rightsize 0.7.10 → 0.7.13

package/dist/core/model.d.ts

@@ -1,9 +1,29 @@
+/**
+ * The transport a published port speaks. `"tcp"` is the long-standing
+ * default — every producer of a `PortBinding` before this type existed
+ * always meant TCP, so a value here is never optional: every current
+ * producer (`GenericContainer.buildSpec`/`buildReuseSpec`,
+ * `fromCheckpointRegistryEntry`) tags it explicitly. A DESERIALIZED entry
+ * (the checkpoint registry) is the one place a missing tag can still show up
+ * — on-disk records written before this field existed — and that boundary
+ * normalizes a missing value to `"tcp"` rather than requiring it, so an old
+ * registry file keeps reading correctly.
+ */
+export type PortProtocol = "tcp" | "udp";
 /** A published container port: a host port already chosen, mapped to the port the workload listens on inside the guest. */
 export interface PortBinding {
-    /** The host-side port, pre-allocated by `FreePorts`. */
+    /** The host-side port, pre-allocated by `FreePorts` (TCP) or its UDP counterpart. */
     readonly hostPort: number;
     /** The port the workload listens on inside the guest. */
     readonly guestPort: number;
+    /**
+     * The transport this binding publishes over. A container may expose the
+     * SAME numeric `guestPort` on both protocols (DNS's 53, say) — each
+     * protocol gets its own independent host-port mapping, never a shared
+     * bare-int key, which is exactly why this field exists rather than
+     * inferring transport from the port number alone.
+     */
+    readonly protocol: PortProtocol;
 }
 /** A host path mounted into the guest before boot. `readOnly` is `false` via the builder (`withCopyFileToContainer`). */
 export interface FileMount {
@@ -110,6 +130,22 @@ export interface ContainerSpec {
      * hash, the same as `memoryLimitMb`.
      */
     readonly networkDisabled: boolean;
+    /**
+     * The host loopback UDP ports this sandbox's network links need to reach —
+     * the distinct, ascending-sorted `targetHostPort`s of the UDP-protocol
+     * links `GenericContainer.start()` computes for this boot, filled in
+     * before `backend.create()` so a backend that routes links through the
+     * host (msb) can open exactly these ports in the SAME argv that boots the
+     * sandbox. `undefined`/absent means none — every current producer sets it
+     * explicitly, the same convention `mounts`/`aliases` follow with an empty
+     * array rather than leaving it out; absent only ever shows up on a
+     * hand-built spec that predates this field. docker ignores it — its
+     * native bridge network already carries UDP with no per-link declaration.
+     * Per-run wiring, never identity: never written to the named-checkpoint
+     * registry, never part of the reuse identity hash, never added to the
+     * pinned diagnostics report format.
+     */
+    readonly hostUdpEgressPorts?: readonly number[];
 }
 /**
  * The result of `GenericContainer.checkpoint()`: a ref to the committed

package/dist/core/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yHAAyH;AACzH,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+JAA+J;IAC/J,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8IAA8I;IAC9I,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/core/model.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,CAAC;AAEzC,2HAA2H;AAC3H,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC;AAED,yHAAyH;AACzH,MAAM,WAAW,SAAS;IACxB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,kEAAkE;AAClE,MAAM,WAAW,UAAU;IACzB,uCAAuC;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,wEAAwE;IACxE,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpD;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;IAC3C,iEAAiE;IACjE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C,qDAAqD;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IACvC,sDAAsD;IACtD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,+JAA+J;IAC/J,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8IAA8I;IAC9I,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;CAC9B"}

package/dist/core/network.d.ts

@@ -10,10 +10,14 @@ export interface NetworkMember {
     readonly aliases: ReadonlyArray<string>;
     /** Whether this member is currently running (a stopped member is never linked to). */
     readonly isRunning: boolean;
-    /** Guest ports this member has exposed. */
+    /** Guest ports this member has exposed over TCP. */
     readonly exposedGuestPorts: ReadonlyArray<number>;
-    /** The host port bound to `guestPort`. */
+    /** The TCP host port bound to `guestPort`. */
     mappedPort(guestPort: number): number;
+    /** Guest ports this member has exposed over UDP (`withExposedUdpPorts`) — a separate list from `exposedGuestPorts`, never merged with it. */
+    readonly exposedUdpGuestPorts: ReadonlyArray<number>;
+    /** The UDP host port bound to `guestPort`. */
+    mappedUdpPort(guestPort: number): number;
 }
 /**
  * Alias-based connectivity between containers, on both backends. Docker

package/dist/core/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/core/network.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,2CAA2C;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,0CAA0C;IAC1C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACvC;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,OAAQ,YAAW,eAAe;IAC7C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0C;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,WAAW,CAA6B;IAEhD,OAAO;IAIP,2HAA2H;IAC3H,MAAM,CAAC,UAAU,IAAI,OAAO;IAI5B,qGAAqG;IACrG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAQjD;;;;;OAKG;IACH,iBAAiB,IAAI,aAAa,CAAC,WAAW,CAAC;IAe/C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAe9F,oGAAoG;IAC9F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,sFAAsF;IAChF,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7C"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/core/network.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGhE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,sFAAsF;IACtF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,oDAAoD;IACpD,QAAQ,CAAC,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAClD,8CAA8C;IAC9C,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC,6IAA6I;IAC7I,QAAQ,CAAC,oBAAoB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrD,8CAA8C;IAC9C,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1C;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,OAAQ,YAAW,eAAe;IAC7C,yDAAyD;IACzD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA0C;IACrE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,WAAW,CAA6B;IAEhD,OAAO;IAIP,2HAA2H;IAC3H,MAAM,CAAC,UAAU,IAAI,OAAO;IAI5B,qGAAqG;IACrG,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM;IAQjD;;;;;OAKG;IACH,iBAAiB,IAAI,aAAa,CAAC,WAAW,CAAC;IAkB/C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI;IAe9F,oGAAoG;IAC9F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B,sFAAsF;IAChF,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7C"}

package/dist/core/network.js

@@ -46,7 +46,10 @@ export class Network {
             }
             for (const alias of member.aliases) {
                 for (const guestPort of member.exposedGuestPorts) {
-                    links.push({ alias, guestPort, targetHostPort: member.mappedPort(guestPort) });
+                    links.push({ alias, guestPort, targetHostPort: member.mappedPort(guestPort), protocol: "tcp" });
+                }
+                for (const guestPort of member.exposedUdpGuestPorts) {
+                    links.push({ alias, guestPort, targetHostPort: member.mappedUdpPort(guestPort), protocol: "udp" });
                 }
             }
         }

package/dist/core/network.js.map

@@ -1 +1 @@
-{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/core/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuBlD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,OAAO;IAClB,yDAAyD;IAChD,EAAE,CAAS;IACH,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,OAAO,GAAuB,EAAE,CAAC;IAC1C,WAAW,CAA6B;IAEhD,YAAoB,EAAU;QAC5B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,2HAA2H;IAC3H,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,qGAAqG;IACrG,OAAO,CAAC,KAAa,EAAE,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,EAAE,iBAAiB,KAAK,yBAAyB,SAAS,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACf,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,MAAqB,EAAE,OAA8B,EAAE,OAAuB;QACrF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"network.js","sourceRoot":"","sources":["../../src/core/network.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AA2BlD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,OAAO;IAClB,yDAAyD;IAChD,EAAE,CAAS;IACH,UAAU,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,OAAO,GAAuB,EAAE,CAAC;IAC1C,WAAW,CAA6B;IAEhD,YAAoB,EAAU;QAC5B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACf,CAAC;IAED,2HAA2H;IAC3H,MAAM,CAAC,UAAU;QACf,OAAO,IAAI,OAAO,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,qGAAqG;IACrG,OAAO,CAAC,KAAa,EAAE,SAAiB;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,EAAE,iBAAiB,KAAK,yBAAyB,SAAS,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,OAAO,GAAG,KAAK,IAAI,SAAS,EAAE,CAAC;IACjC,CAAC;IAED;;;;;OAKG;IACH,iBAAiB;QACf,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,KAAK,MAAM,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACtB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;oBACjD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBAClG,CAAC;gBACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,oBAAoB,EAAE,CAAC;oBACpD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;gBACrG,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,QAAQ,CAAC,MAAqB,EAAE,OAA8B,EAAE,OAAuB;QACrF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,KAAK,GAAG,IAAI,GAAG,EAAE,CAAC;gBAClB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;gBACjD,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,oGAAoG;IACpG,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,sFAAsF;IACtF,KAAK,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF"}

package/dist/core/reuse/hash.d.ts

@@ -15,6 +15,18 @@ export interface ReuseIdentitySpec {
     readonly command: ReadonlyArray<string> | undefined;
     /** Order does not affect the hash (canonicalized by sorting ascending). */
     readonly exposedPorts: ReadonlyArray<number>;
+    /**
+     * UDP-exposed guest ports (`withExposedUdpPorts`) — a separate list from
+     * `exposedPorts`, never merged with it: a container exposing guest port 53
+     * on both protocols must hash differently from one exposing only 53/tcp or
+     * only 53/udp, so protocol is part of identity, not just the port number.
+     * Order does not affect the hash (canonicalized by sorting ascending); an
+     * empty array is omitted from the canonical form entirely, so a spec that
+     * never calls `withExposedUdpPorts` hashes exactly as it did before this
+     * field existed (see the pinned cross-language contract vector in
+     * `hash.test.ts`).
+     */
+    readonly exposedUdpPorts: ReadonlyArray<number>;
     readonly memoryLimitMb: number | undefined;
     /** Order does not affect the hash (canonicalized by sorting on `guestPath`); content is hashed from `hostPath` at call time. */
     readonly copies: ReadonlyArray<{

package/dist/core/reuse/hash.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iIAAiI;IACjI,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpD,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,gIAAgI;IAChI,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAqED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,iIAAiI;IACjI,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;IACpD,2EAA2E;IAC3E,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC7C;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3C,gIAAgI;IAChI,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1F,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,gGAAgG;IAChG,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAuED;;;;;GAKG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAGxE;AAED,gGAAgG;AAChG,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C"}

package/dist/core/reuse/hash.js

@@ -38,6 +38,7 @@ async function canonicalize(spec) {
         ...(spec.diskLimitMb !== undefined ? { diskLimitMb: spec.diskLimitMb } : {}),
         ...(spec.tmpfsRootMb !== undefined ? { tmpfsRootMb: spec.tmpfsRootMb } : {}),
         ...(spec.networkDisabled ? { networkDisabled: true } : {}),
+        ...(spec.exposedUdpPorts.length > 0 ? { exposedUdpPorts: [...spec.exposedUdpPorts].sort((a, b) => a - b) } : {}),
     };
 }
 /**

package/dist/core/reuse/hash.js.map

@@ -1 +1 @@
-{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AAkDxC,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CAAC,IAAuB;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC7C,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB;IACrD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../../src/core/reuse/hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AA+DxC,SAAS,cAAc,CAAC,CAAS,EAAE,CAAS;IAC1C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,QAAgB;IAC7C,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC7C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;GAUG;AACH,KAAK,UAAU,YAAY,CAAC,IAAuB;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC;KAC7C,CAAC,CAAC,CACJ,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG;QACH,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;QAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1D,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;QACzC,MAAM;QACN,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAuB;IACrD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC"}

package/dist/core/reuse/registry.d.ts

@@ -9,11 +9,20 @@
 export interface ReuseRegistryEntry {
     readonly name: string;
     readonly image: string;
-    /** `{"<guestPort>": <hostPort>, ...}` — JSON object keys are always strings, so the guest port is stringified. */
+    /** `{"<guestPort>": <hostPort>, ...}` — TCP ports only. JSON object keys are always strings, so the guest port is stringified. */
     readonly ports: Record<string, number>;
     readonly createdIso: string;
     /** The backend name (e.g. `"microsandbox"`, `"docker"`) that created this sandbox — informational; adopt always re-verifies liveness through the CURRENTLY active backend regardless of this value. */
     readonly backend: string;
+    /**
+     * The UDP counterpart of `ports` (`withExposedUdpPorts`), kept as a
+     * SEPARATE map so a bare-int guest port never has to serve as a key
+     * shared between protocols. ADDITIVE and OPTIONAL: absent on every entry
+     * written before UDP exposure existed — a reader treats a missing value
+     * as "no UDP ports were ever exposed" (normalizes to `{}`), never as
+     * corrupt.
+     */
+    readonly udpPorts?: Record<string, number>;
 }
 /** `<cacheDir>/reuse` — the directory every reuse registry file lives under. */
 export declare function reuseDir(cacheDir: string): string;

package/dist/core/reuse/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kHAAkH;IAClH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uMAAuM;IACvM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,2BAA2B;AAC3B,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAsBD,uPAAuP;AACvP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB9F;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlH;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/core/reuse/registry.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kIAAkI;IAClI,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,uMAAuM;IACvM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAED,gFAAgF;AAChF,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,2BAA2B;AAC3B,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhE;AAoCD,uPAAuP;AACvP,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,CAAC;AAEnE;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAiB9F;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlH;AAED,sFAAsF;AACtF,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAElF"}

package/dist/core/reuse/registry.js

@@ -23,7 +23,21 @@ function isRegistryEntry(value) {
     if (typeof ports !== "object" || ports === null || Array.isArray(ports)) {
         return false;
     }
-    return Object.values(ports).every((v) => typeof v === "number");
+    if (!Object.values(ports).every((v) => typeof v === "number")) {
+        return false;
+    }
+    // Additive and optional (see ReuseRegistryEntry's own doc): an entry
+    // written before UDP exposure existed simply omits the key.
+    const udpPorts = rec["udpPorts"];
+    if (udpPorts !== undefined) {
+        if (typeof udpPorts !== "object" || udpPorts === null || Array.isArray(udpPorts)) {
+            return false;
+        }
+        if (!Object.values(udpPorts).every((v) => typeof v === "number")) {
+            return false;
+        }
+    }
+    return true;
 }
 /**
  * Reads and parses `reuse/<hash>.json`. `"missing"` means the file does not

package/dist/core/reuse/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/core/reuse/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAoBlC,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IACE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAChC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;AAC7F,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAY,EAAE,KAAyB;IACjG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IACjE,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9D,CAAC"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/core/reuse/registry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,GAAG,MAAM,kBAAkB,CAAC;AACxC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA6BlC,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,2BAA2B;AAC3B,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY;IACtD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IACE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC/B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ;QAChC,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrC,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,EAClC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACzF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,qEAAqE;IACrE,4DAA4D;IAC5D,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAmC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC5F,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAQD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IAC/D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,IAAY,EAAE,KAAyB;IACjG,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC7E,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAChD,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,IAAY;IACjE,MAAM,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/index.d.ts

@@ -16,7 +16,7 @@
  */
 export { UnsupportedByBackendError, PortBindConflictError, ContainerLaunchError, BackendError, ProvisionError, ReuseWithNetworkError, IsolationRequiredError, CheckpointUnsupportedError, CheckpointBackendMismatchError, ReuseFromCheckpointError, CheckpointRestoreEnvOverrideError, RelativeContainerPathError, InvalidCheckpointNameError, CheckpointArtifactMissingError, MalformedCheckpointArchiveError, IncompatibleImageError, RootDiskConflictError, TmpfsRootExceedsMemoryError, NetworkDisabledConflictError, TmpfsRootCheckpointError, CheckpointWorkloadCommandMissingError, } from "./core/errors.js";
 export { DockerImageName } from "./core/docker-image-name.js";
-export type { PortBinding, FileMount, ExecResult, ContainerSpec, Checkpoint } from "./core/model.js";
+export type { PortBinding, PortProtocol, FileMount, ExecResult, ContainerSpec, Checkpoint } from "./core/model.js";
 export type { NetworkLink, SandboxHandle, FollowHandle, SandboxBackend, BackendProvider, ReaperKillCommand, BackendCapabilities, } from "./core/backend.js";
 export { registerBackend, Backends } from "./core/backends.js";
 export { FreePorts } from "./core/free-ports.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrG,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,sBAAsB,EACtB,0BAA0B,EAC1B,8BAA8B,EAC9B,wBAAwB,EACxB,iCAAiC,EACjC,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,+BAA+B,EAC/B,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,4BAA4B,EAC5B,wBAAwB,EACxB,qCAAqC,GACtC,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACnH,YAAY,EACV,WAAW,EACX,aAAa,EACb,YAAY,EACZ,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,YAAY,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACzE,YAAY,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/modules/cassandra.d.ts

@@ -6,16 +6,15 @@ import { DockerImageName } from "../core/docker-image-name.js";
  * No-arg construction floats to `cassandra:latest`, so the version tracks
  * upstream rather than this library's release cycle (verified against
  * `cassandra:5.0.8`, including every fact below — the `GPG_KEYS` override
- * stays unconditional regardless of which version ends up running, since
- * it's a no-op against a build that never baked the problem tab and required
- * against one that does).
+ * stays unconditional regardless of which version ends up running: a
+ * harmless no-op on the pinned msb either way).
  *
- * ### `GPG_KEYS` must be overridden — this is the difference between booting and aborting
+ * ### `GPG_KEYS` is cleared as a guard for older msb releases
  *
  * `cassandra:5.0.8`'s baked-in `GPG_KEYS` build arg contains a literal TAB
- * character, and msb panics on any image whose baked env contains one — 0.6.6
- * and the pinned 0.6.8 alike
- * — before the guest even boots:
+ * character. On older msb releases (0.6.x) that character panicked the VM
+ * builder on any image whose baked env carried one, before the guest even
+ * booted:
  *
  * ```
  * sandbox process exited (signal: 6 (SIGABRT)) before agent relay became available
@@ -27,11 +26,12 @@ import { DockerImageName } from "../core/docker-image-name.js";
  * panicked at msb_krun_vmm-0.1.25/src/builder.rs:1154: ... Err value: InvalidAscii
  * ```
  *
- * `GPG_KEYS` is consumed only at image-build time (verifying the signing
- * keys baked into that layer) — it has no effect on the running container,
- * so overriding it to an empty, tab-free string here is safe and required.
- * Without this override, `start()` never gets far enough to run its own
- * wait strategy at all.
+ * The pinned msb boots this image fine with no override at all. `GPG_KEYS`
+ * is consumed only at image-build time (verifying the signing keys baked
+ * into that layer) — it has no effect on the running container, so
+ * overriding it to an empty, tab-free string here is safe and kept
+ * unconditionally as a guard (for example, for anyone pointing `MSB_PATH`
+ * at an older msb).
  *
  * ### Heap sized down, memory ceiling measured
  *

package/dist/modules/cassandra.js

@@ -11,16 +11,15 @@ const DEFAULT_IMAGE = "cassandra:latest";
  * No-arg construction floats to `cassandra:latest`, so the version tracks
  * upstream rather than this library's release cycle (verified against
  * `cassandra:5.0.8`, including every fact below — the `GPG_KEYS` override
- * stays unconditional regardless of which version ends up running, since
- * it's a no-op against a build that never baked the problem tab and required
- * against one that does).
+ * stays unconditional regardless of which version ends up running: a
+ * harmless no-op on the pinned msb either way).
  *
- * ### `GPG_KEYS` must be overridden — this is the difference between booting and aborting
+ * ### `GPG_KEYS` is cleared as a guard for older msb releases
  *
  * `cassandra:5.0.8`'s baked-in `GPG_KEYS` build arg contains a literal TAB
- * character, and msb panics on any image whose baked env contains one — 0.6.6
- * and the pinned 0.6.8 alike
- * — before the guest even boots:
+ * character. On older msb releases (0.6.x) that character panicked the VM
+ * builder on any image whose baked env carried one, before the guest even
+ * booted:
  *
  * ```
  * sandbox process exited (signal: 6 (SIGABRT)) before agent relay became available
@@ -32,11 +31,12 @@ const DEFAULT_IMAGE = "cassandra:latest";
  * panicked at msb_krun_vmm-0.1.25/src/builder.rs:1154: ... Err value: InvalidAscii
  * ```
  *
- * `GPG_KEYS` is consumed only at image-build time (verifying the signing
- * keys baked into that layer) — it has no effect on the running container,
- * so overriding it to an empty, tab-free string here is safe and required.
- * Without this override, `start()` never gets far enough to run its own
- * wait strategy at all.
+ * The pinned msb boots this image fine with no override at all. `GPG_KEYS`
+ * is consumed only at image-build time (verifying the signing keys baked
+ * into that layer) — it has no effect on the running container, so
+ * overriding it to an empty, tab-free string here is safe and kept
+ * unconditionally as a guard (for example, for anyone pointing `MSB_PATH`
+ * at an older msb).
  *
  * ### Heap sized down, memory ceiling measured
  *
@@ -54,7 +54,7 @@ export class CassandraContainer extends GenericContainer {
     constructor(image = DEFAULT_IMAGE) {
         super(DockerImageName.requireCompatible(image, EXPECTED_REPOSITORY));
         this.withExposedPorts(CQL_PORT)
-            // Required — see the class doc for the exact panic this avoids.
+            // Guard for older msb releases — see the class doc for the exact panic this avoids.
             .withEnv("GPG_KEYS", "")
             .withEnv("MAX_HEAP_SIZE", "512M")
             .withEnv("HEAP_NEWSIZE", "128M")

package/dist/modules/cassandra.js.map

@@ -1 +1 @@
-{"version":3,"file":"cassandra.js","sourceRoot":"","sources":["../../src/modules/cassandra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC7B,gEAAgE;aAC/D,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;aAChC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;aAC/B,eAAe,CAAC,IAAI,CAAC;aACrB,UAAU,CACT,IAAI,CAAC,aAAa,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CACvG,CAAC;IACN,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAuB,CAAC;IAC7E,CAAC;IAED,uGAAuG;IACvG,IAAI,YAAY;QACd,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,uJAAuJ;IACvJ,IAAI,eAAe;QACjB,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}
+{"version":3,"file":"cassandra.js","sourceRoot":"","sources":["../../src/modules/cassandra.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AACxC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC7B,oFAAoF;aACnF,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;aACvB,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC;aAChC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC;aAC/B,eAAe,CAAC,IAAI,CAAC;aACrB,UAAU,CACT,IAAI,CAAC,aAAa,CAAC,wCAAwC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CACvG,CAAC;IACN,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAuB,CAAC;IAC7E,CAAC;IAED,uGAAuG;IACvG,IAAI,YAAY;QACd,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,uJAAuJ;IACvJ,IAAI,eAAe;QACjB,OAAO,aAAa,CAAC;IACvB,CAAC;CACF"}

package/dist/modules/minio.d.ts

@@ -17,11 +17,14 @@ import { DockerImageName } from "../core/docker-image-name.js";
  * Readiness is a protocol-aware HTTP check against `/minio/health/live` on
  * the API port — verified answering 200 on the very first poll after boot.
  *
- * No-arg construction floats to `quay.io/minio/minio:latest` (Docker Hub's
- * `minio/minio` repository was removed upstream — see `DEFAULT_IMAGE`'s own
- * comment), so the version tracks upstream rather than this library's
- * release cycle (verified against `minio/minio:RELEASE.2025-09-07T16-13-09Z`,
- * before the Docker Hub removal).
+ * No-arg construction floats to `pgsty/minio:latest` (see `DEFAULT_IMAGE`
+ * for why), so the version moves with that image's releases rather than
+ * this library's. `minio/minio` and `quay.io/minio/minio` images are still
+ * accepted. Verified against `minio/minio:RELEASE.2025-09-07T16-13-09Z`;
+ * readiness, auth enforcement, and the `mc` round-trip were verified again
+ * by this module's integration test against
+ * `pgsty/minio:RELEASE.2026-08-04T00-00-00Z` (what `latest` pointed at) on
+ * msb 0.7.3.
  */
 export declare class MinIOContainer extends GenericContainer {
     private rootUserState;

package/dist/modules/minio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../src/modules/minio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAe/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IAClD,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,iBAAiB,CAAkB;gBAE/B,KAAK,GAAE,MAAM,GAAG,eAA+B;WAcrC,KAAK,CAAC,KAAK,GAAE,MAAM,GAAG,eAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrG,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKhC,kHAAkH;IAClH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKxC,qDAAqD;IACrD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,6DAA6D;IAC7D,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uDAAuD;IACvD,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}
+{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../src/modules/minio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAyB/D;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAe,SAAQ,gBAAgB;IAClD,OAAO,CAAC,aAAa,CAAc;IACnC,OAAO,CAAC,iBAAiB,CAAkB;gBAE/B,KAAK,GAAE,MAAM,GAAG,eAA+B;WAcrC,KAAK,CAAC,KAAK,GAAE,MAAM,GAAG,eAA+B,GAAG,OAAO,CAAC,cAAc,CAAC;IAIrG,wDAAwD;IACxD,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKhC,kHAAkH;IAClH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKxC,qDAAqD;IACrD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,6DAA6D;IAC7D,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,uDAAuD;IACvD,IAAI,WAAW,IAAI,MAAM,CAExB;CACF"}

package/dist/modules/minio.js

@@ -4,15 +4,24 @@ import { DockerImageName } from "../core/docker-image-name.js";
 const API_PORT = 9000;
 const CONSOLE_PORT = 9001;
 const EXPECTED_REPOSITORY = "minio/minio";
-// Docker Hub's `minio/minio` repository has been removed upstream (`docker
-// pull minio/minio` now fails with "repository does not exist") — the
-// default floats to `quay.io/minio/minio:latest`, MinIO's maintained mirror,
-// instead. `requireCompatible` below strips the registry host before
-// comparing against EXPECTED_REPOSITORY, so this is the only line that
-// needed to change: a caller-supplied `minio/minio:<tag>` override (from a
-// mirror that still serves it, or a private registry) and a
-// `quay.io/minio/minio:<tag>` override are both still accepted, unchanged.
-const DEFAULT_IMAGE = "quay.io/minio/minio:latest";
+// MinIO no longer publishes public images: Docker Hub's `minio/minio` was
+// removed, and as of September 2026 `quay.io/minio/minio`, this module's
+// previous default, refuses anonymous pulls (HTTP 401). `pgsty/minio` is
+// Pigsty's community build of MinIO from source, published on Docker Hub
+// for linux/amd64 and linux/arm64 with upstream's image layout (the same
+// entrypoint and env defaults, `mc` bundled).
+const DEFAULT_IMAGE = "pgsty/minio:latest";
+const PGSTY_REPOSITORY = "pgsty/minio";
+/**
+ * `pgsty/minio` is this module's own default, so it counts as a substitute
+ * for `EXPECTED_REPOSITORY` without the caller declaring it. Every other
+ * image, including `minio/minio` and `quay.io/minio/minio`, passes through
+ * unchanged for `requireCompatible` to check as usual.
+ */
+function resolveCompatibleImage(image) {
+    const name = typeof image === "string" ? DockerImageName.parse(image) : image;
+    return name.repository === PGSTY_REPOSITORY ? name.asCompatibleSubstituteFor(EXPECTED_REPOSITORY) : image;
+}
 /**
  * A single-node MinIO container — an S3-compatible object store. Requires
  * an explicit command: the image's default ENTRYPOINT alone does not serve,
@@ -30,24 +39,27 @@ const DEFAULT_IMAGE = "quay.io/minio/minio:latest";
  * Readiness is a protocol-aware HTTP check against `/minio/health/live` on
  * the API port — verified answering 200 on the very first poll after boot.
  *
- * No-arg construction floats to `quay.io/minio/minio:latest` (Docker Hub's
- * `minio/minio` repository was removed upstream — see `DEFAULT_IMAGE`'s own
- * comment), so the version tracks upstream rather than this library's
- * release cycle (verified against `minio/minio:RELEASE.2025-09-07T16-13-09Z`,
- * before the Docker Hub removal).
+ * No-arg construction floats to `pgsty/minio:latest` (see `DEFAULT_IMAGE`
+ * for why), so the version moves with that image's releases rather than
+ * this library's. `minio/minio` and `quay.io/minio/minio` images are still
+ * accepted. Verified against `minio/minio:RELEASE.2025-09-07T16-13-09Z`;
+ * readiness, auth enforcement, and the `mc` round-trip were verified again
+ * by this module's integration test against
+ * `pgsty/minio:RELEASE.2026-08-04T00-00-00Z` (what `latest` pointed at) on
+ * msb 0.7.3.
  */
 export class MinIOContainer extends GenericContainer {
     rootUserState = "testuser";
     rootPasswordState = "testpassword";
     constructor(image = DEFAULT_IMAGE) {
-        super(DockerImageName.requireCompatible(image, EXPECTED_REPOSITORY));
+        super(DockerImageName.requireCompatible(resolveCompatibleImage(image), EXPECTED_REPOSITORY));
         this.withExposedPorts(API_PORT, CONSOLE_PORT)
             .withCommand("server", "/data", "--console-address", ":9001")
             .withEnv("MINIO_ROOT_USER", this.rootUserState)
             .withEnv("MINIO_ROOT_PASSWORD", this.rootPasswordState)
             .waitingFor(Wait.forHttp("/minio/health/live").forPort(API_PORT));
-        // No withMemoryLimit override: the round-trip that verified this module
-        // ran at 1024 MB, but whether MinIO actually needs more than msb's
+        // No withMemoryLimit override: the `minio/minio` round-trip that verified
+        // this module ran at 1024 MB, but whether MinIO actually needs more than msb's
         // default microVM sizing was never isolated in that pass — a floor
         // belongs here once that's measured on its own, not assumed from a
         // number that included the whole round-trip's overhead.

package/dist/modules/minio.js.map

@@ -1 +1 @@
-{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../src/modules/minio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,2EAA2E;AAC3E,sEAAsE;AACtE,6EAA6E;AAC7E,qEAAqE;AACrE,uEAAuE;AACvE,2EAA2E;AAC3E,4DAA4D;AAC5D,2EAA2E;AAC3E,MAAM,aAAa,GAAG,4BAA4B,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IAC1C,aAAa,GAAG,UAAU,CAAC;IAC3B,iBAAiB,GAAG,cAAc,CAAC;IAE3C,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC;aAC1C,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;aAC5D,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC;aAC9C,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;aACtD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,wEAAwE;QACxE,mEAAmE;QACnE,mEAAmE;QACnE,mEAAmE;QACnE,wDAAwD;IAC1D,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAmB,CAAC;IACrE,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,IAAY;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,kHAAkH;IAClH,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,6DAA6D;IAC7D,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW;QACb,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}
+{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../src/modules/minio.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,mBAAmB,GAAG,aAAa,CAAC;AAC1C,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,8CAA8C;AAC9C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAEvC;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,KAA+B;IAC7D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9E,OAAO,IAAI,CAAC,UAAU,KAAK,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,yBAAyB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,OAAO,cAAe,SAAQ,gBAAgB;IAC1C,aAAa,GAAG,UAAU,CAAC;IAC3B,iBAAiB,GAAG,cAAc,CAAC;IAE3C,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC7F,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,YAAY,CAAC;aAC1C,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;aAC5D,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,aAAa,CAAC;aAC9C,OAAO,CAAC,qBAAqB,EAAE,IAAI,CAAC,iBAAiB,CAAC;aACtD,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpE,0EAA0E;QAC1E,+EAA+E;QAC/E,mEAAmE;QACnE,mEAAmE;QACnE,wDAAwD;IAC1D,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAmB,CAAC;IACrE,CAAC;IAED,wDAAwD;IACxD,YAAY,CAAC,IAAY;QACvB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;IAC/C,CAAC;IAED,kHAAkH;IAClH,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,iBAAiB,GAAG,QAAQ,CAAC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,6DAA6D;IAC7D,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,uDAAuD;IACvD,IAAI,WAAW;QACb,OAAO,UAAU,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC;IAC/D,CAAC;CACF"}

package/dist/modules/postgres.d.ts

@@ -11,8 +11,8 @@ import { DockerImageName } from "../core/docker-image-name.js";
  * `postgres:18-alpine`, including the wait-strategy and `DOCKER_PG_LLVM_DEPS`
  * facts below). `latest` is Debian-based rather than Alpine — functionally
  * equivalent, larger to pull. The `DOCKER_PG_LLVM_DEPS` override stays in
- * place regardless: it's a no-op against a build that never baked the
- * problem tab character, and required against one that does.
+ * place regardless: a harmless no-op on the pinned msb either way, and a
+ * guard for anyone running against an older msb.
  */
 export declare class PostgresContainer extends GenericContainer {
     private usernameState;

package/dist/modules/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/modules/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAM/D;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,gBAAgB;IACrD,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,aAAa,CAAU;gBAEnB,KAAK,GAAE,MAAM,GAAG,eAA+B;WAyBrC,KAAK,CAAC,KAAK,GAAE,MAAM,GAAG,eAA+B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIxG,kDAAkD;IAClD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,sDAAsD;IACtD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,gDAAgD;IAChD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,qDAAqD;IACrD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,yDAAyD;IACzD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,qDAAqD;IACrD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,oFAAoF;IACpF,IAAI,gBAAgB,IAAI,MAAM,CAE7B;CACF"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/modules/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAEhE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAM/D;;;;;;;;;;;;;GAaG;AACH,qBAAa,iBAAkB,SAAQ,gBAAgB;IACrD,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,aAAa,CAAU;IAC/B,OAAO,CAAC,aAAa,CAAU;gBAEnB,KAAK,GAAE,MAAM,GAAG,eAA+B;WA2BrC,KAAK,CAAC,KAAK,GAAE,MAAM,GAAG,eAA+B,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIxG,kDAAkD;IAClD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,sDAAsD;IACtD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,gDAAgD;IAChD,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAKpC,qDAAqD;IACrD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,yDAAyD;IACzD,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED,qDAAqD;IACrD,IAAI,YAAY,IAAI,MAAM,CAEzB;IAED,oFAAoF;IACpF,IAAI,gBAAgB,IAAI,MAAM,CAE7B;CACF"}

package/dist/modules/postgres.js

@@ -15,8 +15,8 @@ const DEFAULT_IMAGE = "postgres:latest";
  * `postgres:18-alpine`, including the wait-strategy and `DOCKER_PG_LLVM_DEPS`
  * facts below). `latest` is Debian-based rather than Alpine — functionally
  * equivalent, larger to pull. The `DOCKER_PG_LLVM_DEPS` override stays in
- * place regardless: it's a no-op against a build that never baked the
- * problem tab character, and required against one that does.
+ * place regardless: a harmless no-op on the pinned msb either way, and a
+ * guard for anyone running against an older msb.
  */
 export class PostgresContainer extends GenericContainer {
     usernameState = "test";
@@ -30,13 +30,15 @@ export class PostgresContainer extends GenericContainer {
             .withEnv("POSTGRES_DB", this.databaseState)
             // The official postgres:*-alpine image bakes DOCKER_PG_LLVM_DEPS into
             // its manifest with a literal tab character in the value (a
-            // package-list built with `\t\t` continuation). msb's krun VMM
-            // builder panics with InvalidAscii on that boot-env value before the
-            // guest ever starts (reproduced with zero rightsize-set env vars —
-            // it's the image, not us). Docker is unaffected. Overriding the var
-            // here wins over the image default in both backends' env-merge order
-            // and is a no-op for the build the image already baked, so it's a
-            // safe, backend-portable fix rather than an msb-only special case.
+            // package-list built with `\t\t` continuation). On older msb releases
+            // (0.6.x) that boot-env value panicked the krun VMM builder with
+            // InvalidAscii before the guest ever started (reproduced with zero
+            // rightsize-set env vars — it's the image, not us); the pinned msb
+            // boots it fine with no override. Docker is unaffected either way.
+            // Overriding the var here wins over the image default in both
+            // backends' env-merge order and is a no-op for the build the image
+            // already baked, so it's a safe, backend-portable guard rather than an
+            // msb-only special case.
             .withEnv("DOCKER_PG_LLVM_DEPS", "")
             // The postgres entrypoint starts the server once to run initdb
             // scripts against it, shuts it down, then starts it again for real —

package/dist/modules/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/modules/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IAC7C,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IAE/B,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;aAC9B,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;aAC5C,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,aAAa,CAAC;aAChD,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC;YAC3C,sEAAsE;YACtE,4DAA4D;YAC5D,+DAA+D;YAC/D,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,mEAAmE;aAClE,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACnC,+DAA+D;YAC/D,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,sDAAsD;aACrD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAsB,CAAC;IAC3E,CAAC;IAED,kDAAkD;IAClD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,sDAAsD;IACtD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,gDAAgD;IAChD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,qDAAqD;IACrD,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,oFAAoF;IACpF,IAAI,gBAAgB;QAClB,OAAO,cAAc,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IACvI,CAAC;CACF"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../src/modules/postgres.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,mBAAmB,GAAG,UAAU,CAAC;AACvC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AAExC;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IAC7C,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IACvB,aAAa,GAAG,MAAM,CAAC;IAE/B,YAAY,QAAkC,aAAa;QACzD,KAAK,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,gBAAgB,CAAC,UAAU,CAAC;aAC9B,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,CAAC;aAC5C,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,aAAa,CAAC;aAChD,OAAO,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC;YAC3C,sEAAsE;YACtE,4DAA4D;YAC5D,sEAAsE;YACtE,iEAAiE;YACjE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,8DAA8D;YAC9D,mEAAmE;YACnE,uEAAuE;YACvE,yBAAyB;aACxB,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC;YACnC,+DAA+D;YAC/D,qEAAqE;YACrE,iEAAiE;YACjE,gEAAgE;YAChE,mEAAmE;YACnE,sDAAsD;aACrD,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,oDAAoD,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,CAAU,KAAK,CAAC,KAAK,CAAC,QAAkC,aAAa;QACzE,OAAO,CAAC,MAAM,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAsB,CAAC;IAC3E,CAAC;IAED,kDAAkD;IAClD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;IAED,sDAAsD;IACtD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,gDAAgD;IAChD,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,aAAa,GAAG,QAAQ,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC;IAED,qDAAqD;IACrD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,yDAAyD;IACzD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,qDAAqD;IACrD,IAAI,YAAY;QACd,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,oFAAoF;IACpF,IAAI,gBAAgB;QAClB,OAAO,cAAc,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;IACvI,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rightsize",
-  "version": "0.7.10",
+  "version": "0.7.13",
   "description": "Testcontainers-style integration testing on microsandbox microVMs, with a Docker fallback and an await-using lifecycle. No Docker required.",
   "keywords": [
     "testcontainers",