (see `src/core/cleanup.ts`) the first time a backend is created.
+ */
+function active() {
+    if (activeBackend === undefined) {
+        activeBackend = resolve(registered, process.env["RIGHTSIZE_BACKEND"]);
+        if (!exitHookInstalled) {
+            exitHookInstalled = true;
+            let closeStarted = false;
+            // "beforeExit" fires while the event loop is still alive (unlike
+            // "exit", which runs synchronously and cannot await), so it's the one
+            // hook where the backend's real async close() can actually run. It is
+            // NOT a true shutdown hook, though: it fires at every full event-loop
+            // drain, not only at process exit. With the once-guard below, close()
+            // therefore runs at the FIRST complete drain — in a process that goes
+            // fully idle between containers, that can be before its last container
+            // was booted. Accepted tradeoff: a completely drained loop has no
+            // pending timers, sockets, or awaits, so nothing in the process is
+            // still waiting on those containers, and both backends stay usable
+            // after close() (stateless per-request clients) for any later boot.
+            // This is best-effort and NOT the primary safety net: a process that
+            // dies via SIGKILL, or exits through the synchronous "exit" path
+            // before beforeExit ever fires, is instead covered by the per-
+            // container cleanupSync registered in cleanup.ts and by the orphan
+            // reaper each backend runs at construction.
+            //
+            // "beforeExit" re-fires every time the event loop would otherwise go
+            // idle. close() is async — it awaits HTTP/subprocess calls — so
+            // invoking it unconditionally here schedules new event-loop work on
+            // every firing, which makes the NEXT idle point trigger this same
+            // handler again: an infinite close()-then-beforeExit cycle that never
+            // lets the process exit (observed as a `node --test` run hanging
+            // indefinitely after every assertion had already passed). The
+            // closeStarted guard makes this a once-per-process call — the single
+            // shutdown pass a process-lifetime cleanup hook is meant to be.
+            process.on("beforeExit", () => {
+                if (closeStarted) {
+                    return;
+                }
+                closeStarted = true;
+                // Best-effort: a backend whose close() rejects — or, as a defensive
+                // fake in a test can do, throws synchronously before ever producing
+                // a Promise to attach .catch() to — must not crash the process on
+                // its way out. There is no caller left to report the failure to.
+                try {
+                    activeBackend?.close().catch(() => { });
+                }
+                catch {
+                    // Swallowed for the same reason as the .catch() above.
+                }
+            });
+        }
+    }
+    return activeBackend;
+}
+/** Test seam: forces the next `Backends.active()` call to re-resolve. */
+function _resetActiveForTests() {
+    activeBackend = undefined;
+    exitHookInstalled = false;
+}
+/** The library's single entry point for obtaining the active `SandboxBackend`. */
+export const Backends = {
+    /** Pure resolution against an explicit provider list — see `resolve` above. */
+    resolve,
+    /** The memoized, per-process active backend — resolved from whatever's registered plus `RIGHTSIZE_BACKEND`. */
+    active,
+    /** Test seam: forces the next `active()` call to re-resolve. Never call from library code. */
+    _resetActiveForTests,
+};
+//# sourceMappingURL=backends.js.map

package/dist/core/backends.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backends.js","sourceRoot":"","sources":["../../src/core/backends.ts"],"names":[],"mappings":"AAEA,sEAAsE;AACtE,wEAAwE;AACxE,oEAAoE;AACpE,kDAAkD;AAClD,MAAM,UAAU,GAAsB,EAAE,CAAC;AAEzC,yHAAyH;AACzH,MAAM,UAAU,eAAe,CAAC,QAAyB;IACvD,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAC5B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,sBAAsB;IACpC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AACxB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,UAAU,CAAC,SAAqC;IACvD,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,OAAO,CAAC,SAAqC,EAAE,SAA6B;IAC1F,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,oHAAoH,CACrH,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,oBAAoB,SAAS,sBAAsB,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,IAAI,8CAA8C,KAAK,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;IACxB,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9G,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,aAAyC,CAAC;AAC9C,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B;;;;GAIG;AACH,SAAS,MAAM;IACb,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAChC,aAAa,GAAG,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,iEAAiE;YACjE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,kEAAkE;YAClE,mEAAmE;YACnE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,iEAAiE;YACjE,+DAA+D;YAC/D,mEAAmE;YACnE,4CAA4C;YAC5C,EAAE;YACF,qEAAqE;YACrE,gEAAgE;YAChE,oEAAoE;YACpE,kEAAkE;YAClE,sEAAsE;YACtE,iEAAiE;YACjE,8DAA8D;YAC9D,qEAAqE;YACrE,gEAAgE;YAChE,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,EAAE;gBAC5B,IAAI,YAAY,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,YAAY,GAAG,IAAI,CAAC;gBACpB,oEAAoE;gBACpE,oEAAoE;gBACpE,kEAAkE;gBAClE,iEAAiE;gBACjE,IAAI,CAAC;oBACH,aAAa,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBACzC,CAAC;gBAAC,MAAM,CAAC;oBACP,uDAAuD;gBACzD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,yEAAyE;AACzE,SAAS,oBAAoB;IAC3B,aAAa,GAAG,SAAS,CAAC;IAC1B,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,+EAA+E;IAC/E,OAAO;IACP,+GAA+G;IAC/G,MAAM;IACN,8FAA8F;IAC9F,oBAAoB;CACrB,CAAC"}

package/dist/core/cleanup.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Best-effort exit-path cleanup — the JVM-shutdown-hook / Rust-cleanup-
+ * thread analog for a process that dies (or is asked to die) before its
+ * `await using` scopes unwind normally.
+ *
+ * Node's `process.on("exit", ...)` handler runs SYNCHRONOUSLY and cannot
+ * `await` — by the time it fires, the event loop is already being torn
+ * down, so a backend's real async `stop()`/`remove()` cannot run there.
+ * Each backend therefore registers a synchronous, blocking teardown
+ * function per live container (`child_process.spawnSync` for msb, a
+ * blocking unix-socket DELETE for docker) instead of its normal async
+ * path. This module only owns the REGISTRY and the process hooks; it has
+ * no opinion on how any one backend tears a container down.
+ *
+ * This is a last-resort backstop, not the primary cleanup path — the
+ * primary path is `GenericContainer.stop()` / `[Symbol.asyncDispose]`.
+ * SIGKILL bypasses even this (no handler runs at all); the orphan reaper
+ * each backend runs at startup (`sweepOrphans`) is the backstop for that
+ * case, sweeping up `rz-<other-runid>-*` leftovers from a crashed prior
+ * run.
+ */
+export type SyncCleanup = () => void;
+/** Registers a synchronous teardown for a live container, keyed by handle id. */
+export declare function registerSyncCleanup(handleId: string, cleanupFn: SyncCleanup): void;
+/** Unregisters a container's teardown once it has been stopped/removed normally. */
+export declare function unregisterSyncCleanup(handleId: string): void;
+/** Test seam: clears registered cleanups without running them. */
+export declare function _resetForTests(): void;
+/**
+ * Test seam: runs every registered cleanup exactly the way the real "exit"
+ * handler does (best-effort, swallowing failures, then clearing the
+ * registry) without actually terminating the test process. This is how a
+ * unit test proves the exit-path teardown is wired to something real,
+ * rather than asserting on `registered`'s internal size.
+ */
+export declare function _runAllForTests(): void;
+//# sourceMappingURL=cleanup.d.ts.map

package/dist/core/cleanup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.d.ts","sourceRoot":"","sources":["../../src/core/cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC;AA+CrC,iFAAiF;AACjF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,IAAI,CAGlF;AAED,oFAAoF;AACpF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAE5D;AAED,kEAAkE;AAClE,wBAAgB,cAAc,IAAI,IAAI,CAErC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/core/cleanup.js

@@ -0,0 +1,86 @@
+/**
+ * Best-effort exit-path cleanup — the JVM-shutdown-hook / Rust-cleanup-
+ * thread analog for a process that dies (or is asked to die) before its
+ * `await using` scopes unwind normally.
+ *
+ * Node's `process.on("exit", ...)` handler runs SYNCHRONOUSLY and cannot
+ * `await` — by the time it fires, the event loop is already being torn
+ * down, so a backend's real async `stop()`/`remove()` cannot run there.
+ * Each backend therefore registers a synchronous, blocking teardown
+ * function per live container (`child_process.spawnSync` for msb, a
+ * blocking unix-socket DELETE for docker) instead of its normal async
+ * path. This module only owns the REGISTRY and the process hooks; it has
+ * no opinion on how any one backend tears a container down.
+ *
+ * This is a last-resort backstop, not the primary cleanup path — the
+ * primary path is `GenericContainer.stop()` / `[Symbol.asyncDispose]`.
+ * SIGKILL bypasses even this (no handler runs at all); the orphan reaper
+ * each backend runs at startup (`sweepOrphans`) is the backstop for that
+ * case, sweeping up `rz-<other-runid>-*` leftovers from a crashed prior
+ * run.
+ */
+const registered = new Map();
+let hooksInstalled = false;
+function runAll() {
+    for (const cleanupFn of registered.values()) {
+        try {
+            cleanupFn();
+        }
+        catch {
+            // Best-effort: a failure to clean up one container must not block
+            // cleanup of the others, and the process is exiting regardless.
+        }
+    }
+    registered.clear();
+}
+function installHooksOnce() {
+    if (hooksInstalled) {
+        return;
+    }
+    hooksInstalled = true;
+    process.on("exit", runAll);
+    // SIGINT/SIGTERM: run the same synchronous cleanup, then re-raise the
+    // signal so the process still exits the way it would have without this
+    // handler (correct exit code, no swallowed Ctrl-C).
+    //
+    // On Windows this pair is best-effort, not the real safety net: Node
+    // delivers a synthetic SIGINT for Ctrl+C (and SIGBREAK for Ctrl+Break,
+    // which is not registered here) but there is no real SIGTERM delivery from
+    // another process the way POSIX has it — Windows has no signal-based IPC
+    // for that. The interactive Ctrl+C path still fires this handler as
+    // expected; a `taskkill`-style external termination does not. The `"exit"`
+    // handler above is therefore the one Windows-portable guarantee — it fires
+    // on every normal process exit regardless of platform or what triggered
+    // it — while this signal-handler loop is a POSIX nicety layered on top.
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+        process.on(signal, () => {
+            runAll();
+            process.removeAllListeners(signal);
+            process.kill(process.pid, signal);
+        });
+    }
+}
+/** Registers a synchronous teardown for a live container, keyed by handle id. */
+export function registerSyncCleanup(handleId, cleanupFn) {
+    installHooksOnce();
+    registered.set(handleId, cleanupFn);
+}
+/** Unregisters a container's teardown once it has been stopped/removed normally. */
+export function unregisterSyncCleanup(handleId) {
+    registered.delete(handleId);
+}
+/** Test seam: clears registered cleanups without running them. */
+export function _resetForTests() {
+    registered.clear();
+}
+/**
+ * Test seam: runs every registered cleanup exactly the way the real "exit"
+ * handler does (best-effort, swallowing failures, then clearing the
+ * registry) without actually terminating the test process. This is how a
+ * unit test proves the exit-path teardown is wired to something real,
+ * rather than asserting on `registered`'s internal size.
+ */
+export function _runAllForTests() {
+    runAll();
+}
+//# sourceMappingURL=cleanup.js.map

package/dist/core/cleanup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cleanup.js","sourceRoot":"","sources":["../../src/core/cleanup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAuB,CAAC;AAClD,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B,SAAS,MAAM;IACb,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,SAAS,EAAE,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,gBAAgB;IACvB,IAAI,cAAc,EAAE,CAAC;QACnB,OAAO;IACT,CAAC;IACD,cAAc,GAAG,IAAI,CAAC;IAEtB,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE3B,sEAAsE;IACtE,uEAAuE;IACvE,oDAAoD;IACpD,EAAE;IACF,qEAAqE;IACrE,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,wEAAwE;IACxE,wEAAwE;IACxE,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAU,EAAE,CAAC;QACpD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,MAAM,EAAE,CAAC;YACT,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,SAAsB;IAC1E,gBAAgB,EAAE,CAAC;IACnB,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,qBAAqB,CAAC,QAAgB;IACpD,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC9B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc;IAC5B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,CAAC;AACX,CAAC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `feature` stays a noun phrase ("network links", "read-only mount
+ * enforcement") and advice lives in `remedy`; the two are composed with an
+ * em-dash so every backend renders the same sentence shape.
+ *
+ * @param feature - A noun phrase naming the unsupported capability.
+ * @param backend - The active backend's name (e.g. `"microsandbox"`).
+ * @param remedy - Optional actionable advice, appended after an em-dash.
+ */
+export declare class UnsupportedByBackendError extends Error {
+    /** A noun phrase naming the unsupported capability. */
+    readonly feature: string;
+    /** The active backend's name (e.g. `"microsandbox"`). */
+    readonly backend: string;
+    /** Optional actionable advice, appended after an em-dash in the rendered message. */
+    readonly remedy?: string | undefined;
+    constructor(
+    /** A noun phrase naming the unsupported capability. */
+    feature: string, 
+    /** The active backend's name (e.g. `"microsandbox"`). */
+    backend: string, 
+    /** Optional actionable advice, appended after an em-dash in the rendered message. */
+    remedy?: string | undefined);
+}
+/**
+ * Thrown when a backend's `start()` fails because a chosen host port is
+ * already bound by something else. `GenericContainer`'s start loop classifies
+ * this (typed-first, message-substring fallback) and retries with fresh
+ * ports rather than surfacing it directly — it only escapes after every
+ * retry attempt is exhausted.
+ */
+export declare class PortBindConflictError extends Error {
+    /** The underlying error or daemon response this classification was derived from, if any. */
+    readonly cause?: unknown | undefined;
+    constructor(message: string, 
+    /** The underlying error or daemon response this classification was derived from, if any. */
+    cause?: unknown | undefined);
+}
+/** Thrown when a wait strategy never observes readiness before its deadline. */
+export declare class ContainerLaunchError extends Error {
+    constructor(message: string);
+}
+/** Thrown on subprocess/daemon failures; message carries full stderr/body. */
+export declare class BackendError extends Error {
+    constructor(message: string);
+}
+/** Thrown when the msb toolchain provisioner can't get a runnable `msb` binary in place (download, checksum, or lock failure). */
+export declare class ProvisionError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAEhD,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,MAAM;IACxB,qFAAqF;IACrF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM;;IALxB,uDAAuD;IAC9C,OAAO,EAAE,MAAM;IACxB,yDAAyD;IAChD,OAAO,EAAE,MAAM;IACxB,qFAAqF;IAC5E,MAAM,CAAC,EAAE,MAAM,YAAA;CAK3B;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO;gBAFxB,OAAO,EAAE,MAAM;IACf,4FAA4F;IACnF,KAAK,CAAC,EAAE,OAAO,YAAA;CAK3B;AAED,gFAAgF;AAChF,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,8EAA8E;AAC9E,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAED,kIAAkI;AAClI,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B"}

package/dist/core/errors.js

@@ -0,0 +1,66 @@
+/**
+ * `feature` stays a noun phrase ("network links", "read-only mount
+ * enforcement") and advice lives in `remedy`; the two are composed with an
+ * em-dash so every backend renders the same sentence shape.
+ *
+ * @param feature - A noun phrase naming the unsupported capability.
+ * @param backend - The active backend's name (e.g. `"microsandbox"`).
+ * @param remedy - Optional actionable advice, appended after an em-dash.
+ */
+export class UnsupportedByBackendError extends Error {
+    feature;
+    backend;
+    remedy;
+    constructor(
+    /** A noun phrase naming the unsupported capability. */
+    feature, 
+    /** The active backend's name (e.g. `"microsandbox"`). */
+    backend, 
+    /** Optional actionable advice, appended after an em-dash in the rendered message. */
+    remedy) {
+        super(`Feature '${feature}' is not supported by the '${backend}' backend${remedy ? ` — ${remedy}` : ""}`);
+        this.feature = feature;
+        this.backend = backend;
+        this.remedy = remedy;
+        this.name = "UnsupportedByBackendError";
+    }
+}
+/**
+ * Thrown when a backend's `start()` fails because a chosen host port is
+ * already bound by something else. `GenericContainer`'s start loop classifies
+ * this (typed-first, message-substring fallback) and retries with fresh
+ * ports rather than surfacing it directly — it only escapes after every
+ * retry attempt is exhausted.
+ */
+export class PortBindConflictError extends Error {
+    cause;
+    constructor(message, 
+    /** The underlying error or daemon response this classification was derived from, if any. */
+    cause) {
+        super(message, cause !== undefined ? { cause } : undefined);
+        this.cause = cause;
+        this.name = "PortBindConflictError";
+    }
+}
+/** Thrown when a wait strategy never observes readiness before its deadline. */
+export class ContainerLaunchError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ContainerLaunchError";
+    }
+}
+/** Thrown on subprocess/daemon failures; message carries full stderr/body. */
+export class BackendError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "BackendError";
+    }
+}
+/** Thrown when the msb toolchain provisioner can't get a runnable `msb` binary in place (download, checksum, or lock failure). */
+export class ProvisionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "ProvisionError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAGvC;IAEA;IAEA;IANX;IACE,uDAAuD;IAC9C,OAAe;IACxB,yDAAyD;IAChD,OAAe;IACxB,qFAAqF;IAC5E,MAAe;QAExB,KAAK,CAAC,YAAY,OAAO,8BAA8B,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QANjG,YAAO,GAAP,OAAO,CAAQ;QAEf,YAAO,GAAP,OAAO,CAAQ;QAEf,WAAM,GAAN,MAAM,CAAS;QAGxB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAInC;IAHX,YACE,OAAe;IACf,4FAA4F;IACnF,KAAe;QAExB,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAFnD,UAAK,GAAL,KAAK,CAAU;QAGxB,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,gFAAgF;AAChF,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,8EAA8E;AAC9E,MAAM,OAAO,YAAa,SAAQ,KAAK;IACrC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAED,kIAAkI;AAClI,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF"}

package/dist/core/free-ports.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Allocates a host port this process has not already handed out. Binding
+ * `127.0.0.1:0` and immediately closing the socket leaves a window where
+ * another process (or another allocate() racing on ITS OWN OS-level choice)
+ * could rebind the same port before the caller's container process starts —
+ * `GenericContainer`'s port-retry loop is the mitigation for that race, not
+ * this function. What this function guarantees is in-process uniqueness:
+ * two calls here never return the same port while either is still issued.
+ */
+export declare function allocate(): Promise<number>;
+/** Releases a port back to the pool. Releasing a port never issued by this process is a harmless no-op. */
+export declare function release(port: number): void;
+/** Test-only observability seam: the ports currently considered issued. */
+export declare function issuedView(): ReadonlySet<number>;
+export declare const FreePorts: {
+    /** Allocates a host port this process has not already handed out — see `allocate` above. */
+    allocate: typeof allocate;
+    /** Releases a port back to the pool — see `release` above. */
+    release: typeof release;
+    /** Test-only observability seam — see `issuedView` above. */
+    issuedView: typeof issuedView;
+};
+//# sourceMappingURL=free-ports.d.ts.map

package/dist/core/free-ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-ports.d.ts","sourceRoot":"","sources":["../../src/core/free-ports.ts"],"names":[],"mappings":"AAgCA;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAShD;AAED,2GAA2G;AAC3G,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE1C;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,IAAI,WAAW,CAAC,MAAM,CAAC,CAEhD;AAED,eAAO,MAAM,SAAS;IACpB,4FAA4F;;IAE5F,8DAA8D;;IAE9D,6DAA6D;;CAE9D,CAAC"}

package/dist/core/free-ports.js

@@ -0,0 +1,63 @@
+import * as net from "node:net";
+const MAX_ALLOCATE_ATTEMPTS = 100;
+// Binds are loopback-only (127.0.0.1), not wildcard — the same conservative
+// choice used everywhere else a host port is touched (publishing, wait
+// probes). A deliberate divergence from binding 0.0.0.0, not an oversight.
+const BIND_HOST = "127.0.0.1";
+function bindEphemeralPort() {
+    return new Promise((resolvePort, rejectPort) => {
+        const server = net.createServer();
+        server.once("error", (err) => {
+            rejectPort(err);
+        });
+        server.listen(0, BIND_HOST, () => {
+            const address = server.address();
+            if (address === null || typeof address === "string") {
+                server.close();
+                rejectPort(new Error("failed to read an ephemeral port from the bound server"));
+                return;
+            }
+            const port = address.port;
+            server.close(() => {
+                resolvePort(port);
+            });
+        });
+    });
+}
+const issued = new Set();
+/**
+ * Allocates a host port this process has not already handed out. Binding
+ * `127.0.0.1:0` and immediately closing the socket leaves a window where
+ * another process (or another allocate() racing on ITS OWN OS-level choice)
+ * could rebind the same port before the caller's container process starts —
+ * `GenericContainer`'s port-retry loop is the mitigation for that race, not
+ * this function. What this function guarantees is in-process uniqueness:
+ * two calls here never return the same port while either is still issued.
+ */
+export async function allocate() {
+    for (let attempt = 0; attempt < MAX_ALLOCATE_ATTEMPTS; attempt++) {
+        const port = await bindEphemeralPort();
+        if (!issued.has(port)) {
+            issued.add(port);
+            return port;
+        }
+    }
+    throw new Error(`could not allocate a unique free port after ${MAX_ALLOCATE_ATTEMPTS} attempts`);
+}
+/** Releases a port back to the pool. Releasing a port never issued by this process is a harmless no-op. */
+export function release(port) {
+    issued.delete(port);
+}
+/** Test-only observability seam: the ports currently considered issued. */
+export function issuedView() {
+    return new Set(issued);
+}
+export const FreePorts = {
+    /** Allocates a host port this process has not already handed out — see `allocate` above. */
+    allocate,
+    /** Releases a port back to the pool — see `release` above. */
+    release,
+    /** Test-only observability seam — see `issuedView` above. */
+    issuedView,
+};
+//# sourceMappingURL=free-ports.js.map

package/dist/core/free-ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-ports.js","sourceRoot":"","sources":["../../src/core/free-ports.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAEhC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAElC,4EAA4E;AAC5E,uEAAuE;AACvE,2EAA2E;AAC3E,MAAM,SAAS,GAAG,WAAW,CAAC;AAE9B,SAAS,iBAAiB;IACxB,OAAO,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC3B,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,UAAU,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBAChB,WAAW,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;AAEjC;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ;IAC5B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,qBAAqB,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,MAAM,iBAAiB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,qBAAqB,WAAW,CAAC,CAAC;AACnG,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,4FAA4F;IAC5F,QAAQ;IACR,8DAA8D;IAC9D,OAAO;IACP,6DAA6D;IAC7D,UAAU;CACX,CAAC"}

package/dist/core/generic-container.d.ts

@@ -0,0 +1,145 @@
+import { Network } from "./network.js";
+import type { NetworkMember } from "./network.js";
+import type { WaitStrategy } from "./wait.js";
+import type { SandboxBackend, FollowHandle } from "./backend.js";
+import type { ContainerSpec, ExecResult } from "./model.js";
+import type { MountableFile } from "./mountable-file.js";
+/**
+ * The builder, launcher, and lifecycle guard for a single container — the
+ * one class every module (`RedisContainer`, `PostgresContainer`, …)
+ * subclasses, and the type you reach for directly for any image without a
+ * dedicated module.
+ *
+ * The instance itself is the guard: after `start()` it implements
+ * `Symbol.asyncDispose`, so `await using c = await new GenericContainer(img).start()`
+ * tears the container down at scope exit — the direct analog of the Kotlin
+ * `AutoCloseable` and Rust's RAII guard, expressed with TC39 explicit
+ * resource management. Prefer `await using` in tests; use explicit
+ * `start()`/`stop()` where a `using` scope can't span a framework hook
+ * (Jest/Vitest `beforeAll`/`afterAll`, `node:test`'s `before`/`after`).
+ *
+ * Builder methods (`withEnv`, `withExposedPorts`, …) mutate and return
+ * `this` for chaining; none of them perform I/O. All I/O happens in
+ * `start()`, `stop()`, `exec()`, `logs()`, and `followOutput()`.
+ */
+export declare class GenericContainer implements AsyncDisposable, NetworkMember {
+    private readonly image;
+    private envPairs;
+    private exposedPorts;
+    private command;
+    private network;
+    private aliasNames;
+    private mounts;
+    private waitStrategy;
+    private memoryLimitMb;
+    private backendOverride;
+    private handle;
+    private backend;
+    private mappedPorts;
+    private running;
+    /** Builds against `image` (e.g. `"redis:8.6-alpine"`); no I/O happens until `start()`. */
+    constructor(image: string);
+    /** Convenience: `new GenericContainer(image).start()`. */
+    static start(image: string): Promise<GenericContainer>;
+    /** Sets an environment variable visible to the workload. Last-write-wins if called again with the same key; insertion order is otherwise preserved. */
+    withEnv(key: string, value: string): this;
+    /** Publishes these guest ports to pre-allocated host ports (see `FreePorts`); read back with `getMappedPort`. */
+    withExposedPorts(...ports: number[]): this;
+    /** Overrides the image's default ENTRYPOINT/CMD. Omit this call entirely to run the image unmodified. */
+    withCommand(...cmd: string[]): this;
+    /** Joins a `Network`, making this container reachable from (and to) its running siblings by alias. */
+    withNetwork(net: Network): this;
+    /** Names this container answers to on its network — resolved via `Network.resolve(alias, port)` by other members. */
+    withNetworkAliases(...names: string[]): this;
+    /** Copies a host file into the guest before boot, at `guestPath`. Read-only is enforced on docker; advisory only on msb (current microsandbox releases do not enforce guest-side read-only mounts). */
+    withCopyFileToContainer(file: MountableFile, guestPath: string): this;
+    /** Sets the readiness check `start()` waits on before returning. Defaults to `Wait.forListeningPort()`. */
+    waitingFor(strategy: WaitStrategy): this;
+    /** Raises the container's memory ceiling (in MB) above the backend default — required by several JVM-heavy modules; see each module's own doc for its pin. */
+    withMemoryLimit(megabytes: number): this;
+    /** Test/advanced seam: pin the backend instead of resolving `Backends.active()`. */
+    withBackend(backend: SandboxBackend): this;
+    /** Module hook: override to adjust the spec once mapped host ports are known (e.g. advertised listeners). */
+    protected customizeSpec(spec: ContainerSpec, _mapped: (guest: number) => number): ContainerSpec;
+    /** Module hook: runs after the container is ready (e.g. `rs.initiate` for a Mongo replica set). */
+    protected containerIsStarted(): Promise<void>;
+    /**
+     * Module hook: runs the instant `start()` has resolved a backend — before
+     * `ensureNetwork`, port allocation, or the container is created/booted at
+     * all. The one hook that lets a module reject a backend-incompatible
+     * request (e.g. `FlinkContainer.withTaskManager()` on msb) without paying
+     * for a boot first. `containerIsStarted()` (above) fires much later, after
+     * this container is already fully up — fine for post-readiness setup, but
+     * too late to fail fast on a capability the backend never had.
+     */
+    protected containerIsStarting(_backend: SandboxBackend): Promise<void>;
+    /**
+     * Module hook: the backend this container actually started against (only
+     * valid once `start()` has resolved it — i.e. from within
+     * `containerIsStarted()` or later). Lets a module's post-start hook branch
+     * on backend capability, e.g. `FlinkContainer.withTaskManager()` throwing a
+     * typed `UnsupportedByBackendError` on msb instead of attempting a
+     * network-link topology the exec-tunnel emulation can't carry.
+     */
+    protected currentBackend(): SandboxBackend;
+    private resolveBackend;
+    private buildSpec;
+    private allocatePorts;
+    private releasePorts;
+    /**
+     * Resolves a backend, allocates host ports, boots the container, installs
+     * any network links, and waits for readiness — in that order. On ANY
+     * failure partway through (a bad wait strategy, a network-link rejection,
+     * a port conflict exhausting its retries), everything already allocated
+     * or started is torn down to completion BEFORE this rejects: a
+     * half-started container never leaks, and there is no detached
+     * fire-and-forget cleanup running after `start()` has already returned
+     * control to the caller.
+     *
+     * A host-port-bind conflict specifically retries (up to 5 attempts) with
+     * a fresh port before giving up — pre-allocated ports can still lose an
+     * allocate-then-bind race to an unrelated process.
+     */
+    start(): Promise<this>;
+    /**
+     * Stops and removes the backend-native resource, releases its host ports,
+     * and clears the port map. Idempotent — stopping a container that never
+     * started, or stopping twice, is a harmless no-op the second time. Errors
+     * from the backend's own stop/remove calls are swallowed (best-effort
+     * teardown); this method itself never throws.
+     */
+    stop(): Promise<void>;
+    /** `= stop()`. What `await using c = await new GenericContainer(img).start()` calls at scope exit; never throws. */
+    [Symbol.asyncDispose](): Promise<void>;
+    /** Whether `start()` has completed and `stop()` has not yet run. */
+    get isRunning(): boolean;
+    /** Always `"127.0.0.1"` — every published port is bound loopback-only, on both backends. */
+    get host(): string;
+    /** Names this container answers to on its network (set via `withNetworkAliases`). Part of the `NetworkMember` contract `Network` uses to compute links. */
+    get aliases(): ReadonlyArray<string>;
+    /** Every guest port this container published (set via `withExposedPorts`). Part of the `NetworkMember` contract `Network` uses to compute links. */
+    get exposedGuestPorts(): ReadonlyArray<number>;
+    /**
+     * The host port bound to `guestPort`. Throws distinct messages for the
+     * two ways this can be wrong: not running at all ("call start() first"),
+     * versus running but never exposed via `withExposedPorts` ("call
+     * withExposedPorts(N)").
+     */
+    getMappedPort(guestPort: number): number;
+    /** Alias for `getMappedPort`, satisfying the `NetworkMember`/`WaitTarget` shape (which name this method `mappedPort`). */
+    mappedPort(guestPort: number): number;
+    private requireHandle;
+    /** Runs a one-shot command inside the running container and waits for it to exit. Throws if the container is not running. */
+    exec(...cmd: string[]): Promise<ExecResult>;
+    /** Fetches the workload's logs so far (a bounded tail), as a single string. Throws if the container is not running. */
+    logs(): Promise<string>;
+    /**
+     * Streams log lines to `consumer` as they're produced, in order, with no
+     * duplicates — including the final unterminated fragment after the
+     * workload exits, delivered exactly once. Call `close()` on the returned
+     * handle to stop delivery without flushing anything further.
+     */
+    followOutput(consumer: (line: string) => void): Promise<FollowHandle>;
+    private asWaitTarget;
+}
+//# sourceMappingURL=generic-container.d.ts.map

package/dist/core/generic-container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic-container.d.ts","sourceRoot":"","sources":["../../src/core/generic-container.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAc,MAAM,WAAW,CAAC;AAE1D,OAAO,KAAK,EAAE,cAAc,EAAiB,YAAY,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,aAAa,EAAa,UAAU,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAyCzD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,gBAAiB,YAAW,eAAe,EAAE,aAAa;IACrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAA+B;IAC/C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,OAAO,CAAsB;IACrC,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,YAAY,CAAyC;IAC7D,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,eAAe,CAA6B;IAEpD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,WAAW,CAAkC;IACrD,OAAO,CAAC,OAAO,CAAS;IAExB,0FAA0F;gBAC9E,KAAK,EAAE,MAAM;IAIzB,0DAA0D;WAC7C,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAI5D,uJAAuJ;IACvJ,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IASzC,iHAAiH;IACjH,gBAAgB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK1C,yGAAyG;IACzG,WAAW,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,IAAI;IAKnC,sGAAsG;IACtG,WAAW,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI;IAK/B,qHAAqH;IACrH,kBAAkB,CAAC,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAK5C,uMAAuM;IACvM,uBAAuB,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAKrE,2GAA2G;IAC3G,UAAU,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI;IAKxC,8JAA8J;IAC9J,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKxC,oFAAoF;IACpF,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAK1C,6GAA6G;IAC7G,SAAS,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,aAAa;IAI/F,mGAAmG;IACnG,SAAS,CAAC,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI7C;;;;;;;;OAQG;IACH,SAAS,CAAC,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAItE;;;;;;;OAOG;IACH,SAAS,CAAC,cAAc,IAAI,cAAc;IAI1C,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,SAAS;YA2BH,aAAa;IAQ3B,OAAO,CAAC,YAAY;IAMpB;;;;;;;;;;;;;OAaG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAgF5B;;;;;;OAMG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAgB3B,oHAAoH;IAC9G,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5C,oEAAoE;IACpE,IAAI,SAAS,IAAI,OAAO,CAEvB;IAED,4FAA4F;IAC5F,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,2JAA2J;IAC3J,IAAI,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,CAEnC;IAED,oJAAoJ;IACpJ,IAAI,iBAAiB,IAAI,aAAa,CAAC,MAAM,CAAC,CAE7C;IAED;;;;;OAKG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWxC,0HAA0H;IAC1H,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAIrC,OAAO,CAAC,aAAa;IAOrB,6HAA6H;IACvH,IAAI,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;IAKjD,uHAAuH;IACjH,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC;IAK7B;;;;;OAKG;IACG,YAAY,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;IAK3E,OAAO,CAAC,YAAY;CASrB"}