signalk-container 1.30.0 → 1.31.0

package/AGENTS.md

@@ -42,6 +42,14 @@ Do not add error handling, fallbacks, or validation for scenarios that cannot ha
   - `npm test` — unit only (`dist/test/*.test.js`, no recursion). Safe to run anywhere.
   - `npm run test:integration` — integration only (`dist/test/integration/*.test.js`). Requires podman or docker; tests still self-skip on Windows and when no runtime is found.
   - `npm run test:all` — both. The pre-PR full sweep on a dev box.
+- **Known Windows CI flake.** `node --test` intermittently marks a whole test
+  file failed with a bare `'test failed'` at `:1:1` while every assertion
+  inside it passed — the file's child process exits non-zero after its work
+  completes. It is not tied to any particular file or to the change under
+  test, and `--test-concurrency=1` does not prevent it. Diagnose it by
+  checking whether the reported file's own tests all show ✔; if they do,
+  re-run the job. `npm test` writes `test-results/junit.xml`, which plugin-CI
+  uploads as an artifact — attach that to any upstream report.
 - All new code requires tests. Test behavior at the function boundary, not internal control flow.
 - Inject `client: ContainerClient = getClient()` rather than calling dockerode directly. Tests stub via `makeMockClient(spec)` from `src/test/helpers/mockClient.ts`. See `src/test/getLiveResources.test.ts` for the canonical pattern: a mock whose `getContainer().inspect()` returns the JSON object under test, no real podman/docker invocations.
 - Container-integration tests (those that actually pull `alpine:3.19`) live under `src/test/integration/` and gate on `hasContainerRuntime()` which returns `null` on Windows. Do not add new tests that pull real Linux images without putting them under `src/test/integration/` AND gating on the helper.

package/dist/containers.d.ts

@@ -1,5 +1,5 @@
 import type Docker from "dockerode";
-import { ContainerConfig, ContainerInfo, ContainerRuntimeInfo, ContainerState, DeviceIssue, EnsureRunningOptions, LocalImageSummary, ManagedImageRef, NofileLimits, PruneResult, ContainerWedged, ResourceClamp, UlimitClamp, VolumeIssue, VolumeSpec } from "./types.js";
+import { ContainerConfig, ContainerInfo, ContainerRuntimeInfo, ContainerState, DeviceIssue, EnsureRunningOptions, LocalImageSummary, ManagedImageRef, NofileLimits, PruneResult, ContainerStateDetail, RequestedConfigProvenance, ContainerWedged, ResourceClamp, UlimitClamp, VolumeIssue, VolumeSpec } from "./types.js";
 import { StreamingProcessHandle } from "./runtime.js";
 import { type ContainerClient } from "./client.js";
 import { type ErrorKind } from "./errors.js";
@@ -84,7 +84,17 @@ export declare function resolveHostTimezone(systemZone?: () => string): string |
  * `defaultHomeForConfigRoot`.
  */
 export declare function defaultTimezoneEnv(env: Record<string, string> | undefined, zone: string | undefined): Record<string, string> | undefined;
-export declare function classifyVolumeSources(volumes: Record<string, string | VolumeSpec> | undefined, probe?: (path: string) => boolean): {
+/**
+ * What a host-source probe could establish about a path.
+ *
+ * `"unknown"` is NOT a synonym for absent. When the manager runs inside a
+ * container its filesystem is not the one the runtime resolves bind sources
+ * against, so `existsSync` on a host path answers a different question than
+ * the one asked. Reporting that as absent drops a volume whose source is
+ * perfectly real — the bug this type exists to prevent.
+ */
+export type VolumeSourceState = boolean | "unknown";
+export declare function classifyVolumeSources(volumes: Record<string, string | VolumeSpec> | undefined, probe?: (path: string) => VolumeSourceState): {
     kept: Record<string, string>;
     skipped: Array<{
         containerPath: string;
@@ -94,6 +104,11 @@ export declare function classifyVolumeSources(volumes: Record<string, string | V
         containerPath: string;
         source: string;
     }>;
+    /** Host paths whose existence could not be established. Kept, not dropped. */
+    unverified: Array<{
+        containerPath: string;
+        source: string;
+    }>;
 };
 /**
  * Given the volume issues from the last `ensureRunning` call (both
@@ -325,6 +340,19 @@ export declare function getLiveContainerDigest(runtime: ContainerRuntimeInfo, co
  */
 export declare function pullImage(runtime: ContainerRuntimeInfo, image: string, onProgress?: (msg: string) => void, client?: ContainerClient): Promise<void>;
 export declare function getContainerState(runtime: ContainerRuntimeInfo, name: string, client?: ContainerClient): Promise<ContainerState>;
+/**
+ * Coarse state plus the detail that explains it — exit code, OOM kill,
+ * restart count and the container's own healthcheck verdict.
+ *
+ * `getContainerState` answers "can I talk to it"; this answers "why is
+ * it like that". Both read the same `State` block from one inspect, and
+ * share `coarseStateFrom` so the two can never disagree about running.
+ *
+ * Returns `state: "missing"` with no detail when the container is gone.
+ * Individual fields stay undefined when the runtime omits them rather
+ * than defaulting to a zero that would read as real data.
+ */
+export declare function getContainerStateDetail(name: string, client?: ContainerClient): Promise<ContainerStateDetail>;
 /**
  * Upper bound on the `.State.Error` text surfaced to callers. Some OCI
  * runtime rejections embed multi-kilobyte detail (spec dumps, nested
@@ -377,6 +405,19 @@ export declare function getLiveResources(runtime: ContainerRuntimeInfo, name: st
  * current-vs-target check minus runtime-injected fields.
  */
 export declare function getRequestedResources(name: string, client?: ContainerClient): Promise<import("./types.js").ContainerResourceLimits | undefined>;
+/**
+ * Parse the requested-config provenance label written at create time.
+ *
+ * Returns `undefined` — meaning "no provenance", so the caller keeps
+ * today's positive-only drift behaviour — when the label is absent,
+ * unparseable, or not an object. It must never return `{}` for a
+ * missing label: an empty provenance reads as "the container was
+ * created with no env at all", which would mask a genuine unset.
+ *
+ * Never throws. A hand-edited or truncated label degrades to
+ * `undefined` rather than breaking `ensureRunning`.
+ */
+export declare function parseRequestedConfigLabel(raw: string | undefined): RequestedConfigProvenance | undefined;
 /**
  * One host-side endpoint for a single container port. Mirror of the
  * `{ HostIp, HostPort }` shape that podman/docker emit under
@@ -503,18 +544,20 @@ export declare function getLiveContainerConfig(runtime: ContainerRuntimeInfo, na
  *     for floating tags (`:latest` digest drift) is the update service's job.
  *   - command: explicit drift when `requested.command` is set and differs
  *     from `live.command`. When `requested.command` is undefined, drift is
- *     reported only if a `prior.command` was set (i.e. the user is now
- *     unsetting it). Without a `prior`, an undefined `requested.command`
- *     can't be told apart from "image's baked CMD" so we skip — the
- *     wrapper's prior-config cache (`lastConfigs`) closes that loop on the
- *     second-and-later calls within a single signalk-container lifetime.
+ *     reported only if a prior `command` was set (i.e. the user is now
+ *     unsetting it). The prior comes from the wrapper's `lastConfigs`
+ *     cache when warm, and otherwise from the create-time provenance
+ *     label; with neither, an undefined `requested.command` can't be
+ *     told apart from "image's baked CMD" so we skip.
  *   - networkMode: runtime defaults (`bridge`, `slirp4netns`, etc.) are
  *     normalized to `""` and compared as equivalent to requested undefined.
  *   - env: requested keys must match live values. Additionally, any key
- *     present in `prior.env` but absent from `requested.env` is treated
- *     as drift (the user is unsetting it). Image-baked env keys not in
- *     either `requested.env` or `prior.env` are ignored — they were never
- *     ours.
+ *     present in the prior env but absent from `requested.env` is treated
+ *     as drift (the user is unsetting it). Image-baked env keys in neither
+ *     `requested.env` nor the prior are ignored — they were never ours.
+ *     The prior is the warm `lastConfigs` entry, falling back to the env
+ *     KEY NAMES recorded in the create-time provenance label; values are
+ *     never recorded there because this check reads only key presence.
  *   - volumes: trailing slashes stripped on both sides; `(host, container)`
  *     tuples compared as a Map keyed by container path. Live binds have
  *     their `:Z`/`:ro` flags already stripped by `getLiveContainerConfig`.
@@ -612,8 +655,10 @@ export declare function ensureRunning(runtime: ContainerRuntimeInfo, name: strin
  * this signalk-container lifetime, if any. Used to detect "unset" drift
  * — env keys removed, `command` previously set and now undefined. The
  * wrapper in `index.ts` reads from its `lastConfigs` cache before
- * overwriting it; on the first call (or after a Signal K restart) this
- * will be undefined and only positive drift is detected.
+ * overwriting it. On the first call (or after a Signal K restart) it
+ * is undefined and the diff falls back to the requested-config
+ * provenance label stamped at create time, so an unset is still
+ * detected across a restart.
  */
 prior?: ContainerConfig, _postRecreate?: boolean, _pull?: PullFn): Promise<void>;
 export declare function startContainer(runtime: ContainerRuntimeInfo, name: string, client?: ContainerClient): Promise<void>;
@@ -959,6 +1004,43 @@ export interface ContainerMountResolution {
  *     `resolveSignalkDataSource` does for backwards-compat).
  */
 export declare function resolveHostPath(absPath: string, runtime: ContainerRuntimeInfo, debug?: (msg: string) => void, client?: ContainerClient): Promise<ContainerMountResolution | null>;
+/**
+ * Can `existsSync(hostPath)` be trusted inside this container?
+ *
+ * The caller holds a HOST path and stats that same string locally, so the
+ * mount has to make those two the same thing. Three conditions, and all are
+ * load-bearing:
+ *
+ * - **Bind mounts only.** A named volume's contents are not the host
+ *   filesystem at that path, so a file seen inside one proves nothing.
+ * - **Path-preserving only** (`source === dest`). A bind of `/host/data` to
+ *   `/data` puts the host's `/host/data` at `/data`; the string `/data` inside
+ *   the container names `/host/data` on the host, and the host's own `/data`
+ *   is not visible at all. Verified against a real runtime. Trusting such a
+ *   mount would let `existsSync("/data/certs")` answer about
+ *   `/host/data/certs` and report a nonexistent required source as present --
+ *   exactly the `ifMissing: "abort"` failure this guards.
+ * - **Exact-or-child.** A mount at `/data` covers `/data` and `/data/sub`,
+ *   never `/database`.
+ *
+ * Factored out of `ownBindMountCoverage` so the rule is testable without a
+ * runtime.
+ */
+export declare function isPathUnderBindMount(absPath: string, mounts: readonly InspectedMount[]): boolean;
+/**
+ * Host paths this container can see truthfully, as a predicate.
+ *
+ * A bind mount makes this container's view of a path the HOST's view at a
+ * known offset, so `existsSync` under one is authoritative in both directions.
+ * Anywhere else a containerized process is looking at a different filesystem
+ * entirely, and neither answer means anything about the host.
+ *
+ * Returns a predicate rather than resolving one path so the inspect happens
+ * ONCE per reconcile instead of once per volume. On bare metal, or when the
+ * self-inspect fails, every path is covered / not covered respectively — the
+ * caller decides what that means.
+ */
+export declare function ownBindMountCoverage(runtime: ContainerRuntimeInfo, debug?: (msg: string) => void, client?: ContainerClient): Promise<(absPath: string) => boolean>;
 /**
  * Release a port that was reserved by `findAvailablePort()`.
  * Must be called after the container runtime has successfully bound the port

package/dist/containers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,eAAe,EACf,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAOtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAoB,GAC5C;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,CAuCA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACrE,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACvE,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CA4BzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAmBD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA8KrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkPvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY1E;AAKD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,GACpC,IAAI,CAEN;AAOD,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAC5D,IAAI,CAEN;AAwDD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAwBD,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAWD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AA0OD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;GAOG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyqBf;AAyFD,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS,EACxB,OAAO,CAAC,EAAE,YAAY;CAKzB;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,EAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,iBAA8B,GACtD;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,8EAA8E;IAC9E,UAAU,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D,CAmEA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACrE,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACvE,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CAezB;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAmD/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,yBAAyB,GAAG,SAAS,CAiBvC;AA0CD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA8KrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkQvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY1E;AAKD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,GACpC,IAAI,CAEN;AAOD,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAC5D,IAAI,CAEN;AAwDD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAwBD,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAWD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AAoPD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;;;GASG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyqBf;AAyFD,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS,EACxB,OAAO,CAAC,EAAE,YAAY;CAKzB;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,EAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,GAChC,OAAO,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CA8BvC;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/containers.js

@@ -8,7 +8,7 @@ import { demuxToText, demuxBufferToText, getClient, safe, safeInspect, } from ".
 import { describeError, isStorageCorruptError, isUlimitRejectionText, messageWithRaw, } from "./errors.js";
 import { DEVICES_UNRESOLVED_LABEL, filterUnresolvedDeviceEntries, KEEP_ORIGINAL_GROUPS_ANNOTATION, parseUnresolvedDevicesLabel, presentLiveDeviceNodes, resolveDeviceRequests, resolveGroupAdd, unresolvedGroupNames, } from "./devices.js";
 import { parseResourceLimits, resourcePayloadForRun } from "./resources.js";
-import { containerPrefix, requestedResourcesLabel } from "./namespace.js";
+import { containerPrefix, requestedConfigLabel, requestedResourcesLabel, } from "./namespace.js";
 import { classifyTag } from "./updates/tagClassifier.js";
 import { compareVersions } from "./updates/semver.js";
 import { isOfflineError } from "./updates/offline.js";
@@ -155,8 +155,9 @@ export function classifyVolumeSources(volumes, probe = existsSync) {
     const kept = {};
     const skipped = [];
     const aborted = [];
+    const unverified = [];
     if (!volumes)
-        return { kept, skipped, aborted };
+        return { kept, skipped, aborted, unverified };
     for (const [containerPath, raw] of Object.entries(volumes)) {
         const source = typeof raw === "string" ? raw : raw.source;
         const policy = typeof raw === "string" ? "create" : (raw.ifMissing ?? "create");
@@ -169,10 +170,37 @@ export function classifyVolumeSources(volumes, probe = existsSync) {
             continue;
         }
         // Host path: only the missing case differentiates policies.
-        if (probe(source)) {
+        const state = probe(source);
+        if (state === true) {
             kept[containerPath] = source;
             continue;
         }
+        // Could not tell whether the source exists. Each policy keeps the
+        // guarantee it promised, because the runtimes disagree about what a
+        // missing bind source does -- verified against both: Docker silently
+        // auto-creates an empty directory, podman refuses to start the container
+        // (`statfs: no such file or directory`).
+        //
+        // `abort` means "cannot run without this" (TLS certs, required state).
+        // Keeping it would mount an empty directory where the certs belong and
+        // start anyway on Docker -- the exact outcome the policy prevents.
+        //
+        // `skip` and `create` are kept. Dropping a skip source here is what #245
+        // reports: the mount is real and working, and omitting it is the silent
+        // failure the caller cannot see. The residual risk -- a source that is
+        // genuinely absent AND unverifiable -- is bounded by the probe above,
+        // which returns "unknown" only when this process has no bind mount
+        // covering the path and therefore cannot be the one to judge.
+        if (state === "unknown") {
+            if (policy === "abort") {
+                aborted.push({ containerPath, source });
+            }
+            else {
+                unverified.push({ containerPath, source });
+                kept[containerPath] = source;
+            }
+            continue;
+        }
         if (policy === "skip") {
             skipped.push({ containerPath, source });
         }
@@ -186,7 +214,7 @@ export function classifyVolumeSources(volumes, probe = existsSync) {
             kept[containerPath] = source;
         }
     }
-    return { kept, skipped, aborted };
+    return { kept, skipped, aborted, unverified };
 }
 /**
  * Given the volume issues from the last `ensureRunning` call (both
@@ -725,21 +753,78 @@ export async function getContainerState(runtime, name, client = getClient()) {
     const info = await safeInspect(() => client.getContainer(fullName).inspect());
     if (info === null)
         return "missing";
-    const state = info.State ?? {};
-    const status = (state.Status ?? "").toLowerCase().trim();
+    return coarseStateFrom(info.State ?? {});
+}
+/**
+ * The defensive OR shared by `getContainerState` and
+ * `getContainerStateDetail`, so a caller asking for detail can never
+ * be told something different about running than a caller asking for
+ * the coarse state alone.
+ *
+ * Running if ANY source says so. We'd rather report "running" when the
+ * container is actually stopped (worst case: ensureRunning's "already
+ * running" fast path skips a start call, which would then fail the
+ * subsequent health check and recover) than report "stopped" when it's
+ * running (worst case: update service skips legit checks, user sees
+ * flap).
+ */
+function coarseStateFrom(state) {
+    const status = String(state.Status ?? "")
+        .toLowerCase()
+        .trim();
     const runningFlag = state.Running === true;
     const pid = Number(state.Pid ?? 0);
     const hasLivePid = Number.isFinite(pid) && pid > 0;
-    // Running if ANY source says so. This is the defensive OR — we'd
-    // rather report "running" when the container is actually stopped
-    // (worst case: ensureRunning's "already running" fast path skips
-    // a start call, which would then fail the subsequent health check
-    // and recover) than report "stopped" when it's running (worst
-    // case: update service skips legit checks, user sees flap).
     if (status === "running" || runningFlag || hasLivePid)
         return "running";
     return "stopped";
 }
+/**
+ * Coarse state plus the detail that explains it — exit code, OOM kill,
+ * restart count and the container's own healthcheck verdict.
+ *
+ * `getContainerState` answers "can I talk to it"; this answers "why is
+ * it like that". Both read the same `State` block from one inspect, and
+ * share `coarseStateFrom` so the two can never disagree about running.
+ *
+ * Returns `state: "missing"` with no detail when the container is gone.
+ * Individual fields stay undefined when the runtime omits them rather
+ * than defaulting to a zero that would read as real data.
+ */
+export async function getContainerStateDetail(name, client = getClient()) {
+    const info = await safeInspect(() => client.getContainer(prefixedName(name)).inspect());
+    if (info === null)
+        return { state: "missing" };
+    const state = (info.State ?? {});
+    // RestartCount is a TOP-LEVEL inspect field on both runtimes, not part
+    // of the State block — verified against podman 5.4.2 (its native
+    // inspect has no State.RestartCount at all) and Docker.
+    const restartCount = info.RestartCount;
+    const detail = { state: coarseStateFrom(state) };
+    // `typeof === "number"`, never `Number(...)`: dockerode types ExitCode
+    // as `number | null`, and `Number(null)` is a finite 0 — which would
+    // report a clean exit that never happened. Same for "" and [].
+    if (typeof state.ExitCode === "number" && Number.isFinite(state.ExitCode)) {
+        detail.exitCode = state.ExitCode;
+    }
+    if (typeof state.OOMKilled === "boolean")
+        detail.oomKilled = state.OOMKilled;
+    if (typeof restartCount === "number" &&
+        Number.isFinite(restartCount) &&
+        restartCount >= 0) {
+        detail.restartCount = restartCount;
+    }
+    const health = String(state.Health?.Status ?? "")
+        .toLowerCase()
+        .trim();
+    if (health === "starting" ||
+        health === "healthy" ||
+        health === "unhealthy" ||
+        health === "none") {
+        detail.health = health;
+    }
+    return detail;
+}
 /**
  * Upper bound on the `.State.Error` text surfaced to callers. Some OCI
  * runtime rejections embed multi-kilobyte detail (spec dumps, nested
@@ -870,6 +955,61 @@ export async function getRequestedResources(name, client = getClient()) {
         return undefined;
     return parseResourceLimits(raw);
 }
+/**
+ * Parse the requested-config provenance label written at create time.
+ *
+ * Returns `undefined` — meaning "no provenance", so the caller keeps
+ * today's positive-only drift behaviour — when the label is absent,
+ * unparseable, or not an object. It must never return `{}` for a
+ * missing label: an empty provenance reads as "the container was
+ * created with no env at all", which would mask a genuine unset.
+ *
+ * Never throws. A hand-edited or truncated label degrades to
+ * `undefined` rather than breaking `ensureRunning`.
+ */
+export function parseRequestedConfigLabel(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        return undefined;
+    }
+    const src = parsed;
+    const out = {};
+    if (isStringArray(src.envKeys))
+        out.envKeys = src.envKeys;
+    if (isStringArray(src.command))
+        out.command = src.command;
+    if (isStringArray(src.devices))
+        out.devices = src.devices;
+    return out;
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((v) => typeof v === "string");
+}
+/**
+ * Re-shape label provenance into the `ContainerConfig` slice that
+ * `diffContainerConfig`'s unset checks read. Env values are not
+ * retained in the label, so each key maps to `""` — the unset check
+ * only asks whether a key is present, never what it held.
+ */
+function labelProvenanceAsPrior(provenance) {
+    if (!provenance)
+        return undefined;
+    return {
+        env: provenance.envKeys
+            ? Object.fromEntries(provenance.envKeys.map((k) => [k, ""]))
+            : undefined,
+        command: provenance.command,
+        devices: provenance.devices,
+    };
+}
 /**
  * Convert a byte count back into the human form consumer plugins
  * use ("512m", "2g"). Picks the largest unit that produces an
@@ -1266,18 +1406,20 @@ function sortedStringArraysEqual(a, b) {
  *     for floating tags (`:latest` digest drift) is the update service's job.
  *   - command: explicit drift when `requested.command` is set and differs
  *     from `live.command`. When `requested.command` is undefined, drift is
- *     reported only if a `prior.command` was set (i.e. the user is now
- *     unsetting it). Without a `prior`, an undefined `requested.command`
- *     can't be told apart from "image's baked CMD" so we skip — the
- *     wrapper's prior-config cache (`lastConfigs`) closes that loop on the
- *     second-and-later calls within a single signalk-container lifetime.
+ *     reported only if a prior `command` was set (i.e. the user is now
+ *     unsetting it). The prior comes from the wrapper's `lastConfigs`
+ *     cache when warm, and otherwise from the create-time provenance
+ *     label; with neither, an undefined `requested.command` can't be
+ *     told apart from "image's baked CMD" so we skip.
  *   - networkMode: runtime defaults (`bridge`, `slirp4netns`, etc.) are
  *     normalized to `""` and compared as equivalent to requested undefined.
  *   - env: requested keys must match live values. Additionally, any key
- *     present in `prior.env` but absent from `requested.env` is treated
- *     as drift (the user is unsetting it). Image-baked env keys not in
- *     either `requested.env` or `prior.env` are ignored — they were never
- *     ours.
+ *     present in the prior env but absent from `requested.env` is treated
+ *     as drift (the user is unsetting it). Image-baked env keys in neither
+ *     `requested.env` nor the prior are ignored — they were never ours.
+ *     The prior is the warm `lastConfigs` entry, falling back to the env
+ *     KEY NAMES recorded in the create-time provenance label; values are
+ *     never recorded there because this check reads only key presence.
  *   - volumes: trailing slashes stripped on both sides; `(host, container)`
  *     tuples compared as a Map keyed by container path. Live binds have
  *     their `:Z`/`:ro` flags already stripped by `getLiveContainerConfig`.
@@ -1301,6 +1443,12 @@ function sortedStringArraysEqual(a, b) {
  */
 export function diffContainerConfig(requested, live, runtime, prior) {
     const drifted = [];
+    // Provenance ladder for the unset checks below: the warm in-memory
+    // prior wins, and the create-time label fills the cold slot after a
+    // Signal K restart. Without the label, a key the consumer dropped
+    // while the server was down would never be detected as drift.
+    const unsetPrior = prior ??
+        labelProvenanceAsPrior(parseRequestedConfigLabel(live.labels[requestedConfigLabel()]));
     const requestedImageRef = qualifyImage(requested.digest
         ? `${requested.image}@${requested.digest}`
         : `${requested.image}:${requested.tag}`, runtime);
@@ -1313,7 +1461,7 @@ export function diffContainerConfig(requested, live, runtime, prior) {
             drifted.push("command");
         }
     }
-    else if (prior?.command !== undefined) {
+    else if (unsetPrior?.command !== undefined) {
         // Unset detection: the user previously set command and now wants the
         // image default back. Recreate so the runtime drops the override.
         drifted.push("command");
@@ -1334,8 +1482,8 @@ export function diffContainerConfig(requested, live, runtime, prior) {
     // Unset detection: any key we previously set that the user is now
     // dropping should force a recreate so the runtime forgets the override.
     // Image-baked keys (in live.env but never in prior.env) stay ignored.
-    if (!envDrift && prior?.env) {
-        for (const key of Object.keys(prior.env)) {
+    if (!envDrift && unsetPrior?.env) {
+        for (const key of Object.keys(unsetPrior.env)) {
             if (!requested.env || !(key in requested.env)) {
                 envDrift = true;
                 break;
@@ -1477,8 +1625,8 @@ export function diffContainerConfig(requested, live, runtime, prior) {
             !sortedStringArraysEqual(canonicalDeviceKeys(requestedDevices.nodes), canonicalDeviceKeys(presentLiveDeviceNodes(live.devices))) ||
                 !sortedStringArraysEqual(requestedDevices.cgroupRules, live.deviceCgroupRules);
     }
-    else if (prior !== undefined) {
-        const priorDevices = resolveDeviceRequests(filterUnresolvedDeviceEntries(prior.devices ?? [], unresolvedDevices), runtime);
+    else if (unsetPrior !== undefined) {
+        const priorDevices = resolveDeviceRequests(filterUnresolvedDeviceEntries(unsetPrior.devices ?? [], unresolvedDevices), runtime);
         devicesDrift =
             !sortedStringArraysEqual(canonicalDeviceKeys(requestedDevices.nodes), canonicalDeviceKeys(priorDevices.nodes)) ||
                 !sortedStringArraysEqual(requestedDevices.cgroupRules, priorDevices.cgroupRules);
@@ -1983,9 +2131,19 @@ function buildCreateOptions(name, config, runtime, healthcheck, debug = () => {
     // runtime-injected limit (rootless podman clamps a child's
     // oom_score_adj up to its parent's) is never misread as a user
     // unset. Stamped after the consumer labels so it can't be shadowed.
+    //
+    // The requested-config provenance label does the same job for the
+    // fields whose *unset* can only be detected against a prior config:
+    // env keys, `command` and `devices`. Env records key names only —
+    // the unset check never reads a value, and a value can be a secret.
     options.Labels = {
         ...config.labels,
         [requestedResourcesLabel()]: JSON.stringify(config.resources ?? {}),
+        [requestedConfigLabel()]: JSON.stringify({
+            ...(config.env ? { envKeys: Object.keys(config.env).sort() } : {}),
+            ...(config.command ? { command: [...config.command] } : {}),
+            ...(config.devices ? { devices: [...config.devices] } : {}),
+        }),
     };
     // Healthcheck. An explicit override wins over the image's own
     // HEALTHCHECK; we always emit it ourselves rather than relying on
@@ -2003,8 +2161,10 @@ export async function ensureRunning(runtime, name, config, debug, options, clien
  * this signalk-container lifetime, if any. Used to detect "unset" drift
  * — env keys removed, `command` previously set and now undefined. The
  * wrapper in `index.ts` reads from its `lastConfigs` cache before
- * overwriting it; on the first call (or after a Signal K restart) this
- * will be undefined and only positive drift is detected.
+ * overwriting it. On the first call (or after a Signal K restart) it
+ * is undefined and the diff falls back to the requested-config
+ * provenance label stamped at create time, so an unset is still
+ * detected across a restart.
  */
 prior, _postRecreate = false, _pull = pullImage) {
     const fullName = prefixedName(name);
@@ -3561,6 +3721,73 @@ export async function resolveHostPath(absPath, runtime, debug = () => { }, clien
     }
     return resolved;
 }
+/**
+ * Can `existsSync(hostPath)` be trusted inside this container?
+ *
+ * The caller holds a HOST path and stats that same string locally, so the
+ * mount has to make those two the same thing. Three conditions, and all are
+ * load-bearing:
+ *
+ * - **Bind mounts only.** A named volume's contents are not the host
+ *   filesystem at that path, so a file seen inside one proves nothing.
+ * - **Path-preserving only** (`source === dest`). A bind of `/host/data` to
+ *   `/data` puts the host's `/host/data` at `/data`; the string `/data` inside
+ *   the container names `/host/data` on the host, and the host's own `/data`
+ *   is not visible at all. Verified against a real runtime. Trusting such a
+ *   mount would let `existsSync("/data/certs")` answer about
+ *   `/host/data/certs` and report a nonexistent required source as present --
+ *   exactly the `ifMissing: "abort"` failure this guards.
+ * - **Exact-or-child.** A mount at `/data` covers `/data` and `/data/sub`,
+ *   never `/database`.
+ *
+ * Factored out of `ownBindMountCoverage` so the rule is testable without a
+ * runtime.
+ */
+export function isPathUnderBindMount(absPath, mounts) {
+    return mounts.some((m) => m.type === "bind" &&
+        m.source === m.dest &&
+        (absPath === m.dest || absPath.startsWith(m.dest + "/")));
+}
+/**
+ * Host paths this container can see truthfully, as a predicate.
+ *
+ * A bind mount makes this container's view of a path the HOST's view at a
+ * known offset, so `existsSync` under one is authoritative in both directions.
+ * Anywhere else a containerized process is looking at a different filesystem
+ * entirely, and neither answer means anything about the host.
+ *
+ * Returns a predicate rather than resolving one path so the inspect happens
+ * ONCE per reconcile instead of once per volume. On bare metal, or when the
+ * self-inspect fails, every path is covered / not covered respectively — the
+ * caller decides what that means.
+ */
+export async function ownBindMountCoverage(runtime, debug = () => { }, client = getClient()) {
+    if (!isContainerized())
+        return () => true;
+    // Every failure below degrades to "covers nothing", never to a throw.
+    // safeInspect rethrows anything that is not a 404, and findSelfContainerId
+    // touches the runtime too; letting either escape would reject ensureRunning
+    // outright on a transient daemon hiccup, when the tri-state classification
+    // is designed to carry on with "unknown" instead.
+    try {
+        const selfId = await findSelfContainerId(runtime, debug, client);
+        if (!selfId) {
+            debug("ownBindMountCoverage: could not detect self container id");
+            return () => false;
+        }
+        const info = await safeInspect(() => client.getContainer(selfId).inspect());
+        if (info === null) {
+            debug(`ownBindMountCoverage: inspect ${selfId} failed`);
+            return () => false;
+        }
+        const mounts = mountsFromInspect(info);
+        return (absPath) => isPathUnderBindMount(absPath, mounts);
+    }
+    catch (err) {
+        debug(`ownBindMountCoverage: could not read own mounts (${err instanceof Error ? err.message : String(err)}); treating every path as unverifiable`);
+        return () => false;
+    }
+}
 /**
  * Process-local set of ports that are currently reserved by an in-flight
  * `findAvailablePort()` call.  Prevents two concurrent `ensureRunning()`