signalk-container 1.33.4 → 1.35.0

package/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.35.0"
+}

package/AGENTS.md

@@ -74,7 +74,7 @@ These are non-obvious rules baked into the runtime layer. Breaking them produces
 Every managed container, one-shot job container, and job label carries a **namespace prefix** so two Signal K servers sharing one container runtime never collide, reap, or drift-recreate each other's containers. The canonical case is a devcontainer dev instance and a production install on the same host, both talking to the same rootless-Podman socket: without a namespace the dev server's `ensureRunning("questdb")` would inspect the production `sk-questdb`, and its job reaper (`cleanupOrphanedJobs`) could force-remove production `sk-job-*` helpers.
 
 - `src/namespace.ts` is the single source of truth. The namespace token defaults to `sk`, so an install that sets no env var produces **the same container names, job names, and label keys** as prior releases: containers `sk-<name>`, jobs `sk-job-<id>`, labels `sk-charts-job` / `sk-job-owner` / `sk-job-label`.
-- `setNamespace(process.env.SIGNALK_CONTAINER_NAMESPACE, onInvalid)` runs once in `plugin.start()`, **before** anything creates or reaps a container. `plugin.stop()` calls `resetNamespace()` (mirrors the `setDisableUserns` lifecycle — see below). The value is boundary-validated: 1–32 lowercase alphanumerics; anything else logs via `app.error` and falls back to `sk` so a typo can't crash startup or produce an invalid container name.
+- `setNamespace(process.env.SIGNALK_CONTAINER_NAMESPACE, onInvalid)` runs once in `plugin.start()`, **before** anything creates or reaps a container. `plugin.stop()` deliberately leaves the namespace set: a consumer stopped in the same server shutdown can still call `api.stop(name)` after this plugin stopped (it falls back to the runtime `stop()` retired), and that stop must resolve the same prefixed name — resetting to `sk` would let a dev instance stop production's container. The value is boundary-validated: 1–32 lowercase alphanumerics; anything else logs via `app.error` and falls back to `sk` so a typo can't crash startup or produce an invalid container name.
 - Everything derives from the token via the accessors — `containerPrefix()`, `jobPrefix()`, `jobMarkerLabel()`, `jobOwnerLabel()`, `jobNameLabel()`, `requestedResourcesLabel()`. Never re-hardcode `"sk-"`; `prefixedName()` is the sole place a bare name becomes a container name — call it, never re-implement a `startsWith("sk-")` prefix check.
 - The **label keys** are namespaced too (`<ns>-charts-job`, `<ns>-job-owner`, `<ns>-job-label`, `<ns>-requested-resources`), so a dev instance's reap query doesn't even _list_ production's jobs. The name-prefix guard in `orphanFromContainer` (`name.startsWith(jobPrefix())`) remains the unspoofable-by-label trait — and being namespaced, it can never match a foreign-namespace helper.
 - The devcontainer sets `SIGNALK_CONTAINER_NAMESPACE=devpod` (in the installer repo's `dev/dev.sh`), so its containers are `devpod-<name>`. Note the prefix isolates **names and reaping**, not host **ports** — a consumer plugin that publishes a fixed host port still collides port-wise with its production twin; that is handled separately (pick non-colliding ports for dev).
@@ -176,10 +176,11 @@ When we need to read live container state, call `getContainer(name).inspect()` o
 
 Docker reports `HostConfig.NetworkMode` as `"default"` or `"bridge"` when no `--network` was passed. Podman rootless reports `"slirp4netns"` or `"pasta"`. These are runtime defaults equivalent to "user did not request a specific network." `canonicalNetworkMode()` in `src/containers.ts` normalizes all of them to `""` so comparison against a requested `undefined`/`""` is correct. Any new comparison of `networkMode` between requested and live state must go through this helper.
 
-### Device access (`devices` / `groupAdd`)
+### Device access (`devices` / `groupAdd` / `capAdd`)
 
 Three runtime quirks shape this feature; all were verified live on rootless Podman 5.4.2 and are load-bearing:
 
+- **`capAdd` is normalised, never extended.** `normalizeCapabilities` upper-cases and `CAP_`-prefixes both the requested and the live list so drift compares capabilities, not spelling. `buildCreateOptions` emits exactly what the consumer asked for. Drift is symmetric off the live container (both runtimes report `HostConfig.CapAdd`, nothing else populates it), so _removing_ a capability is detected without `prior` and survives a server restart — the security-relevant direction. There is deliberately no `privileged` field: that is the absence of a boundary, not a capability, and would belong to operator config, never a consumer-set `ContainerConfig`. Note capabilities are bounded by the invoking user's under rootless podman, so acceptance at create time is not proof of access.
 - **Rootless runtimes reject `HostConfig.DeviceCgroupRules`** at container create ("device cgroup rules are not supported in rootless mode or in a user namespace"), so `resolveDeviceRequests` emits no rules when `isRootless === true`. Rootless device access is gated by plain file permissions on the bound nodes instead — that's what `groupAdd` + keep-original-groups exist for.
 - **`--group-add keep-groups` is CLI sugar only.** Over the docker-compat create API, a literal `keep-groups` in `HostConfig.GroupAdd` is treated as a group _name_ and fails the container at start. The API-level spelling is the `run.oci.keep_original_groups: "1"` annotation (`HostConfig.Annotations`), emitted for rootless podman only — never for docker.
 - **Podman applies `HostConfig.Devices`/`DeviceCgroupRules` but reports neither back through inspect** (compat and libpod both return `[]`/`null`, even for CLI-created `--device` containers). `diffContainerConfig` therefore live-compares node devices and rules on docker only; on podman it compares against `prior`, and directory devices compare through their bind mounts (visible on both engines). Do not "fix" a podman devices-drift gap by comparing against live inspect — it will recreate on every reconcile.
@@ -203,17 +204,27 @@ Discoverability — `selfDeployment().containerStorage` reports the filesystem b
 
 ### Degradation notifications (`notifications.container.*`)
 
-`src/notifications.ts` (`makeDegradationEmitter`) publishes SignalK notifications for four managed-container degradation conditions, via the server's `app.notifications.raise()`/`clear()` API. Wired into the `src/index.ts` wrapper.
+`src/notifications.ts` (`makeDegradationEmitter`) publishes SignalK notifications for six degradation conditions (five per container, plus the host-level deployment one), via the server's `app.notifications.raise()`/`clear()` API. Wired into the `src/index.ts` wrapper.
 
-- **Conditions → path → state**: unhealthy → `notifications.container.<name>.unhealthy` `warn`; host-rejected device (`DeviceIssue` action `unresolved`) → `.deviceUnresolved` `warn`; missing required volume (`ifMissing:'abort'`) → `.volumeAborted` `alert`; degraded runtime deployment (`isDashboardDeploymentError`) → the host-level `notifications.container.deployment` `warn`. Paths use the **unprefixed** container name (the notification bus is per-server, so the container-name namespace buys nothing here) and `idInPath:false` (stable, addressable, updates in place — plus the tracked id is what `clear` needs).
+- **Conditions → path → state**: unhealthy → `notifications.container.<name>.unhealthy` `warn`; host-rejected device (`DeviceIssue` action `unresolved`) → `.deviceUnresolved` `warn`; missing required volume (`ifMissing:'abort'`) → `.volumeAborted` `alert`; degraded runtime deployment (`isDashboardDeploymentError`) → the host-level `notifications.container.deployment` `warn`; crash-looping container → `.crashLooping` `alert`; container whose owning plugin is no longer installed → `.ownerUninstalled` `warn`. Paths use the **unprefixed** container name (the notification bus is per-server, so the container-name namespace buys nothing here) and `idInPath:false` (stable, addressable, updates in place — plus the tracked id is what `clear` needs).
+- **crashLooping keys on a RATE, never a raw count.** `RestartCount` from inspect is a _lifetime_ total and is legitimately non-zero on a healthy container under `--restart=unless-stopped` after a host reboot — a threshold on the raw value alerts on uptime, not on failure. The invariants `observeRestarts` must hold: the **first** observation of a container never raises (its history is unwitnessed); a _decreasing_ count re-baselines (the container was recreated); a burst straddling a window boundary still raises (the window slides, it does not tumble); and an observation gap longer than the window re-anchors rather than alerting, because those restarts are undatable. Driven by one shared sweep over `lastConfigs`, deliberately **not** gated on `options.healthCheck`: a container dying at startup never reaches the state where a health check could run, so `pollHealth` cannot see this class of failure at all. See `src/notifications.ts`, `sweepRestartsOnce` in `src/index.ts`, and their boundary tests.
 - **Additive, never a replacement.** Every site keeps its existing log / `setPluginError` / consumer-callback surfacing; the notification is a parallel channel. Do not remove the old surfacing when touching these sites.
 - **Two gates**: the `emitDegradationNotifications` config toggle (default **on**) and the server exposing `app.notifications` (≥ 2.30.0). The pinned `@signalk/server-api` (2.24.0) does NOT declare `raise`/`clear`, so the `App` interface declares a local minimal shape (like `handleMessage?`/`config?`) and the emitter no-ops when `app.notifications` is absent — older servers degrade to the existing surfacing, never throw.
 - **NO `method`.** The emitter states severity only; the NotificationManager owns presentation (RFC notification-handling §6.1). The `raise` option type deliberately omits `method` so the `updates/service.ts` `handleMessage`+`method:["visual"]` pattern (a separate, older emitter on `notifications.plugins.<id>.updateAvailable`) can't be copied here.
-- **Recovery/clear**: unhealthy is edge-triggered (raise on healthy→unhealthy, clear on unhealthy→healthy) via per-container health tracking in `pollHealth`; deviceUnresolved raises/clears off the `unresolved` subset each commit (`syncDeviceIssues`, called from all three `commitDeviceIssues` sites); volumeAborted clears unconditionally on any successful `ensureRunning` (reaching the success commit means nothing aborted); deployment clears on a subsequent start that finds the host `ok`. `afterContainerRemoved` clears the three per-container conditions; `stop()` calls `degradation.reset()` (clears all outstanding + drops state), mirroring the `resetNamespace`/`setDisableUserns` lifecycle.
+- **Recovery/clear**: unhealthy is edge-triggered (raise on healthy→unhealthy, clear on unhealthy→healthy) via per-container health tracking in `pollHealth`; deviceUnresolved raises/clears off the `unresolved` subset each commit (`syncDeviceIssues`, called from all three `commitDeviceIssues` sites); volumeAborted clears unconditionally on any successful `ensureRunning` (reaching the success commit means nothing aborted); deployment clears on a subsequent start that finds the host `ok`. crashLooping is rate-derived in `observeRestarts` (see below) and clears when the rate falls back below the threshold across the sliding window, or when the counter resets. ownerUninstalled clears when the owner brings the container up again (a successful `ensureRunning`). `afterContainerRemoved` clears the five per-container conditions; `stop()` calls `degradation.reset()` (clears all outstanding + drops state), mirroring the `setDisableUserns` lifecycle.
+
+### Containers of uninstalled plugins
+
+Removing a plugin removes its package, not its container, and under `unless-stopped` the container outlives the plugin and every server restart. `checkOrphans` in `src/index.ts` runs once, `ORPHAN_CHECK_DELAY_MS` after the runtime is detected, and stops (never removes) each managed container that `findOrphans` (`src/orphans.ts`) reports, then raises `ownerUninstalled` and sets `ContainerInfo.uninstalledOwner` for the panel. Removing such a container also drops its manifest record. The rules keep a false positive from stopping a live plugin's container:
+
+- **The owner comes from the manifest, never the container name** (names do not map to packages: `mayara-server` belongs to `@marineyachtradar/signalk-plugin`). A container recorded only under the synthetic `container:<name>` id has no owner and is never flagged.
+- **The installed set is `app.getPluginsList()` ids, read after a delay.** Signal K loads plugins in sequence, so a list read at this plugin's own start can still lack owners that load later. No list, or an empty one, flags nothing.
+- **An owner counts as installed if its id is a loaded plugin's id OR a package of that name is installed** under the config dir, so a consumer that records its npm name instead of its plugin id is not flagged.
+- **A container brought up by `ensureRunning` this session is never flagged** (`lastConfigs`): its owner is evidently running, whatever id it recorded.
 
 ### Auto-recreate on config drift
 
-`ensureRunning` compares the requested `ContainerConfig` against the live container's effective config on every call. On drift across `image+tag`, `command`, `networkMode`, `env`, `volumes`, or `ports`, it removes and recreates the container transparently. `resources` follows the existing live-update path. Consumer plugins do not need (and should remove) per-plugin `${dataDir}.container-hash` files — this is centralized.
+`ensureRunning` compares the requested `ContainerConfig` against the live container's effective config on every call. On drift across `image+tag`, `command`, `networkMode`, `env`, `volumes`, `ports`, `extraHosts`, `devices`, `groupAdd`, `capAdd`, or `user`, it removes and recreates the container transparently. (`user` only where the expected form surfaces in `Config.User` — rootless podman's `keep-id` mapping does not, and suppresses it by design.) The authoritative list is `drifted.push(...)` in `diffContainerConfig`; per-field intent lives on `ContainerConfig` in `src/types.ts`. `resources` follows the existing live-update path. Consumer plugins do not need (and should remove) per-plugin `${dataDir}.container-hash` files — this is centralized.
 
 The diff has an optional `prior?: ContainerConfig` parameter for detecting "unset" drift (an env key previously set is now absent, a `command` previously set is now `undefined`). The wrapper in `src/index.ts` reads it from `lastConfigs` before overwriting.
 
@@ -297,23 +308,31 @@ Only push after all four pass. **Never push without explicit approval.** `git pu
 
 ### Release flow
 
-Tag-triggered (`.github/workflows/publish.yml` fires on `v*` tags):
+release-please owns the release. Merging a releasable commit to master opens
+a `chore: release X.Y.Z` PR that bumps `package.json`; merging that PR creates
+the tag and the GitHub Release, then dispatches `publish.yml` on the tag to run
+`npm publish --provenance --access public`.
+
+1. Land the work through a normal PR. No hand-written `chore(release)` PR — release-please writes the bump itself.
+2. Merge the release PR when the version is right. The bump follows the commit type — `feat` minor, `fix`/`perf` patch, `!` or a `BREAKING CHANGE:` footer major. To release a specific version instead, add a `Release-As: X.Y.Z` footer to a commit.
+3. Never merge a release PR without explicit approval — that merge is what publishes to npm.
 
-1. Branch `chore-release-X.Y.Z` off master.
-2. Bump `version` in `package.json`. There is no `package-lock.json` (the `~/.npmrc` setting disables it).
-3. Commit `chore(release): X.Y.Z`. Run the pre-PR checklist.
-4. Open PR, wait for explicit merge approval.
-5. After merge: `git checkout master && git pull --ff-only`, then `git tag vX.Y.Z && git push --tags`. The workflow creates the GitHub Release and runs `npm publish --provenance --access public` (prereleases use `--tag beta`).
-6. Never publish to npm without explicit approval.
+Pre-release tags (`vX.Y.Z-beta.N`, `vX.Y.Z-rc.N`) are still pushed by hand and
+publish under the `beta` dist-tag; only those get their GitHub Release created
+by `publish.yml`.
 
-Angular semver:
+A release only gets proposed when the push carries a commit users get — see the
+`gate` job in `.github/workflows/release-please.yml`.
 
-- `feat` → minor
-- `fix` → patch
-- `BREAKING CHANGE:` footer or `!` → major
-- Pure `chore`/`docs`/`refactor` → patch (or skip release)
+Commit type decides two separate things. Whether a release is proposed at
+all: `feat`, `fix`, `perf`, a `revert`, any `type!`, a `BREAKING CHANGE:`
+footer and `build(deps)` all propose one; pure `chore`, `docs`, `ci`, `test`
+and `build(deps-dev)` do not. And how big the bump is: `feat` minor,
+`fix`/`perf` patch, `!` or a `BREAKING CHANGE:` footer major.
 
-Dirk may override the bump rule (e.g. ship behavior change as minor even if technically API-compatible). Ask before assuming.
+A `Release-As: X.Y.Z` footer overrides the derived version when a release
+should carry a different one — Dirk may do that (e.g. ship a behaviour change
+as minor even if technically API-compatible). Ask before assuming.
 
 ## Common Pitfalls
 

package/CONTRIBUTING.md

@@ -0,0 +1,21 @@
+# Contributing
+
+Bug reports, feature requests and pull requests are welcome at
+<https://github.com/dirkwa/signalk-container>.
+
+Before opening a pull request, run the full local chain:
+
+```bash
+npm run format && npm run build:all && npm run ci-lint
+```
+
+`npm run build:all` covers the unit tests. If you have podman or docker
+available, `npm run build:all:integration` runs the integration suite too.
+
+## Contributor license grant
+
+By submitting a pull request or patch, you grant Dirk Wahrheit a perpetual,
+worldwide, non-exclusive, royalty-free, irrevocable license to use, reproduce,
+modify, publish, sublicense and distribute your contribution, and to relicense
+it under any terms, including as part of signalk-container releases. You confirm
+that you have the right to grant this.

package/README.md

@@ -8,11 +8,11 @@ Instead of each plugin implementing its own container orchestration, they delega
 
 - **Runtime detection** -- resolves the container runtime over its Docker-API socket (Podman preferred, Docker fallback); no podman/docker CLI binary is needed. Consumer plugins `await containers.whenReady()` once instead of polling in a loop — resolves when the probe settles in either direction.
 - **Container lifecycle** -- pull, create, start, stop, remove with `sk-` prefix naming
-- **Automatic config-drift recreation** -- `ensureRunning` compares the requested `ContainerConfig` against the live container on every call. If `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, or `ports` differ, the container is removed and recreated transparently. Consumer plugins no longer need a per-plugin hash file to detect "config changed since last start." See the [developer guide](doc/plugin-developer-guide.md#container-config-changes).
+- **Automatic config-drift recreation** -- `ensureRunning` compares the requested `ContainerConfig` against the live container on every call. If `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, `ports`, `extraHosts`, `devices`, `groupAdd`, or `capAdd` differ, the container is removed and recreated transparently (`user` too, where the runtime reports it). `resources` is applied live where possible instead. Consumer plugins no longer need a per-plugin hash file to detect "config changed since last start." See the [developer guide](doc/plugin-developer-guide.md#container-config-changes).
 - **Healthcheck handling** -- image-declared healthchecks are made to work reliably across runtimes. For images that ship **no** healthcheck, consumer plugins set `ContainerConfig.healthcheck` to supply a probe, so the container reports a real health status instead of being stuck in `starting`. See the [developer guide](doc/plugin-developer-guide.md#healthcheck-for-images-that-ship-none).
 - **One-shot jobs** -- run containers for batch tasks (export, conversion, etc.)
 - **Update detection** -- centralized "is there a newer image?" service for all consumer plugins. Auto-detects semver vs floating tags (`:latest`, `:main`), offline-tolerant with persistent cache, emits Signal K notifications, visible inline in the config panel. See the [developer guide](doc/plugin-developer-guide.md#update-detection).
-- **Degradation notifications** -- publishes SignalK notifications on `notifications.container.*` when a managed container is unhealthy, a requested host device was rejected, a required volume source is missing, or the container-runtime deployment is degraded. Severity is `warn` (or `alert` for a missing required volume) — visual only, no audible alarm. Each clears when its condition recovers: the unhealthy and volume notifications clear the moment the next health check or `ensureRunning` succeeds, while the deployment notification clears on the next plugin start that finds the host healthy. On by default; opt out with the "Emit container degradation notifications" config toggle. Requires a SignalK server ≥ 2.30.0 (no effect on older servers).
+- **Degradation notifications** -- publishes SignalK notifications on `notifications.container.*` when a managed container is unhealthy, a requested host device was rejected, a required volume source is missing, the container-runtime deployment is degraded, a container is crash-looping, or a container's plugin is no longer installed. Severity is `warn` (or `alert` for a missing required volume and for a crash loop); the notification carries no `method`, so the server's NotificationManager controls how it is presented. Each clears when its condition recovers: the unhealthy and volume notifications clear the moment the next health check or `ensureRunning` succeeds, the device notification clears when a later `ensureRunning` finds no unresolved devices, the crash-loop notification clears once the container falls back below three restarts per five minutes, and the deployment notification clears on the next plugin start that finds the host healthy. A crash loop is measured as three restarts within any five-minute span _while the plugin is watching_ — the restarts a container accumulated before that (surviving a host reboot, say) never raise it. On by default; opt out with the "Emit container degradation notifications" config toggle. Requires a SignalK server ≥ 2.30.0 (no effect on older servers).
 - **Resource limits editor** -- interactive UI in the config panel for setting CPU/memory/PID caps per container. Values are applied live via `podman update` when possible (no downtime), falls back to recreate when needed. Stored overrides are minimized against the consumer plugin's defaults so a future default bump flows through automatically. See the [developer guide](doc/plugin-developer-guide.md#resource-limits).
 - **Reset to plugin default** -- one-click restore of a container's original resource limits, clearing any user override.
 - **CPU caps that fit the host** -- a `cpus` limit above the daemon's core count is lowered to it instead of failing the container create (Docker rejects `--cpus 1.5` on a 1-vCPU host outright); the consumer plugin can surface it via the optional `onResourceClamped` callback (otherwise it is a debug-log line). See the [developer guide](doc/plugin-developer-guide.md#resource-limits).
@@ -23,7 +23,7 @@ Instead of each plugin implementing its own container orchestration, they delega
 - **Zero-config container service connectivity** -- `signalkAccessiblePorts` lets the SignalK process connect back to a service running inside a managed container (e.g. an HTTP or TCP server). signalk-container picks the right networking strategy automatically — port binding on the host loopback for bare-metal deployments, or a shared Docker network with DNS for containerised ones. No host ports are exposed unnecessarily.
 - **Host timezone propagation** -- managed containers and one-shot jobs get `TZ=<host zone>` injected automatically, so time-based logic inside them (cron-style Node-RED flows, Grafana/QuestDB time rendering, log timestamps) agrees with the host clock instead of defaulting to UTC. Consumer plugins that set `env.TZ` themselves keep full control; shell-level tools inside minimal images may additionally need the image's `tzdata` package to interpret the zone name. See the [developer guide](doc/plugin-developer-guide.md#host-timezone).
 - **SELinux support** -- `:Z` volume flags for Podman bind mounts on Fedora/RHEL; named volumes are handled correctly (`:Z` is not applied)
-- **Host device access** -- `ContainerConfig.devices` exposes host device nodes or whole device directories (`/dev/snd`, `/dev/input`, …) to a managed container — directory bindings are hot-plug-safe, so a USB replug keeps working without a recreate (individual nodes are attached statically and need one) — and `ContainerConfig.groupAdd` resolves host group names to the GIDs that own those nodes. Works across docker and rootless Podman (on rootless the access comes from the Podman caller's own host groups, so that user must be in the device-owning group); a missing device never blocks container start. See [Exposing host devices](#exposing-host-devices-devices-groupadd).
+- **Host device access** -- `ContainerConfig.devices` exposes host device nodes or whole device directories (`/dev/snd`, `/dev/input`, …) to a managed container — directory bindings are hot-plug-safe, so a USB replug keeps working without a recreate (individual nodes are attached statically and need one) — and `ContainerConfig.groupAdd` resolves host group names to the GIDs that own those nodes. Works across docker and rootless Podman (on rootless the access comes from the Podman caller's own host groups, so that user must be in the device-owning group); a missing device never blocks container start. See [Exposing host devices](#exposing-host-devices-devices-groupadd-capadd).
 - **Read-only volumes** -- `{ source, readOnly: true }` binds a volume `:ro`, for sharing a directory another component owns (charts published by a chart provider, say) without granting write access to it. 1.30.0+.
 - **Per-volume host-source policy** -- volumes accept `{ source, ifMissing: "skip" | "abort" }` for user-managed (USB drives, NFS) or deployment-required (TLS certs) mounts. Plugins subscribe to `onVolumeIssue` events for `'skipped'`, `'aborted'`, and `'recovered'` actions; signalk-container auto-recreates the container when a previously-missing source reappears. See the [developer guide](doc/plugin-developer-guide.md#optional-and-required-volumes).
 - **Container log streaming** -- click **Logs** on any managed-container card to open a live-streaming popup of the container's stdout+stderr (combined, the same shape `podman logs <name>` produces). Plugin authors can also wire `onContainerLog` in `ensureRunning` options to forward the same stream into their plugin's `app.debug` channel — visible in the Signal K server log when debug is enabled. Multiple subscribers share a single underlying log stream. See the [developer guide](doc/plugin-developer-guide.md#streaming-container-logs-into-your-plugins-debug-channel).
@@ -476,6 +476,7 @@ The plugin embeds a React config panel in the Signal K Admin UI (via Module Fede
 - **Logs** opens a live-streaming popup of the container's combined stdout/stderr — works for both running and stopped containers. A container that never started has no logs; the empty log view then shows the runtime's record of the last start failure (inspect `.State.Error`) so the reason is visible without shell access
 - **Current effective resource limits** shown as compact badges (e.g. `1.5 CPU · 512m · 200 PIDs`)
 - **Override active** amber badge when the user has configured a resource override for the container
+- **"Its plugin … is no longer installed"** note on a container left behind by an uninstalled plugin. Removing a plugin removes its package, not its container, so about two minutes after startup signalk-container stops every managed container whose recorded owner is no longer installed, raises `notifications.container.<name>.ownerUninstalled` (`warn`), and leaves the container for you to **Remove** (which also drops its manifest record). It only knows the owner of a container whose plugin passes `pluginId` to `ensureRunning` (signalk-container-helper does); others are never touched
 - **Updates row** (when the consumer plugin has registered with the update service):
   - Color-coded badge: `✓ up to date`, `↑ v3.4.0 available`, `↻ rebuild available` (floating tag), `📡 offline` (with cached state fallback), `⚠ check error`
   - "checked 5m ago" staleness indicator
@@ -807,7 +808,7 @@ The allocated address is cached for the lifetime of the plugin session, so repea
 > a manual `ports` or `networkMode` entry for the same container — the field takes
 > full ownership of those concerns.
 
-## Exposing host devices (`devices`, `groupAdd`)
+## Exposing host devices (`devices`, `groupAdd`, `capAdd`)
 
 When a managed container needs a host device — a USB speakerphone for a voice assistant, a serial/GPS dongle, a GPU — declare it in the config instead of hand-rolling runtime flags:
 
@@ -834,9 +835,23 @@ On rootless Podman (the recommended deployment) device access is governed by pla
 
 > Note when verifying by hand: some device nodes (e.g. `/dev/snd/timer`) are blocking character devices — a `read` hangs until an event, which looks like a failure. Test access by _opening_ the node (`exec 3</dev/snd/timer`), not by reading it. Inside a rootless container `id` may show the supplementary groups as `nobody`; that is expected — the kernel still checks the caller's real host GIDs against the node, so access works regardless of the display.
 
-Both fields participate in config-drift detection — adding, removing, or changing them recreates the container on the next `ensureRunning` call.
+### Capabilities (`capAdd`)
 
-> Availability: `devices` and `groupAdd` require signalk-container ≥ 1.24.0. Older versions silently ignore the fields — the container still runs, just without the device access.
+Some workloads need a Linux capability rather than (or as well as) a device node. `ContainerConfig.capAdd` maps to `--cap-add`:
+
+```js
+capAdd: ["SYS_ADMIN"], // or "CAP_SYS_ADMIN" — the same capability
+```
+
+Names are accepted with or without the `CAP_` prefix and normalised to the prefixed form the runtimes report, so rewriting one spelling as the other does not recreate the container.
+
+Every capability widens what the container may do to the host, so request the narrowest set that works. `SYS_ADMIN` in particular is close to root — prefer a specific capability, a device passthrough, or `groupAdd` when one of those covers the need.
+
+Capabilities are not a route to privileges the runtime itself lacks: under rootless Podman the container's capabilities are bounded by the invoking user's, so an entry can be accepted at create time and still not grant the access you expected. Verify on the target host rather than assuming. There is deliberately **no `privileged` field** — that is the absence of a boundary rather than a capability.
+
+All three fields participate in config-drift detection — adding, removing, or changing them recreates the container on the next `ensureRunning` call. That includes _removing_ a capability: the container does not keep running with a capability the consumer has dropped.
+
+> Availability: `devices` and `groupAdd` require signalk-container ≥ 1.24.0; `capAdd` requires ≥ 1.34.0. Older versions silently ignore the fields — the container still runs, just without the device access.
 
 ---
 
@@ -900,7 +915,7 @@ See [doc/plugin-developer-guide.md](doc/plugin-developer-guide.md) for the full
 | `pullImage(image, onProgress?)`                 | Pull a container image (auto-qualifies for Podman)                                                                                                                                                                                                                                                                   |
 | `imageExists(image)`                            | Check if image exists locally                                                                                                                                                                                                                                                                                        |
 | `getImageDigest(imageOrContainer)`              | Local image ID (sha256) for an image:tag or container                                                                                                                                                                                                                                                                |
-| `ensureRunning(name, config, options?)`         | Create and start container if not running; auto-recreates on config drift across `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, `ports`                                                                                                                                                                 |
+| `ensureRunning(name, config, options?)`         | Create and start container if not running; auto-recreates on config drift across `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, `ports`, `extraHosts`, `devices`, `groupAdd`, or `capAdd`                                                                                                               |
 | `recreate(name, config, options?)`              | Force-recreate: remove (if present) + ensureRunning. Always replaces an existing container (running or stopped) — use this for "update now" / plugin-startup self-heal flows where correctness must not depend on drift detection (1.12.0+)                                                                          |
 | `start(name)`                                   | Start a stopped container                                                                                                                                                                                                                                                                                            |
 | `stop(name)`                                    | Stop a running container                                                                                                                                                                                                                                                                                             |

package/dist/containers.d.ts

@@ -561,6 +561,12 @@ export interface LiveContainerConfig {
     deviceCgroupRules: string[];
     /** `HostConfig.GroupAdd`, `[]` when unset. Both runtimes report it. */
     groupAdd: string[];
+    /**
+     * `HostConfig.CapAdd`, `[]` when unset, normalised to the
+     * `CAP_`-prefixed upper-case form so a live value reported in either
+     * spelling compares equal to the requested one.
+     */
+    capAdd: string[];
     /**
      * `Config.Labels`, `{}` when unset. Not part of drift detection as a
      * field — read for the system labels signalk-container stamps itself,

package/dist/containers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EASL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,iBAA8B,GACtD;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,8EAA8E;IAC9E,UAAU,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D,CAmEA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACrE,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACvE,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA6B5D;AAID,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;KACzC,GAAG,IAAI,CAAC;CACV,GAAG,OAAO,CAQV;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;KAC7D,GAAG,IAAI,CAAC;IACT,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAWV;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CAezB;AA8BD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAmD/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,yBAAyB,GAAG,SAAS,CAiBvC;AA0CD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CA8KrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAkQvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY1E;AAKD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,GACpC,IAAI,CAEN;AAOD,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAC5D,IAAI,CAEN;AAwDD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAwBD,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAWD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAgC,CAAC;AAEtE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACvC,aAAa,CAEf;AA+OD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;;;GASG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyqBf;AAyFD,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS,EACxB,OAAO,CAAC,EAAE,YAAY;CAKzB;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,EAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,IAAI,CAYN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,EACrC,KAAK,SAAqB,GACzB,OAAO,CAAC,MAAM,CAAC,CAuEjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,GAChC,OAAO,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CA8BvC;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"containers.d.ts","sourceRoot":"","sources":["../src/containers.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,MAAM,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,eAAe,EACf,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,yBAAyB,EACzB,eAAe,EACf,aAAa,EACb,WAAW,EACX,WAAW,EACX,UAAU,EACV,aAAa,EACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EAIvB,MAAM,cAAc,CAAC;AACtB,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,aAAa,CAAC;AACrB,OAAO,EAKL,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,EAUL,KAAK,cAAc,EACpB,MAAM,cAAc,CAAC;AAWtB,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGjD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CACvB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,GAAE,OAAe,GACxB,MAAM,CAOR;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAE7E;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAsBD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,GAAE,MAAM,MACgC,GACjD,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAIpC;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAC;AAEpD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC,GAAG,SAAS,EACxD,KAAK,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,iBAA8B,GACtD;IACD,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,8EAA8E;IAC9E,UAAU,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9D,CAmEA;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EACD;IACE,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC1D,OAAO,EAAE,KAAK,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC3D,GACD,SAAS,EACb,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,cAAc,EAAE,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,EAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC3B,KAAK,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAmBlD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAUN;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7D,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,KAAK,EAAE,WAAW,EAClB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACrE,KAAK,EAAE,aAAa,EACpB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACvE,KAAK,EAAE,eAAe,EACtB,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EAC7E,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAON;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,OAAO,CAAC,EAAE;IACR,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,GACA,sBAAsB,CAuDxB;AAED,kEAAkE;AAClE,eAAO,MAAM,QAAQ,QAAQ,CAAC;AAe9B;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,OAAO,EACZ,KAAK,EAAE,MAAM,GACZ;IAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAqB/C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,CAAC,CAmCnB;AAiBD,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,CAmCR;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,MAAM,EAAE,CAYV;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAKlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,gBAAgB,EAAE,MAAM,EACxB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAaxB;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAUD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAqBlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUxB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAexB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAClC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CA6B5D;AAID,oEAAoE;AACpE,eAAO,MAAM,0BAA0B,QAAS,CAAC;AACjD,gFAAgF;AAChF,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAE7C;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;KACzC,GAAG,IAAI,CAAC;CACV,GAAG,OAAO,CAQV;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,KAAK,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,OAAO,CAAC;YAAC,GAAG,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IACvE,MAAM,CAAC,EAAE;QACP,WAAW,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,OAAO,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI,CAAC;KAC7D,GAAG,IAAI,CAAC;IACT,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAWV;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,cAAc,CAAC,CAezB;AAwFD;;;;;;;;;;;GAWG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,oBAAoB,CAAC,CAmD/B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,CAAC,CAwEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,OAAO,YAAY,EAAE,uBAAuB,GAAG,SAAS,CAAC,CAWnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,MAAM,GAAG,SAAS,GACtB,yBAAyB,GAAG,SAAS,CAiBvC;AA0CD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GACxD,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CA2C5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,CAOrC;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzC,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,qEAAqE;IACrE,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAsLrC;AA6HD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,eAAe,EAC1B,IAAI,EAAE,mBAAmB,EACzB,OAAO,EAAE,oBAAoB,EAC7B,KAAK,CAAC,EAAE,eAAe,GACtB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CA6QvB;AAiGD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,GAC5B,MAAM,GAAG,IAAI,CAsBf;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY1E;AAKD,wBAAgB,8BAA8B,CAC5C,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,GAAG,IAAI,GACpC,IAAI,CAEN;AAOD,wBAAgB,2BAA2B,CACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,oBAAoB,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAC5D,IAAI,CAEN;AAwDD;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAG9B;AAwBD,wBAAgB,qCAAqC,IAAI,IAAI,CAE5D;AAWD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,eAAe,CAAC,SAAS,CAAC,EACnC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,EAC7B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,GACrD,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAsC7B;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAAE,aAAgC,CAAC;AAEtE;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GACvC,aAAa,CAEf;AAwPD;;;;;GAKG;AACH,KAAK,MAAM,GAAG,CACZ,OAAO,EAAE,oBAAoB,EAC7B,KAAK,EAAE,MAAM,EACb,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,eAAe,EACvB,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAE5B,OAAO,CAAC,EAAE,oBAAoB,EAC9B,MAAM,GAAE,eAA6B;AACrC;;;;;;;;;GASG;AACH,KAAK,CAAC,EAAE,eAAe,EACvB,aAAa,GAAE,OAAe,EAC9B,KAAK,GAAE,MAAkB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyqBf;AAyFD,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAEf;AA2CD,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAED;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAG5C,QAAQ,CAAC,IAAI,EAAE,SAAS;gBADxB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,SAAS,EACxB,OAAO,CAAC,EAAE,YAAY;CAKzB;AAqBD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,EACxE,MAAM,GAAE,eAA6B,EAKrC,SAAS,GAAE,MAAM,IAAe,GAC/B,OAAO,CAAC,IAAI,CAAC,CAkDf;AAED;;;;GAIG;AACH,eAAO,MAAM,eAAe,oBAAa,CAAC;AAE1C,wBAAsB,cAAc,CAClC,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,aAAa,EAAE,CAAC,CAwC1B;AAED,wBAAsB,WAAW,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB5D;AAiED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,iBAAiB,EAAE,EAC3B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,GACxB,MAAM,EAAE,CAiDV;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,OAAO,EAAE,eAAe,EAAE,EAC1B,iBAAiB,EAAE,MAAM,EACzB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,WAAW,CAAC,CA0DtB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC;CAC5C;AAED;;;;;;;;;;GAUG;AACH;;;;;;;;GAQG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,oBAAoB,EAC7B,SAAS,EAAE,aAAa,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,EAC3E,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC5B,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,cAAc,EAAE,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC,EAChD,iBAAiB,EAAE,MAAM,EACzB,GAAG,EAAE,cAAc,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA2Bf;AAuCD,wBAAsB,eAAe,CACnC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,EACjB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAE/D;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,EACZ,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAiBf;AAED,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,oBAAoB,EAC7B,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,MAAM,EACnB,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAWf;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAW1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAW7E;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,8BAA8B,IAAI,MAAM,EAAE,CAQzD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CA2B5E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,iCAAiC,IAAI,MAAM,EAAE,CAQ5D;AA8BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAsDxB;AAuBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,IAAI,CAYN;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,EACrC,KAAK,SAAqB,GACzB,OAAO,CAAC,MAAM,CAAC,CAuEjB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,cAAc,EAAE,GACvB,wBAAwB,GAAG,IAAI,CAgCjC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAgC1C;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,cAAc,EAAE,GAChC,OAAO,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CA8BvC;AAcD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAEtD;AAeD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS1E;AASD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,oBAAoB,EAC7B,KAAK,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAe,EACvC,MAAM,GAAE,eAA6B,GACpC,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CA8C1B;AAED,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAAc,EACzB,UAAU,GAAE,MAAY,GACvB,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/containers.js

@@ -6,7 +6,7 @@ import { rm } from "node:fs/promises";
 import { isContainerized, makeLineSplitter, userMappingFlags, } from "./runtime.js";
 import { demuxToText, demuxBufferToText, getClient, safe, safeInspect, } from "./client.js";
 import { describeError, isStorageCorruptError, isUlimitRejectionText, messageWithRaw, } from "./errors.js";
-import { DEVICES_UNRESOLVED_LABEL, filterUnresolvedDeviceEntries, KEEP_ORIGINAL_GROUPS_ANNOTATION, parseUnresolvedDevicesLabel, presentLiveDeviceNodes, resolveDeviceRequests, resolveGroupAdd, unresolvedGroupNames, } from "./devices.js";
+import { DEVICES_UNRESOLVED_LABEL, filterUnresolvedDeviceEntries, KEEP_ORIGINAL_GROUPS_ANNOTATION, parseUnresolvedDevicesLabel, presentLiveDeviceNodes, resolveDeviceRequests, resolveGroupAdd, normalizeCapabilities, unresolvedGroupNames, } from "./devices.js";
 import { parseResourceLimits, resourcePayloadForRun } from "./resources.js";
 import { containerPrefix, requestedConfigLabel, requestedResourcesLabel, } from "./namespace.js";
 import { classifyTag } from "./updates/tagClassifier.js";
@@ -847,23 +847,72 @@ export async function getContainerState(runtime, name, client = getClient()) {
         return "missing";
     return coarseStateFrom(info.State ?? {});
 }
+// The runtime's zero-value timestamp (Go's zero `time.Time`, RFC3339-
+// encoded) for a `StartedAt`/`FinishedAt` that has never been set.
+const ZERO_TIME_PREFIX = "0001-01-01T00:00:00";
+const NS_PER_MS = 1000000n;
+const SUB_MS_DIGITS = 6;
+/**
+ * A `StartedAt`/`FinishedAt` as epoch nanoseconds, or null when it was
+ * never set or does not parse. Compared as instants, never as text: Docker
+ * trims trailing zeros from the fraction (`…05.9Z` sorts after `…05.95Z`)
+ * and Podman writes the host's local offset, which changes with daylight
+ * saving or a timezone change between a stop and the next start.
+ * `Date.parse` keeps milliseconds only, and a restart can stop and start
+ * within one, so the fraction's remaining digits are added back.
+ */
+function timestampNs(value) {
+    if (typeof value !== "string" ||
+        value === "" ||
+        value.startsWith(ZERO_TIME_PREFIX)) {
+        return null;
+    }
+    const ms = Date.parse(value);
+    if (!Number.isFinite(ms))
+        return null;
+    const fraction = /\.(\d+)/.exec(value)?.[1] ?? "";
+    const subMs = fraction.slice(3, 3 + SUB_MS_DIGITS).padEnd(SUB_MS_DIGITS, "0");
+    return BigInt(ms) * NS_PER_MS + BigInt(subMs);
+}
 /**
  * The defensive OR shared by `getContainerState` and
  * `getContainerStateDetail`, so a caller asking for detail can never
  * be told something different about running than a caller asking for
  * the coarse state alone.
  *
- * Running if ANY source says so. We'd rather report "running" when the
- * container is actually stopped (worst case: ensureRunning's "already
- * running" fast path skips a start call, which would then fail the
- * subsequent health check and recover) than report "stopped" when it's
- * running (worst case: update service skips legit checks, user sees
- * flap).
+ * Running if ANY source says so — Status, Running, or a positive Pid.
+ * We'd rather report "running" when the container is actually stopped
+ * (worst case: ensureRunning's "already running" fast path skips a
+ * start call) than report "stopped" when it's running (worst case:
+ * update service skips legit checks, user sees flap). But that OR is
+ * itself untrustworthy once the runtime has recorded a completed stop
+ * at or after the last start: a podman restart-policy re-create that
+ * fails partway through (conmon's OCI create racing a systemd/D-Bus
+ * reload, "Failed to create container: exit status 1") can leave
+ * Running/Pid holding stale values from the aborted attempt
+ * indefinitely, with nothing to ever correct them (no consumer plugin
+ * forces a restart off an unhealthy verdict). FinishedAt is written
+ * synchronously by the runtime's die-handling when the container
+ * actually exits, a step that already completed before any restart
+ * attempt runs, so a failed re-create never gets to roll it back.
+ *
+ * The timestamps decide only when Status does not say running. Status
+ * is the signal that failure leaves correct, and a host clock stepped
+ * back between a stop and the next start (a Pi without a real-time
+ * clock booting on a saved time after a power cut) records a StartedAt
+ * before the last FinishedAt on a container that is running.
  */
 function coarseStateFrom(state) {
     const status = String(state.Status ?? "")
         .toLowerCase()
         .trim();
+    const startedAt = timestampNs(state.StartedAt);
+    const finishedAt = timestampNs(state.FinishedAt);
+    if (status !== "running" &&
+        finishedAt !== null &&
+        (startedAt === null || finishedAt >= startedAt)) {
+        return "stopped";
+    }
     const runningFlag = state.Running === true;
     const pid = Number(state.Pid ?? 0);
     const hasLivePid = Number.isFinite(pid) && pid > 0;
@@ -1229,6 +1278,7 @@ export async function getLiveContainerConfig(runtime, name, client = getClient()
     const rawDevices = hostConfig.Devices ?? null;
     const rawDeviceCgroupRules = hostConfig.DeviceCgroupRules ?? null;
     const rawGroupAdd = hostConfig.GroupAdd ?? null;
+    const rawCapAdd = hostConfig.CapAdd ?? null;
     // Split image into image+tag (and optional digest). Config.Image can
     // be `repo:tag`, `repo@sha256:...`, or `repo:tag@sha256:...`.
     // Registries with ports (`localhost:5000/foo:tag`) push the
@@ -1341,6 +1391,9 @@ export async function getLiveContainerConfig(runtime, name, client = getClient()
     const groupAdd = Array.isArray(rawGroupAdd)
         ? rawGroupAdd.filter((g) => typeof g === "string")
         : [];
+    const capAdd = Array.isArray(rawCapAdd)
+        ? normalizeCapabilities(rawCapAdd.filter((c) => typeof c === "string"))
+        : [];
     const labels = {};
     if (config.Labels && typeof config.Labels === "object") {
         for (const [key, value] of Object.entries(config.Labels)) {
@@ -1362,6 +1415,7 @@ export async function getLiveContainerConfig(runtime, name, client = getClient()
         devices,
         deviceCgroupRules,
         groupAdd,
+        capAdd,
         labels,
     };
 }
@@ -1737,6 +1791,16 @@ export function diffContainerConfig(requested, live, runtime, prior) {
     if (!sortedStringArraysEqual(expectedGroupAdd, live.groupAdd)) {
         drifted.push("groupAdd");
     }
+    // CapAdd: requested vs live, both normalised to the CAP_ form, as
+    // sorted sets. Both runtimes report HostConfig.CapAdd and nothing else
+    // populates it, so the symmetric comparison detects unsetting without
+    // `prior` — the same property that makes groupAdd restart-safe.
+    const expectedCapAdd = requested.capAdd?.length
+        ? normalizeCapabilities(requested.capAdd)
+        : [];
+    if (!sortedStringArraysEqual(expectedCapAdd, live.capAdd)) {
+        drifted.push("capAdd");
+    }
     // User/ownership drift. Compute the `User` form the translator would
     // emit and compare to live `Config.User`. The rootless-Podman
     // `UsernsMode: keep-id` mapping doesn't surface in `Config.User`, so
@@ -2158,6 +2222,15 @@ function buildCreateOptions(name, config, runtime, healthcheck, debug = () => {
     // half that actually grants device-node access there. Docker never
     // receives the annotation (crun-specific; dockerode's HostConfig
     // typing predates the field, hence the cast).
+    // Capabilities widen what the container may do to the host, so the
+    // emitted set is exactly what the consumer asked for — normalised, but
+    // never extended. Under rootless podman the runtime still bounds these
+    // by the invoking user's own capability set.
+    if (config.capAdd?.length) {
+        const caps = normalizeCapabilities(config.capAdd);
+        if (caps.length > 0)
+            hostConfig.CapAdd = caps;
+    }
     if (config.groupAdd?.length) {
         const groups = resolveGroupAdd(config.groupAdd, debug);
         if (groups.length > 0)