-
Hello World
-
- You can open{' '}
-
+
+ {children}
);
}
+
+export default function HomePage() {
+ return (
+
+ {/* Hero */}
+
+
+ Execution primitive, Node.js
+
+
+ Run untrusted code in hardened containers.
+
+
+ A single-purpose Node.js library that runs your code in a container it tears down
+ afterwards, and hands you back the exit code, logs, and any files you asked for. Nothing
+ else.
+
+
+
+ Quick start
+
+
+ API reference
+
+
+ GitHub
+
+
+ npm install light-runner
+
+
+
+ {/* Primitives */}
+
+ what you get
+
+ Give it code. Get back an exit code , logs, and the
+ files you asked for.
+
+
+ {primitives.map((p) => (
+
+
{p.num}
+
{p.title}
+
{p.body}
+
+ ))}
+
+
+ {/* Quick start */}
+
+ quick start
+
+ A few lines to run, one to get your artefact.
+
+
+ {code}
+
+
+
+ {/* Security */}
+
+ security model
+
+ Hardened defaults, never opt-out. Add more
+ restrictions, never fewer.
+
+
+ {security.map(([k, v]) => (
+
+ ))}
+
+ Does not cover kernel exploits, runc CVEs, or side-channel attacks. For genuinely hostile
+ code, combine with the gVisor (runsc) or Kata runtimes.
+
+
+
+ {/* Ecosystem */}
+
+ ecosystem
+
+ Three tools. Each does one thing.
+
+
+ {ecosystem.map((e) => (
+
+
+ {e.name}
+
+ {e.tag}
+
+
+
{e.title}
+
{e.body}
+
+ ))}
+
+
+ {/* Footer */}
+
+
+
light-runner / execution primitive
+
+ GitHub
+ npm
+ MIT
+
+
+
+ );
+}
diff --git a/website/src/app/layout.tsx b/website/src/app/layout.tsx
index fffc0a5..c092ccd 100644
--- a/website/src/app/layout.tsx
+++ b/website/src/app/layout.tsx
@@ -6,6 +6,15 @@ const inter = Inter({
subsets: ['latin'],
});
+export const metadata = {
+ metadataBase: new URL('https://enixcode.github.io/light-runner'),
+ title: {
+ default: 'light-runner',
+ template: '%s | light-runner',
+ },
+ description: 'Run untrusted code in hardened Docker containers from Node.js.',
+};
+
export default function Layout({ children }: LayoutProps<'/'>) {
return (
diff --git a/website/src/lib/shared.ts b/website/src/lib/shared.ts
index 812926e..8d8d18d 100644
--- a/website/src/lib/shared.ts
+++ b/website/src/lib/shared.ts
@@ -1,11 +1,11 @@
-export const appName = 'My App';
+export const appName = 'light-runner';
export const docsRoute = '/docs';
export const docsImageRoute = '/og/docs';
export const docsContentRoute = '/llms.mdx/docs';
// fill this with your actual GitHub info, for example:
export const gitConfig = {
- user: 'fuma-nama',
- repo: 'fumadocs',
+ user: 'enixCode',
+ repo: 'light-runner',
branch: 'main',
};
From 02c38f770f90f0896367bee76583eda5596a8661 Mon Sep 17 00:00:00 2001
From: enixCode <58286681+enixCode@users.noreply.github.com>
Date: Sat, 30 May 2026 07:29:21 +0200
Subject: [PATCH 07/10] docs(fumadocs): make llms.txt spec-compliant
The default Fumadocs llms.txt emits `# Docs` with root-relative links. Per
the llmstxt.org spec, set the H1 to the project name, add a blockquote
summary, and rewrite links to absolute deployed URLs (domain + basePath) so
they are followable.
build with cc
---
website/src/app/llms.txt/route.ts | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/website/src/app/llms.txt/route.ts b/website/src/app/llms.txt/route.ts
index fc80cb6..f1fc274 100644
--- a/website/src/app/llms.txt/route.ts
+++ b/website/src/app/llms.txt/route.ts
@@ -3,6 +3,25 @@ import { llms } from 'fumadocs-core/source';
export const revalidate = false;
+// Deployed site root (domain + basePath). Page urls from the source are
+// root-relative (`/docs/...`), so prefixing with this yields absolute,
+// followable URLs as the llms.txt spec recommends.
+const SITE = 'https://enixcode.github.io/light-runner';
+
+const SUMMARY =
+ 'Run untrusted code in hardened Docker containers from Node.js. A single-purpose ' +
+ 'library: spawn one container, get back the exit code, logs, and any files you ask ' +
+ 'for. Domain-agnostic, secure by default.';
+
export function GET() {
- return new Response(llms(source).index());
+ const body = llms(source)
+ .index()
+ // Spec: the H1 is the project name, followed by an optional blockquote summary.
+ .replace(/^# Docs\n*/, `# light-runner\n\n> ${SUMMARY}\n\n## Docs\n\n`)
+ // Make every internal link an absolute, deployed URL.
+ .replace(/\]\((\/[^)]+)\)/g, `](${SITE}$1)`);
+
+ return new Response(body, {
+ headers: { 'Content-Type': 'text/markdown; charset=utf-8' },
+ });
}
From d7e07aa586392aa482907038f08fdf6a0a6a418b Mon Sep 17 00:00:00 2001
From: enixCode <58286681+enixCode@users.noreply.github.com>
Date: Sat, 30 May 2026 08:30:59 +0200
Subject: [PATCH 08/10] docs(fumadocs): restore the bespoke landing page
Port the original VitePress landing to the Fumadocs home: the dark bespoke
design (hero + banner, primitives, code window, security grid, ecosystem,
footer) with the Fraunces / JetBrains Mono type, live GitHub version badges,
and the copy button.
- landing.css: the original bespoke stylesheet, with the three global
selectors (code/pre, footer, focus rings) scoped to .bespoke-landing so it
cannot leak into the docs pages; Google Fonts imported.
- page.tsx: HTML ported to JSX as a client component; the script (GitHub
release fetch + copy) ported to a useEffect; the code sample uses
dangerouslySetInnerHTML to keep the syntax spans verbatim.
- The home route drops Fumadocs HomeLayout chrome to render full-bleed.
- Copy banner.webp into website/public.
build with cc
---
website/public/banner.webp | Bin 0 -> 26938 bytes
website/src/app/(home)/landing.css | 607 +++++++++++++++++++++++++++++
website/src/app/(home)/layout.tsx | 7 +-
website/src/app/(home)/page.tsx | 594 +++++++++++++++++++---------
4 files changed, 1009 insertions(+), 199 deletions(-)
create mode 100644 website/public/banner.webp
create mode 100644 website/src/app/(home)/landing.css
diff --git a/website/public/banner.webp b/website/public/banner.webp
new file mode 100644
index 0000000000000000000000000000000000000000..a2a08e9d2148c266eabb5f3dea5bb762506ed268
GIT binary patch
literal 26938
zcmV(rK<>X%Nk&F8X#fCMMM6+kP&gnaX#fCl`vRQ-DnJDQ13obribNtIqo$(uIGE4|
z3295H&A)qleTDE
4q%kr<&|IasC%^%zN8TX(5-lqSX|AGET_m};r
zsDF+Aul~RM2jf@Bcj7)v#FTBtGkDyg}
zmrzgppZI-z@H77BI=}uu=KXJeS^n4mSNZ>eU*n(MfARl`2iNA|m&hseEm#)N2q#JY
z^BmVC%y8Kj(z=+RKh~p)4DahlbQcA1()6Vr4F)r+=!WY}#IpF)iOAebdwW_bP@QTx
z3fcg$76QOmCmIm?-CP5{~Wuen?|kXT^Ivat$G+
z&$I_@t+R|el&_5|sR+t*P&PnZ(lgdhWiXoPERKlUOGUvW$^YFNHub|SA}Q(b81O~w
z^UMWtBuZTO8Y*?`1y2h<0t9zhED?1om$FNd=l`p0df37ALTO{hV-B06OpjT@^B;ur
z2RqQ|H4_*0yBd_GX9iN(Z(~4)G3M_Z>)j?9O?kz_eCaA2P4njRCzN>WSA|xCGXixY
z_&0GI%V?8lugAKMLD12Gz>wsIn#gf=YY-L&L-hph1;Mdqn^L1CTmpflX5^g(`3%lmBw_pB|Wj>Jwk-_mr%=%#M$Pzr~_TJ3non<
zi>TgzMF|e>^HwntKkdHy0LM#(ZiqaZR+YeYvsovteSt5P6PgBC25ypU9#cOGobsb4
zyJ(7SLsNLkP2%|db|VbIH&}iX(U%-|kXT8$#a!{o{yGcBactFvavcSd;3x1H1#M6n
zJprP!l&v4dyM!*=)QG@8{qu7SM@&bPOExPdH4K5I-aj7%)fqfX=G-|es3ZbSMuUqr
zFE^)3Qwo@2&&7S%r)i%>d=2hWrFl9qc`?v%wKrd^9jIh?o-v2uq-HWIXNYTgR-3W%
zqQ9<-6R0CZ9f1vqjAwFU0~FaHdW2W&z$4kz)7}+AR23W`fNP4lUDR{1xfp59n_WnL
z3SNhs2ZupF!2V$DtSq#M;(FcLowS-Fo%YE~W~XfI!peLYV|Isk!Ku=G@*xIGTv+oP
zGMz-OB}Y6Y{B8@;3_$FUCYAZS7=GL0Z!}HYp7dK_vBz*ID#(k)3TDTd=Q`Av-5+o-
zQMuN-*SI;W+Z5#aPN_o>FR<7RI|r$bpR33HSb_0yqT#YOa8fJexT47ociYlxI!~?a
zLQEN^pg=RRAqT~>N!c#7HTOm@%OJSY1+ZI2m&1!a+d#tVGzpK5;NijB8_Ek=1J74`
zG)9=K%1>%}xE$*pN64XR_Zdz?yd4@HyXOfXmS-1
zYW^w6bx9-;)VQ5DgZzMDryIBVCmNR%Dr%h6%ii?H0ak3_6_rCXkxvH~pi1)@Do?I;
zMIXfoNj{xjEno}bO?Kf#iog0i(F;PUI+;~^WS^1Jbi98@t$uyM7S!~p5^@CAkk~61
zRq`PHG<1LJP}RFrGk$l1}-R3?+S9S5+K{49NZW{!I~)
z9K`bVt=?RU*adIj?F!GolZ06-Cqes7rK2KOe8*71&?+om(j&Aca8$aHwuhGeF5O%%
zVir#R1E9%SjWN4wxGQ2J=gVIp%}iRdT-KsCI$UyH5t~Vm^)vj>GzMw0g=qV4nFFx=
zjYf7pg}YytRe2))^3I*vAQnFKEvEk1)&AxYDS(&k$^Uw+hKx3cU;2mp(JlQNRa6O2
zLitM}KQK+Bo!TpFx-#^dr{>Knv&P2(U@P)YKIx1fGy)k)ZYZ6$<2^l0!73O%Ot;)H
z8^5eUR>B@Xj+ktfvqkL%q-5t6b=&~yUA;f@0R|3|WpZ44Gt0;~{1?p9#bs(k@uiyM
z>~2ay#_j$~3WY%3!O+Fq7AJvQhx^C+FZV{f63AWnv6aD*h=vgyf6I-Nw{6h{l=%>>
zCqTuH=Q3fa*|wMU-t>&(9>ed>#-tW>w5DnR+}nJ+x3>mgAgI@HrU~DYY%=Y>inWz;
zp2BZPAoxDlndYVoHw?gR0EPeH+j_s)=vHsvKfSid&znYCkWn^GU|#4f!=~&HjSJ8bHV0}UWSwAs?gV?AR2BTKJz=z_VH;P_D-S=`
zFxa8eS;9x)H=fK`RTQmnqdSrmJ%@f}_#;>}QJIoyQV^%SvO!1rowy}Xl?6u*o1?V`
z!lrnCgUaRyU-$$s=s;%^JD4BU;5wSQ*YbV>+aK?6&Rll9X4k=H8XvFyi=3xsEl8L7
zNyEK*o}Qn9vk%scWREK8vJ)E+c|XZeRB+*@gUtGk(QG?s$KgCGJna
z%*kd3%5lc0z(WXhmwDqLNcy>;qh?@ZOqhGK(N)M--3%Xt+YD{A<+7Q!?6k(Ts|Il*
zV?k1oo#j_(3gIBW-Ult(VzS16ncJisZMLD3<5)Dv_9sh^pC8HbHqgs3{5grzu(Ht_
zduoh5(?u=vUo!vFU#FLeyc~h^)Oz*%Ee7+SyPT0LPufevp_hV7KZ+(PB}JOC@*3Oo
zaf?O#GA9@#E+}aHq9R8?fGsQUHef5q(m_+-z*upQ-Kq+X5I%4Peo4wCx5
zTw_pot3_Y27V@J|`i(ujLdr0JSb({yYW!OXBnI3aV_#5mTikPwPDvz&SyJ{^$jXM{
zy{av%yjBr&g@KB*K(FQYW9e7(t@||#rW6eKo-(G@Xo#2zJZqvsnp{hqG(HSGy5p$|
zn)%?}>mPKtv5w=uX(C@BQWL5uj_d&7lYQNav=*@TTmCN(S%k1
zRjGwE4Se@Ahc#tP_s%sBJ-CsZ(SdHKzAy8(-vt&)JAaaK{z`(QhfUGnEm5h*N*Z8M
z4%X+rH;VtT8QCYr`;Fg)KOKT(%YR+opTTx`gSBva`N3wyFdD20LkdXpN|ZY19V}IQwYrps?>2>F8-KL&N+r#`PkRhj1CGrJ$0q)v{5`4H!LRwRw
z57&6}a_+(*>Lsbl$Ut@?e9?2tdr3xU$vSD=-fPL}ZA7j&hcJPp<+N+I^eHoA!%{V=Fh4aVLDVg3}O
zk%LDXR+p+`0*Y1-F2+@ElCW~dFnGCUXsx-?BtgZ`aq9A3H&AH8gL;T6zN5FngdcAt
zgHh$RtIjNhq#2sDJaSHBb|0GHzoWiUaV5Gq@+0hLY$-Fwdz}vHjwzwoDyoWrLEA*Jog=&%F?~`_q
z%1PN3urBx1W-5e;ZX}WK&f*))XXVW8Wox#&#s7^}tuIuFF
zq46eTzGFbl9fzJn>55jDmIsEix}L!P+0sA!n`-A{>p$l%Y(*J|^lQE9Tm*rsoiZ`5
zo)@g(ym>$WX)gHYhfS7yVi|K~9<4g`EbHB866g2Y+n0wJaOXD7uN@
z|NJk~AU3g9cJ8Mx3&Yb*VwEX>PfMr3ktDLi13eeq`Mor>p6pp_7@zaByA%ZpS|
z^ZGZyp&ATF>BSZBO=KM>*6MQ#D#^VhTuh}_UOA5q{!gYmUl+NCkki;KX8#z#7bxYI
zMF5ay7>^rbg;l+Y)L?O&J=FefbFtg(MXYk11|)E((tP`14jiAgnkh)eh%C&UWsI?U&7a+LH9V+Vh9qG?h)ylq~%+y(jiObloP$R#)ABk6Ig%krcj>{m`07s
zoZ?zaOc~Z&u*Vbp&$DY
zu2C^-_n<41l584ecb+ka;??uHExzN!_Fj{`8@T*4hi?>(xaKV_WhBKU64!E`t@0u3
zk902rk7uLT8*Hr)n42rE!=El8gRh8_%7zM5oSY9ewN~&yT%~J{?B9F5^ZEVwWZs~V
z^;>#>*rp`S>fPpRu2sLMa?IlK78(n)F+J3{=e57;Kv;j{R)e4Npn$Agj(Bd*ywrmG
z8%G*67?E}e^_tIMnV60F9{=@9HH$0C3WRA3(K6AM>FX3Px8fd>)O#qhp(G+)Yv0!=
z`?@dR{0ClwRV&6^*Pac5SB}sl#QB~oC
zCUntG@nh9o0)!tzBZKEDXMCN8>7OCUwEyIAu_~!>V`E=kHkBj;(kXIb8S|e@S@5l6
zi|E!+qz`jPa+fn53nBv&%Tf82KX07uf`EPP$>c1+xO$wd+beh^Y%zTO7b4L2n0HqP
z{ZpIz*#%3UHaagLaH9vxh-AP65|~Yjv8a>*xZPJ(b``tkd71vOD-ptw7Nbt>XS$(P
z1560r!NvME*}K16@j|aKqL-+_^^G!Jp!4KldIA!1ljE)k8&I`}(keX?4TTsSCw8T9
z9Xu2TyTd`uvUbZK|ce(9g!^1u0#Ig^rxmG2z)5vdeF$mm#V}YG+k7!|FBGI4S8)X{ZZ%ElN%>3k
z5)WiOwla>rkEl4P_E*T-NWmfG&gCi{U)nf)%@q}sta8moXY$Wj-nEX+D21om9-<&sJnHCI&F8t+ZRiU_j9n#0;;%Ps#mY7f`h+EoO%@*o_KU0B+KB$pLF*z#h{qQR7|
zX<14g+~@Wg;pm%q-0(bXi>b-oFPiNK>ou|eWpB88=kVe<|EQ2_$g}AbxQ|(esTYL{
z)|F1<-PMzV(!b>YrBg+Ed){v8T$+V4V>y5WD*As)VdAaa^geFb;oNgp2vnV$&_0D_MV*N^CJ8tn1-$}DW&&1Q2JUd@$Oi@>|55TTp
zslXU*UrwV4usPcQF{Czfs^Xlqcfv@rmr&jr4V+@tFJD_{;44bHi`Pk}e~+SYj_IA{
zz!8HTST;gMI~z#dN{sLl4$}Ys>A85K3J}|&Pc=VM2cCkWivb%GUGbA)#Y6GycI750R;0UyO2DPb;9oY*AU((bG9%MS>)`a%?DV&HE
z7l@CX7d>%_{1#6wH%ieFO~gzJeOLmr2$|aOqvoP8n8^4Qhx>qHiEar0Tg8w!y!5SA
za{S~tQPmLKBj0c0w#=GGORa?UVO3y!LNU@ez
z^B=T?efQZNZoLm`FaG2n&t}zVzL!U_-agO`Fk=T8!DjE#GZPFgg
z(*~v{XjH+lo+bY0Wdg$-3!SEKwI#OPO)vx`xxa-SlzzWaon@t)k=f}Y{
zh30J64o`uuolV#bG?GWbKA-T>f8vXeoWUpKrA|tsVDBCjOf%H~5tp`pu_ML?oD_8f
z+KI3|NR+E{tzK~(#1)NMg9M~&J3e4&84x-?=~cA4Z^1WzzJt0Pbo~8i)r~_%?@${O
zJ-Q+CHN_1Zkm(h)a)phI7DTV8G~_YUJiVlIrIZ$i@1%HVW77Sp^kJjMX-plA-IKSC
z`6k;T)3`tY{`nb$$O1JIlxR8_%+}#V56CYBpOp-IsCsd+e-kKcz;dIh0Ibh0qjOqh
zkpbMoNe~2`jdj>@nNuLpdyZ^vV3ow1bdRV%
zGxyZ}%5qr2hM=Fdzb}0R?S*2qPdT-LMT<|jPy$8Pq!C1;dWFzMgjp3n~
z%_NzM0O&(L(uq$KkSD!+h@rZs{u0te&u2&5w#4*u4QaJb@cc5CgW(P`k;1q%h?32+
zN3ONLe$E?5)TrRf_H2`P%LvI28R$*$Y3(+OoNA4{(77TI0}3L-9+PBd+OcDPgKQ_n
zU6mbVO>CrB%0uJUuW)ne13@oAW(_NmdmVhm>Q=gTiVT*!)fINwj4|*o+@d~_?%?6-
zVpIEnoN$vMr#3YVRz8}bG{S>Qt{aoj(T{`M;mI~{@9H%89$nkwB0empSTF*Ag`;Vf
zK!^Qj(*+*i-Gtstu(QJ4eD?!6W@GAC?-Vw@hhvWiuE)1^9Qq
z;1n|@AV^t
zYPr*f#`l2yKslNfxt7i1Nf+IfJdUUZ(EF_C_v42CMAJ|xKbTCnTM7;WYcnV3Dd`e?
z!-i?r?ts>z3mjDi=R&*{_=Q8E)q4j060B2>8use(BIc0+QBL3)<(iige9_-_<8)o9
z`}~w#l1fC*f#`=+pNDH>|YH931YcsLS_
zv{O)QNp#irHZ8x7&`Ka`8P0*VB7XVPTI@fSH==ivuNgph)}0KHg~R9BQHBB8!Ol#h
zb2Kr9`uwOgm)924qcV)4ETv_z<>Z5I+D}fD%||YKtIqVKo2tD~NgmySN5~uy(H^jc
zlEN8Y;3FF4GFSa#uadio>4UR*ZCKyRT$~BI-o@LRi^;A8h{3GD1sFgRwt+<(s2Ci9
z6MEKyu6x=i)D8~1yz5vsZT2-GA>Ta$MkYxKGda4u7NbEv6$xFYohNMN?HeFBiiU9)
z>{L2j+}n6c;a;)UTjdWH_kjboOH<`Z$B8+mu*d_ZyZ;d{g@_mnH4WJ~dc8wqG1-Jb
z)#}V}xCd0S+F2{?)6c~+081PI`5TL0RF=w&-QHUfS`q5RP6O|*tHeaj%v^`VN!&J@
z1W*)jr^2|hEyl(39|C$L46&$?~O?F4gjkyJ3MipO7>
z`KnvA%>7k%SS@)Xs$|!jvVpA(Ge8cs^KsT3am@V}s_##oA(!yj6Ax@LYW}xCA5G&#
zA@)5l^W9%#4kBA1hj_6V>HAn3q);-G*+!r@H?rcjX_q1sycP7W2Br$k6PkRKZ4Ed;
z_xN&8b`n)$y9p!qrQcFaLI};)^d_$~;oX$fVTmknr4$}?{mG14Q&^&Z;0gLJd6Mj7
zHE1fhNTulQL3sD%ViYg(7oNisb;$&s28}8H)5zGtOF*M7^zHC49`lHQ30HBomR|Df
z4^}eX=fBD`o)3&^CB5Q)#^fJ=-uA|NZZg$>PnwEf{r@KE{
zh;aAWhEl!$%^|N2Zk-=gTGt9W29n&2D>X>XeR5KrSJMkyp^}dpjff4>L+atyszUWbd-EW$w#_2BKDxJ&d1OJvCb$
zpGtz5GCjqC_9TdBFz~%uKjdQ>KrwmUc5$G;R?h`B*_|-2PT4XJt`e3uAJJnWs3WdOE^4@rJ`+
z1P8HSsv!ItW@Egbnzi3SS0vc@tW2R7l6(`u>T@PWe0rt>(-65nNlD;Q(Dj~@9D$3B
zmK@@(5;zAsT9)iH1Cr_M=*LTxx>d$|3C`O>MD6fGcY(G>Q!D=tXr+QP*gLN$&}_8W
z!BcECMU)jZnQwa;RK6hM9YNbM0AaJ-l$0T+`S7Ttu*Bs|L@+_HM>{z?X2=Fmqe7`IR3loy+;I%T*&v}fXBWqeMJHk>CiX>!;_@j}OEUBp6cbhi4>zE01*Wnk
zainvAf3E45DrI#)POOm{ePH&g?=UsEX-wFc7&GNZ)qi4CmHi&ZS9
zKI|(Mv-0vt2nZ+E+q)C;>~-;;MQB;P;y1{47yIgw%YdZ2lTQI#JOqkPbl4
zx;*bVYAU3ab|hxM;~F$0R0|LLw-)g?=QZRZzN#-9QL(j4!}8}FViu@*{fWF^xiF$T
zEP#46MJXQHDgyih2vMpO-%sA_^OB2!mRNEG4h>yBSj;-{J+D-n1bP4h6R0K>^_zYQ
zdxtZ=h%nh`{2J%tI1f;^MyE?|BuG-LVR4;GSJ=77$z8FJ+Ql6kZRyNMBQora6%h16
zrZuOph_8p?IcVX%>wB3}Y9;SHFh+-e0&oka
zX)Td!v`ct;JJdV5SYA`}NERwE)5(Os9a?}x=s;HFjGf~h5a-`sJpf
zq2kZ{H-#dE<1ii!&*M^I6xS``ne~vslf%$<*>tikPyu|L1>o{^81W(Xo!D?q6(PTBe*HK2lR^_McPlKd-5NsGQJ==d6DNpBLZubG4hO+
z*b1oxfe!lUiZ7bU944|EcFyw%8geDn=Bx;E1TT>-=~os~MZ%zLK(TB47QoN@Z080(2NHNN
z{M1~3(;7H%Ts9m#Y1D=oT4^=?jOe}dN>P8JNM6|*ibmrmE@h<`g>--n&(w|giIV4g
zodHmy2UxJ?gu~fV5WLFe8ujqFI#s_8bo#A|XEk+j!V}|nKrccF%%UJ8TsiTn2gn;|w2=BD@FrBYVQYAy7DRR$YYXCXK{-lty3~NaMYZw?t5D_I=OZ^LYm3X;Ou{6uJFSjWF
zAV+xzGtPr;p~q!O9f0G=2=1M`l)D~s2Du(X^zniNf!PZf_hyWbjg(k?R9Q~4VOF!5
zcypg^{w=xv0s;2nbLq?l6rse8G)B|{e{;H7fE|W7uE1P*)*8W6Q`*Je1fk
zIf26!iGbd9hPxujt`iDbkZEe3Dw42*NdAZ;R<2HpQy_
zd$>{#IHbRd3b9gV^*Ao4=4a>JPYgOqjd=QQS8?T!+
z##c@EF^!L*qPDtY>c?xj4+UYJ4et>^PIuogrz7e5zh(J9if%x$_I*)}_k=JIzvK%8
z<(t4kK(Q7kGFvq3C{j5`lSeAU9rQnW#PPe5FhBo
zcf05cqWDG9+^$4RQm`qETnZ-bT!Gcf*f7Dh>WlC&1?Sm^#N*Bp~l)dc^4}*82Uc+hnk9=8
z@0b8|UoMTo^^BXJ%vPyB2|tL;LwPK0wFw+XXCRJvda!X^j$sn^Q#pmc_T0ap)V+Z2
zXgE`9uA3I(Il6KVa@RGKANhy#&|LcW*UO57o=EG8>BOFdPjFNn>>|Z^3rk|-L&KqW
zKUyoYG@wVPA;MZRiN3)Sc)br2P%2=jwVN>T5f7Awv%@PWz+F}d-Xh}7%9`h~m;@7)
zGOWG_mNW1f47ngftfT76hPWho6kr(hz+bEN^M_6!Be1=oxu0vl-Bx|)t+ENRpLA9l
zbqMZw&pvBQxf)w$QtVOvqN7W(zCrCp|4Ip#F5(O0cxDPmd2q!!0r@y#@AfnEQkZLJS`rhC}^@U%JG
zjkE3ai%y{tAkJA5gLLjyY$q5zG6p!Z<|Mt{4I=&_>VoVdP?iHHY)ZV^37ssnUpA5sXqwHYdBfI4$o{dg|_qYVgCK0Gf5a4V@K
zU4wz7;BUKwHcNifbWy*Ft`^G9gu?YG^jaYGV~rSfv7cOGLfSvi_x;-Pb=iz7ThqxW
zZyy%j&lYiTjjVPbNc0q@^MZ+?5KL<2ZA3t8!P45V$zg`Y&o66v(7f!<8ePcK2E9Vd
z5ia!|8Ec4Z1}TVTUuQw3cIZ<}vGX0s~`Q<~>A;kc`7v+VUkU4az`c>Zc$Ry=Z@ZRCgT$k#l
z;n$>jkO+tJc6o>PO~H@84_IJ9F4V*INl6zd!eMJWL#>yEu!HjMB-fADCylUEo(X`h
zAYt0Lm`0Z_*D=v^@4qVIh7M>dR1Uv$A&hYq9u(Qr>(ha5Md_y-H#SOA?dL^ec5fFo
z8M06ac!ibL4Su`Ba3rb6l3P~zv`9B>|fz$hXNzwhluj4Mn?tj0mmlT9wL>
zLK$71Oo?Tg#EdvwT>PD-c5rcph4g2%s+IMtN8@nZ*nCgJaXQbd{R2WT_Iya@6-meH
ze&gvh{!9&M|Ht29^SA)4i;_RG{~~D&O6nu!j*o^|wn6z^oW+L!UdXhke}S|m11}1D
zX{||@Iz?gx8Xj~JnE`Id{$Bqpn}t%I&t#;Xe)&Eh(k+iPY2W6G`$+szzriK7&3`QU
z=sefx&|IT^|9Ck$+V-P95OX|j2J?hE$M|*r;3z4&zbA7_!YZ!~Ih!7>a&&~E&Rxpm
zsZ-XwwVPK9?SqOD8}m&*21Orp07
z`i;ca^Zgx|KD3(;Z~Oiodh>PgoF+`JrR{%
z#}`PQt+fdg3-x<_mg|`DNXHmUgIZx7pk%0(3iT??Ct-pT=WKJRj7S?n)QeTu1&M`$q+Q#HTF9Z
z`5uo-D3zv{Fhlo}>%RP7XX5(M;!Qa(YrJSWMz6iQE`54eaAcs2|834^0vo`Wsa=P(
z%(Afm$W60M1nLc;VtJRHM?M{7s|X!c$GidBhU)L`t}|MVG3(NcJ=p4RACj^G#2K$<
zg`!jdQIn-nf=Y;oei
zA;Imnj#ZWegFGW+y>4}td2i0zDKQDE*7qRG_eCW8f~K8`_i62dS_xXI#r0L^A04P!
zhR$cfhWJGR*0ZXm*wI+8itJ>6X3bk2V@QR@810i~#P&XfIZF4}S#UinJ0)u3cFdaa57g4vDI
zjhEdaE1`1x6UAZCOs7c!l>^tfI6={J0~M!*no)`B!GKW)-cC=QCiD$^oYt60mRh_7
zQ(K{%!ZP%r)Bc*(xyo(zOn%!v{dTpLo>Pw&=6H>?Ez-BAPk~=G**Q%37{*p4gr0F*
z^7rvYIn;xA;(>Lbl0rM-J;q~1msw&D+|~oQP|}mqv=a-^AjwJR)eq(Y!n=i}zI3>6
zG!-dR)%j4hS6)RA8!2{@+d~~DT5))r9)tGZH6{P&3uaefm@NGka80r@p!HI_f}E2>
zD_orSNbW2c7m%lsp4tf$^S*V&jw=%_a?y%;Gk1p5lJNHIIKaCgS09T$nb|Ozc+>kc
zSYew9yQ?0onOQC^hCWqAmtPEQp=KvaO_WR63mIuIe9un5OAEH%Wrg~{dX{T2JP*~Y
zA5$yKr9|N_isE+y-U%2^j#=)s4$9ux{6)7Tg`=*fBmDOAJ-_g_&Hn0b3MsaUd1pXK
zFaz#{TXyBGaKKTZ>=n-*GoVAfEPao#@9A<1vxjhM#C9OBjp#cd)&@K&i=wS12OQ?bib5*4G`fqNI7w{CjOQ$+A+sN`HHk4-sy{sxMBQT=MlKN{NCN*n60
zObB88=WA(DIA{8#&H-bpFRIn>XU$dss1QEm%k$b-mS$H&1V3{qLD~A2mN{imF<{?|?AUo*)dVrS1j}?W_=3?=g^@$$
zq4B2bFnXoHVD1_jCMlt)XwwJE_vgh81TS~M={g6@L<3bf^}I^$a2i1it!tlT25XQI
z@vu1VmtL{5)+cR|Hgl^}FUnj;j5zvQ4oKA9)gma{WgrK&sqmm*#O|TUveLXZJzJJ(E;-&Cm~8rn~!1?kEwix0$GH>;abj4H2Jc}II2Q43?TL@cA=b5^48zu>qAw<
zjHZMc)Q+v$5SKzXz0KeKKy{QGxe4Rp+CjY_4wW~)x1m1{4BJddU21*^An%-NiB@MH
z1qPfCNyXe6AQ}{AEyeHyOs=jKk|TE(H0keJPVm<_)@JY!dp}6YsNj$b@c!A%-;1A!
z=wf%9VPfyWqFZtk;@M7P=6#%S{tnl{9CaIF{EtYFKS?o$bbVZK8{~~8rjl8+^0bkN
zI7J-RyxNsoWs?xSIwaCU={Ytg(7U#QN9zR|50RoI<9@S`+$p}n^@i|WKg-mBqItxnNTjMU?Wd)#`g%Mi(%3@D@>fLNW<
z9hPFlM4*X9C*9-N|J%Tf8i-Avf&sYdVL|g+_Z3>NFVY+9&v-B$ZA6T(5Zna;LoPJq
z&%aFs(nIXx`}O~amx~se(b=$IeoKH6;zVj9TpnkoEN0FGcIm!1Cf9UB
zTd8Z>Fo850jGRo$PKRc4AcSNmE^>BTFfZ;*Ttlw-BNiN9&=I1W4?2=G>TB(p5LKC(
zfftnjgG{e2m8W@z`6XU$aS-!JJu?yN)Tt38$8pE_*58tMqf<
z%w!+3Bdxxq@>^G^5x8(TZ5a${6w%dx7#V>cQ~wnZ4MO<$FFdFnyzVE)=^`{2aD^8J
zCl>sQ>i+(TsiA+kcz0aKS1eC%}Z#|OOlD)TcF_~DEcHV%jTfUW5r56`-L0H+f`xm8mcH_1VK)0j-
zsgD$=w!cVP(RR?<-`ys=4VKUs2o&43aR=h;-!$Mi6uEzfTN!o&UY(e9gv8oXz_Fok
z-p8&Ca{bH|*Tc5eag0e-Rb`X$s~g5o(3&7lWNr%9$OjM@ghhEiUgd+UYYm$8&@cAr
z&K$Ea(@;83nVV1&7sQhGf{O1Qh9}D>^t_dkf`ciwpAZDtoR=7RuKu}zVc@0S-hyaX
zqP=cSzs|Ha@*k_`%1o*wi^ynj$Jf`
z^p{l{c8`z;ey3|!pjKk%rf
zXmFijime+dtoE9pR%>`J6yr@}sSPg$xx+|f>3w|OvU=wvbk*sKmpeQTWJD&dyEE=A
zr;q9@Q6e)gvR;2?sz*Lb7vgH@{>Z?3+9>01ZTG!#L=1<(+P5Zc`U4cUDRcvsAL&@{
zUDcoL3n^L&_mPXb2Q|OxMQ`%`nyGI7C|v}^_=G4ppY#UMBeokL6754cT|}2X*3gam
z`5b_0A)W^I#9ha6ffpWlkAbi69GQ5s$08W|Je(M-3cgdwed}x*SJFVOxgFCy--2*+
z%apO9VqiGza++lV_qu`D_ehy$$^F#NQNlW?%RjCij_F9)e4bN${}!>b?d~;4dw}^w
z!{C*_Gjq3}>AQJ6$$kP~K(&QVb&i|d|$%lwU!hzDO%gif2toEJsOgfP>`xMP)Bu{TB}Y@XDQ*@YqpDLXar$nP0r=U^lmlVOuoTL`yG)
z(x9pRq@QO?=L6gy)FYl*RKto0tR9xMd!w54<6z(cH3!q6p
zD)(HpluW$algeO)l#0v6t9h#2mwO%Z=59@>#8~~I@@ES*i&guIHha=$W+gdVvVz0H
zcK7NK%Y?jmz!9M37(!+e$Svn2YS()W(P61wUdQ_G>NCNXqn#~K_^=@8LI6>gxJbtI
z2uVr+#}};B5L^K%i6$;C;Ni|vzedBOyF4;yz}BuOMyT$LlNuY1}dpvP822QUurCZFrdzr
zy=!K0K~hCf+WQ7^l@+#&Opnh{s}?438SE!)cVeS6oh0}j4Z2c8q9^Z1X9K&CVe79D
z@PaaWVo^J(-&4mi%0s$L9&Wg3L5&td`Z?qFKpWRAkH#J6(vY*B`1|snd6c8&&+^u(
zg+nzW15Q%@dr!$rP)%9JEJcggV694r=NE)2YEY*EmDQ(t$WFa{B{&(#Es@>G
z{2@&!bAQ8zlfac>#@Z01hCQNC)hl95<*04H(DOCdPhc1V>B+W-!oPibHyBL+=C0Jt
ze$1PQIM1FeR&Ers{6tFH?yEg81LH4QZeXcMpkY&`yBeba?k%&
znR>tF1HlUdV-{^VQ1b~+V$ZGtUatkNY1`#=Z%1SE*LM9$m~WNIZ}pgvbo*Bz;qcBI
z6@h3V91g1qG5z%~2TxnM*DhO5M*5hmJ!p&_8yi>~TFP4Y;jug_JOfubasSAAI8^RVGT8`Byq9>aLG3I`5o^e;iR$@V23kvpRE(D;y$Gs>Bsw6S{w-
zh4*#uXdLRx`jd6B=UV2{EsaWR#!AolfRD28{hV8BJZfMl&V?WWt#(x*Fh-qQ;wgmf
z3I;T({D*GX#Y+%~L-)qg;dm+|R?CG(DBH`$@w()ekYBFQ>h;zIdhD}
z19yB#l0Bpvf7A$1U$R)!@1%8vR?_m~--iG7%rw2puu)>D2P?tpd@P~6*hIPO5-|82
z^cmZK@Yrv&(Yr7+2>$+ozK99SGCdixi*ayKPex-E6+_y-6d;WGGy?<1e49u(280ui
zYi~>QFIRm8@)Rxa83gvFTRa2F732>hu9Dg|6FLy&)_dwdi;Ks3&G12t5i&{UUimFR}4%z24J&+%jbKr9gdgW{k~m$
zU1Ih+bd&_wEE+GV`Y0?LvBF6eBzjE6e=kL30Vyfg)*$%LYsInGWS_%Df4TbOc27+g
zchlD6tJSOylsGOIWDagEdV?`f_06-XHmM~y&A~hDRqGcHExw2Qd~$o);BDl
zbRX9QxC?gqju^7&Yyh@B%6`Qvh_adPIz8ir&mKkK84JY>ri3AEepy{#1YlWSzd`l*
zu{VZkRqwl8=~-t-g-Kw)Y}|#?>>#?2jP+lJQ((&Z2Ae;nMJ1aWt185fx}=Ci)41*Q
zE-#q2y@9NE$knp{C_+5r+%85v@~8P*w4Idzz?=1tAa4SZGhdzP;*3N#8fhijW#$Vn
zB!oKS_i%K&V>usIOav~K0#0HdyC{*+*$O_j|tBc
z)hhCekG2DUd@u~6NZ)g*1bnf9BFXw4$LQ)+z#xGLa}YQ=%J)7sPSrFJt?k>=`P9t<
zY*(!7e>t;F?1_)p3aq42qlQNKV|}YLwuvNjc`KQla@BIQKOdic2M1kM8CAGD$XwDH
zPs|12d-rf|6^HQTJ{&$md~}bYJq3M7Ex#kgAEHp7aCs50S_Fr@tHxY>
zXX}lR{ascnXdq31RoeUP78^cw3bYbV>=uYdF!3n|$+d?o_A`j;lTz)OpGtv_TQ3bP|8uc-u7;8vqyZpT7-yhl8ocv|J2vtxv8
ziVnf-um_Ic_nbx^X`M69gKs*)l8~8H{5#gh;Po~!n7Qg~{+
zndz`^Zd$7k9;&7-39H5D6KYLZ*Ifdeu>+M>yF2U1EoKE8C5SSHzL{v8(+|cgVA@Ac
z9Ae+rx+q_lvoH-$>}?ZTB_<`Ml@lt3_N7mfe&6pG9XES3!-XLmhpcOx}+!;kvO`bZ`)iP_<;?5HI;Ppz(=jvXH
zv0exHi~e?HL6wAdrgvXb-pUPtLxKrT8Zrw5`CZ
zTbdvH-U2L{TfOd9yn6>RuS0TL)phhVpD!yJ8CiSK1@dphc8?tG2VP25KQyKgghNt}
zzMjJMinzRYflA+N`jO@^;!2_ukjQr0`np=?;1@&+4*^FoPr2bKy6Jjc1qLB0O3zVPJK(+nLI5zOd><&N
zGv2qkZUa(W^_}v{WWuXTbYZOOfo`22hJD41@fr(AU5ZT<4e=+di$2QtG7jVKn6^t3ju2
z&YtJH;y&G+bh=$`&T2hSF%hhBoAeR=%s_@4Sc1Vsj1I&pCgFwq*r9hYKNy2R!)=0c
zTOjQ0B2V&q6NIX-YHC_;@^k&}gGZ>9^9>TH=neKE5hNUH)69m^{3r2um#xD}k>SD5U>!-H`+73(WwG
z3T8PUF}yN^cv1N$P8<&=0^lDF^q3lD(JF#D+QqBExV;CX-dN0Un@llO`ZT)j0
z9_-hIzbC-z7>TP;;8OJR;xTJBDU@XMF*Mmv;W1fR&qS2jBn>nExE1_VpTEOr@7+E|
z6pV=@R>p9M-X5GRgTZd%FME$4f)XSu?JTxavs^zedSZUOT71$BNIExF5&7^Kh6%~N
z-LcOB<p$9sI4k1q6iu_W{sJ=KBWJ*(#2%?qs{BQy^L~^Gms`Ts`!jq8-Rk@y(%2
zPk_s~BU+{mY#9mux4N%yU>0Tc3D|GlQlW%mO!s~-&XIE?sIG0;x5o(hSM+)zM(rSgpS#;m1QX1iO`sXWx&>_R
zC+sqr9{B-&(D$Y8=hM5n
zvqXfF1wVgCLa?=7L!7MUZ=pn-9T#{lfPKI+bR$Pi!O)DQsR{TL&cCM-zN8U4aj;2S
zyon5|TuPxg+(Vjp;<)(YMZuXuECwWMwv>BPVd*sVtE=VLog|eZ5NA~SsB_)rndz#k
z?3yMr2ZjfB5t!`Zd+mVJC{1?6-1j$L2acj*%pUhdw@c-;4`ZGi<{V0vk0Tkd5%{4x
z(}$B>e2*W=t7FRzN+KZe+{&?xU~4Sas2NQr1WRC>xscxx;gV!4|B{nOV3PNUX?_Mb
zM0EbD)=oL5i=byNP7_TLf6~xByH<^ECkXGK!?b(4TnTiId!)RF86X;=Vh4G61>3o`yz5S38-r9B;W0>!n
zb=88R0d~WsZ|hGcml;vwu5pWEx(BQhV-hB&UQFF_uu8+F@XIkPJ>Dq%c4Kb{sgr3%
zeXXyR36eHAnaZKQ6Q*VQ4`wvA_7T3*8=&`O(WK2BPpGv|nFAM40ZPogM6ufh7C;H>
z5g&namG=isZM(H~ie@ZCrEG^o=q==}d)DG?CO3yW5g6_xw!$Z&V+OW)UfiyHFmCm(
zw`8XDf*O$kI0J^e(VC);FVW$}{1KN1Xi>r-)fC!nF!MmuU9DEc9J_#Mw3k|gPWIb?
zi5du})7?FT$WS?_#|YKD!E_^#0V?6LA0EqQIW+q2*ARnBQ+F1
zqn}()iK9xAlqU=avj;tB{FKchw*v;dDnM8Sct~39RXpxPX|uy!o3nDD748t2Q}U-eH?lyy8Bs1FHia(&mo;Puh
zf8TcNh0>0li8#Fl$CGS)i-DlCDX=d($Q%&cCPAp0Cr{rPX@ZjB`ob*4SWW#cAq0}g
z;A=5r^~;aa`*5EO4Mb9*EB^N*EaW&Mb#^s#Fb&e`7hV_$tfx*U8fi!z`o<|zoCb5g
zuxUJO%?}EGhRQEsL0lFyzXDn9!H@=4t9en~t|Ec;oFi{MljJlHEDSmsjj}&}e>qqH
zt{GD>kw-fxi+IB8)KBCRwv>piOH%t3U3mX78Sm91KTl=ICvG(=EN*hd`T7AU5d5|8
z>xyC;&ikbmj7-t5Y-?)U<1Bt3Y=?76kWrQ5ylg~_6ae>0vWkKR+U6H>N
zbb_WnHAC;)?vNL6BFgH9e?fq)crBcEW1gmdt7y#&CHRvk%NMUguf-hZ10GFF7=GGC
z0W)5|^~(pp8X5uw@KCuTuV0`DA^Pna4niUep;r3UTxjD-7k>aD3Ca0r@
zO>%&jk3D%427WZH`UWZTct{`-M->jiKLTaHCufuQx0zDiX7TngeJEVgFh`!DdXx-2
z&AF%4xHDwRTPyQK$I|u-zGLpl0qomzgIL|Tct=pkg%z!1N1)MDv>DZxmS6ya+ucf_
z1rm`hAC40t%q&iZ-YL8HqTLu#nD@{VSXUA_Q{Wx$fDi{wyg0F(N;{S#)RL!YQ12kmRV{9TY
z2^;Kmu!`W4d-0#;zxAbWM0
z9Q<`nAVbuie;38adM85tCK(M>s>zdk-@LDQYZRIvZ*5Oq&CST!L#2~CNc1($Q6LrB
z_X&Pb!!PtJU!dKStrLoIO8Lo;5#{1fDY$7gj#ditY6uaDOHBII(gd0qfns@VI-2>l
zf&{0pc{`K%5UlAy9MYmk8J5fy&EK-5shc#UZzwcr;H32PI+AB3P>qs)Vrgz-x>opAZ2GI;2r*!Ha@0<^O9P
zaOu|RYi36+S`peL(haqY$G&BFF^|Xw{+E^2
z1xbMAEw}UC7HNNZ`R|h{i#MJ>8XR9rO5S4U9T!HxMuiWkL?(=G@iM-K;oN
zeKD%sbthH9K31Bdo`G#t%RBD0@V3yMj~-SKGn&=Hqfyc!7+RTLcCJq2GpOG11wkJ@y(MV#3RmP+gi*
ziwhl|*DRrI_QM5$^RVEv_&#hDT;mK)a+Jd(tXU{#X`xK#gP4h{hnM*-b&AZQGYC-b
zM~gFiJ0F$;$K=@P6^o7yEH;7Wcc~SbT9@Rr{$1b7AoJ=P2^D&#N!ZL}guuOr%kIg?
z!)OeQVTQo0Z3gedyXVt##Wmnxk57t%QpGd&PWyOUCOoSjH-mcJ+Xn;(MP9+)GRvCJ
z$dgu~kU7O#fa?AKZ}q7RNC23((Cc`NaTPCV4xc}q+wdW9+tNO~QVY6FvCdS&Y%5+3
zxMXM-MHCCO`Kna4{^Vg*>2WO#IZkd3AaLBAbnf!rodgnn{CiYCtYtD_Z*IqW=60{DU>B{x6qtD9|X$#L7GaJKXGBOlfoH^&x?9t
z$zKr?HO_=1W2QEXh0gNVouM>1+jLhg@-gX0*_x10gWkc7OcOH7dY1PPgG@#b5Xj&=
zLlF^57HqDiL1L+nYhk%U|68sDl>(W!Si*Ov
zNT8o*Cmr~AdxpLZ<>y$uL>M#_8RtwP!q~`>OrqqC$&LYt(vvm$ve^i9WL;L)V2+hj>Mg
z|8Xejc`bc#-Qz8YqYAX@1ZZ)
zjQLKiSG|hhkooQ`rZ%rqc8@U`(A?nw#2*Ig#u1H5f>^Yx78D2$I{^JEydxm-?1?&7
z8uOZ)0h=(D-kA?z$gJ*htxG>6AMnR6<>z(>{vJ4)ZuZ-~qN?(J@ux4Ew#=mnj@SCXa3g;7?H
zigmKp)^KDylm;DWj_g->Ap_nbz&~w@km#YR{nQ(P{`smH?{lMxk)87(Av|flQv_TB
zUn}%muf}l45nJWEj8b7hy<}cdxYFkmkC)?$6jQoUwZSam8Ce9Csdz1Bf1|~WdM$sy
zi#cAn;9S9COtaAs7^3q?CklhwjT`K#nNafQ^_>I3u+Ixkkz3k1_f4zYCzsvVp8N46
zL!bv$R@vd+o0{l!qNCU}H-v{z_Xft=EqPLsS0
z7kWgl{%DN`Kvsiz^eYITUw)ZX>DYtQ?HSXQ*cQZUKkJU72z3#|&RaIzoQjk#YEl4@
zb3b{biQp%(uSqXU7)3U>aCohtOKpU`=@Hffp?1&
zb$_V0V1QW7ibpenKB-BVQU5T|Lb(oHWmnOP|
ztDe`K_hJI3*zf>*w;PoQsVb^)1jp4Xea%ZJ!(uZok}~~`i+M%WV>SMPU&e^fP8}fu
zk&}khlb9O5t*W(~J+3#@3`RDzW{`1f!n_kE-a&!15}zrx=OZjj(^w3#-y#0idM>{p
ztchufC>>p4EOn;pbF4mzntM3m&g&3Ld=Qp`{wCIvP-pcDKsjW}SIG;aQrOQ9=zVApsIyM53?VVzua--nzE
zwXQ{VF;TgMl2#Fi!w=34h9{&CGjZ@)CS9w$@e|g)p6gSgyKl!gAXWY
z*K#j>D|Bjuea4bBt=@BMwF&Ibwjdm6#bf8wk$EGKH|GTc?n?@_?zoS$>>`(Ut`ZK-S
z)edrWuGF#@K<6*tbnt_B98K6x&W!|1H<=o$%jYU`LE@BfmD10&xQdVUMPN>qiocSA
zH5l<7H=UVmxu{C_f!&~L|5qwBvPhw`a*7IGe#F>9S2LuCh-ybWplN}~ovzDG_+X{D
zb_FU7t9c>7M1soeIO!SwH5%>`moyZe3K(achgNv3f@R&4$C5u9s!v!?b$nf^A?6;O
z@N2sw1DjL}jzK5My!^r~>IybEZ66B6{lI@l#TUL$nwcI{C{
zve~OH0CQ?8!=eL2X;1x*j|VzBNsi(PP-EVj`r@kS5#&`>9BCc_df5ds6tE4~vwzh5
zUgKbskC_m!7w;iZXbbkdzOM_}zGUbgP7`H8mIR}C
z;fBJjg!JtM1v<3nygLETUr{1hD^PF%9wQDPcRV??vZ8BdaoscJX#H?{vQ?pA2ew);-E2vPWcQ0l)u=e_k@;N6TQ?MAA
zUl9wUliZ~Tph6&6O+1FSa;|jAQW#zju)u6+4ux=E8W!t|Vro^V-N(%n-u@dVc;Var
z?%L#5Uxb33ImX7%wbh2@EqaavY@e*PHtZ4X^Y*V?N92mmWWW6FCZL|gh!7nR$0%Zg28}xe9B7n)1&yyn>FRGop`)wIuR-a=zfaa5~01DBDE%H
ztN9T#Vi!m2{sVdq*R5GwNo`c66sr
zuMu-d)2Qwpx7}WgocG&eog;H61!*9}`AH8R9xVxf#0=j^I!to_wxCIQP|{VBEkN%gWYr
zzcl6L`ZB7*x#+^<2GGNfsD~a_+|dh@0^HH_xP;2#{SX`{O(XIA6wZ0xHp+zqr)ll$
z$Ndj6$i{1&`Q7Z3q>i9bl_)}YHy&2(Yg=3{XLRbjD6qz88S+P<8(&>vh=lB^8kfv~Q(06gyhbw#X@wK7yYifN2SqN9&%
z2B>?<8kwm(;1q*-0ZyHL5y5332hofe;1y!#2-5fDUkCxJ(B0)ER><_Y$P0DC$3a<}
zJM?5Q@2rLKQ@SZ?>c8P~)!jAG@HX0&gsf(uPv26yaue>$Jl=_W9r-l1=dZFS@baghh
zfet0!vctO%flgRjtj9>c8Tnam4x7z`^-!3U=LVQ}X@agh!}DNQs0Y2->aq^&5m_(WV*!==y#cu2#5*w}Si$*ou1^Pka8Vmd49F{Jab+?+
z)Qx5FTthe(eV&&>+y0SOC7*o_bCtfWBG2!j3FaC8H%e&7%_7xjcbpHZD_CpZwz8Ts
zkG=|Kl=}cA3fEaM-PWp;$Z}-M$JE;`$e$$
zG;Oh}r4#Z7U-I?3lN5>M0BV8`;$%sMJmd7(?!@GSAy3ya+<~*9LwGzHUwH-4v+i+_9If>(u9vv%xDFZ%SyNq30~b
zJ(V#in&I+X9^&G-3)3_0j|FTDlipV?+ep|XQFtDhG!`ZI4%9$8`yjG)Xn0iXNBgLX
znzRN^g8S7QD&790={q#Cb$#`)(Uf>2ZdP7832@L0JcvK*Fj-1jfqG$ATUSzxGvT@y?cCl!4g8kN9tJMk~#e37Qd^|R{d;72GXMjY~0&5_<
z^uGtTCY3vudl`AkFxvS|koSJX+Q~EaE0<=+c(kJfZkmkKn1uAu&k8}wvPa4P9
zm&o$b5~NLf%(TDEiD|z=+5t0y5UjSe-@M5ZuL3N5$t_A!Dg>
zxsr#b!iB{};cZgMTjv0I`cID;vQiS0OG?2u$Q~Qa>fK;eAY%)W0yQ9F#$`IhCn1f-
zPi{Djq)XbL%{f`L3L&0yEqYsG#_Y14ZCuMD?wp@xiddd
zHR*lR)Sn#ywGY%K;97qB=TdGZ-P(H^VUAO&^3Z*25whxG-MD4W-b34BjFp@JzQLX<
z?SLlkgegTfa!>GKA(?mnqFL!hZRKucdpCF_MOAS0aNy2~k8itjPBO>EXadDj#)`1d
zuO|ad-=bavVyY+nSI-Mfn5?*o(I^cWDGy9+EaA8Z9B`VNe%Xi@taZGD=jtTCin0hw
zTic>YVn#9C?Pt?r9V=fFH%F%%UHG^7W6s|wTPsQu_!kra8813?TN;mAXw?|QRm|9~
z;@N1~&dNeo`~(G1)w0O&Ls*$^G`4)lH`&`$?;iTnBkJSpP3`hfsf+I5Kw@
z9$(kECWEf^@;x_jN*JH0E;JSZv={hCI3PI#g(`D{FKsMkSf@Xq*=M&`BY$Av;vp8d
z1j=P1#6W2H-{~@9JHvHI9@bZs{P||hg9Mi2R
zEL2{wDVR>7jm~0t6O_U0-?OgOR}U&ja2A5}^oUM)svD4|3uvV>#k95#myH1`7$!?^
zir4~7Vv2Pmlg4-^>@r1gn0{nS!gPio#rP?Ob7oQ#AsiQjNt2KQ5ZLLAzFt%I0TL6l
zyx}zyuc!?aSbetE^R4R*W`w+{8)0_C*{to_H^=3UhmnL=v*`rqj|&l8v5BhXuafp!
zBvk(3%Aq$T8=}a@L}$G=cu#)e~>RgJLvVC&McT!
zU{4Kt+0z7Dsg$4Kz5ek7_BFrGo_t&8y!Jg9DhD?oysWfJFu`Z12uw1i{5O=iG7Kvq
zSgBRV__cC*{G?MF`{Kyn&rG*Ry=JoG69DkL541ftLp4l#T^69E##c3;j5KQIJu|@>Uh`@iJlBUufB*!I4$d4>o{Ll5^N*bSsW*T6
z4&#*wkdm8#1;ji^c}q^%YN({T@w2Ird?rMk&Xg8a7;-ny_DAKL&3;=9X)7KmlS
z5ck8B9{$5X@QxZtOC=6V0c$Gub#nkPY5>uLCy;2eBuJUdh=kw8{>jd4SJl;Z)7|+#
z-{ES%ft_0HC*FPJJ*#X<*+G{Fss_mfIe(f{`5H+hE$e4|_{
znaaX!aNqtOT%Tmgh<|ev8-NhC$#VNYc0h=l=LT}v*i9d>CE9QF%thFg?S)-ss-%fs
zg{>wQd7-B&TvZYSn
z_9#KV&mhE7D)snyv2ukvm3TWy4Z)-mw
zfNQ^F9N(q>TCH3`psbRZJ_t>B`oq%Io?^n3GD_A+;Wh76@YJA
RXEZ!lep7n6@cY3S003FOdYb?M
literal 0
HcmV?d00001
diff --git a/website/src/app/(home)/landing.css b/website/src/app/(home)/landing.css
new file mode 100644
index 0000000..f06c133
--- /dev/null
+++ b/website/src/app/(home)/landing.css
@@ -0,0 +1,607 @@
+@import url('https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..500;1,9..144,300..500&family=JetBrains+Mono:wght@400;500&display=swap');
+
+.bespoke-landing {
+ background: var(--ink);
+ color: var(--paper);
+ min-height: 100vh;
+ font-family: 'Fraunces', serif;
+}
+
+/* Bespoke landing styles. Loaded by theme/index.ts. Selectors are mostly class-based (.hero, .prim, etc.) so they only match elements present on the landing page; the few that could collide with VitePress chrome (section, main/header/footer) are scoped to .bespoke-landing / .bespoke-landing-wrap. */
+ :root {
+ --ink: #050608;
+ --ink-2: #0a0c10;
+ --ink-3: #12151c;
+ --line: #1a1d24;
+ --line-hot: #242933;
+ --paper: #edeef0;
+ --paper-dim: #8a8f9a;
+ --paper-dimmer: #4d525c;
+ --halo: #c7e8ff;
+ --halo-soft: #7fddff;
+ --amber: #ffb855;
+ --ember: #ff6b35;
+ }
+
+
+
+ .bespoke-landing main, .bespoke-landing header, .bespoke-landing footer { position: relative; z-index: 1; }
+
+ /* ---------- typography ---------- */
+
+ .display {
+ font-family: 'Fraunces', serif;
+ font-variation-settings: "SOFT" 50, "WONK" 1;
+ font-weight: 350;
+ letter-spacing: -0.02em;
+ line-height: 1;
+ }
+ .label {
+ font-family: 'JetBrains Mono', monospace;
+ font-weight: 500;
+ font-size: 11px;
+ letter-spacing: 0.22em;
+ text-transform: uppercase;
+ color: var(--paper-dim);
+ }
+ .label::before {
+ content: "// ";
+ color: var(--halo-soft);
+ }
+ .bespoke-landing code, .bespoke-landing pre, .bespoke-landing .mono {
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 13px;
+ }
+
+ /* ---------- layout ---------- */
+
+ .shell {
+ max-width: 1240px;
+ margin: 0 auto;
+ padding: 0 clamp(24px, 5vw, 64px);
+ }
+
+ /* ---------- top bar ---------- */
+
+ header.top {
+ padding: 28px 0 0;
+ }
+ .top-row {
+ display: flex;
+ align-items: center;
+ justify-content: space-between;
+ padding-bottom: 20px;
+ border-bottom: 1px solid var(--line);
+ }
+ .mark {
+ display: inline-flex;
+ align-items: center;
+ gap: 10px;
+ font-family: 'Fraunces', serif;
+ font-weight: 400;
+ font-size: 17px;
+ letter-spacing: -0.01em;
+ color: var(--paper);
+ text-decoration: none;
+ }
+ .mark-dot {
+ width: 10px; height: 10px;
+ border-radius: 50%;
+ background: var(--halo);
+ box-shadow: 0 0 14px var(--halo-soft), 0 0 3px #fff inset;
+ }
+ .mark em {
+ font-style: italic;
+ font-weight: 300;
+ color: var(--paper-dim);
+ font-size: 12px;
+ margin-left: 6px;
+ }
+ nav.top-nav {
+ display: flex; gap: 28px;
+ }
+ nav.top-nav a {
+ font-size: 12px;
+ letter-spacing: 0.18em;
+ text-transform: uppercase;
+ font-family: 'JetBrains Mono', monospace;
+ font-weight: 400;
+ color: var(--paper-dim);
+ text-decoration: none;
+ transition: color .2s;
+ }
+ nav.top-nav a:hover { color: var(--paper); }
+ nav.top-nav a:hover::before { content: "› "; color: var(--halo-soft); }
+ @media (max-width: 720px) {
+ nav.top-nav a:not(.primary) { display: none; }
+ }
+ nav.top-nav a.primary {
+ color: var(--ink);
+ background: var(--halo);
+ padding: 8px 14px;
+ border-radius: 2px;
+ }
+ nav.top-nav a.primary::before { display: none !important; }
+
+ /* ---------- hero ---------- */
+
+ .bespoke-landing section.hero {
+ padding: clamp(60px, 10vh, 120px) 0 60px;
+ display: grid;
+ grid-template-columns: 1fr;
+ gap: 60px;
+ align-items: end;
+ }
+
+ .hero-headline { max-width: 860px; }
+ .hero-eyebrow {
+ display: flex; align-items: center; gap: 14px;
+ margin-bottom: 32px;
+ opacity: 0; transform: translateY(8px);
+ animation: rise .9s .1s forwards cubic-bezier(.2,.7,.2,1);
+ }
+ .hero-eyebrow .v { color: var(--halo-soft); font-family: 'JetBrains Mono', monospace; font-size: 11px; letter-spacing: 0.18em; }
+ .hero-eyebrow .divider { width: 36px; height: 1px; background: var(--line-hot); }
+ .hero-eyebrow .tag { font-family: 'JetBrains Mono', monospace; font-size: 11px; letter-spacing: 0.22em; text-transform: uppercase; color: var(--paper-dim); }
+
+ h1.display {
+ font-size: clamp(52px, 9vw, 124px);
+ opacity: 0; transform: translateY(16px);
+ animation: rise 1s .15s forwards cubic-bezier(.2,.7,.2,1);
+ }
+ h1.display .accent {
+ font-style: italic;
+ font-weight: 300;
+ color: var(--halo);
+ }
+ h1.display .shy {
+ font-style: italic;
+ font-weight: 300;
+ color: var(--paper-dim);
+ }
+
+ .hero-lede {
+ font-family: 'Fraunces', serif;
+ font-weight: 300;
+ font-size: clamp(18px, 2vw, 22px);
+ line-height: 1.45;
+ color: var(--paper);
+ max-width: 640px;
+ margin-top: 36px;
+ opacity: 0; transform: translateY(12px);
+ animation: rise 1s .3s forwards cubic-bezier(.2,.7,.2,1);
+ }
+ .hero-lede em {
+ color: var(--paper-dim);
+ font-style: italic;
+ }
+
+ .hero-meta {
+ display: grid;
+ grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
+ gap: 24px 48px;
+ margin-top: 48px;
+ padding-top: 28px;
+ border-top: 1px solid var(--line);
+ opacity: 0; transform: translateY(12px);
+ animation: rise 1s .45s forwards cubic-bezier(.2,.7,.2,1);
+ }
+ .hero-meta .cell { }
+ .hero-meta .k { font-family: 'JetBrains Mono', monospace; font-size: 10px; letter-spacing: 0.22em; text-transform: uppercase; color: var(--paper-dimmer); margin-bottom: 6px; }
+ .hero-meta .v { font-family: 'Fraunces', serif; font-size: 22px; font-weight: 350; letter-spacing: -0.01em; }
+ .hero-meta .v .sub { color: var(--paper-dim); font-size: 13px; margin-left: 6px; font-family: 'JetBrains Mono', monospace; letter-spacing: 0; text-transform: none; }
+
+ .hero-banner {
+ margin-top: clamp(48px, 8vh, 96px);
+ position: relative;
+ overflow: hidden;
+ border: 1px solid var(--line);
+ border-radius: 2px;
+ background: #000;
+ aspect-ratio: 16 / 5;
+ opacity: 0; transform: translateY(20px);
+ animation: rise 1.4s .6s forwards cubic-bezier(.2,.7,.2,1);
+ }
+ .hero-banner img {
+ width: 100%; height: 100%;
+ object-fit: cover;
+ display: block;
+ filter: contrast(1.05);
+ }
+ .hero-banner::before {
+ content: "";
+ position: absolute; inset: 0;
+ background: linear-gradient(180deg, transparent 60%, var(--ink) 100%);
+ pointer-events: none;
+ }
+ .hero-banner .corners {
+ position: absolute; inset: 12px;
+ pointer-events: none;
+ }
+ .hero-banner .corners::before,
+ .hero-banner .corners::after {
+ content: "";
+ position: absolute;
+ width: 14px; height: 14px;
+ border: 1px solid var(--halo-soft);
+ opacity: .6;
+ }
+ .hero-banner .corners::before { top: 0; left: 0; border-right: none; border-bottom: none; }
+ .hero-banner .corners::after { bottom: 0; right: 0; border-left: none; border-top: none; }
+
+ .hero-banner-caption {
+ display: flex; justify-content: space-between;
+ margin-top: 12px;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 10px;
+ letter-spacing: 0.2em;
+ color: var(--paper-dimmer);
+ text-transform: uppercase;
+ }
+
+ /* ---------- section frame ---------- */
+
+ .bespoke-landing section {
+ padding: clamp(80px, 12vh, 140px) 0;
+ border-top: 1px solid var(--line);
+ position: relative;
+ }
+ .bespoke-landing section .section-head {
+ display: grid;
+ grid-template-columns: 160px 1fr;
+ gap: 48px;
+ margin-bottom: 64px;
+ align-items: baseline;
+ }
+ .bespoke-landing section .section-head .label { padding-top: 10px; }
+ .bespoke-landing section h2 {
+ font-family: 'Fraunces', serif;
+ font-weight: 350;
+ font-style: italic;
+ font-size: clamp(32px, 4.5vw, 56px);
+ letter-spacing: -0.015em;
+ line-height: 1.05;
+ max-width: 820px;
+ }
+ .bespoke-landing section h2 .strong {
+ font-style: normal;
+ color: var(--halo);
+ font-variation-settings: "WONK" 1;
+ }
+ @media (max-width: 720px) {
+ .bespoke-landing section .section-head { grid-template-columns: 1fr; gap: 8px; margin-bottom: 36px; }
+ }
+
+ /* ---------- primitives grid ---------- */
+
+ .prims {
+ display: grid;
+ grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
+ gap: 0;
+ border-top: 1px solid var(--line);
+ }
+ .prim {
+ padding: 36px 32px 40px;
+ border-bottom: 1px solid var(--line);
+ border-right: 1px solid var(--line);
+ position: relative;
+ transition: background .25s;
+ }
+ .prim:hover { background: var(--ink-2); }
+ .prim:last-child { border-right: 1px solid var(--line); }
+ @media (max-width: 720px) { .prim { border-right: none !important; } }
+
+ .prim .num {
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 11px;
+ color: var(--halo-soft);
+ letter-spacing: 0.2em;
+ margin-bottom: 32px;
+ display: flex; align-items: center; gap: 10px;
+ }
+ .prim .num::after {
+ content: ""; flex: 1; height: 1px; background: var(--line-hot);
+ }
+ .prim h3 {
+ font-family: 'Fraunces', serif;
+ font-weight: 400;
+ font-size: 24px;
+ line-height: 1.15;
+ margin-bottom: 14px;
+ letter-spacing: -0.01em;
+ }
+ .prim h3 em { color: var(--halo); font-style: italic; font-weight: 300; }
+ .prim p {
+ font-size: 14px;
+ line-height: 1.6;
+ color: var(--paper-dim);
+ max-width: 34ch;
+ }
+
+ /* ---------- code block ---------- */
+
+ .code-window {
+ border: 1px solid var(--line);
+ background: var(--ink-2);
+ border-radius: 2px;
+ overflow: hidden;
+ margin-top: 8px;
+ }
+ .code-window .bar {
+ display: flex; align-items: center; justify-content: space-between;
+ padding: 10px 16px;
+ border-bottom: 1px solid var(--line);
+ background: var(--ink-3);
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 11px;
+ color: var(--paper-dimmer);
+ letter-spacing: 0.15em;
+ text-transform: uppercase;
+ }
+ .code-window .bar .pills {
+ display: inline-flex; gap: 6px;
+ }
+ .code-window .bar .pills i {
+ width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+ background: #2a2f38;
+ }
+ .code-window .bar .pills i:first-child { background: #ff5f57; opacity: .55; }
+ .code-window .bar .pills i:nth-child(2) { background: #febc2e; opacity: .55; }
+ .code-window .bar .pills i:nth-child(3) { background: #28c840; opacity: .55; }
+ .code-window pre {
+ padding: 28px 32px;
+ overflow-x: auto;
+ font-size: 13px;
+ line-height: 1.75;
+ color: var(--paper);
+ }
+ .code-window pre .k { color: var(--halo-soft); }
+ .code-window pre .s { color: #f5d796; }
+ .code-window pre .c { color: var(--paper-dimmer); font-style: italic; }
+ .code-window pre .f { color: var(--paper); }
+ .code-window pre .p { color: var(--paper-dim); }
+ .code-window pre .n { color: #c8b6ff; }
+ button.copy {
+ background: transparent;
+ border: 1px solid var(--line-hot);
+ color: var(--paper-dim);
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 10px;
+ letter-spacing: 0.18em;
+ text-transform: uppercase;
+ padding: 4px 10px;
+ cursor: pointer;
+ border-radius: 2px;
+ transition: all .2s;
+ }
+ button.copy:hover { color: var(--ink); background: var(--halo); border-color: var(--halo); }
+ button.copy.done { color: var(--ink); background: var(--halo-soft); border-color: var(--halo-soft); }
+
+ /* ---------- quick-start split ---------- */
+
+ .qstart {
+ display: grid;
+ grid-template-columns: 5fr 7fr;
+ gap: 64px;
+ align-items: start;
+ }
+ @media (max-width: 900px) { .qstart { grid-template-columns: 1fr; gap: 36px; } }
+
+ .qstart .side p {
+ font-family: 'Fraunces', serif;
+ font-size: 19px;
+ line-height: 1.55;
+ color: var(--paper);
+ font-weight: 300;
+ }
+ .qstart .side p + p { margin-top: 18px; color: var(--paper-dim); }
+ .qstart .side .install {
+ margin-top: 28px;
+ display: inline-flex;
+ align-items: center;
+ gap: 12px;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 13px;
+ padding: 12px 18px;
+ border: 1px solid var(--line-hot);
+ background: var(--ink-2);
+ border-radius: 2px;
+ }
+ .qstart .side .install::before {
+ content: "$"; color: var(--halo-soft);
+ }
+
+ /* ---------- security block ---------- */
+
+ .sec-grid {
+ display: grid;
+ grid-template-columns: 1fr 1fr;
+ border-top: 1px solid var(--line);
+ }
+ .sec-grid .row {
+ display: contents;
+ }
+ .sec-grid .k, .sec-grid .v {
+ padding: 20px 24px;
+ border-bottom: 1px solid var(--line);
+ }
+ .sec-grid .k {
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 12px;
+ letter-spacing: 0.05em;
+ color: var(--halo-soft);
+ border-right: 1px solid var(--line);
+ }
+ .sec-grid .v {
+ font-size: 14px;
+ color: var(--paper-dim);
+ line-height: 1.6;
+ }
+ .sec-grid .v strong { color: var(--paper); font-weight: 400; }
+ @media (max-width: 720px) {
+ .sec-grid { grid-template-columns: 1fr; }
+ .sec-grid .k { border-right: none; padding-bottom: 4px; }
+ .sec-grid .v { padding-top: 4px; }
+ }
+
+ .sec-note {
+ margin-top: 40px;
+ padding: 20px 24px;
+ border-left: 2px solid var(--amber);
+ background: rgba(255, 184, 85, 0.04);
+ font-size: 14px;
+ color: var(--paper-dim);
+ line-height: 1.6;
+ }
+ .sec-note strong { color: var(--amber); font-weight: 500; }
+
+ /* ---------- ecosystem cards ---------- */
+
+ .eco {
+ display: grid;
+ grid-template-columns: repeat(3, 1fr);
+ gap: 20px;
+ }
+ @media (max-width: 900px) { .eco { grid-template-columns: 1fr; } }
+
+ .eco-card {
+ padding: 32px 28px 28px;
+ border: 1px solid var(--line);
+ background: linear-gradient(180deg, var(--ink-2) 0%, var(--ink) 100%);
+ border-radius: 2px;
+ position: relative;
+ overflow: hidden;
+ transition: border-color .25s, transform .25s;
+ }
+ .eco-card:hover { border-color: var(--line-hot); transform: translateY(-2px); }
+ .eco-card.this {
+ border-color: var(--halo-soft);
+ background: linear-gradient(180deg, rgba(127,221,255,0.06) 0%, var(--ink) 100%);
+ }
+ .eco-card.this::after {
+ content: "this repo";
+ position: absolute;
+ top: 16px; right: 16px;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 10px;
+ letter-spacing: 0.2em;
+ text-transform: uppercase;
+ color: var(--ink);
+ background: var(--halo);
+ padding: 4px 8px;
+ border-radius: 2px;
+ }
+ .eco-card .mono-name {
+ font-family: 'JetBrains Mono', monospace;
+ font-weight: 500;
+ font-size: 15px;
+ color: var(--paper);
+ margin-bottom: 18px;
+ }
+ .eco-card h3 {
+ font-family: 'Fraunces', serif;
+ font-weight: 400;
+ font-size: 20px;
+ line-height: 1.2;
+ margin-bottom: 10px;
+ letter-spacing: -0.01em;
+ }
+ .eco-card p {
+ font-size: 13px;
+ color: var(--paper-dim);
+ line-height: 1.55;
+ }
+ .eco-card .status {
+ margin-top: 22px;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 10px;
+ letter-spacing: 0.2em;
+ text-transform: uppercase;
+ color: var(--paper-dimmer);
+ display: flex; align-items: center; gap: 8px;
+ }
+ .eco-card .status::before {
+ content: ""; width: 6px; height: 6px; border-radius: 50%;
+ background: var(--paper-dimmer);
+ }
+ .eco-card.this .status::before { background: var(--halo); box-shadow: 0 0 10px var(--halo-soft); }
+ .eco-card.this .status { color: var(--halo-soft); }
+ /* Eco-card version: hidden by default, surfaced once GitHub API resolves. */
+ .eco-card .status .status-version:not(:empty)::before { content: " - "; }
+
+ /* ---------- footer ---------- */
+
+ .bespoke-landing footer {
+ padding: 56px 0 48px;
+ border-top: 1px solid var(--line);
+ }
+ .foot-row {
+ display: flex;
+ justify-content: space-between;
+ align-items: flex-end;
+ flex-wrap: wrap;
+ gap: 32px;
+ }
+ .foot-row .sig {
+ font-family: 'Fraunces', serif;
+ font-style: italic;
+ font-weight: 300;
+ font-size: 14px;
+ color: var(--paper-dim);
+ max-width: 320px;
+ line-height: 1.5;
+ }
+ .foot-links {
+ display: flex; gap: 32px;
+ }
+ .foot-links a {
+ color: var(--paper-dim);
+ text-decoration: none;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 11px;
+ letter-spacing: 0.18em;
+ text-transform: uppercase;
+ transition: color .2s;
+ }
+ .foot-links a:hover { color: var(--halo); }
+ .foot-meta {
+ margin-top: 36px;
+ padding-top: 20px;
+ border-top: 1px solid var(--line);
+ display: flex;
+ justify-content: space-between;
+ font-family: 'JetBrains Mono', monospace;
+ font-size: 10px;
+ letter-spacing: 0.2em;
+ text-transform: uppercase;
+ color: var(--paper-dimmer);
+ }
+
+ /* ---------- motion ---------- */
+
+ @keyframes rise {
+ to { opacity: 1; transform: translateY(0); }
+ }
+
+ /* Fallback for users with prefers-reduced-motion: reduce. The hero elements
+ * start at opacity: 0 and rely on the rise animation to become visible; if
+ * the animation is suppressed by the reduced-motion media query in custom.css,
+ * we must surface them anyway, otherwise the entire hero reads as empty space. */
+ @media (prefers-reduced-motion: reduce) {
+ .bespoke-landing .hero-eyebrow,
+ .bespoke-landing h1.display,
+ .bespoke-landing .hero-lede,
+ .bespoke-landing .hero-meta,
+ .bespoke-landing .hero-banner {
+ opacity: 1 !important;
+ transform: none !important;
+ animation: none !important;
+ }
+ }
+
+
+ /* ---------- focus ---------- */
+ .bespoke-landing a:focus-visible, .bespoke-landing button:focus-visible {
+ outline: 1px solid var(--halo);
+ outline-offset: 3px;
+ }
diff --git a/website/src/app/(home)/layout.tsx b/website/src/app/(home)/layout.tsx
index 77379fa..dc098a0 100644
--- a/website/src/app/(home)/layout.tsx
+++ b/website/src/app/(home)/layout.tsx
@@ -1,6 +1,5 @@
-import { HomeLayout } from 'fumadocs-ui/layouts/home';
-import { baseOptions } from '@/lib/layout.shared';
-
+// The home route is a full-bleed bespoke landing with its own header and
+// footer, so it deliberately does not use Fumadocs' HomeLayout chrome.
export default function Layout({ children }: LayoutProps<'/'>) {
- return {children} ;
+ return <>{children};
}
diff --git a/website/src/app/(home)/page.tsx b/website/src/app/(home)/page.tsx
index 970bd1e..110a6d7 100644
--- a/website/src/app/(home)/page.tsx
+++ b/website/src/app/(home)/page.tsx
@@ -1,212 +1,416 @@
-import Link from 'next/link';
+'use client';
-const primitives = [
- {
- num: '01 / isolated',
- title: 'Your code runs in its own cell.',
- body: 'Every run gets a fresh container, its own volume, its own network. Nothing leaks in from the host, nothing leaks out to sibling runs. Torn down on exit, success or not.',
- },
- {
- num: '02 / drop in, pull out',
- title: 'Send a folder. Get any file back.',
- body: 'Point at a directory on your disk, it becomes the container workdir. When the run finishes, ask for any path and it lands back on your host.',
- },
- {
- num: '03 / stop on demand',
- title: 'Cancel, abort, or time out.',
- body: 'Pass an AbortSignal, call cancel(), or set a deadline. The container dies and its volume goes with it. No zombie processes, no leaked disk.',
- },
- {
- num: '04 / any stack',
- title: 'Python, Node, Go, Ruby, shell, anything.',
- body: 'Any Docker image on your registry or anyone else’s. No special runtime inside the container, no SDK to import, no convention to follow.',
- },
-];
+import { useEffect } from 'react';
+import './landing.css';
-const security: [string, string][] = [
- ['Kernel permissions', 'Dangerous capabilities stripped at startup: raw sockets, device creation, chroot escapes, capability juggling, audit-log spoofing. Every run, unconditionally.'],
- ['No privilege escalation', 'A setuid binary inside your container cannot elevate above the user it starts as.'],
- ['Fork-bomb protection', 'Max 100 processes per container. A runaway loop caps out in milliseconds.'],
- ['Memory and CPU budget', '512 MiB and one core by default, cgroup-enforced. Tunable per runner.'],
- ['Network isolation', 'Isolated bridge by default with inter-container traffic blocked. Use networks: [‘none’] to sever it entirely.'],
- ['Host filesystem', 'Symlinks in your input folder are filtered before seeding, so a stray link cannot reach back into the host.'],
- ['Safe extraction', 'Paths escaping upward (..) are refused; each extracted entry is capped at 1 GiB.'],
- ['Kernel-level hardening', 'Swap the runtime to gVisor with one option for user-space syscall interception.'],
-];
+const BASE = '/light-runner';
-const ecosystem = [
- {
- name: 'light-runner',
- tag: 'this library',
- title: 'Spawn one container, return exit code and files.',
- body: 'The execution primitive. Domain-agnostic. Zero orchestration. The other two tools call down to this one.',
- },
- {
- name: 'light-run',
- tag: 'HTTP',
- title: 'CLI and HTTP surface around light-runner.',
- body: 'Point a POST endpoint at it, pipe bodies through, get results back. Stateless wrapper, same defaults, same guarantees.',
- },
- {
- name: 'light-process',
- tag: 'DAG',
- title: 'DAG orchestration, retries, fan-out.',
- body: 'Composes runs into pipelines with backoff, concurrency limits, and structured outputs.',
- },
-];
+const CODE_HTML = `import { DockerRunner } from 'light-runner' ;
+const runner = new DockerRunner ( { memory : '512m' , cpus : '1' } ) ;
+const execution = runner. run ( {
+ image : 'python:3.12-alpine' ,
+ entrypoint : 'python main.py' ,
+ dir : './my-project' ,
+ input : { task : 'compute' , n : 20 } ,
+ timeout : 30_000 ,
+ extract : [ { from : '/app/result.json' , to : './out' } ] ,
+} ) ;
+const result = await execution. result;
+result. success // true if exit 0 and not cancelled
+result. exitCode // the container exit code
+result. extracted // [{ from, to, status, bytes }] `;
-const code = `import { DockerRunner } from 'light-runner';
+export default function HomePage() {
+ useEffect(() => {
+ const btn = document.querySelector('[data-copy]');
+ const src = document.getElementById('code-sample');
+ if (btn && src) {
+ btn.addEventListener('click', async () => {
+ try {
+ await navigator.clipboard.writeText((src as HTMLElement).innerText.trim());
+ btn.textContent = 'Copied';
+ btn.classList.add('done');
+ setTimeout(() => {
+ btn.textContent = 'Copy';
+ btn.classList.remove('done');
+ }, 1600);
+ } catch {
+ btn.textContent = 'Select';
+ }
+ });
+ }
-const runner = new DockerRunner({ memory: '512m', cpus: '1' });
+ const PROJECT = 'enixCode/light-runner';
+ const repos = new Set([PROJECT]);
+ document.querySelectorAll('[data-eco-status][data-gh-repo]').forEach((el) => {
+ const r = el.getAttribute('data-gh-repo');
+ if (r) repos.add(r);
+ });
-const execution = runner.run({
- image: 'python:3.12-alpine',
- entrypoint: 'python main.py',
- dir: './my-project',
- input: { task: 'compute', n: 20 },
- timeout: 30_000,
- extract: [{ from: '/app/result.json', to: './out' }],
-});
+ const fetchLatest = (repo: string): Promise<{ tag_name?: string; prerelease?: boolean } | null> =>
+ fetch(`https://api.github.com/repos/${repo}/releases/latest`)
+ .then((r) => (r.ok ? r.json() : null))
+ .catch(() => null);
-const result = await execution.result;
-result.success; // true if exit 0 and not cancelled
-result.exitCode; // the container exit code
-result.extracted; // [{ from, to, status, bytes }]`;
+ Promise.all([...repos].map((repo) => fetchLatest(repo).then((data) => [repo, data] as const))).then(
+ (entries) => {
+ const releases = new Map(entries);
+ const project = releases.get(PROJECT);
+ if (project?.tag_name) {
+ const tag = project.tag_name;
+ const v = tag.startsWith('v') ? tag : `v${tag}`;
+ document.querySelectorAll('[data-gh-version]').forEach((el) => {
+ el.textContent = v;
+ });
+ }
+ document.querySelectorAll('[data-eco-status][data-gh-repo]').forEach((el) => {
+ const repo = el.getAttribute('data-gh-repo');
+ const fallback = el.getAttribute('data-fallback') || 'In development';
+ const data = repo ? releases.get(repo) : null;
+ const tag = data?.tag_name;
+ if (!tag) {
+ el.textContent = fallback;
+ return;
+ }
+ const v = tag.startsWith('v') ? tag : `v${tag}`;
+ el.textContent = `${data?.prerelease === true ? 'Pre-release - ' : 'Stable - '}${v}`;
+ });
+ },
+ );
+ }, []);
-function Label({ children }: { children: React.ReactNode }) {
return (
-
- {children}
-
- );
-}
-
-export default function HomePage() {
- return (
-
- {/* Hero */}
-
-
- Execution primitive, Node.js
-
-
- Run untrusted code in hardened containers.
-
-
- A single-purpose Node.js library that runs your code in a container it tears down
- afterwards, and hands you back the exit code, logs, and any files you asked for. Nothing
- else.
-
-
-
- Quick start
-
-
- API reference
-
-
- GitHub
-
-
-
npm install light-runner
+
+
+
-
-
- {/* Primitives */}
-
- what you get
-
- Give it code. Get back an exit code , logs, and the
- files you asked for.
-
-
- {primitives.map((p) => (
-
-
{p.num}
-
{p.title}
-
{p.body}
+
+
+ {/* HERO */}
+
+
+
+ Execution primitive - Node.js
- ))}
-
-
- {/* Quick start */}
-
- quick start
-
- A few lines to run, one to get your artefact.
-
-
- {code}
-
-
-
- {/* Security */}
-
- security model
-
- Hardened defaults, never opt-out. Add more
- restrictions, never fewer.
-
-
- {security.map(([k, v]) => (
-
-
{k}
-
{v}
+
+
+ Run untrusted code
+ in hardened containers.
+
+
+ A single-purpose Node.js library that runs your code in a container it tears down
+ afterwards, and hands you back the exit code, logs, and any files you asked for. {' '}
+ Nothing else.
+
+
+
+
Runtime
+
+ Node >=22
+
+
+
+
Dependencies
+
+ 3 dockerode + tar
+
+
+
+
Transport
+
+ dockerode no CLI
+
+
+
+
License
+
+ MIT permissive
+
+
+
- ))}
-
-
- Does not cover kernel exploits, runc CVEs, or side-channel attacks. For genuinely hostile
- code, combine with the gVisor (runsc) or Kata runtimes.
-
-
-
- {/* Ecosystem */}
-
- ecosystem
-
- Three tools. Each does one thing.
-
-
- {ecosystem.map((e) => (
-
-
- {e.name}
-
- {e.tag}
-
-
-
{e.title}
-
{e.body}
+
+
+ {/* eslint-disable-next-line @next/next/no-img-element */}
+
+
+
+ Fig. 01 - One process, one cell, one grid.
+ light-runner / visual
+
+
+
+
+ {/* PRIMITIVES */}
+
+
+
+
what you get
+
+ Give it code. Get back an exit code , logs, and the
+ files you asked for.
+
- ))}
-
-
- {/* Footer */}
-
-
-
light-runner / execution primitive
-
- GitHub
- npm
- MIT
-
+
+
+
01 / isolated
+
+ Your code runs in its own cell .
+
+
+ Every run gets a fresh container, its own volume, its own network. Nothing leaks in
+ from the host, nothing leaks out to sibling runs. Torn down on exit, success or not.
+
+
+
+
02 / drop in, pull out
+
+ Send a folder. Get any file back.
+
+
+ Point at a directory on your disk, it becomes the container workdir. When the run
+ finishes, ask for any path and it lands back on your host.
+
+
+
+
03 / stop on demand
+
+ Cancel, abort, or time out .
+
+
+ Pass an AbortSignal, call cancel(), or set a deadline. The
+ container dies and its volume goes with it. No zombie processes, no leaked disk.
+
+
+
+
04 / any stack
+
+ Python, Node, Go, Ruby, shell, anything .
+
+
+ Any Docker image on your registry or anyone else's. No special runtime inside the
+ container, no SDK to import, no convention to follow. Your code stays your code.
+
+
+
+
+
+
+
quick start
+
+ Five lines to run, one to get your artefact.
+
+
+
+
+
+ Point light-runner at an image and a folder. Pipe input through stdin.
+ Extract whatever your container wrote.
+
+
No HTTP server. No config file. No CLI.
+
npm install light-runner
+
+
+
+
+
+ example.ts
+
+ Copy
+
+
+
+
+
+
+ {/* SECURITY */}
+
+
+
+
security model
+
+ Hardened defaults, never opt-out. Add more
+ restrictions, never fewer.
+
+
+
+
+
Kernel permissions
+
+ Dangerous capabilities stripped at startup - raw sockets, device
+ creation, chroot escapes, capability juggling, audit-log spoofing. Every run,
+ unconditionally.
+
+
+
+
No privilege escalation
+
+ A setuid binary inside your container cannot elevate above the user
+ it starts as.
+
+
+
+
Fork-bomb protection
+
+ Max 100 processes per container. A runaway loop caps out in
+ milliseconds instead of paging the host.
+
+
+
+
Memory and CPU budget
+
+ 512 MiB and one core by default, cgroup-enforced.
+ Noisy runs cannot starve their neighbours. Tunable per runner.
+
+
+
+
Network isolation
+
+ Isolated bridge by default with inter-container traffic blocked.
+ Pass networks: ['none'] to sever it entirely.
+
+
+
+
Host filesystem protection
+
+ Symlinks in your input folder are filtered before seeding, so a
+ stray link cannot reach back into the host filesystem.
+
+
+
+
Safe file extraction
+
+ A container cannot write outside the destination folder you chose: paths escaping
+ upward (..) are refused. Each extracted entry is capped at{' '}
+ 1 GiB so a runaway output cannot fill your disk.
+
+
+
+
Kernel-level hardening
+
+ Swap the runtime to gVisor with one option for user-space syscall
+ interception, at ~10-30% I/O cost.
+
+
+
+
+ Does not cover - kernel exploits, runc CVEs, side-channel
+ attacks. For genuinely hostile code, combine with {'{ runtime: \'runsc\' }'}{' '}
+ (gVisor) or {'{ runtime: \'kata\' }'} (Kata Containers, VM-level isolation).
+
+
+ {/* ECOSYSTEM */}
+
+
+
+
ecosystem
+
+ Three tools. Each does one thing.
+
+
+
+
+ light-runner
+ Spawn one container, return exit code and files.
+
+ The execution primitive. Domain-agnostic. Zero orchestration. The other two tools in
+ this family both call down to this one.
+
+
+ Loading
+
+
+
+ light-run
+ CLI and HTTP surface around light-runner.
+
+ Point a POST endpoint at it, pipe bodies through, get results back. Stateless
+ wrapper, same defaults, same guarantees.
+
+
+ Loading
+
+
+
+ light-process
+ DAG orchestration, retries, fan-out.
+
+ When one container is not enough. Composes runs into pipelines with backoff,
+ concurrency limits, and structured outputs.
+
+
+ Loading
+
+
+
+
+
+
-
+ import { DockerRunner } from 'light-runner' ;
+const runner = new DockerRunner ( { memory : '512m' , cpus : '1' } ) ;
+const execution = runner. run ( {
+ image : 'python:3.12-alpine' ,
+ entrypoint : 'python main.py' ,
+ dir : './my-project' ,
+ input : { task : 'compute' , n : 20 } ,
+ timeout : 30_000 ,
+ extract : [ { from : '/app/result.json' , to : './out' } ] ,
+} ) ;
+const result = await execution. result;
+result. success // true if exit 0 and not cancelled
+result. exitCode // the container exit code
+result. extracted // [{ from, to, status, bytes }] `;
+
+export const lightRunnerData: LandingData = {
+ githubRepo: 'enixCode/light-runner',
+ brand: 'light-runner',
+ nav: [
+ { label: 'Primitives', href: '#primitives' },
+ { label: 'Quick start', href: '#quick-start' },
+ { label: 'Security', href: '#security' },
+ { label: 'Ecosystem', href: '#ecosystem' },
+ { label: 'Documentation', href: `${BASE}/docs` },
+ { label: 'GitHub ->', href: 'https://github.com/enixCode/light-runner', primary: true },
+ ],
+ hero: {
+ tag: 'Execution primitive - Node.js',
+ headline: (
+ <>
+ Run untrusted code
+ in hardened containers.
+
+ ),
+ lede: (
+ <>
+ A single-purpose Node.js library that runs your code in a container it tears down afterwards,
+ and hands you back the exit code, logs, and any files you asked for. Nothing else.
+
+ ),
+ meta: [
+ { k: 'Runtime', v: <>Node >=22 },
+ { k: 'Dependencies', v: <>3 dockerode + tar },
+ { k: 'Transport', v: <>dockerode no CLI },
+ { k: 'License', v: <>MIT permissive },
+ ],
+ banner: {
+ src: `${BASE}/banner.webp`,
+ alt: 'A single glowing sphere floating above a wireframe cube on an isolated dark grid, the visual metaphor for a sandboxed container.',
+ captionLeft: 'Fig. 01 - One process, one cell, one grid.',
+ captionRight: 'light-runner / visual',
+ },
+ },
+ primitives: {
+ label: 'what you get',
+ heading: (
+ <>
+ Give it code. Get back an exit code , logs, and the files you
+ asked for.
+
+ ),
+ items: [
+ {
+ num: '01 / isolated',
+ title: (
+ <>
+ Your code runs in its own cell .
+
+ ),
+ body: 'Every run gets a fresh container, its own volume, its own network. Nothing leaks in from the host, nothing leaks out to sibling runs. Torn down on exit, success or not.',
+ },
+ {
+ num: '02 / drop in, pull out',
+ title: (
+ <>
+ Send a folder. Get any file back.
+
+ ),
+ body: 'Point at a directory on your disk, it becomes the container workdir. When the run finishes, ask for any path and it lands back on your host.',
+ },
+ {
+ num: '03 / stop on demand',
+ title: (
+ <>
+ Cancel, abort, or time out .
+
+ ),
+ body: (
+ <>
+ Pass an AbortSignal, call cancel(), or set a deadline. The
+ container dies and its volume goes with it. No zombie processes, no leaked disk.
+
+ ),
+ },
+ {
+ num: '04 / any stack',
+ title: (
+ <>
+ Python, Node, Go, Ruby, shell, anything .
+
+ ),
+ body: 'Any Docker image on your registry or anyone else’s. No special runtime inside the container, no SDK to import, no convention to follow. Your code stays your code.',
+ },
+ ],
+ },
+ quickstart: {
+ label: 'quick start',
+ heading: (
+ <>
+ Five lines to run, one to get your artefact.
+
+ ),
+ side: (
+ <>
+
+ Point light-runner at an image and a folder. Pipe input through stdin. Extract
+ whatever your container wrote.
+
+ No HTTP server. No config file. No CLI.
+
+ ),
+ install: 'npm install light-runner',
+ codeHtml: CODE_HTML,
+ },
+ security: {
+ label: 'security model',
+ heading: (
+ <>
+ Hardened defaults, never opt-out. Add more restrictions, never
+ fewer.
+
+ ),
+ rows: [
+ {
+ k: 'Kernel permissions',
+ v: (
+ <>
+ Dangerous capabilities stripped at startup - raw sockets, device
+ creation, chroot escapes, capability juggling, audit-log spoofing. Every run,
+ unconditionally.
+
+ ),
+ },
+ {
+ k: 'No privilege escalation',
+ v: (
+ <>
+ A setuid binary inside your container cannot elevate above the user it
+ starts as.
+
+ ),
+ },
+ {
+ k: 'Fork-bomb protection',
+ v: (
+ <>
+ Max 100 processes per container. A runaway loop caps out in milliseconds
+ instead of paging the host.
+
+ ),
+ },
+ {
+ k: 'Memory and CPU budget',
+ v: (
+ <>
+ 512 MiB and one core by default, cgroup-enforced. Noisy
+ runs cannot starve their neighbours. Tunable per runner.
+
+ ),
+ },
+ {
+ k: 'Network isolation',
+ v: (
+ <>
+ Isolated bridge by default with inter-container traffic blocked. Pass{' '}
+ networks: ['none'] to sever it entirely.
+
+ ),
+ },
+ {
+ k: 'Host filesystem protection',
+ v: (
+ <>
+ Symlinks in your input folder are filtered before seeding, so a stray
+ link cannot reach back into the host filesystem.
+
+ ),
+ },
+ {
+ k: 'Safe file extraction',
+ v: (
+ <>
+ A container cannot write outside the destination folder you chose: paths escaping upward
+ (..) are refused. Each extracted entry is capped at 1 GiB so
+ a runaway output cannot fill your disk.
+
+ ),
+ },
+ {
+ k: 'Kernel-level hardening',
+ v: (
+ <>
+ Swap the runtime to gVisor with one option for user-space syscall
+ interception, at ~10-30% I/O cost.
+
+ ),
+ },
+ ],
+ note: (
+ <>
+ Does not cover - kernel exploits, runc CVEs, side-channel
+ attacks. For genuinely hostile code, combine with {'{ runtime: \'runsc\' }'}{' '}
+ (gVisor) or {'{ runtime: \'kata\' }'} (Kata Containers, VM-level isolation).
+
+ ),
+ },
+ ecosystem: {
+ label: 'ecosystem',
+ heading: (
+ <>
+ Three tools. Each does one thing.
+
+ ),
+ cards: [
+ {
+ name: 'light-runner',
+ current: true,
+ title: 'Spawn one container, return exit code and files.',
+ body: 'The execution primitive. Domain-agnostic. Zero orchestration. The other two tools in this family both call down to this one.',
+ repo: 'enixCode/light-runner',
+ },
+ {
+ name: 'light-run',
+ title: 'CLI and HTTP surface around light-runner.',
+ body: 'Point a POST endpoint at it, pipe bodies through, get results back. Stateless wrapper, same defaults, same guarantees.',
+ repo: 'enixCode/light-run',
+ },
+ {
+ name: 'light-process',
+ title: 'DAG orchestration, retries, fan-out.',
+ body: 'When one container is not enough. Composes runs into pipelines with backoff, concurrency limits, and structured outputs.',
+ repo: 'enixCode/light-process',
+ },
+ ],
+ },
+ footer: {
+ sig: 'One glowing node. One dark grid. The rest is up to the code inside.',
+ links: [
+ { label: 'API', href: `${BASE}/docs/api` },
+ { label: 'GitHub', href: 'https://github.com/enixCode/light-runner' },
+ { label: 'npm', href: 'https://www.npmjs.com/package/light-runner' },
+ { label: 'Security', href: '#security' },
+ { label: 'MIT', href: 'https://github.com/enixCode/light-runner/blob/main/LICENSE' },
+ ],
+ metaLeft: 'light-runner // execution primitive',
+ metaRight: 'built with cc',
+ },
+};
diff --git a/website/src/app/(home)/landing.css b/website/src/app/(home)/landing.css
deleted file mode 100644
index f06c133..0000000
--- a/website/src/app/(home)/landing.css
+++ /dev/null
@@ -1,607 +0,0 @@
-@import url('https://fonts.googleapis.com/css2?family=Fraunces:ital,opsz,wght@0,9..144,300..500;1,9..144,300..500&family=JetBrains+Mono:wght@400;500&display=swap');
-
-.bespoke-landing {
- background: var(--ink);
- color: var(--paper);
- min-height: 100vh;
- font-family: 'Fraunces', serif;
-}
-
-/* Bespoke landing styles. Loaded by theme/index.ts. Selectors are mostly class-based (.hero, .prim, etc.) so they only match elements present on the landing page; the few that could collide with VitePress chrome (section, main/header/footer) are scoped to .bespoke-landing / .bespoke-landing-wrap. */
- :root {
- --ink: #050608;
- --ink-2: #0a0c10;
- --ink-3: #12151c;
- --line: #1a1d24;
- --line-hot: #242933;
- --paper: #edeef0;
- --paper-dim: #8a8f9a;
- --paper-dimmer: #4d525c;
- --halo: #c7e8ff;
- --halo-soft: #7fddff;
- --amber: #ffb855;
- --ember: #ff6b35;
- }
-
-
-
- .bespoke-landing main, .bespoke-landing header, .bespoke-landing footer { position: relative; z-index: 1; }
-
- /* ---------- typography ---------- */
-
- .display {
- font-family: 'Fraunces', serif;
- font-variation-settings: "SOFT" 50, "WONK" 1;
- font-weight: 350;
- letter-spacing: -0.02em;
- line-height: 1;
- }
- .label {
- font-family: 'JetBrains Mono', monospace;
- font-weight: 500;
- font-size: 11px;
- letter-spacing: 0.22em;
- text-transform: uppercase;
- color: var(--paper-dim);
- }
- .label::before {
- content: "// ";
- color: var(--halo-soft);
- }
- .bespoke-landing code, .bespoke-landing pre, .bespoke-landing .mono {
- font-family: 'JetBrains Mono', monospace;
- font-size: 13px;
- }
-
- /* ---------- layout ---------- */
-
- .shell {
- max-width: 1240px;
- margin: 0 auto;
- padding: 0 clamp(24px, 5vw, 64px);
- }
-
- /* ---------- top bar ---------- */
-
- header.top {
- padding: 28px 0 0;
- }
- .top-row {
- display: flex;
- align-items: center;
- justify-content: space-between;
- padding-bottom: 20px;
- border-bottom: 1px solid var(--line);
- }
- .mark {
- display: inline-flex;
- align-items: center;
- gap: 10px;
- font-family: 'Fraunces', serif;
- font-weight: 400;
- font-size: 17px;
- letter-spacing: -0.01em;
- color: var(--paper);
- text-decoration: none;
- }
- .mark-dot {
- width: 10px; height: 10px;
- border-radius: 50%;
- background: var(--halo);
- box-shadow: 0 0 14px var(--halo-soft), 0 0 3px #fff inset;
- }
- .mark em {
- font-style: italic;
- font-weight: 300;
- color: var(--paper-dim);
- font-size: 12px;
- margin-left: 6px;
- }
- nav.top-nav {
- display: flex; gap: 28px;
- }
- nav.top-nav a {
- font-size: 12px;
- letter-spacing: 0.18em;
- text-transform: uppercase;
- font-family: 'JetBrains Mono', monospace;
- font-weight: 400;
- color: var(--paper-dim);
- text-decoration: none;
- transition: color .2s;
- }
- nav.top-nav a:hover { color: var(--paper); }
- nav.top-nav a:hover::before { content: "› "; color: var(--halo-soft); }
- @media (max-width: 720px) {
- nav.top-nav a:not(.primary) { display: none; }
- }
- nav.top-nav a.primary {
- color: var(--ink);
- background: var(--halo);
- padding: 8px 14px;
- border-radius: 2px;
- }
- nav.top-nav a.primary::before { display: none !important; }
-
- /* ---------- hero ---------- */
-
- .bespoke-landing section.hero {
- padding: clamp(60px, 10vh, 120px) 0 60px;
- display: grid;
- grid-template-columns: 1fr;
- gap: 60px;
- align-items: end;
- }
-
- .hero-headline { max-width: 860px; }
- .hero-eyebrow {
- display: flex; align-items: center; gap: 14px;
- margin-bottom: 32px;
- opacity: 0; transform: translateY(8px);
- animation: rise .9s .1s forwards cubic-bezier(.2,.7,.2,1);
- }
- .hero-eyebrow .v { color: var(--halo-soft); font-family: 'JetBrains Mono', monospace; font-size: 11px; letter-spacing: 0.18em; }
- .hero-eyebrow .divider { width: 36px; height: 1px; background: var(--line-hot); }
- .hero-eyebrow .tag { font-family: 'JetBrains Mono', monospace; font-size: 11px; letter-spacing: 0.22em; text-transform: uppercase; color: var(--paper-dim); }
-
- h1.display {
- font-size: clamp(52px, 9vw, 124px);
- opacity: 0; transform: translateY(16px);
- animation: rise 1s .15s forwards cubic-bezier(.2,.7,.2,1);
- }
- h1.display .accent {
- font-style: italic;
- font-weight: 300;
- color: var(--halo);
- }
- h1.display .shy {
- font-style: italic;
- font-weight: 300;
- color: var(--paper-dim);
- }
-
- .hero-lede {
- font-family: 'Fraunces', serif;
- font-weight: 300;
- font-size: clamp(18px, 2vw, 22px);
- line-height: 1.45;
- color: var(--paper);
- max-width: 640px;
- margin-top: 36px;
- opacity: 0; transform: translateY(12px);
- animation: rise 1s .3s forwards cubic-bezier(.2,.7,.2,1);
- }
- .hero-lede em {
- color: var(--paper-dim);
- font-style: italic;
- }
-
- .hero-meta {
- display: grid;
- grid-template-columns: repeat(auto-fit, minmax(140px, 1fr));
- gap: 24px 48px;
- margin-top: 48px;
- padding-top: 28px;
- border-top: 1px solid var(--line);
- opacity: 0; transform: translateY(12px);
- animation: rise 1s .45s forwards cubic-bezier(.2,.7,.2,1);
- }
- .hero-meta .cell { }
- .hero-meta .k { font-family: 'JetBrains Mono', monospace; font-size: 10px; letter-spacing: 0.22em; text-transform: uppercase; color: var(--paper-dimmer); margin-bottom: 6px; }
- .hero-meta .v { font-family: 'Fraunces', serif; font-size: 22px; font-weight: 350; letter-spacing: -0.01em; }
- .hero-meta .v .sub { color: var(--paper-dim); font-size: 13px; margin-left: 6px; font-family: 'JetBrains Mono', monospace; letter-spacing: 0; text-transform: none; }
-
- .hero-banner {
- margin-top: clamp(48px, 8vh, 96px);
- position: relative;
- overflow: hidden;
- border: 1px solid var(--line);
- border-radius: 2px;
- background: #000;
- aspect-ratio: 16 / 5;
- opacity: 0; transform: translateY(20px);
- animation: rise 1.4s .6s forwards cubic-bezier(.2,.7,.2,1);
- }
- .hero-banner img {
- width: 100%; height: 100%;
- object-fit: cover;
- display: block;
- filter: contrast(1.05);
- }
- .hero-banner::before {
- content: "";
- position: absolute; inset: 0;
- background: linear-gradient(180deg, transparent 60%, var(--ink) 100%);
- pointer-events: none;
- }
- .hero-banner .corners {
- position: absolute; inset: 12px;
- pointer-events: none;
- }
- .hero-banner .corners::before,
- .hero-banner .corners::after {
- content: "";
- position: absolute;
- width: 14px; height: 14px;
- border: 1px solid var(--halo-soft);
- opacity: .6;
- }
- .hero-banner .corners::before { top: 0; left: 0; border-right: none; border-bottom: none; }
- .hero-banner .corners::after { bottom: 0; right: 0; border-left: none; border-top: none; }
-
- .hero-banner-caption {
- display: flex; justify-content: space-between;
- margin-top: 12px;
- font-family: 'JetBrains Mono', monospace;
- font-size: 10px;
- letter-spacing: 0.2em;
- color: var(--paper-dimmer);
- text-transform: uppercase;
- }
-
- /* ---------- section frame ---------- */
-
- .bespoke-landing section {
- padding: clamp(80px, 12vh, 140px) 0;
- border-top: 1px solid var(--line);
- position: relative;
- }
- .bespoke-landing section .section-head {
- display: grid;
- grid-template-columns: 160px 1fr;
- gap: 48px;
- margin-bottom: 64px;
- align-items: baseline;
- }
- .bespoke-landing section .section-head .label { padding-top: 10px; }
- .bespoke-landing section h2 {
- font-family: 'Fraunces', serif;
- font-weight: 350;
- font-style: italic;
- font-size: clamp(32px, 4.5vw, 56px);
- letter-spacing: -0.015em;
- line-height: 1.05;
- max-width: 820px;
- }
- .bespoke-landing section h2 .strong {
- font-style: normal;
- color: var(--halo);
- font-variation-settings: "WONK" 1;
- }
- @media (max-width: 720px) {
- .bespoke-landing section .section-head { grid-template-columns: 1fr; gap: 8px; margin-bottom: 36px; }
- }
-
- /* ---------- primitives grid ---------- */
-
- .prims {
- display: grid;
- grid-template-columns: repeat(auto-fit, minmax(260px, 1fr));
- gap: 0;
- border-top: 1px solid var(--line);
- }
- .prim {
- padding: 36px 32px 40px;
- border-bottom: 1px solid var(--line);
- border-right: 1px solid var(--line);
- position: relative;
- transition: background .25s;
- }
- .prim:hover { background: var(--ink-2); }
- .prim:last-child { border-right: 1px solid var(--line); }
- @media (max-width: 720px) { .prim { border-right: none !important; } }
-
- .prim .num {
- font-family: 'JetBrains Mono', monospace;
- font-size: 11px;
- color: var(--halo-soft);
- letter-spacing: 0.2em;
- margin-bottom: 32px;
- display: flex; align-items: center; gap: 10px;
- }
- .prim .num::after {
- content: ""; flex: 1; height: 1px; background: var(--line-hot);
- }
- .prim h3 {
- font-family: 'Fraunces', serif;
- font-weight: 400;
- font-size: 24px;
- line-height: 1.15;
- margin-bottom: 14px;
- letter-spacing: -0.01em;
- }
- .prim h3 em { color: var(--halo); font-style: italic; font-weight: 300; }
- .prim p {
- font-size: 14px;
- line-height: 1.6;
- color: var(--paper-dim);
- max-width: 34ch;
- }
-
- /* ---------- code block ---------- */
-
- .code-window {
- border: 1px solid var(--line);
- background: var(--ink-2);
- border-radius: 2px;
- overflow: hidden;
- margin-top: 8px;
- }
- .code-window .bar {
- display: flex; align-items: center; justify-content: space-between;
- padding: 10px 16px;
- border-bottom: 1px solid var(--line);
- background: var(--ink-3);
- font-family: 'JetBrains Mono', monospace;
- font-size: 11px;
- color: var(--paper-dimmer);
- letter-spacing: 0.15em;
- text-transform: uppercase;
- }
- .code-window .bar .pills {
- display: inline-flex; gap: 6px;
- }
- .code-window .bar .pills i {
- width: 8px; height: 8px; border-radius: 50%; display: inline-block;
- background: #2a2f38;
- }
- .code-window .bar .pills i:first-child { background: #ff5f57; opacity: .55; }
- .code-window .bar .pills i:nth-child(2) { background: #febc2e; opacity: .55; }
- .code-window .bar .pills i:nth-child(3) { background: #28c840; opacity: .55; }
- .code-window pre {
- padding: 28px 32px;
- overflow-x: auto;
- font-size: 13px;
- line-height: 1.75;
- color: var(--paper);
- }
- .code-window pre .k { color: var(--halo-soft); }
- .code-window pre .s { color: #f5d796; }
- .code-window pre .c { color: var(--paper-dimmer); font-style: italic; }
- .code-window pre .f { color: var(--paper); }
- .code-window pre .p { color: var(--paper-dim); }
- .code-window pre .n { color: #c8b6ff; }
- button.copy {
- background: transparent;
- border: 1px solid var(--line-hot);
- color: var(--paper-dim);
- font-family: 'JetBrains Mono', monospace;
- font-size: 10px;
- letter-spacing: 0.18em;
- text-transform: uppercase;
- padding: 4px 10px;
- cursor: pointer;
- border-radius: 2px;
- transition: all .2s;
- }
- button.copy:hover { color: var(--ink); background: var(--halo); border-color: var(--halo); }
- button.copy.done { color: var(--ink); background: var(--halo-soft); border-color: var(--halo-soft); }
-
- /* ---------- quick-start split ---------- */
-
- .qstart {
- display: grid;
- grid-template-columns: 5fr 7fr;
- gap: 64px;
- align-items: start;
- }
- @media (max-width: 900px) { .qstart { grid-template-columns: 1fr; gap: 36px; } }
-
- .qstart .side p {
- font-family: 'Fraunces', serif;
- font-size: 19px;
- line-height: 1.55;
- color: var(--paper);
- font-weight: 300;
- }
- .qstart .side p + p { margin-top: 18px; color: var(--paper-dim); }
- .qstart .side .install {
- margin-top: 28px;
- display: inline-flex;
- align-items: center;
- gap: 12px;
- font-family: 'JetBrains Mono', monospace;
- font-size: 13px;
- padding: 12px 18px;
- border: 1px solid var(--line-hot);
- background: var(--ink-2);
- border-radius: 2px;
- }
- .qstart .side .install::before {
- content: "$"; color: var(--halo-soft);
- }
-
- /* ---------- security block ---------- */
-
- .sec-grid {
- display: grid;
- grid-template-columns: 1fr 1fr;
- border-top: 1px solid var(--line);
- }
- .sec-grid .row {
- display: contents;
- }
- .sec-grid .k, .sec-grid .v {
- padding: 20px 24px;
- border-bottom: 1px solid var(--line);
- }
- .sec-grid .k {
- font-family: 'JetBrains Mono', monospace;
- font-size: 12px;
- letter-spacing: 0.05em;
- color: var(--halo-soft);
- border-right: 1px solid var(--line);
- }
- .sec-grid .v {
- font-size: 14px;
- color: var(--paper-dim);
- line-height: 1.6;
- }
- .sec-grid .v strong { color: var(--paper); font-weight: 400; }
- @media (max-width: 720px) {
- .sec-grid { grid-template-columns: 1fr; }
- .sec-grid .k { border-right: none; padding-bottom: 4px; }
- .sec-grid .v { padding-top: 4px; }
- }
-
- .sec-note {
- margin-top: 40px;
- padding: 20px 24px;
- border-left: 2px solid var(--amber);
- background: rgba(255, 184, 85, 0.04);
- font-size: 14px;
- color: var(--paper-dim);
- line-height: 1.6;
- }
- .sec-note strong { color: var(--amber); font-weight: 500; }
-
- /* ---------- ecosystem cards ---------- */
-
- .eco {
- display: grid;
- grid-template-columns: repeat(3, 1fr);
- gap: 20px;
- }
- @media (max-width: 900px) { .eco { grid-template-columns: 1fr; } }
-
- .eco-card {
- padding: 32px 28px 28px;
- border: 1px solid var(--line);
- background: linear-gradient(180deg, var(--ink-2) 0%, var(--ink) 100%);
- border-radius: 2px;
- position: relative;
- overflow: hidden;
- transition: border-color .25s, transform .25s;
- }
- .eco-card:hover { border-color: var(--line-hot); transform: translateY(-2px); }
- .eco-card.this {
- border-color: var(--halo-soft);
- background: linear-gradient(180deg, rgba(127,221,255,0.06) 0%, var(--ink) 100%);
- }
- .eco-card.this::after {
- content: "this repo";
- position: absolute;
- top: 16px; right: 16px;
- font-family: 'JetBrains Mono', monospace;
- font-size: 10px;
- letter-spacing: 0.2em;
- text-transform: uppercase;
- color: var(--ink);
- background: var(--halo);
- padding: 4px 8px;
- border-radius: 2px;
- }
- .eco-card .mono-name {
- font-family: 'JetBrains Mono', monospace;
- font-weight: 500;
- font-size: 15px;
- color: var(--paper);
- margin-bottom: 18px;
- }
- .eco-card h3 {
- font-family: 'Fraunces', serif;
- font-weight: 400;
- font-size: 20px;
- line-height: 1.2;
- margin-bottom: 10px;
- letter-spacing: -0.01em;
- }
- .eco-card p {
- font-size: 13px;
- color: var(--paper-dim);
- line-height: 1.55;
- }
- .eco-card .status {
- margin-top: 22px;
- font-family: 'JetBrains Mono', monospace;
- font-size: 10px;
- letter-spacing: 0.2em;
- text-transform: uppercase;
- color: var(--paper-dimmer);
- display: flex; align-items: center; gap: 8px;
- }
- .eco-card .status::before {
- content: ""; width: 6px; height: 6px; border-radius: 50%;
- background: var(--paper-dimmer);
- }
- .eco-card.this .status::before { background: var(--halo); box-shadow: 0 0 10px var(--halo-soft); }
- .eco-card.this .status { color: var(--halo-soft); }
- /* Eco-card version: hidden by default, surfaced once GitHub API resolves. */
- .eco-card .status .status-version:not(:empty)::before { content: " - "; }
-
- /* ---------- footer ---------- */
-
- .bespoke-landing footer {
- padding: 56px 0 48px;
- border-top: 1px solid var(--line);
- }
- .foot-row {
- display: flex;
- justify-content: space-between;
- align-items: flex-end;
- flex-wrap: wrap;
- gap: 32px;
- }
- .foot-row .sig {
- font-family: 'Fraunces', serif;
- font-style: italic;
- font-weight: 300;
- font-size: 14px;
- color: var(--paper-dim);
- max-width: 320px;
- line-height: 1.5;
- }
- .foot-links {
- display: flex; gap: 32px;
- }
- .foot-links a {
- color: var(--paper-dim);
- text-decoration: none;
- font-family: 'JetBrains Mono', monospace;
- font-size: 11px;
- letter-spacing: 0.18em;
- text-transform: uppercase;
- transition: color .2s;
- }
- .foot-links a:hover { color: var(--halo); }
- .foot-meta {
- margin-top: 36px;
- padding-top: 20px;
- border-top: 1px solid var(--line);
- display: flex;
- justify-content: space-between;
- font-family: 'JetBrains Mono', monospace;
- font-size: 10px;
- letter-spacing: 0.2em;
- text-transform: uppercase;
- color: var(--paper-dimmer);
- }
-
- /* ---------- motion ---------- */
-
- @keyframes rise {
- to { opacity: 1; transform: translateY(0); }
- }
-
- /* Fallback for users with prefers-reduced-motion: reduce. The hero elements
- * start at opacity: 0 and rely on the rise animation to become visible; if
- * the animation is suppressed by the reduced-motion media query in custom.css,
- * we must surface them anyway, otherwise the entire hero reads as empty space. */
- @media (prefers-reduced-motion: reduce) {
- .bespoke-landing .hero-eyebrow,
- .bespoke-landing h1.display,
- .bespoke-landing .hero-lede,
- .bespoke-landing .hero-meta,
- .bespoke-landing .hero-banner {
- opacity: 1 !important;
- transform: none !important;
- animation: none !important;
- }
- }
-
-
- /* ---------- focus ---------- */
- .bespoke-landing a:focus-visible, .bespoke-landing button:focus-visible {
- outline: 1px solid var(--halo);
- outline-offset: 3px;
- }
diff --git a/website/src/app/(home)/page.tsx b/website/src/app/(home)/page.tsx
index 110a6d7..edb4a8d 100644
--- a/website/src/app/(home)/page.tsx
+++ b/website/src/app/(home)/page.tsx
@@ -1,416 +1,7 @@
-'use client';
-
-import { useEffect } from 'react';
-import './landing.css';
-
-const BASE = '/light-runner';
-
-const CODE_HTML = `import { DockerRunner } from 'light-runner' ;
-const runner = new DockerRunner ( { memory : '512m' , cpus : '1' } ) ;
-const execution = runner. run ( {
- image : 'python:3.12-alpine' ,
- entrypoint : 'python main.py' ,
- dir : './my-project' ,
- input : { task : 'compute' , n : 20 } ,
- timeout : 30_000 ,
- extract : [ { from : '/app/result.json' , to : './out' } ] ,
-} ) ;
-const result = await execution. result;
-result. success // true if exit 0 and not cancelled
-result. exitCode // the container exit code
-result. extracted // [{ from, to, status, bytes }] `;
+import { LandingPage } from 'light-landing-page';
+import 'light-landing-page/styles.css';
+import { lightRunnerData } from './data';
export default function HomePage() {
- useEffect(() => {
- const btn = document.querySelector('[data-copy]');
- const src = document.getElementById('code-sample');
- if (btn && src) {
- btn.addEventListener('click', async () => {
- try {
- await navigator.clipboard.writeText((src as HTMLElement).innerText.trim());
- btn.textContent = 'Copied';
- btn.classList.add('done');
- setTimeout(() => {
- btn.textContent = 'Copy';
- btn.classList.remove('done');
- }, 1600);
- } catch {
- btn.textContent = 'Select';
- }
- });
- }
-
- const PROJECT = 'enixCode/light-runner';
- const repos = new Set([PROJECT]);
- document.querySelectorAll('[data-eco-status][data-gh-repo]').forEach((el) => {
- const r = el.getAttribute('data-gh-repo');
- if (r) repos.add(r);
- });
-
- const fetchLatest = (repo: string): Promise<{ tag_name?: string; prerelease?: boolean } | null> =>
- fetch(`https://api.github.com/repos/${repo}/releases/latest`)
- .then((r) => (r.ok ? r.json() : null))
- .catch(() => null);
-
- Promise.all([...repos].map((repo) => fetchLatest(repo).then((data) => [repo, data] as const))).then(
- (entries) => {
- const releases = new Map(entries);
- const project = releases.get(PROJECT);
- if (project?.tag_name) {
- const tag = project.tag_name;
- const v = tag.startsWith('v') ? tag : `v${tag}`;
- document.querySelectorAll('[data-gh-version]').forEach((el) => {
- el.textContent = v;
- });
- }
- document.querySelectorAll('[data-eco-status][data-gh-repo]').forEach((el) => {
- const repo = el.getAttribute('data-gh-repo');
- const fallback = el.getAttribute('data-fallback') || 'In development';
- const data = repo ? releases.get(repo) : null;
- const tag = data?.tag_name;
- if (!tag) {
- el.textContent = fallback;
- return;
- }
- const v = tag.startsWith('v') ? tag : `v${tag}`;
- el.textContent = `${data?.prerelease === true ? 'Pre-release - ' : 'Stable - '}${v}`;
- });
- },
- );
- }, []);
-
- return (
-
-
-
- {/* HERO */}
-
-
-
- Execution primitive - Node.js
-
-
-
- Run untrusted code
- in hardened containers.
-
-
- A single-purpose Node.js library that runs your code in a container it tears down
- afterwards, and hands you back the exit code, logs, and any files you asked for. {' '}
- Nothing else.
-
-
-
-
Runtime
-
- Node >=22
-
-
-
-
Dependencies
-
- 3 dockerode + tar
-
-
-
-
Transport
-
- dockerode no CLI
-
-
-
-
License
-
- MIT permissive
-
-
-
-
-
-
- {/* eslint-disable-next-line @next/next/no-img-element */}
-
-
-
- Fig. 01 - One process, one cell, one grid.
- light-runner / visual
-
-
-
- {/* PRIMITIVES */}
-
-
-
-
what you get
-
- Give it code. Get back an exit code , logs, and the
- files you asked for.
-
-
-
-
-
01 / isolated
-
- Your code runs in its own cell .
-
-
- Every run gets a fresh container, its own volume, its own network. Nothing leaks in
- from the host, nothing leaks out to sibling runs. Torn down on exit, success or not.
-
-
-
-
02 / drop in, pull out
-
- Send a folder. Get any file back.
-
-
- Point at a directory on your disk, it becomes the container workdir. When the run
- finishes, ask for any path and it lands back on your host.
-
-
-
-
03 / stop on demand
-
- Cancel, abort, or time out .
-
-
- Pass an AbortSignal, call cancel(), or set a deadline. The
- container dies and its volume goes with it. No zombie processes, no leaked disk.
-
-
-
-
04 / any stack
-
- Python, Node, Go, Ruby, shell, anything .
-
-
- Any Docker image on your registry or anyone else's. No special runtime inside the
- container, no SDK to import, no convention to follow. Your code stays your code.
-
-
-
-
- {/* QUICK START */}
-
-
-
-
quick start
-
- Five lines to run, one to get your artefact.
-
-
-
-
-
- Point light-runner at an image and a folder. Pipe input through stdin.
- Extract whatever your container wrote.
-
-
No HTTP server. No config file. No CLI.
-
npm install light-runner
-
-
-
-
-
- example.ts
-
- Copy
-
-
-
-
-
-
- {/* SECURITY */}
-
-
-
-
security model
-
- Hardened defaults, never opt-out. Add more
- restrictions, never fewer.
-
-
-
-
-
Kernel permissions
-
- Dangerous capabilities stripped at startup - raw sockets, device
- creation, chroot escapes, capability juggling, audit-log spoofing. Every run,
- unconditionally.
-
-
-
-
No privilege escalation
-
- A setuid binary inside your container cannot elevate above the user
- it starts as.
-
-
-
-
Fork-bomb protection
-
- Max 100 processes per container. A runaway loop caps out in
- milliseconds instead of paging the host.
-
-
-
-
Memory and CPU budget
-
- 512 MiB and one core by default, cgroup-enforced.
- Noisy runs cannot starve their neighbours. Tunable per runner.
-
-
-
-
Network isolation
-
- Isolated bridge by default with inter-container traffic blocked.
- Pass networks: ['none'] to sever it entirely.
-
-
-
-
Host filesystem protection
-
- Symlinks in your input folder are filtered before seeding, so a
- stray link cannot reach back into the host filesystem.
-
-
-
-
Safe file extraction
-
- A container cannot write outside the destination folder you chose: paths escaping
- upward (..) are refused. Each extracted entry is capped at{' '}
- 1 GiB so a runaway output cannot fill your disk.
-
-
-
-
Kernel-level hardening
-
- Swap the runtime to gVisor with one option for user-space syscall
- interception, at ~10-30% I/O cost.
-
-
-
-
- Does not cover - kernel exploits, runc CVEs, side-channel
- attacks. For genuinely hostile code, combine with {'{ runtime: \'runsc\' }'}{' '}
- (gVisor) or {'{ runtime: \'kata\' }'} (Kata Containers, VM-level isolation).
-
-
- {/* ECOSYSTEM */}
-
-
-
-
ecosystem
-
- Three tools. Each does one thing.
-
-
-
-
- light-runner
- Spawn one container, return exit code and files.
-
- The execution primitive. Domain-agnostic. Zero orchestration. The other two tools in
- this family both call down to this one.
-
-
- Loading
-
-
-
- light-run
- CLI and HTTP surface around light-runner.
-
- Point a POST endpoint at it, pipe bodies through, get results back. Stateless
- wrapper, same defaults, same guarantees.
-
-
- Loading
-
-
-
- light-process
- DAG orchestration, retries, fan-out.
-
- When one container is not enough. Composes runs into pipelines with backoff,
- concurrency limits, and structured outputs.
-
-
- Loading
-
-
-
-
-
-
-
;
-```
-
-Defined in: [src/DockerRunner.ts:122](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L122)
-
-#### Parameters
-
-##### opts?
-
-[`CleanupCacheOptions`](../interfaces/CleanupCacheOptions.md) = `{}`
-
-#### Returns
-
-`Promise`\<`number`\>
-
-***
-
-### cleanupOrphanNetworks()
-
-```ts
-static cleanupOrphanNetworks(opts?): Promise;
-```
-
-Defined in: [src/DockerRunner.ts:133](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L133)
-
-#### Parameters
-
-##### opts?
-
-[`CleanupNetworkOptions`](../interfaces/CleanupNetworkOptions.md) = `{}`
-
-#### Returns
-
-`Promise`\<`number`\>
-
-***
-
-### cleanupOrphanStates()
-
-```ts
-static cleanupOrphanStates(): Promise;
-```
-
-Defined in: [src/DockerRunner.ts:167](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L167)
-
-#### Returns
-
-`Promise`\<`number`\>
-
-***
-
-### cleanupOrphanVolumes()
-
-```ts
-static cleanupOrphanVolumes(): Promise;
-```
-
-Defined in: [src/DockerRunner.ts:113](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L113)
-
-#### Returns
-
-`Promise`\<`number`\>
-
-***
-
-### isAvailable()
-
-```ts
-static isAvailable(): Promise;
-```
-
-Defined in: [src/DockerRunner.ts:109](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L109)
-
-#### Returns
-
-`Promise`\<`boolean`\>
-
-***
-
-### list()
-
-```ts
-static list(): RunState[];
-```
-
-Defined in: [src/DockerRunner.ts:146](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L146)
-
-#### Returns
-
-[`RunState`](../interfaces/RunState.md)[]
-
-***
-
-### reapOrphans()
-
-```ts
-static reapOrphans(): Promise<{
- containers: number;
- volumes: number;
-}>;
-```
-
-Defined in: [src/DockerRunner.ts:178](https://github.com/enixCode/light-runner/blob/main/src/DockerRunner.ts#L178)
-
-#### Returns
-
-`Promise`\<\{
- `containers`: `number`;
- `volumes`: `number`;
-\}\>
diff --git a/docs/api/classes/Execution.md b/docs/api/classes/Execution.md
deleted file mode 100644
index 2dbb376..0000000
--- a/docs/api/classes/Execution.md
+++ /dev/null
@@ -1,138 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / Execution
-
-# Class: Execution
-
-Defined in: [src/Execution.ts:17](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L17)
-
-## Constructors
-
-### Constructor
-
-```ts
-new Execution(
- id,
- result,
- onCancel): Execution;
-```
-
-Defined in: [src/Execution.ts:22](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L22)
-
-#### Parameters
-
-##### id
-
-`string`
-
-##### result
-
-`Promise`\<[`RunResult`](../interfaces/RunResult.md)\>
-
-##### onCancel
-
-() => `void`
-
-#### Returns
-
-`Execution`
-
-## Properties
-
-### id
-
-```ts
-readonly id: string;
-```
-
-Defined in: [src/Execution.ts:18](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L18)
-
-***
-
-### result
-
-```ts
-readonly result: Promise;
-```
-
-Defined in: [src/Execution.ts:19](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L19)
-
-## Accessors
-
-### cancelled
-
-#### Get Signature
-
-```ts
-get cancelled(): boolean;
-```
-
-Defined in: [src/Execution.ts:45](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L45)
-
-##### Returns
-
-`boolean`
-
-## Methods
-
-### cancel()
-
-```ts
-cancel(): void;
-```
-
-Defined in: [src/Execution.ts:36](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L36)
-
-#### Returns
-
-`void`
-
-***
-
-### pause()
-
-```ts
-pause(): Promise;
-```
-
-Defined in: [src/Execution.ts:92](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L92)
-
-#### Returns
-
-`Promise`\<`void`\>
-
-***
-
-### resume()
-
-```ts
-resume(): Promise;
-```
-
-Defined in: [src/Execution.ts:100](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L100)
-
-#### Returns
-
-`Promise`\<`void`\>
-
-***
-
-### stop()
-
-```ts
-stop(options?): Promise;
-```
-
-Defined in: [src/Execution.ts:54](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L54)
-
-#### Parameters
-
-##### options?
-
-[`StopOptions`](../interfaces/StopOptions.md) = `{}`
-
-#### Returns
-
-`Promise`\<`void`\>
diff --git a/docs/api/classes/LightRunnerError.md b/docs/api/classes/LightRunnerError.md
deleted file mode 100644
index 011710b..0000000
--- a/docs/api/classes/LightRunnerError.md
+++ /dev/null
@@ -1,299 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / LightRunnerError
-
-# Class: LightRunnerError
-
-Defined in: [src/errors.ts:25](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L25)
-
-## Extends
-
-- `Error`
-
-## Properties
-
-### cause?
-
-```ts
-optional cause?: unknown;
-```
-
-Defined in: node\_modules/typescript/lib/lib.es2022.error.d.ts:24
-
-#### Inherited from
-
-```ts
-Error.cause
-```
-
-***
-
-### code
-
-```ts
-readonly code: LightRunnerErrorCode;
-```
-
-Defined in: [src/errors.ts:26](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L26)
-
-***
-
-### containerId?
-
-```ts
-readonly optional containerId?: string;
-```
-
-Defined in: [src/errors.ts:28](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L28)
-
-***
-
-### dockerOp?
-
-```ts
-readonly optional dockerOp?: string;
-```
-
-Defined in: [src/errors.ts:27](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L27)
-
-***
-
-### message
-
-```ts
-message: string;
-```
-
-Defined in: node\_modules/typescript/lib/lib.es5.d.ts:1075
-
-#### Inherited from
-
-```ts
-Error.message
-```
-
-***
-
-### name
-
-```ts
-name: string;
-```
-
-Defined in: node\_modules/typescript/lib/lib.es5.d.ts:1074
-
-#### Inherited from
-
-```ts
-Error.name
-```
-
-***
-
-### stack?
-
-```ts
-optional stack?: string;
-```
-
-Defined in: node\_modules/typescript/lib/lib.es5.d.ts:1076
-
-#### Inherited from
-
-```ts
-Error.stack
-```
-
-***
-
-### stackTraceLimit
-
-```ts
-static stackTraceLimit: number;
-```
-
-Defined in: node\_modules/@types/node/globals.d.ts:67
-
-The `Error.stackTraceLimit` property specifies the number of stack frames
-collected by a stack trace (whether generated by `new Error().stack` or
-`Error.captureStackTrace(obj)`).
-
-The default value is `10` but may be set to any valid JavaScript number. Changes
-will affect any stack trace captured _after_ the value has been changed.
-
-If set to a non-number value, or set to a negative number, stack traces will
-not capture any frames.
-
-#### Inherited from
-
-```ts
-Error.stackTraceLimit
-```
-
-## Methods
-
-### toJSON()
-
-```ts
-toJSON(): {
- code: LightRunnerErrorCode;
- containerId?: string;
- dockerOp?: string;
- message: string;
- name: string;
-};
-```
-
-Defined in: [src/errors.ts:39](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L39)
-
-#### Returns
-
-```ts
-{
- code: LightRunnerErrorCode;
- containerId?: string;
- dockerOp?: string;
- message: string;
- name: string;
-}
-```
-
-##### code
-
-```ts
-code: LightRunnerErrorCode;
-```
-
-##### containerId?
-
-```ts
-optional containerId?: string;
-```
-
-##### dockerOp?
-
-```ts
-optional dockerOp?: string;
-```
-
-##### message
-
-```ts
-message: string;
-```
-
-##### name
-
-```ts
-name: string;
-```
-
-***
-
-### captureStackTrace()
-
-```ts
-static captureStackTrace(targetObject, constructorOpt?): void;
-```
-
-Defined in: node\_modules/@types/node/globals.d.ts:51
-
-Creates a `.stack` property on `targetObject`, which when accessed returns
-a string representing the location in the code at which
-`Error.captureStackTrace()` was called.
-
-```js
-const myObject = {};
-Error.captureStackTrace(myObject);
-myObject.stack; // Similar to `new Error().stack`
-```
-
-The first line of the trace will be prefixed with
-`${myObject.name}: ${myObject.message}`.
-
-The optional `constructorOpt` argument accepts a function. If given, all frames
-above `constructorOpt`, including `constructorOpt`, will be omitted from the
-generated stack trace.
-
-The `constructorOpt` argument is useful for hiding implementation
-details of error generation from the user. For instance:
-
-```js
-function a() {
- b();
-}
-
-function b() {
- c();
-}
-
-function c() {
- // Create an error without stack trace to avoid calculating the stack trace twice.
- const { stackTraceLimit } = Error;
- Error.stackTraceLimit = 0;
- const error = new Error();
- Error.stackTraceLimit = stackTraceLimit;
-
- // Capture the stack trace above function b
- Error.captureStackTrace(error, b); // Neither function c, nor b is included in the stack trace
- throw error;
-}
-
-a();
-```
-
-#### Parameters
-
-##### targetObject
-
-`object`
-
-##### constructorOpt?
-
-`Function`
-
-#### Returns
-
-`void`
-
-#### Inherited from
-
-```ts
-Error.captureStackTrace
-```
-
-***
-
-### prepareStackTrace()
-
-```ts
-static prepareStackTrace(err, stackTraces): any;
-```
-
-Defined in: node\_modules/@types/node/globals.d.ts:55
-
-#### Parameters
-
-##### err
-
-`Error`
-
-##### stackTraces
-
-`CallSite`[]
-
-#### Returns
-
-`any`
-
-#### See
-
-https://v8.dev/docs/stack-trace-api#customizing-stack-traces
-
-#### Inherited from
-
-```ts
-Error.prepareStackTrace
-```
diff --git a/docs/api/functions/cleanupOrphanNetworks.md b/docs/api/functions/cleanupOrphanNetworks.md
deleted file mode 100644
index b99793e..0000000
--- a/docs/api/functions/cleanupOrphanNetworks.md
+++ /dev/null
@@ -1,23 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / cleanupOrphanNetworks
-
-# Function: cleanupOrphanNetworks()
-
-```ts
-function cleanupOrphanNetworks(opts?): Promise;
-```
-
-Defined in: [src/network.ts:213](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L213)
-
-## Parameters
-
-### opts?
-
-[`CleanupNetworkOptions`](../interfaces/CleanupNetworkOptions.md) = `{}`
-
-## Returns
-
-`Promise`\<`number`\>
diff --git a/docs/api/functions/connectNetwork.md b/docs/api/functions/connectNetwork.md
deleted file mode 100644
index 81b6c6c..0000000
--- a/docs/api/functions/connectNetwork.md
+++ /dev/null
@@ -1,27 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / connectNetwork
-
-# Function: connectNetwork()
-
-```ts
-function connectNetwork(name, containerId): Promise;
-```
-
-Defined in: [src/network.ts:166](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L166)
-
-## Parameters
-
-### name
-
-`string`
-
-### containerId
-
-`string`
-
-## Returns
-
-`Promise`\<`void`\>
diff --git a/docs/api/functions/createNetwork.md b/docs/api/functions/createNetwork.md
deleted file mode 100644
index ff0cf8b..0000000
--- a/docs/api/functions/createNetwork.md
+++ /dev/null
@@ -1,27 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / createNetwork
-
-# Function: createNetwork()
-
-```ts
-function createNetwork(name, opts?): Promise;
-```
-
-Defined in: [src/network.ts:69](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L69)
-
-## Parameters
-
-### name
-
-`string`
-
-### opts?
-
-[`CreateNetworkOptions`](../interfaces/CreateNetworkOptions.md) = `{}`
-
-## Returns
-
-`Promise`\<`boolean`\>
diff --git a/docs/api/functions/deleteNetwork.md b/docs/api/functions/deleteNetwork.md
deleted file mode 100644
index bf0c114..0000000
--- a/docs/api/functions/deleteNetwork.md
+++ /dev/null
@@ -1,23 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / deleteNetwork
-
-# Function: deleteNetwork()
-
-```ts
-function deleteNetwork(name): Promise;
-```
-
-Defined in: [src/network.ts:145](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L145)
-
-## Parameters
-
-### name
-
-`string`
-
-## Returns
-
-`Promise`\<`void`\>
diff --git a/docs/api/functions/listStates.md b/docs/api/functions/listStates.md
deleted file mode 100644
index 168abe9..0000000
--- a/docs/api/functions/listStates.md
+++ /dev/null
@@ -1,17 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / listStates
-
-# Function: listStates()
-
-```ts
-function listStates(): RunState[];
-```
-
-Defined in: [src/state.ts:56](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L56)
-
-## Returns
-
-[`RunState`](../interfaces/RunState.md)[]
diff --git a/docs/api/functions/networkExists.md b/docs/api/functions/networkExists.md
deleted file mode 100644
index 81a6dae..0000000
--- a/docs/api/functions/networkExists.md
+++ /dev/null
@@ -1,23 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / networkExists
-
-# Function: networkExists()
-
-```ts
-function networkExists(name): Promise;
-```
-
-Defined in: [src/network.ts:182](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L182)
-
-## Parameters
-
-### name
-
-`string`
-
-## Returns
-
-`Promise`\<`boolean`\>
diff --git a/docs/api/functions/readState.md b/docs/api/functions/readState.md
deleted file mode 100644
index 5bab374..0000000
--- a/docs/api/functions/readState.md
+++ /dev/null
@@ -1,23 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / readState
-
-# Function: readState()
-
-```ts
-function readState(id): RunState | null;
-```
-
-Defined in: [src/state.ts:46](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L46)
-
-## Parameters
-
-### id
-
-`string`
-
-## Returns
-
-[`RunState`](../interfaces/RunState.md) \| `null`
diff --git a/docs/api/index.md b/docs/api/index.md
deleted file mode 100644
index 2c81b26..0000000
--- a/docs/api/index.md
+++ /dev/null
@@ -1,39 +0,0 @@
-**light-runner v0.15.0**
-
-***
-
-# light-runner v0.15.0
-
-## Classes
-
-- [DockerRunner](classes/DockerRunner.md)
-- [Execution](classes/Execution.md)
-- [LightRunnerError](classes/LightRunnerError.md)
-
-## Interfaces
-
-- [CleanupCacheOptions](interfaces/CleanupCacheOptions.md)
-- [CleanupNetworkOptions](interfaces/CleanupNetworkOptions.md)
-- [CreateNetworkOptions](interfaces/CreateNetworkOptions.md)
-- [ExtractResult](interfaces/ExtractResult.md)
-- [ExtractSpec](interfaces/ExtractSpec.md)
-- [RunnerOptions](interfaces/RunnerOptions.md)
-- [RunRequest](interfaces/RunRequest.md)
-- [RunResult](interfaces/RunResult.md)
-- [RunState](interfaces/RunState.md)
-- [StopOptions](interfaces/StopOptions.md)
-
-## Type Aliases
-
-- [LightRunnerErrorCode](type-aliases/LightRunnerErrorCode.md)
-- [Runtime](type-aliases/Runtime.md)
-
-## Functions
-
-- [cleanupOrphanNetworks](functions/cleanupOrphanNetworks.md)
-- [connectNetwork](functions/connectNetwork.md)
-- [createNetwork](functions/createNetwork.md)
-- [deleteNetwork](functions/deleteNetwork.md)
-- [listStates](functions/listStates.md)
-- [networkExists](functions/networkExists.md)
-- [readState](functions/readState.md)
diff --git a/docs/api/interfaces/CleanupCacheOptions.md b/docs/api/interfaces/CleanupCacheOptions.md
deleted file mode 100644
index f54129c..0000000
--- a/docs/api/interfaces/CleanupCacheOptions.md
+++ /dev/null
@@ -1,19 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / CleanupCacheOptions
-
-# Interface: CleanupCacheOptions
-
-Defined in: [src/build.ts:190](https://github.com/enixCode/light-runner/blob/main/src/build.ts#L190)
-
-## Properties
-
-### maxAgeMs?
-
-```ts
-optional maxAgeMs?: number;
-```
-
-Defined in: [src/build.ts:192](https://github.com/enixCode/light-runner/blob/main/src/build.ts#L192)
diff --git a/docs/api/interfaces/CleanupNetworkOptions.md b/docs/api/interfaces/CleanupNetworkOptions.md
deleted file mode 100644
index 2fec63b..0000000
--- a/docs/api/interfaces/CleanupNetworkOptions.md
+++ /dev/null
@@ -1,35 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / CleanupNetworkOptions
-
-# Interface: CleanupNetworkOptions
-
-Defined in: [src/network.ts:47](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L47)
-
-## Properties
-
-### maxAgeMs?
-
-```ts
-optional maxAgeMs?: number;
-```
-
-Defined in: [src/network.ts:55](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L55)
-
-Skip networks created within this many milliseconds. Default 30 minutes.
-This is the race protection: a network just created by a concurrent run
-whose container has not yet attached is preserved.
-
-***
-
-### prefix?
-
-```ts
-optional prefix?: string;
-```
-
-Defined in: [src/network.ts:49](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L49)
-
-Only consider networks whose name starts with this prefix. Defaults to `light-runner-`.
diff --git a/docs/api/interfaces/CreateNetworkOptions.md b/docs/api/interfaces/CreateNetworkOptions.md
deleted file mode 100644
index e5c2376..0000000
--- a/docs/api/interfaces/CreateNetworkOptions.md
+++ /dev/null
@@ -1,105 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / CreateNetworkOptions
-
-# Interface: CreateNetworkOptions
-
-Defined in: [src/network.ts:11](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L11)
-
-## Properties
-
-### driver?
-
-```ts
-optional driver?: "bridge";
-```
-
-Defined in: [src/network.ts:13](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L13)
-
-Docker network driver. Defaults to 'bridge'.
-
-***
-
-### exclusive?
-
-```ts
-optional exclusive?: boolean;
-```
-
-Defined in: [src/network.ts:24](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L24)
-
-When true, fail (return false) if the network already exists. Default
-false = idempotent: returns true whether we created it or it already
-existed.
-
-***
-
-### iccEnabled?
-
-```ts
-optional iccEnabled?: boolean;
-```
-
-Defined in: [src/network.ts:18](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L18)
-
-Inter-container communication. Defaults to false: containers attached
-to the network cannot reach each other. Only honored for bridge driver.
-
-***
-
-### ipam?
-
-```ts
-optional ipam?: {
- gateway?: string;
- ipRange?: string;
- subnet?: string;
-};
-```
-
-Defined in: [src/network.ts:33](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L33)
-
-Explicit IPAM (IP Address Management) config. When omitted, Docker
-auto-assigns a subnet from its default pool. Pass this to let a higher
-layer (typically light-process) allocate a specific subnet per run from
-a CGNAT pool or any other range.
-
-#### gateway?
-
-```ts
-optional gateway?: string;
-```
-
-Gateway IP. Docker picks the first usable address when omitted.
-
-#### ipRange?
-
-```ts
-optional ipRange?: string;
-```
-
-Optional sub-range within `subnet` where Docker is allowed to
-auto-assign IPs. Outside this range stays reserved for static
-assignment. Rare.
-
-#### subnet?
-
-```ts
-optional subnet?: string;
-```
-
-CIDR de la plage IP du réseau, ex: '100.64.42.0/24'.
-
-***
-
-### labels?
-
-```ts
-optional labels?: Record;
-```
-
-Defined in: [src/network.ts:26](https://github.com/enixCode/light-runner/blob/main/src/network.ts#L26)
-
-Optional Docker labels (helpful for downstream tooling / cleanup).
diff --git a/docs/api/interfaces/ExtractResult.md b/docs/api/interfaces/ExtractResult.md
deleted file mode 100644
index 04eaec1..0000000
--- a/docs/api/interfaces/ExtractResult.md
+++ /dev/null
@@ -1,59 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / ExtractResult
-
-# Interface: ExtractResult
-
-Defined in: [src/types.ts:28](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L28)
-
-## Properties
-
-### bytes?
-
-```ts
-optional bytes?: number;
-```
-
-Defined in: [src/types.ts:33](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L33)
-
-***
-
-### error?
-
-```ts
-optional error?: string;
-```
-
-Defined in: [src/types.ts:32](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L32)
-
-***
-
-### from
-
-```ts
-from: string;
-```
-
-Defined in: [src/types.ts:29](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L29)
-
-***
-
-### status
-
-```ts
-status: "ok" | "error" | "missing";
-```
-
-Defined in: [src/types.ts:31](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L31)
-
-***
-
-### to
-
-```ts
-to: string;
-```
-
-Defined in: [src/types.ts:30](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L30)
diff --git a/docs/api/interfaces/ExtractSpec.md b/docs/api/interfaces/ExtractSpec.md
deleted file mode 100644
index 43e18e3..0000000
--- a/docs/api/interfaces/ExtractSpec.md
+++ /dev/null
@@ -1,29 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / ExtractSpec
-
-# Interface: ExtractSpec
-
-Defined in: [src/types.ts:11](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L11)
-
-## Properties
-
-### from
-
-```ts
-from: string;
-```
-
-Defined in: [src/types.ts:16](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L16)
-
-***
-
-### to
-
-```ts
-to: string;
-```
-
-Defined in: [src/types.ts:25](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L25)
diff --git a/docs/api/interfaces/RunRequest.md b/docs/api/interfaces/RunRequest.md
deleted file mode 100644
index edda20d..0000000
--- a/docs/api/interfaces/RunRequest.md
+++ /dev/null
@@ -1,149 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / RunRequest
-
-# Interface: RunRequest
-
-Defined in: [src/types.ts:36](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L36)
-
-## Properties
-
-### detached?
-
-```ts
-optional detached?: boolean;
-```
-
-Defined in: [src/types.ts:110](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L110)
-
-***
-
-### dir?
-
-```ts
-optional dir?: string;
-```
-
-Defined in: [src/types.ts:67](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L67)
-
-***
-
-### entrypoint?
-
-```ts
-optional entrypoint?: string;
-```
-
-Defined in: [src/types.ts:39](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L39)
-
-***
-
-### env?
-
-```ts
-optional env?: Record;
-```
-
-Defined in: [src/types.ts:87](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L87)
-
-***
-
-### extract?
-
-```ts
-optional extract?: ExtractSpec[];
-```
-
-Defined in: [src/types.ts:97](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L97)
-
-***
-
-### image
-
-```ts
-image: string;
-```
-
-Defined in: [src/types.ts:37](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L37)
-
-***
-
-### input?
-
-```ts
-optional input?: unknown;
-```
-
-Defined in: [src/types.ts:71](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L71)
-
-***
-
-### networks?
-
-```ts
-optional networks?: string[];
-```
-
-Defined in: [src/types.ts:85](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L85)
-
-***
-
-### onLog?
-
-```ts
-optional onLog?: (line) => void;
-```
-
-Defined in: [src/types.ts:91](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L91)
-
-#### Parameters
-
-##### line
-
-`string`
-
-#### Returns
-
-`void`
-
-***
-
-### run?
-
-```ts
-optional run?: string[];
-```
-
-Defined in: [src/types.ts:60](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L60)
-
-***
-
-### signal?
-
-```ts
-optional signal?: AbortSignal;
-```
-
-Defined in: [src/types.ts:90](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L90)
-
-***
-
-### timeout?
-
-```ts
-optional timeout?: number;
-```
-
-Defined in: [src/types.ts:73](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L73)
-
-***
-
-### workdir?
-
-```ts
-optional workdir?: string;
-```
-
-Defined in: [src/types.ts:89](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L89)
diff --git a/docs/api/interfaces/RunResult.md b/docs/api/interfaces/RunResult.md
deleted file mode 100644
index 3908826..0000000
--- a/docs/api/interfaces/RunResult.md
+++ /dev/null
@@ -1,61 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / RunResult
-
-# Interface: RunResult
-
-Defined in: [src/types.ts:113](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L113)
-
-## Properties
-
-### cancelled
-
-```ts
-cancelled: boolean;
-```
-
-Defined in: [src/types.ts:117](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L117)
-
-***
-
-### duration
-
-```ts
-duration: number;
-```
-
-Defined in: [src/types.ts:116](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L116)
-
-***
-
-### exitCode
-
-```ts
-exitCode: number;
-```
-
-Defined in: [src/types.ts:115](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L115)
-
-***
-
-### extracted?
-
-```ts
-optional extracted?: ExtractResult[];
-```
-
-Defined in: [src/types.ts:119](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L119)
-
-Status of each requested extract. Present only if `extract` was set.
-
-***
-
-### success
-
-```ts
-success: boolean;
-```
-
-Defined in: [src/types.ts:114](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L114)
diff --git a/docs/api/interfaces/RunState.md b/docs/api/interfaces/RunState.md
deleted file mode 100644
index 14b7a8b..0000000
--- a/docs/api/interfaces/RunState.md
+++ /dev/null
@@ -1,149 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / RunState
-
-# Interface: RunState
-
-Defined in: [src/state.ts:8](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L8)
-
-## Properties
-
-### cancelled?
-
-```ts
-optional cancelled?: boolean;
-```
-
-Defined in: [src/state.ts:27](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L27)
-
-***
-
-### container
-
-```ts
-container: string;
-```
-
-Defined in: [src/state.ts:10](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L10)
-
-***
-
-### durationMs?
-
-```ts
-optional durationMs?: number;
-```
-
-Defined in: [src/state.ts:21](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L21)
-
-***
-
-### entrypoint?
-
-```ts
-optional entrypoint?: string;
-```
-
-Defined in: [src/state.ts:14](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L14)
-
-***
-
-### exitCode?
-
-```ts
-optional exitCode?: number;
-```
-
-Defined in: [src/state.ts:20](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L20)
-
-***
-
-### extract?
-
-```ts
-optional extract?: ExtractSpec[];
-```
-
-Defined in: [src/state.ts:16](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L16)
-
-***
-
-### finishedAt?
-
-```ts
-optional finishedAt?: string;
-```
-
-Defined in: [src/state.ts:18](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L18)
-
-***
-
-### id
-
-```ts
-id: string;
-```
-
-Defined in: [src/state.ts:9](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L9)
-
-***
-
-### image
-
-```ts
-image: string;
-```
-
-Defined in: [src/state.ts:12](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L12)
-
-***
-
-### startedAt
-
-```ts
-startedAt: string;
-```
-
-Defined in: [src/state.ts:17](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L17)
-
-***
-
-### status
-
-```ts
-status: "running" | "exited" | "cancelled" | "failed";
-```
-
-Defined in: [src/state.ts:19](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L19)
-
-***
-
-### timeout?
-
-```ts
-optional timeout?: number;
-```
-
-Defined in: [src/state.ts:15](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L15)
-
-***
-
-### volume
-
-```ts
-volume: string;
-```
-
-Defined in: [src/state.ts:11](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L11)
-
-***
-
-### workdir
-
-```ts
-workdir: string;
-```
-
-Defined in: [src/state.ts:13](https://github.com/enixCode/light-runner/blob/main/src/state.ts#L13)
diff --git a/docs/api/interfaces/RunnerOptions.md b/docs/api/interfaces/RunnerOptions.md
deleted file mode 100644
index b53cc81..0000000
--- a/docs/api/interfaces/RunnerOptions.md
+++ /dev/null
@@ -1,59 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / RunnerOptions
-
-# Interface: RunnerOptions
-
-Defined in: [src/types.ts:3](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L3)
-
-## Properties
-
-### cpus?
-
-```ts
-optional cpus?: string;
-```
-
-Defined in: [src/types.ts:5](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L5)
-
-***
-
-### gpus?
-
-```ts
-optional gpus?: string | number;
-```
-
-Defined in: [src/types.ts:7](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L7)
-
-***
-
-### memory?
-
-```ts
-optional memory?: string;
-```
-
-Defined in: [src/types.ts:4](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L4)
-
-***
-
-### noNewPrivileges?
-
-```ts
-optional noNewPrivileges?: boolean;
-```
-
-Defined in: [src/types.ts:8](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L8)
-
-***
-
-### runtime?
-
-```ts
-optional runtime?: Runtime;
-```
-
-Defined in: [src/types.ts:6](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L6)
diff --git a/docs/api/interfaces/StopOptions.md b/docs/api/interfaces/StopOptions.md
deleted file mode 100644
index 3ec469b..0000000
--- a/docs/api/interfaces/StopOptions.md
+++ /dev/null
@@ -1,29 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / StopOptions
-
-# Interface: StopOptions
-
-Defined in: [src/Execution.ts:4](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L4)
-
-## Properties
-
-### grace?
-
-```ts
-optional grace?: number;
-```
-
-Defined in: [src/Execution.ts:14](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L14)
-
-***
-
-### signal?
-
-```ts
-optional signal?: string;
-```
-
-Defined in: [src/Execution.ts:9](https://github.com/enixCode/light-runner/blob/main/src/Execution.ts#L9)
diff --git a/docs/api/type-aliases/LightRunnerErrorCode.md b/docs/api/type-aliases/LightRunnerErrorCode.md
deleted file mode 100644
index b993eb8..0000000
--- a/docs/api/type-aliases/LightRunnerErrorCode.md
+++ /dev/null
@@ -1,21 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / LightRunnerErrorCode
-
-# Type Alias: LightRunnerErrorCode
-
-```ts
-type LightRunnerErrorCode =
- | "DOCKER_UNREACHABLE"
- | "VOLUME_CREATE_FAILED"
- | "CONTAINER_START_FAILED"
- | "SEED_FAILED"
- | "EXTRACT_FAILED"
- | "BUILD_FAILED"
- | "INVALID_RUN_STEP"
- | "NETWORK_CONNECT_FAILED";
-```
-
-Defined in: [src/errors.ts:1](https://github.com/enixCode/light-runner/blob/main/src/errors.ts#L1)
diff --git a/docs/api/type-aliases/Runtime.md b/docs/api/type-aliases/Runtime.md
deleted file mode 100644
index 216dbdc..0000000
--- a/docs/api/type-aliases/Runtime.md
+++ /dev/null
@@ -1,13 +0,0 @@
-[**light-runner v0.15.0**](../index.md)
-
-***
-
-[light-runner](../index.md) / Runtime
-
-# Type Alias: Runtime
-
-```ts
-type Runtime = "runc" | "runsc" | "kata";
-```
-
-Defined in: [src/types.ts:1](https://github.com/enixCode/light-runner/blob/main/src/types.ts#L1)
diff --git a/docs/guides/detached.md b/docs/guides/detached.md
deleted file mode 100644
index ba05aff..0000000
--- a/docs/guides/detached.md
+++ /dev/null
@@ -1,140 +0,0 @@
-# Detached runs
-
-A standard `runner.run(...)` ties the container's lifetime to the host Node process: kill the host, the run dies. Detached mode lets the container outlive the host.
-
-Use it when:
-
-- A run can take **hours** (training, batch jobs, CI-like workloads) and you cannot afford to lose it on a host crash or deploy.
-- You want a long-poll architecture where one process **starts** runs and a different process **collects** results.
-- You want to spawn a job, return immediately, and reconnect later from anywhere on the same machine.
-
-## Start a detached run
-
-```ts
-import { DockerRunner } from 'light-runner';
-
-const runner = new DockerRunner();
-
-const execution = runner.run({
- image: 'python:3.12-alpine',
- command: 'python long_job.py',
- dir: './job',
- timeout: 6 * 60 * 60 * 1000, // 6 hours
- extract: [{ from: '/app/result.json', to: './out' }],
- detached: true,
-});
-
-console.log('started, id =', execution.id);
-// you can let this process exit; the container keeps running
-```
-
-## Reconnect to a running detached job
-
-```ts
-const ex = DockerRunner.attach('light-runner-abc123def456');
-if (!ex) {
- console.error('no state file for that id');
-} else {
- const result = await ex.result;
- console.log(result.success, result.exitCode, result.extracted);
-}
-```
-
-`attach(id)` returns `null` when no state file exists for that id (typo'd id, or the run was reaped).
-
-## Listing known runs
-
-```ts
-import { DockerRunner } from 'light-runner';
-
-for (const state of DockerRunner.list()) {
- console.log(state.id, state.status, state.startedAt, state.image);
-}
-```
-
-## Detached contract differences
-
-| Capability | Attached | Detached |
-|---|---|---|
-| `input` (stdin) | Supported | **Rejected at API boundary** (host process death loses stdin) |
-| `onLog` callback | Streams stdout/stderr lines | **Not called** (stream lost on host death; use `docker logs ` instead) |
-| `cancel()` / signal | Best-effort kill | Best-effort kill, plus state file marked `cancelled` |
-| `extract` | Runs after exit | Runs after exit, requested set persisted in state file |
-
-## State file lifecycle
-
-Every detached run writes one JSON file under `~/.light-runner/state/.json` (or `LIGHT_RUNNER_STATE_DIR`):
-
-```jsonc
-{
- "id": "light-runner-abc123def456",
- "container": "light-runner-abc123def456",
- "volume": "light-runner-abc123def456",
- "image": "python:3.12-alpine",
- "workdir": "/app",
- "command": "python long_job.py",
- "timeout": 21600000,
- "extract": [{"from": "/app/result.json", "to": "./out"}],
- "startedAt": "2026-04-27T10:15:00.000Z",
- "status": "running"
-}
-```
-
-Status transitions:
-
-```
-running ──┬─> exited (clean exit, exitCode + finishedAt + durationMs added)
- ├─> cancelled (cancel() / abort, exitCode set, cancelled: true)
- └─> failed (setup error, container vanished, etc.)
-```
-
-Writes are atomic via temp + rename, so a host crash mid-write does not corrupt the file.
-
-## Cross-host resume
-
-The state dir is just JSON files under a fixed path. Two ways to make it shared:
-
-1. **Same machine, different process trees**: same `LIGHT_RUNNER_STATE_DIR`, no extra setup. Process A starts the run, process B re-attaches by id.
-2. **Different machines**: mount the state dir on a shared filesystem (NFS, EFS, networked volume). The Docker daemon must be the **same one** on both hosts (they share the named volume + container by name).
-
-## Race-safe attach
-
-`attach(id)` is safe to call **immediately after** `runner.run({detached: true})` returns. The runner writes the state file synchronously inside `run()`, before any async setup, so the file always exists by the time the caller has the `Execution` handle. Internally, `attach` polls the docker daemon for ~3 seconds with `containerExists()` to absorb the gap between state-file-written and container-actually-created.
-
-## Reaping
-
-A long-running host eventually accumulates state files for finished runs. Two cleanup helpers:
-
-```ts
-// Reconcile state files with the docker daemon.
-// Mark `running` states as `failed` if their container has vanished.
-await DockerRunner.cleanupOrphanStates();
-
-// Sweep idle/exited containers + volumes tagged with the light-runner label.
-const { containers, volumes } = await DockerRunner.reapOrphans();
-console.log(`reaped ${containers} containers, ${volumes} volumes`);
-```
-
-`reapOrphans` removes resources older than `LIGHT_RUNNER_REAP_AGE_MS` (default 5 minutes). Safe to run on a shared docker host with unrelated workloads since it filters by the `light-runner.run-id` label.
-
-Run both on host startup, before accepting new work.
-
-## Stop, pause, resume
-
-Detached or attached, the same `Execution` API works:
-
-```ts
-await ex.stop({ signal: 'SIGTERM', grace: 10_000 }); // graceful, fall back to SIGKILL
-await ex.pause(); // freezes via cgroup, memory preserved
-await ex.resume(); // unfreezes
-ex.cancel(); // immediate kill, sync, fire-and-forget
-```
-
-`pause()` is intentionally not flagging `cancelled: true` — a paused run is expected to resume and complete normally.
-
-## Gotchas
-
-- **Stdin is gone.** `RunRequest.input` is rejected at the API boundary when `detached: true`. Pipe input through a file in `dir` instead.
-- **`onLog` is silent.** No live stream on host. Inspect `docker logs ` for stdout/stderr while the run is alive.
-- **State file ≠source of truth for liveness.** A `running` status with a vanished container = ghost run; `cleanupOrphanStates` is what reconciles that.
-- **Extract still runs**, but only when the host that holds the resolved promise sees the exit. Re-attached hosts see `extracted` in their `result` too.
diff --git a/docs/guides/extract.md b/docs/guides/extract.md
deleted file mode 100644
index fda2391..0000000
--- a/docs/guides/extract.md
+++ /dev/null
@@ -1,123 +0,0 @@
-# Extract files
-
-`extract` is the **only output channel** for files. Logs go to `onLog`, exit code goes to `result.exitCode`, structured output goes through stdout / extracted files. The library has no opinion on what your container does inside.
-
-## Basic usage
-
-```ts
-const execution = runner.run({
- image: 'node:lts-alpine',
- command: 'node build.js',
- dir: './project',
- extract: [
- { from: '/app/dist', to: './out' }, // folder, recursive
- { from: '/app/report.pdf', to: './out' }, // single file
- { from: '/app/maybe-missing', to: './out' }, // missing -> reported, run still succeeds
- ],
-});
-
-const result = await execution.result;
-console.log(result.extracted);
-// [
-// { from: '/app/dist', to: './out', status: 'ok', bytes: 124583 },
-// { from: '/app/report.pdf', to: './out', status: 'ok', bytes: 9421 },
-// { from: '/app/maybe-missing', to: './out', status: 'missing' },
-// ]
-```
-
-## Folder vs file semantics (rsync-like)
-
-| `from` is a... | Result |
-|---|---|
-| **Folder** | The **contents** of the folder land **directly in `to`** (no basename wrap). Equivalent to `rsync -a from/ to/` or `cp -r from/. to/`. All subdirectories and files are included recursively. |
-| **File** | The file lands as `to/basename(from)`. |
-
-Trailing slash is irrelevant: `'/app/dist'` and `'/app/dist/'` produce identical output.
-
-```ts
-extract: [
- { from: '/app/dist', to: './out' }, // /app/dist/a.js -> ./out/a.js
- { from: '/app/dist/', to: './out' }, // same as above
- { from: '/app/report.pdf', to: './out' }, // -> ./out/report.pdf
-]
-```
-
-`to` is always a **destination directory**. It is auto-created via `fs.mkdirSync(to, { recursive: true })`.
-
-## Result statuses
-
-Each `extract` entry produces one `ExtractResult`:
-
-| `status` | Meaning |
-|-------------|----------------------------------------------------------|
-| `'ok'` | Archived and extracted. `bytes` reports the archive size.|
-| `'missing'` | `from` does not exist in the container. |
-| `'error'` | Cap exceeded, path traversal, mkdir failed, etc. The `error` field carries the reason. |
-
-A missing or errored entry **never fails the run**. The consumer inspects `result.extracted` and decides what to do.
-
-## Hard rules
-
-- **Path traversal rejected**: any segment containing `..` is refused before any container is spawned. `extract: [{ from: '/app/../etc/passwd', ... }]` → `status: 'error'` with `error: 'path traversal rejected (..)'`.
-- **Symlinks skipped**: a malicious container could craft a symlink whose target path exists on the host. The tar reader silently drops them.
-- **1 GiB per-entry cap**: enforced both **pre-flight** (`du -sb` inside the container) and **streamed** (byte counter in the host pipe). Above that, the entry is reported as `error` and the run still succeeds.
-- **Extract only on success**: skipped when `exitCode !== 0` or the run was cancelled. `result.extracted` is undefined in those cases.
-- **Disk-to-disk streaming**: the host never buffers the archive in Node RAM.
-
-## How extraction works internally
-
-1. After your container exits with code `0`, the runner spawns a **throwaway Alpine** sidecar with the same volume mounted read-only (no need to keep your image alive).
-2. A pre-flight script checks that `from` exists, computes its byte size with `du -sb`, refuses if over the cap.
-3. The sidecar runs `tar c` on `from` and pipes the archive to the host through a hijacked Docker stream.
-4. The host pipes that into the [`tar` extract](https://www.npmjs.com/package/tar) reader, which writes files into `to/` and counts bytes for the streamed cap check.
-5. The sidecar exits, AutoRemove tears it down, the runner returns `result.extracted`.
-
-## Common patterns
-
-### Capture structured output
-
-Have the container write a JSON file, extract it, parse it on the host:
-
-```ts
-// Inside the container:
-// import json
-// json.dump({'fib': fib(20)}, open('/app/result.json', 'w'))
-
-const result = await runner.run({
- image: 'python:3.12-alpine',
- command: 'python main.py',
- dir: './solver',
- extract: [{ from: '/app/result.json', to: './out' }],
-}).result;
-
-const data = JSON.parse(fs.readFileSync('./out/result.json', 'utf8'));
-```
-
-### Pull a build artefact
-
-```ts
-extract: [
- { from: '/app/dist', to: './public' },
- { from: '/app/coverage', to: './reports' },
-],
-```
-
-### Tolerate optional outputs
-
-Multiple entries with one missing is fine:
-
-```ts
-extract: [
- { from: '/app/required.json', to: './out' },
- { from: '/app/optional-extra', to: './out' }, // may not exist
-]
-
-const result = await execution.result;
-const required = result.extracted!.find(e => e.from === '/app/required.json');
-if (required?.status !== 'ok') throw new Error('required.json missing');
-```
-
-## See also
-
-- [`ExtractSpec`](/api/interfaces/ExtractSpec) and [`ExtractResult`](/api/interfaces/ExtractResult) in the API reference
-- [Security model](./security) — why symlinks and `..` segments are dropped
diff --git a/docs/guides/gvisor-kata.md b/docs/guides/gvisor-kata.md
deleted file mode 100644
index 6950849..0000000
--- a/docs/guides/gvisor-kata.md
+++ /dev/null
@@ -1,132 +0,0 @@
-# gVisor & Kata Containers
-
-Default `runtime: 'runc'` shares the host kernel with the container. That is fast and convenient, but it means a kernel-level exploit inside the container can compromise the host. For genuinely hostile code, switch the runtime.
-
-## Choose the right tier
-
-| Runtime | Isolation | Performance | Status in light-runner |
-|---|---|---|---|
-| `runc` (default) | Linux namespaces + cgroups, shared kernel | Native | **Tested**, default for trusted/known code |
-| `runsc` (gVisor) | User-space syscall interception, smaller kernel attack surface | ~10-30% I/O overhead | **Tested**, recommended for hostile code |
-| `kata` (Kata Containers) | Lightweight VM per container, separate kernel | ~5-15% boot + I/O cost | **Option exposed but not yet validated in our test matrix** — open an issue if you run it in production |
-
-Switch via `RunnerOptions`:
-
-```ts
-const runner = new DockerRunner({ runtime: 'runsc' }); // or 'kata'
-```
-
-When the option is `runc` (or omitted), the runner does not pass a `Runtime` field to Docker, so you keep whatever the daemon's default is.
-
-## When to use gVisor
-
-Use it when **any** of these is true:
-
-- The code you run is **anonymous** (random user uploads, public CTF entries).
-- The code is **AI-generated** and you do not audit each call (LLM tool execution, agent runtimes).
-- You ship a **multi-tenant playground** and one tenant compromising the host would be a headline.
-- You handle PII or regulated data and the threat model includes "the running code is the adversary".
-
-You do **not** need gVisor when:
-
-- The code comes from your own CI / internal tooling and you trust the toolchain.
-- You build the image yourself from a known Dockerfile.
-- The performance cost is unacceptable (data-intensive batch jobs).
-
-## Install gVisor on Linux / WSL2
-
-gVisor does **not** run natively on macOS or Windows. On Windows, use Docker Desktop with the **WSL2 backend** — the `runsc` install lives inside the WSL2 distro, not the Windows host.
-
-```bash
-(
- set -e
- ARCH=$(uname -m)
- URL=https://storage.googleapis.com/gvisor/releases/release/latest/${ARCH}
- wget ${URL}/runsc ${URL}/runsc.sha512 \
- ${URL}/containerd-shim-runsc-v1 ${URL}/containerd-shim-runsc-v1.sha512
- sha512sum -c runsc.sha512 -c containerd-shim-runsc-v1.sha512
- rm -f *.sha512
- chmod a+rx runsc containerd-shim-runsc-v1
- sudo mv runsc containerd-shim-runsc-v1 /usr/local/bin
-)
-sudo /usr/local/bin/runsc install
-sudo systemctl reload docker
-```
-
-`latest` is a rolling channel — gVisor ships frequent date-stamped releases (`release-YYYYMMDD.N`), no semantic version. Verify with `runsc --version`.
-
-After the daemon reload, test that Docker accepts the new runtime:
-
-```bash
-docker run --rm --runtime=runsc alpine:3.19 dmesg | head
-# Expect: gVisor-style kernel ring buffer, NOT the host's
-```
-
-Then in your code:
-
-```ts
-const runner = new DockerRunner({ runtime: 'runsc' });
-```
-
-## Performance notes
-
-`runsc` intercepts syscalls in user space, so it pays a tax on every syscall:
-
-| Workload | Approx. overhead vs runc |
-|---|---|
-| CPU-bound (no syscalls) | ~0% |
-| Read-heavy I/O | 10-15% |
-| Write-heavy I/O | 20-30% |
-| Network-heavy (small packets) | 25-40% |
-| Workloads spawning many processes | 30-50% |
-
-For agent-style runs (one container, one process tree, one set of files), the overhead is usually **invisible**. For tight inner loops on disk or network, benchmark before committing.
-
-## Kata Containers
-
-Kata runs each container inside a lightweight VM with its own kernel, giving you **VM-level isolation** at container-level UX.
-
-```ts
-const runner = new DockerRunner({ runtime: 'kata' });
-```
-
-We pass `runtime: 'kata'` straight through to Docker's `HostConfig.Runtime`. Docker then dispatches to whichever Kata shim is installed (`containerd-shim-kata-v2` or similar). The library does **not** validate that the runtime is installed; if it is missing, Docker returns a `CONTAINER_START_FAILED` error at run time.
-
-**The disclaimer** (also visible on the security note in the bespoke landing): we expose this option for users who already run Kata, but our CI does **not** install or test against Kata. If you adopt it in production, please open an issue with results — both successes and edge cases.
-
-Useful resources:
-
-- [Kata Containers project](https://github.com/kata-containers/kata-containers)
-- [Docker + Kata setup guide](https://github.com/kata-containers/kata-containers/blob/main/docs/install/docker/ubuntu-docker-install.md)
-
-## Verifying isolation
-
-A quick sanity check that the runtime actually changed:
-
-```ts
-const result = await runner.run({
- image: 'alpine:3.19',
- command: 'cat /proc/self/maps | head -5',
- // gVisor-mapped binaries look very different from runc-mapped ones
-}).result;
-```
-
-Or look for the gVisor signature:
-
-```ts
-const result = await runner.run({
- image: 'alpine:3.19',
- command: 'dmesg | grep -i gvisor || echo "not gvisor"',
-}).result;
-```
-
-Under `runsc` you will see `gVisor` strings in `dmesg`. Under `runc`, you will see the host's kernel ring buffer.
-
-## Trade-offs summary
-
-| Want... | Use |
-|---|---|
-| Maximum speed, you trust the code | `runc` (default) |
-| Hard barrier against kernel exploits, willing to pay 10-30% I/O | `runsc` |
-| Full VM isolation, separate kernel | `kata` (un-validated, at your own risk) |
-| Air-gapped network on top of any of the above | `network: 'none'` on the request |
diff --git a/docs/guides/quickstart.md b/docs/guides/quickstart.md
deleted file mode 100644
index d97ac23..0000000
--- a/docs/guides/quickstart.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# Quick start
-
-Run untrusted code in a hardened Docker container, get back the exit code, logs, and any files the container produced. That is the whole library.
-
-## Install
-
-```bash
-npm install light-runner
-```
-
-Requirements:
-
-- Node.js >= 22
-- A running Docker daemon (Docker Desktop on macOS / Windows, `dockerd` on Linux)
-- Optional: [gVisor](./gvisor-kata) for kernel-level isolation
-
-## Run something
-
-```ts
-import { DockerRunner } from 'light-runner';
-
-const runner = new DockerRunner({ memory: '512m', cpus: '1' });
-
-const execution = runner.run({
- image: 'python:3.12-alpine',
- command: 'python main.py',
- dir: './my-project',
- input: { task: 'compute', n: 20 },
- timeout: 30_000,
- extract: [{ from: '/app/result.json', to: './out' }],
-});
-
-const result = await execution.result;
-
-result.success // true if exitCode === 0, not cancelled, not timed out
-result.exitCode // container exit code
-result.duration // ms
-result.cancelled // true if cancel() / signal aborted
-result.extracted // [{ from, to, status, bytes? }, ...] if extract was set
-```
-
-## What happens under the hood
-
-1. A named Docker volume is created (`light-runner-`).
-2. The folder at `dir` is streamed into the volume via a throwaway Alpine seeder, skipping `.git`, `node_modules`, `dist`, `build`, `.next`, `.cache`, `.turbo`, `coverage`, and **all symlinks**.
-3. Your image runs with the volume mounted at `workdir` (default `/app`), strict isolation flags, and a PID / memory / CPU cap.
-4. On exit-code 0, each `extract` entry is streamed out via `tar`. On non-zero exit, extract is skipped.
-5. The volume is destroyed, success or not.
-
-## Where to go next
-
-- [Extract files](./extract) — how to pull artefacts out of the container after a run
-- [Detached runs](./detached) — long-running jobs that survive a host restart
-- [Security model](./security) — what the sandbox protects against and what it does not
-- [gVisor & Kata](./gvisor-kata) — adding a stronger runtime for hostile code
-- [API reference](/api/) — full type signatures and class methods
diff --git a/docs/guides/security.md b/docs/guides/security.md
deleted file mode 100644
index bdf5e5d..0000000
--- a/docs/guides/security.md
+++ /dev/null
@@ -1,115 +0,0 @@
-# Security model
-
-`light-runner` is the boring, correct, library-grade answer to "how do I run untrusted code in a container from Node.js?". It is **secure by default**, **additive only** (every option makes the sandbox stronger, never weaker), and it has **one job** (no orchestration, no networking, no persistence beyond the run).
-
-This page describes what is in scope, what is not, and how to choose the right hardening tier.
-
-## Threat model
-
-| In scope | Out of scope |
-|---|---|
-| Untrusted **user code** running inside the container | The host kernel itself (use gVisor for hostile code) |
-| **Filesystem isolation** between the run and the host | Side-channel attacks (timing, cache, Spectre) |
-| **Process isolation** between sibling runs on the same host | Hardware-level threats (firmware, BIOS) |
-| **Network containment** between the run and the host network | The Docker socket itself (root-equivalent on host) |
-| **Resource starvation** (memory, CPU, pids, extract size) | DoS at the orchestration layer (caller's job) |
-| Common container-escape patterns: raw sockets, mknod, capability juggling | Multi-tenant isolation **between tenants** sharing one container |
-
-**The one rule**: one run, one container, one tenant. If two pieces of code must not see each other, they each get their own `runner.run(...)` call.
-
-## What is on by default
-
-Every flag in [`src/createOptions.ts`](https://github.com/enixCode/light-runner/blob/main/src/createOptions.ts) is on for every run, with no opt-out path.
-
-### Capabilities dropped
-
-The following Linux capabilities are stripped at startup:
-
-| Capability | Why |
-|----------------|------------------------------------------------------------|
-| `NET_RAW` | Raw / packet sockets (ARP spoofing, packet crafting) |
-| `MKNOD` | Fabricate device nodes |
-| `SYS_CHROOT` | Escape weaker chroot jails |
-| `SETPCAP` | Modify capability sets of other processes |
-| `SETFCAP` | Escalate via setcap on dropped binaries |
-| `AUDIT_WRITE` | Kernel audit log flooding / spoofing |
-
-### `no-new-privileges`
-
-A `setuid` binary inside the container **cannot elevate above the user it starts as**. Even if the image ships a legitimate-looking root-suid helper, it stays at the run user's privilege level.
-
-### Process cap
-
-`PidsLimit: 100` per container. A fork-bomb caps out in milliseconds instead of paging the host. Tunable upward via `RunnerOptions` if you genuinely need more (compilers spawning many processes, orchestrators-of-orchestrators), but the floor is conservative.
-
-### Memory and CPU budget
-
-`512 MiB` and `1` core by default, **cgroup-enforced**. Noisy runs cannot starve their neighbours. Override with `new DockerRunner({ memory: '4g', cpus: '4' })`.
-
-### Network isolation
-
-Default network: a **dedicated isolated bridge** (`light-runner-isolated`) with **inter-container traffic disabled** (`com.docker.network.bridge.enable_icc: false`). Outbound internet works; sibling runs on the same bridge cannot see each other.
-
-For air-gapped runs, set `network: 'none'` in the request — the container has no network interface at all.
-
-### Filesystem protections
-
-- **Symlinks in your input folder are filtered** at seed time, so a stray `.git` link or a deliberate symlink to `/etc/passwd` cannot cross the host -> container boundary.
-- **`DEFAULT_IGNORES`** (`.git`, `node_modules`, `dist`, `build`, `.next`, `.cache`, `.turbo`, `coverage`) are skipped during seeding. They are noise at best and credentials-bearing at worst.
-- **Path traversal in `extract.from`** (segments containing `..`) is rejected **before** any container is spawned. A malicious container cannot tell the host extractor to write to `/etc/cron.d/`.
-- **Extract symlinks are skipped** during streaming. A container cannot craft a tarball with a symlink that resolves to a host path.
-- **Extract cap**: 1 GiB per entry, enforced **twice** — pre-flight via `du -sb` inside the container, and streamed via a byte counter on the host pipe.
-
-## What this does not cover
-
-- **Kernel exploits** (anything that breaks out of namespaces by tickling the host kernel directly).
-- **`runc` CVEs** (rare but real; you eat them if you ship `runtime: 'runc'`).
-- **Side-channel attacks** (timing, cache eviction, Spectre/Meltdown family).
-
-For genuinely hostile code (anonymous user-submitted source, AI-agent-generated tool calls, a CTF playground), combine with a stronger runtime — see [gVisor & Kata](./gvisor-kata).
-
-## Secrets
-
-`env` vars go to `docker run --env`, which makes them visible in `docker inspect` and Docker metadata. That is fine in most setups (a host with Docker socket access is already root-equivalent), but for sensitive material prefer:
-
-- **`input`** (stdin). Ephemeral. Not in metadata, not in `docker inspect`. Your container reads it via `sys.stdin.read()` / `process.stdin`.
-- **A bind mount to `/run/secrets/`**. Docker-native file-based secrets pattern (compose has a `secrets:` block for this). Not managed by light-runner — the consumer wires it via the host config or via a parent compose definition.
-
-Avoid putting API keys in `env`. Avoid putting them in `command`. Avoid putting them in `dir` (they would be tarred into the seed archive and visible to anyone with access to the volume).
-
-## Hardening recipes
-
-### Air-gapped run (no network, untrusted source code)
-
-```ts
-const runner = new DockerRunner();
-runner.run({
- image: 'python:3.12-alpine',
- command: 'python untrusted.py',
- dir: './sandbox',
- network: 'none',
- timeout: 30_000,
- extract: [{ from: '/app/output.json', to: './out' }],
-});
-```
-
-### Tighter resource budget
-
-```ts
-const runner = new DockerRunner({
- memory: '128m',
- cpus: '0.5',
-});
-```
-
-### Maximum isolation (gVisor)
-
-```ts
-const runner = new DockerRunner({ runtime: 'runsc' });
-```
-
-See [gVisor & Kata](./gvisor-kata) for installation.
-
-## Reporting a security issue
-
-Email the maintainer (see GitHub profile) with `[security]` in the subject. Public issues are fine for things that need a fix but no one is exploiting; private disclosure is preferred for actively-exploitable bugs.
diff --git a/docs/index.md b/docs/index.md
deleted file mode 100644
index 0e91109..0000000
--- a/docs/index.md
+++ /dev/null
@@ -1,324 +0,0 @@
----
-title: light-runner
-layout: page
-sidebar: false
-aside: false
-pageClass: bespoke-landing-page
----
-
-
-
-
-
-
-
-
-
-
- Execution primitive - Node.js
-
-
-
- Run untrusted codein hardened containers.
-
-
- A single-purpose Node.js library that runs your code in a container
- it tears down afterwards, and hands you back the exit code, logs,
- and any files you asked for. Nothing else.
-
-
-
-
-
-
-
-
- Fig. 01 - One process, one cell, one grid.
- light-runner / visual
-
-
-
-
-
-
-
-
what you get
-
Give it code. Get back an exit code , logs, and the files you asked for.
-
-
-
-
01 / isolated
-
Your code runs in its own cell .
-
Every run gets a fresh container, its own volume, its own network. Nothing leaks in from the host, nothing leaks out to sibling runs. Torn down on exit - success or not.
-
-
-
02 / drop in, pull out
-
Send a folder. Get any file back.
-
Point at a directory on your disk, it becomes the container's workdir. When the run finishes, ask for any path - a report, a binary, a whole build tree - and it lands back on your host.
-
-
-
03 / stop on demand
-
Cancel, abort, or time out .
-
Pass an AbortSignal, call cancel(), or set a deadline. The container dies and its volume goes with it. No zombie processes, no leaked disk.
-
-
-
04 / any stack
-
Python, Node, Go, Ruby, shell - anything .
-
Any Docker image on your registry or someone else's. No special runtime inside the container, no SDK to import, no convention to follow. Your code stays your code.
-
-
-
-
-
-
-
-
quick start
-
Five lines to run, one to get your artefact.
-
-
-
-
Point light-runner at an image and a folder. Pipe input through stdin. Extract whatever your container wrote.
-
No HTTP server. No config file. No CLI.
-
npm install light-runner
-
-
-
- example.ts
- Copy
-
-
import { DockerRunner } from 'light-runner' ;
-const runner = new DockerRunner ( { memory : '512m' , cpus : '1' } ) ;
-const execution = runner. run ( {
- image : 'python:3.12-alpine' ,
- command : 'python main.py' ,
- dir : './my-project' ,
- input : { task : 'compute' , n : 20 } ,
- timeout : 30_000 ,
- extract : [ { from : '/app/result.json' , to : './out' } ] ,
-} ) ;
-const result = await execution. result;
-result. success // true if exit 0 and not cancelled
-result. exitCode // the container's exit code
-result. extracted // [{ from, to, status, bytes }]
-
-
-
-
-
-
-
-
security model
-
Hardened defaults, never opt-out. Add more restrictions, never fewer.
-
-
-
-
Kernel permissions
-
Dangerous capabilities stripped at startup - raw sockets, device creation, chroot escapes, capability juggling, audit-log spoofing. Every run, unconditionally.
-
-
-
No privilege escalation
-
A setuid binary inside your container cannot elevate above the user it starts as.
-
-
-
Fork-bomb protection
-
Max 100 processes per container. A runaway loop caps out in milliseconds instead of paging the host.
-
-
-
Memory and CPU budget
-
512 MiB and one core by default, cgroup-enforced. Noisy runs cannot starve their neighbours. Tunable per runner.
-
-
-
Network isolation
-
Isolated bridge by default with inter-container traffic blocked. Pass network: 'none' to sever it entirely.
-
-
-
Host filesystem protection
-
Symlinks in your input folder are filtered before seeding, so a stray link cannot reach back into the host filesystem.
-
-
-
Safe file extraction
-
A container cannot write outside the destination folder you chose: paths escaping upward (..) are refused. Each extracted entry is capped at 1 GiB so a runaway output cannot fill your disk.
-
-
-
Kernel-level hardening
-
Swap the runtime to gVisor with one option for user-space syscall interception, at ~10-30% I/O cost.
-
-
-
- Does not cover - kernel exploits, runc CVEs, side-channel attacks. For genuinely hostile code, combine with { runtime: 'runsc' } (gVisor) or { runtime: 'kata' } (Kata Containers, VM-level isolation - option exposed but not yet validated in our test matrix ).
-
-
-
-
-
-
-
ecosystem
-
Three tools. Each does one thing.
-
-
-
- light-runner
- Spawn one container, return exit code and files.
- The execution primitive. Domain-agnostic. Zero orchestration. The other two tools in this family both call down to this one.
- Loading
-
-
- light-run
- CLI and HTTP surface around light-runner.
- Point a POST endpoint at it, pipe bodies through, get results back. Stateless wrapper, same defaults, same guarantees.
- Loading
-
-
- light-process
- DAG orchestration, retries, fan-out.
- When one container is not enough. Composes runs into pipelines with backoff, concurrency limits, and structured outputs.
- Loading
-
-
-
-
-
-
4q%kr<&|IasC%^%zN8TX(5-lqSX|AGET_m};r
zsDF+Aul~RM2jf@Bcj7)v#FTBtGkDyg}
zmrzgppZI-z@H77BI=}uu=KXJeS^n4mSNZ>eU*n(MfARl`2iNA|m&hseEm#)N2q#JY
z^BmVC%y8Kj(z=+RKh~p)4DahlbQcA1()6Vr4F)r+=!WY}#IpF)iOAebdwW_bP@QTx
z3fcg$76QOmCmIm?-CP5{~Wuen?|kXT^Ivat$G+
z&$I_@t+R|el&_5|sR+t*P&PnZ(lgdhWiXoPERKlUOGUvW$^YFNHub|SA}Q(b81O~w
z^UMWtBuZTO8Y*?`1y2h<0t9zhED?1om$FNd=l`p0df37ALTO{hV-B06OpjT@^B;ur
z2RqQ|H4_*0yBd_GX9iN(Z(~4)G3M_Z>)j?9O?kz_eCaA2P4njRCzN>WSA|xCGXixY
z_&0GI%V?8lugAKMLD12Gz>wsIn#gf=YY-L&L-hph1;Mdqn^L1CTmpflX5^g(`3%lmBw_pB|Wj>Jwk-_mr%=%#M$Pzr~_TJ3non<
zi>TgzMF|e>^HwntKkdHy0LM#(ZiqaZR+YeYvsovteSt5P6PgBC25ypU9#cOGobsb4
zyJ(7SLsNLkP2%|db|VbIH&}iX(U%-|kXT8$#a!{o{yGcBactFvavcSd;3x1H1#M6n
zJprP!l&v4dyM!*=)QG@8{qu7SM@&bPOExPdH4K5I-aj7%)fqfX=G-|es3ZbSMuUqr
zFE^)3Qwo@2&&7S%r)i%>d=2hWrFl9qc`?v%wKrd^9jIh?o-v2uq-HWIXNYTgR-3W%
zqQ9<-6R0CZ9f1vqjAwFU0~FaHdW2W&z$4kz)7}+AR23W`fNP4lUDR{1xfp59n_WnL
z3SNhs2ZupF!2V$DtSq#M;(FcLowS-Fo%YE~W~XfI!peLYV|Isk!Ku=G@*xIGTv+oP
zGMz-OB}Y6Y{B8@;3_$FUCYAZS7=GL0Z!}HYp7dK_vBz*ID#(k)3TDTd=Q`Av-5+o-
zQMuN-*SI;W+Z5#aPN_o>FR<7RI|r$bpR33HSb_0yqT#YOa8fJexT47ociYlxI!~?a
zLQEN^pg=RRAqT~>N!c#7HTOm@%OJSY1+ZI2m&1!a+d#tVGzpK5;NijB8_Ek=1J74`
zG)9=K%1>%}xE$*pN64XR_Zdz?yd4@HyXOfXmS-1
zYW^w6bx9-;)VQ5DgZzMDryIBVCmNR%Dr%h6%ii?H0ak3_6_rCXkxvH~pi1)@Do?I;
zMIXfoNj{xjEno}bO?Kf#iog0i(F;PUI+;~^WS^1Jbi98@t$uyM7S!~p5^@CAkk~61
zRq`PHG<1LJP}RFrGk$l1}-R3?+S9S5+K{49NZW{!I~)
z9K`bVt=?RU*adIj?F!GolZ06-Cqes7rK2KOe8*71&?+om(j&Aca8$aHwuhGeF5O%%
zVir#R1E9%SjWN4wxGQ2J=gVIp%}iRdT-KsCI$UyH5t~Vm^)vj>GzMw0g=qV4nFFx=
zjYf7pg}YytRe2))^3I*vAQnFKEvEk1)&AxYDS(&k$^Uw+hKx3cU;2mp(JlQNRa6O2
zLitM}KQK+Bo!TpFx-#^dr{>Knv&P2(U@P)YKIx1fGy)k)ZYZ6$<2^l0!73O%Ot;)H
z8^5eUR>B@Xj+ktfvqkL%q-5t6b=&~yUA;f@0R|3|WpZ44Gt0;~{1?p9#bs(k@uiyM
z>~2ay#_j$~3WY%3!O+Fq7AJvQhx^C+FZV{f63AWnv6aD*h=vgyf6I-Nw{6h{l=%>>
zCqTuH=Q3fa*|wMU-t>&(9>ed>#-tW>w5DnR+}nJ+x3>mgAgI@HrU~DYY%=Y>inWz;
zp2BZPAoxDlndYVoHw?gR0EPeH+j_s)=vHsvKfSid&znYCkWn^GU|#4f!=~&HjSJ8bHV0}UWSwAs?gV?AR2BTKJz=z_VH;P_D-S=`
zFxa8eS;9x)H=fK`RTQmnqdSrmJ%@f}_#;>}QJIoyQV^%SvO!1rowy}Xl?6u*o1?V`
z!lrnCgUaRyU-$$s=s;%^JD4BU;5wSQ*YbV>+aK?6&Rll9X4k=H8XvFyi=3xsEl8L7
zNyEK*o}Qn9vk%scWREK8vJ)E+c|XZeRB+*@gUtGk(QG?s$KgCGJna
z%*kd3%5lc0z(WXhmwDqLNcy>;qh?@ZOqhGK(N)M--3%Xt+YD{A<+7Q!?6k(Ts|Il*
zV?k1oo#j_(3gIBW-Ult(VzS16ncJisZMLD3<5)Dv_9sh^pC8HbHqgs3{5grzu(Ht_
zduoh5(?u=vUo!vFU#FLeyc~h^)Oz*%Ee7+SyPT0LPufevp_hV7KZ+(PB}JOC@*3Oo
zaf?O#GA9@#E+}aHq9R8?fGsQUHef5q(m_+-z*upQ-Kq+X5I%4Peo4wCx5
zTw_pot3_Y27V@J|`i(ujLdr0JSb({yYW!OXBnI3aV_#5mTikPwPDvz&SyJ{^$jXM{
zy{av%yjBr&g@KB*K(FQYW9e7(t@||#rW6eKo-(G@Xo#2zJZqvsnp{hqG(HSGy5p$|
zn)%?}>mPKtv5w=uX(C@BQWL5uj_d&7lYQNav=*@TTmCN(S%k1
zRjGwE4Se@Ahc#tP_s%sBJ-CsZ(SdHKzAy8(-vt&)JAaaK{z`(QhfUGnEm5h*N*Z8M
z4%X+rH;VtT8QCYr`;Fg)KOKT(%YR+opTTx`gSBva`N3wyFdD20LkdXpN|ZY19V}IQwYrps?>2>F8-KL&N+r#`PkRhj1CGrJ$0q)v{5`4H!LRwRw
z57&6}a_+(*>Lsbl$Ut@?e9?2tdr3xU$vSD=-fPL}ZA7j&hcJPp<+N+I^eHoA!%{V=Fh4aVLDVg3}O
zk%LDXR+p+`0*Y1-F2+@ElCW~dFnGCUXsx-?BtgZ`aq9A3H&AH8gL;T6zN5FngdcAt
zgHh$RtIjNhq#2sDJaSHBb|0GHzoWiUaV5Gq@+0hLY$-Fwdz}vHjwzwoDyoWrLEA*Jog=&%F?~`_q
z%1PN3urBx1W-5e;ZX}WK&f*))XXVW8Wox#&#s7^}tuIuFF
zq46eTzGFbl9fzJn>55jDmIsEix}L!P+0sA!n`-A{>p$l%Y(*J|^lQE9Tm*rsoiZ`5
zo)@g(ym>$WX)gHYhfS7yVi|K~9<4g`EbHB866g2Y+n0wJaOXD7uN@
z|NJk~AU3g9cJ8Mx3&Yb*VwEX>PfMr3ktDLi13eeq`Mor>p6pp_7@zaByA%ZpS|
z^ZGZyp&ATF>BSZBO=KM>*6MQ#D#^VhTuh}_UOA5q{!gYmUl+NCkki;KX8#z#7bxYI
zMF5ay7>^rbg;l+Y)L?O&J=FefbFtg(MXYk11|)E((tP`14jiAgnkh)eh%C&UWsI?U&7a+LH9V+Vh9qG?h)ylq~%+y(jiObloP$R#)ABk6Ig%krcj>{m`07s
zoZ?zaOc~Z&u*Vbp&$DY
zu2C^-_n<41l584ecb+ka;??uHExzN!_Fj{`8@T*4hi?>(xaKV_WhBKU64!E`t@0u3
zk902rk7uLT8*Hr)n42rE!=El8gRh8_%7zM5oSY9ewN~&yT%~J{?B9F5^ZEVwWZs~V
z^;>#>*rp`S>fPpRu2sLMa?IlK78(n)F+J3{=e57;Kv;j{R)e4Npn$Agj(Bd*ywrmG
z8%G*67?E}e^_tIMnV60F9{=@9HH$0C3WRA3(K6AM>FX3Px8fd>)O#qhp(G+)Yv0!=
z`?@dR{0ClwRV&6^*Pac5SB}sl#QB~oC
zCUntG@nh9o0)!tzBZKEDXMCN8>7OCUwEyIAu_~!>V`E=kHkBj;(kXIb8S|e@S@5l6
zi|E!+qz`jPa+fn53nBv&%Tf82KX07uf`EPP$>c1+xO$wd+beh^Y%zTO7b4L2n0HqP
z{ZpIz*#%3UHaagLaH9vxh-AP65|~Yjv8a>*xZPJ(b``tkd71vOD-ptw7Nbt>XS$(P
z1560r!NvME*}K16@j|aKqL-+_^^G!Jp!4KldIA!1ljE)k8&I`}(keX?4TTsSCw8T9
z9Xu2TyTd`uvUbZK|ce(9g!^1u0#Ig^rxmG2z)5vdeF$mm#V}YG+k7!|FBGI4S8)X{ZZ%ElN%>3k
z5)WiOwla>rkEl4P_E*T-NWmfG&gCi{U)nf)%@q}sta8moXY$Wj-nEX+D21om9-<&sJ 
+
+ 
-
-