@ni-c/mcp-hub 0.6.3 → 0.7.0

package/dist/auth/store.js

@@ -8,6 +8,10 @@ import path from 'node:path';
  * approved; approved ones are legitimate and never evicted.
  */
 export const MAX_UNAPPROVED_CLIENTS = 100;
+const LOCK_WAIT_MS = 10_000;
+const STALE_LOCK_MS = 30_000;
+const LOCK_POLL_MS = 10;
+const lockSleep = new Int32Array(new SharedArrayBuffer(4));
 /**
  * All persistent auth state lives in two files under DATA_PATH:
  * jwt-key.pem (Ed25519 private key) and state.json (clients, refresh tokens,
@@ -28,33 +32,117 @@ export class AuthStore {
     publicKey;
     state;
     statePath;
+    lockPath;
     /** Identity of the file contents this.state was loaded from; see fileSignature(). */
     signature;
     tmpCounter = 0;
     constructor(dataDir) {
         fs.mkdirSync(dataDir, { recursive: true });
-        const keyPath = path.join(dataDir, 'jwt-key.pem');
-        if (!fs.existsSync(keyPath)) {
-            const { privateKey } = crypto.generateKeyPairSync('ed25519');
-            fs.writeFileSync(keyPath, privateKey.export({ type: 'pkcs8', format: 'pem' }), { mode: 0o600 });
-        }
-        this.privateKey = crypto.createPrivateKey(fs.readFileSync(keyPath, 'utf8'));
-        this.publicKey = crypto.createPublicKey(this.privateKey);
         this.statePath = path.join(dataDir, 'state.json');
-        const restored = AuthStore.readState(this.statePath);
-        this.state = restored ?? {
-            cookieSecret: crypto.randomBytes(32).toString('base64url'),
-            clients: {},
-            refreshTokens: {},
-            approvals: {},
-            consumedRefreshTokens: {},
-            revokedBefore: {},
-            apiTokens: {}
-        };
-        if (restored)
-            this.signature = this.fileSignature();
-        else
-            this.persist();
+        this.lockPath = path.join(dataDir, '.auth-state.lock');
+        this.acquireLock();
+        try {
+            const keyPath = path.join(dataDir, 'jwt-key.pem');
+            if (!fs.existsSync(keyPath)) {
+                const { privateKey } = crypto.generateKeyPairSync('ed25519');
+                fs.writeFileSync(keyPath, privateKey.export({ type: 'pkcs8', format: 'pem' }), { mode: 0o600 });
+            }
+            this.privateKey = crypto.createPrivateKey(fs.readFileSync(keyPath, 'utf8'));
+            this.publicKey = crypto.createPublicKey(this.privateKey);
+            const restored = AuthStore.readState(this.statePath);
+            this.state = restored ?? {
+                cookieSecret: crypto.randomBytes(32).toString('base64url'),
+                clients: {},
+                refreshTokens: {},
+                approvals: {},
+                consumedRefreshTokens: {},
+                revokedBefore: {},
+                apiTokens: {}
+            };
+            if (restored)
+                this.signature = this.fileSignature();
+            else
+                this.persistUnlocked();
+        }
+        finally {
+            this.releaseLock();
+        }
+    }
+    /** Atomic directory creation is the portable cross-process mutex. */
+    acquireLock() {
+        const deadline = Date.now() + LOCK_WAIT_MS;
+        for (;;) {
+            try {
+                fs.mkdirSync(this.lockPath, { mode: 0o700 });
+                fs.writeFileSync(path.join(this.lockPath, 'owner'), `${process.pid}\n`, { mode: 0o600 });
+                return;
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+            this.removeStaleLock();
+            if (Date.now() >= deadline)
+                throw new Error(`timed out waiting for auth state lock ${this.lockPath}`);
+            Atomics.wait(lockSleep, 0, 0, LOCK_POLL_MS);
+        }
+    }
+    /**
+     * Break a lock whose owner is gone.
+     *
+     * The owner's pid is the precise signal and is used whenever it can be read.
+     * Age is the fallback, and it has to be one: the directory is created before
+     * the owner file is written, so a process killed between the two leaves a
+     * lock nobody can attribute. Treating that as "held" would wedge every
+     * future AuthStore in the data directory until someone deleted it by hand.
+     *
+     * The pid also means nothing across a PID namespace — an admin CLI installed
+     * from npm on the host, against a /data volume the hub uses from inside a
+     * container. The documented invocation is `docker exec` into the hub, which
+     * shares the namespace; for the other case the age fallback is what applies.
+     */
+    removeStaleLock() {
+        try {
+            const stat = fs.statSync(this.lockPath);
+            const pid = this.lockOwnerPid();
+            if (pid !== undefined) {
+                try {
+                    process.kill(pid, 0);
+                    return;
+                }
+                catch (error) {
+                    if (error.code !== 'ESRCH')
+                        return;
+                }
+            }
+            else if (Date.now() - stat.mtimeMs <= STALE_LOCK_MS) {
+                return;
+            }
+            fs.rmSync(this.lockPath, { recursive: true, force: true });
+        }
+        catch {
+            // The owner may have released it between stat and read. Retry mkdir.
+        }
+    }
+    /** undefined when the owner file is missing, unreadable or not a pid. */
+    lockOwnerPid() {
+        let raw;
+        try {
+            raw = fs.readFileSync(path.join(this.lockPath, 'owner'), 'utf8');
+        }
+        catch {
+            return undefined;
+        }
+        const pid = Number(raw.trim());
+        return Number.isSafeInteger(pid) && pid > 0 ? pid : undefined;
+    }
+    releaseLock() {
+        try {
+            fs.rmSync(this.lockPath, { recursive: true, force: true });
+        }
+        catch (error) {
+            console.error(`mcp-hub: could not release auth state lock: ${error.message}`);
+        }
     }
     /**
      * Inode, mtime and size of state.json, or undefined when it is gone. The
@@ -105,10 +193,43 @@ export class AuthStore {
      * what stops persist() from writing a stale snapshot back over them.
      */
     mutate(fn) {
-        this.reloadIfChanged();
-        const result = fn();
-        this.persist();
-        return result;
+        this.acquireLock();
+        try {
+            this.reloadUnderLock();
+            const result = fn();
+            this.persistUnlocked();
+            return result;
+        }
+        finally {
+            this.releaseLock();
+        }
+    }
+    /**
+     * A mutation must never proceed from stale memory, even if stat metadata is
+     * unchanged. A file that is *gone* is not stale memory, though: the
+     * constructor recreates it, and refusing here instead would turn a deleted
+     * state.json into a hub whose every refresh-token rotation fails until it is
+     * restarted. Unparseable content stays a hard error — that is a file with
+     * contents we cannot merge into, and overwriting it would drop grants.
+     */
+    reloadUnderLock() {
+        let parsed;
+        try {
+            parsed = JSON.parse(fs.readFileSync(this.statePath, 'utf8'));
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                console.error('mcp-hub: auth state file is gone, writing the state in memory back to disk');
+                this.persistUnlocked();
+                return;
+            }
+            throw new Error(`cannot reload auth state while holding the mutation lock: ${error.message}`);
+        }
+        const next = AuthStore.normalize(parsed);
+        if (!next)
+            throw new Error('cannot mutate unusable auth state');
+        this.state = next;
+        this.signature = this.fileSignature();
     }
     /**
      * Shapes a parsed state file, or undefined when it is unusable. Fields added
@@ -153,12 +274,11 @@ export class AuthStore {
             return undefined;
         }
     }
-    persist() {
+    persistUnlocked() {
         this.pruneExpired();
-        // Per-writer temporary name: a fixed one would let two processes write into
-        // the same file at once. With a private temporary plus an atomic rename a
-        // reader can never observe a half-written file — the residual risk of
-        // concurrent writers is a lost update, not a corrupt state.
+        // Per-writer temporary name plus atomic rename keeps readers from observing
+        // a half-written file. Mutations are serialized by the cross-process lock,
+        // so this write also cannot overwrite another process's newer state.
         const tmp = `${this.statePath}.tmp-${process.pid}-${this.tmpCounter++}`;
         try {
             fs.writeFileSync(tmp, JSON.stringify(this.state, null, 2), { mode: 0o600 });
@@ -332,12 +452,9 @@ export class AuthStore {
     }
     /** Deleting the record is the revocation: verification refuses unknown ids. */
     revokeApiToken(id) {
-        // reloadIfChanged() before the existence check, so revoking a token another
-        // process minted seconds ago reports true instead of "no such id".
-        this.reloadIfChanged();
-        if (!this.state.apiTokens[id])
-            return false;
         return this.mutate(() => {
+            if (!this.state.apiTokens[id])
+                return false;
             delete this.state.apiTokens[id];
             return true;
         });

package/dist/auth/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8C7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,SAAS;IACX,UAAU,CAAmB;IAC7B,SAAS,CAAmB;IAC7B,KAAK,CAAiB;IACb,SAAS,CAAS;IACnC,qFAAqF;IAC7E,SAAS,CAAU;IACnB,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,OAAe;QACzB,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC7D,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEzD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,KAAK,GAAG,QAAQ,IAAI;YACvB,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC1D,OAAO,EAAE,EAAE;YACX,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;YACb,qBAAqB,EAAE,EAAE;YACzB,aAAa,EAAE,EAAE;YACjB,SAAS,EAAE,EAAE;SACd,CAAC;QACF,IAAI,QAAQ;YAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IAED;;;;;;OAMG;IACK,aAAa;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACpE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uEAAwE,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,MAAM,CAAI,EAAW;QAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAS,CAAC,MAAe;QACtC,MAAM,KAAK,GAAG,MAA+B,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpG,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;YAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;YACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,SAAiB;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,GAAG,SAAS,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CACX,iCAAkC,KAAe,CAAC,OAAO,eAAe,MAAM,uCAAuC,CACtH,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,4EAA4E;QAC5E,0EAA0E;QAC1E,sEAAsE;QACtE,4DAA4D;QAC5D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC9E,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,WAAW;QACT,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,MAAkC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;YAC9C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC,EAAE,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;4EACwE;IACxE,YAAY,CAAC,QAAgB,EAAE,WAAmB,EAAE,UAAmB;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACtG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBAC/B,YAAY;gBACZ,UAAU,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU;gBAC9C,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aAClE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBACtC,aAAa,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC;YACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,KAAa;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,MAA0B;QACxD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,KAAa,EAAE,QAAgB,EAAE,SAAiB;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBACtC,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,MAAsB;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,EAAU;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,EAAU;QACvB,4EAA4E;QAC5E,mEAAmE;QACnE,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/auth/store.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8C7B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAC1C,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;AAE3D;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,SAAS;IACX,UAAU,CAAmB;IAC7B,SAAS,CAAmB;IAC7B,KAAK,CAAiB;IACb,SAAS,CAAS;IAClB,QAAQ,CAAS;IAClC,qFAAqF;IAC7E,SAAS,CAAU;IACnB,UAAU,GAAG,CAAC,CAAC;IAEvB,YAAY,OAAe;QACzB,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;gBAC7D,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEzD,MAAM,QAAQ,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,CAAC,KAAK,GAAG,QAAQ,IAAI;gBACvB,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAC1D,OAAO,EAAE,EAAE;gBACX,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,EAAE;gBACb,qBAAqB,EAAE,EAAE;gBACzB,aAAa,EAAE,EAAE;gBACjB,SAAS,EAAE,EAAE;aACd,CAAC;YACF,IAAI,QAAQ;gBAAE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;;gBAC/C,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED,qEAAqE;IAC7D,WAAW;QACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAC3C,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7C,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YACtE,CAAC;YACD,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACK,eAAe;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,OAAO;wBAAE,OAAO;gBAChE,CAAC;YACH,CAAC;iBAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,aAAa,EAAE,CAAC;gBACtD,OAAO;YACT,CAAC;YACD,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,YAAY;QAClB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,+CAAgD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,aAAa;QACnB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC,SAAS;YAAE,OAAO;QACpE,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,uEAAwE,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,CAAC,KAAK,CAAC,kFAAkF,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,MAAM,CAAI,EAAW;QAC3B,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,IAAI,CAAC,eAAe,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,eAAe;QACrB,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;gBAC5F,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,OAAO;YACT,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,6DAA8D,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAS,CAAC,MAAe;QACtC,MAAM,KAAK,GAAG,MAA+B,CAAC;QAC9C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACpG,OAAO;YACL,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;YAC5B,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;YAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,IAAI,EAAE;YACxD,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,EAAE;YACxC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;SACjC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,SAAiB;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YACvF,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC3D,OAAO,UAAU,CAAC;QACpB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,GAAG,SAAS,YAAY,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACpD,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,CAAC,KAAK,CACX,iCAAkC,KAAe,CAAC,OAAO,eAAe,MAAM,uCAAuC,CACtH,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,4EAA4E;QAC5E,2EAA2E;QAC3E,qEAAqE;QACrE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACxE,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChC,MAAM,KAAK,CAAC;QACd,CAAC;QACD,2EAA2E;QAC3E,2EAA2E;QAC3E,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACxC,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACtE,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC9E,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC5E,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAChE,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,IAAI,YAAY;QACd,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;IACjC,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED,WAAW;QACT,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,UAAU,CAAC,MAAkC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;YAC9C,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,sBAAsB;QAC5B,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;aACjD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;aAC/C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC,EAAE,EAAE,CAAC;YACpE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,WAAW,CAAC,QAAgB;QAC1B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED;4EACwE;IACxE,YAAY,CAAC,QAAgB,EAAE,WAAmB,EAAE,UAAmB;QACrE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAChD,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;YACtG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG;gBAC/B,YAAY;gBACZ,UAAU,EAAE,UAAU,IAAI,QAAQ,EAAE,UAAU;gBAC9C,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;aAClE,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,cAAc,CAAC,QAAgB;QAC7B,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,QAAgB;QAC/B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,QAAgB;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBACtC,aAAa,EAAE,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,aAAa,CAAC;YACnD,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM,CAAC,IAAI,CAAC,KAAa;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAED,gBAAgB,CAAC,KAAa,EAAE,MAA0B;QACxD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,CAAC;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAED,eAAe,CAAC,KAAa;QAC3B,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,KAAa;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,KAAa,EAAE,QAAgB,EAAE,SAAiB;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;QACpF,CAAC,CAAC,CAAC;IACL,CAAC;IAED,WAAW,CAAC,KAAa;QACvB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,+EAA+E;IAC/E,YAAY,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,IAAI,OAAO,GAAG,CAAC,CAAC;YAChB,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;gBACtE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;oBACtC,OAAO,EAAE,CAAC;gBACZ,CAAC;YACH,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,YAAY,CAAC,EAAU,EAAE,MAAsB;QAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC;QACpC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,+EAA+E;IAC/E,WAAW,CAAC,EAAU;QACpB,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACjF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,aAAa;QACX,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IAED,+EAA+E;IAC/E,cAAc,CAAC,EAAU;QACvB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/config.js

@@ -4,6 +4,13 @@ import path from 'node:path';
 const NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
 const RESERVED_NAMES = new Set(['mcp', 'hub', 'authorize', 'token', 'register', 'login', 'consent', 'health', 'livez', 'revoke', '.well-known']);
 const REMOTE_TYPES = new Set(['http', 'sse', 'streamable-http', 'streamable_http']);
+const SECRETS_NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+const VOLUME_SOURCE_PATTERN = /^(?:\/[^:]*|[a-zA-Z0-9][a-zA-Z0-9_.-]*)$/;
+const PORT_PATTERN = /^(?:(\d{1,3}(?:\.\d{1,3}){3}):)?(\d{1,5}):(\d{1,5})(?:\/(tcp|udp))?$/;
+const MEMORY_PATTERN = /^(\d+)([bkmg])?$/i;
+export const DEFAULT_DOCKER_MEMORY = 512 * 1024 * 1024;
+export const DEFAULT_DOCKER_PIDS_LIMIT = 256;
+export const DEFAULT_DOCKER_CPUS = 1;
 export class ConfigError extends Error {
 }
 /** Expand ${VAR} references from the process environment, like Claude Code does. */
@@ -16,10 +23,177 @@ export function expandEnvVars(value, env = process.env) {
         return replacement;
     });
 }
-function expandRecord(record, env) {
-    return Object.fromEntries(Object.entries(record).map(([k, v]) => [k, expandEnvVars(v, env)]));
+function expanderFor(env, options) {
+    if (options?.expand === false)
+        return value => value;
+    return value => expandEnvVars(value, env);
 }
-function parseServer(name, entry, env) {
+function expandRecord(record, expand) {
+    return Object.fromEntries(Object.entries(record).map(([k, v]) => [k, expand(v)]));
+}
+function requireStringArray(name, field, value) {
+    if (!Array.isArray(value) || !value.every(v => typeof v === 'string')) {
+        throw new ConfigError(`Server "${name}": "${field}" must be an array of strings`);
+    }
+    return value;
+}
+function requireStringRecord(name, field, value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value) || !Object.values(value).every(v => typeof v === 'string')) {
+        throw new ConfigError(`Server "${name}": "${field}" must be an object of string values`);
+    }
+    return value;
+}
+/** "512m" / "1g" / "1048576" -> bytes. */
+export function parseMemory(name, value) {
+    if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value) || value <= 0)
+            throw new ConfigError(`Server "${name}": "memory" must be a positive integer`);
+        return value;
+    }
+    if (typeof value !== 'string')
+        throw new ConfigError(`Server "${name}": "memory" must be a string like "512m" or a byte count`);
+    const match = MEMORY_PATTERN.exec(value.trim());
+    if (!match)
+        throw new ConfigError(`Server "${name}": "memory" must look like "512m", "1g" or a byte count`);
+    const factor = { b: 1, k: 1024, m: 1024 ** 2, g: 1024 ** 3 }[(match[2] ?? 'b').toLowerCase()];
+    const bytes = Number(match[1]) * factor;
+    if (bytes <= 0 || !Number.isSafeInteger(bytes))
+        throw new ConfigError(`Server "${name}": "memory" is out of range`);
+    return bytes;
+}
+/**
+ * Everything the docker proxy validates has to be spelled out literally.
+ *
+ * The proxy derives the container it will allow from this very config, but it
+ * deliberately does not hold the hub's environment — a `${VAR}` in the image
+ * name or a bind mount would be a field it could not check, which is exactly
+ * the field an attacker would choose. Only `env` values, which the proxy
+ * compares by key and never by value, may be substituted.
+ */
+function requireLiteral(name, field, value) {
+    if (value.includes('${')) {
+        throw new ConfigError(`Server "${name}": "${field}" must not use \${VAR} — only "env" values are substituted for docker servers`);
+    }
+    return value;
+}
+function parseDockerServer(name, entry, expand, hub) {
+    if (entry.command !== undefined && !Array.isArray(entry.command)) {
+        throw new ConfigError(`Server "${name}": for docker servers "command" is an array of strings (the container's Cmd)`);
+    }
+    if (typeof entry.image !== 'string' || entry.image.length === 0) {
+        throw new ConfigError(`Server "${name}": docker servers need an "image" string`);
+    }
+    const pull = entry.pull ?? 'never';
+    if (pull !== 'never' && pull !== 'missing') {
+        throw new ConfigError(`Server "${name}": "pull" must be "never" or "missing"`);
+    }
+    const secretsFrom = entry.secretsFrom;
+    if (secretsFrom !== undefined && (typeof secretsFrom !== 'string' || !SECRETS_NAME_PATTERN.test(secretsFrom))) {
+        throw new ConfigError(`Server "${name}": "secretsFrom" must be a name matching ${SECRETS_NAME_PATTERN}`);
+    }
+    const volumes = requireStringArray(name, 'volumes', entry.volumes ?? []).map(v => requireLiteral(name, 'volumes', v));
+    for (const volume of volumes) {
+        const parts = volume.split(':');
+        if (parts.length < 2 || parts.length > 3) {
+            throw new ConfigError(`Server "${name}": volume "${volume}" must look like "source:/target" or "source:/target:ro"`);
+        }
+        if (!VOLUME_SOURCE_PATTERN.test(parts[0]) || parts[0].includes('..')) {
+            throw new ConfigError(`Server "${name}": volume source "${parts[0]}" must be an absolute path without ".." or a named volume`);
+        }
+        if (!parts[1].startsWith('/'))
+            throw new ConfigError(`Server "${name}": volume target "${parts[1]}" must be an absolute path`);
+        if (parts[2] !== undefined && parts[2] !== 'ro' && parts[2] !== 'rw') {
+            throw new ConfigError(`Server "${name}": volume mode "${parts[2]}" must be "ro" or "rw"`);
+        }
+    }
+    const ports = requireStringArray(name, 'ports', entry.ports ?? []).map(v => requireLiteral(name, 'ports', v));
+    for (const port of ports) {
+        const match = PORT_PATTERN.exec(port);
+        if (!match)
+            throw new ConfigError(`Server "${name}": port "${port}" must look like "127.0.0.1:8686:8000" or "8686:8000"`);
+        for (const value of [match[2], match[3]]) {
+            const number = Number(value);
+            if (number < 1 || number > 65535)
+                throw new ConfigError(`Server "${name}": port "${port}" is out of range`);
+        }
+    }
+    const network = entry.network === undefined ? 'none' : entry.network;
+    if (typeof network !== 'string' || network.length === 0)
+        throw new ConfigError(`Server "${name}": "network" must be a string`);
+    if (ports.length > 0 && network === 'none') {
+        // Published ports on a container without a network silently do nothing;
+        // saying so here beats a sandbox that looks reachable and is not.
+        throw new ConfigError(`Server "${name}": "ports" need a network, but "network" is "none"`);
+    }
+    const tmpfs = requireStringArray(name, 'tmpfs', entry.tmpfs ?? ['/tmp']).map(v => requireLiteral(name, 'tmpfs', v));
+    for (const mount of tmpfs) {
+        if (!mount.startsWith('/'))
+            throw new ConfigError(`Server "${name}": tmpfs "${mount}" must be an absolute path`);
+    }
+    if (entry.readOnly !== undefined && typeof entry.readOnly !== 'boolean') {
+        throw new ConfigError(`Server "${name}": "readOnly" must be a boolean`);
+    }
+    if (entry.user !== undefined && typeof entry.user !== 'string') {
+        throw new ConfigError(`Server "${name}": "user" must be a string`);
+    }
+    if (entry.pidsLimit !== undefined && (!Number.isSafeInteger(entry.pidsLimit) || entry.pidsLimit < 1)) {
+        throw new ConfigError(`Server "${name}": "pidsLimit" must be a positive integer`);
+    }
+    if (entry.cpus !== undefined &&
+        (typeof entry.cpus !== 'number' ||
+            !Number.isFinite(entry.cpus) ||
+            entry.cpus <= 0 ||
+            !Number.isSafeInteger(Math.round(entry.cpus * 1_000_000_000)))) {
+        throw new ConfigError(`Server "${name}": "cpus" must be a positive number`);
+    }
+    for (const forbidden of ['privileged', 'capAdd', 'securityOpt', 'devices', 'restart']) {
+        if (entry[forbidden] !== undefined) {
+            throw new ConfigError(`Server "${name}": "${forbidden}" is not supported — sandboxes always run with all capabilities dropped, no-new-privileges and no restart policy`);
+        }
+    }
+    return {
+        kind: 'docker',
+        image: requireLiteral(name, 'image', entry.image),
+        pull,
+        ...(entry.command !== undefined ? { command: requireStringArray(name, 'command', entry.command).map(v => requireLiteral(name, 'command', v)) } : {}),
+        ...(entry.entrypoint !== undefined
+            ? { entrypoint: requireStringArray(name, 'entrypoint', entry.entrypoint).map(v => requireLiteral(name, 'entrypoint', v)) }
+            : {}),
+        env: expandRecord(requireStringRecord(name, 'env', entry.env ?? {}), expand),
+        ...(secretsFrom !== undefined ? { secretsFrom } : {}),
+        volumes,
+        ports,
+        network: requireLiteral(name, 'network', network),
+        memory: entry.memory !== undefined ? parseMemory(name, entry.memory) : DEFAULT_DOCKER_MEMORY,
+        pidsLimit: entry.pidsLimit !== undefined ? entry.pidsLimit : DEFAULT_DOCKER_PIDS_LIMIT,
+        cpus: entry.cpus !== undefined ? entry.cpus : DEFAULT_DOCKER_CPUS,
+        readOnly: entry.readOnly !== false,
+        tmpfs,
+        ...(entry.user !== undefined ? { user: requireLiteral(name, 'user', entry.user) } : {}),
+        hub
+    };
+}
+function parseSocketServer(name, entry, type, expand, hub) {
+    if (entry.command !== undefined || entry.url !== undefined) {
+        throw new ConfigError(`Server "${name}": "${type}" servers take a socket address, not "command" or "url"`);
+    }
+    if (type === 'unix') {
+        if (typeof entry.socket !== 'string' || !entry.socket.startsWith('/')) {
+            throw new ConfigError(`Server "${name}": unix servers need a "socket" path starting with "/"`);
+        }
+        return { kind: 'socket', transport: 'unix', socketPath: expand(entry.socket), hub };
+    }
+    if (typeof entry.host !== 'string' || entry.host.length === 0) {
+        throw new ConfigError(`Server "${name}": tcp servers need a "host" string`);
+    }
+    const port = entry.port;
+    if (!Number.isSafeInteger(port) || port < 1 || port > 65535) {
+        throw new ConfigError(`Server "${name}": tcp servers need a "port" between 1 and 65535`);
+    }
+    return { kind: 'socket', transport: 'tcp', host: expand(entry.host), port: port, hub };
+}
+function parseServer(name, entry, env, options) {
+    const expand = expanderFor(env, options);
     const hub = entry.hub !== false;
     if (entry.hub !== undefined && typeof entry.hub !== 'boolean') {
         throw new ConfigError(`Server "${name}": "hub" must be a boolean`);
@@ -28,10 +202,14 @@ function parseServer(name, entry, env) {
     if (type !== undefined && typeof type !== 'string') {
         throw new ConfigError(`Server "${name}": "type" must be a string`);
     }
+    if (type === 'docker')
+        return parseDockerServer(name, entry, expand, hub);
+    if (type === 'unix' || type === 'tcp')
+        return parseSocketServer(name, entry, type, expand, hub);
     const isRemote = (typeof type === 'string' && type !== 'stdio') || entry.url !== undefined;
     if (isRemote) {
         if (typeof type === 'string' && type !== 'stdio' && !REMOTE_TYPES.has(type)) {
-            throw new ConfigError(`Server "${name}": unknown type "${type}" (supported: stdio, http, sse)`);
+            throw new ConfigError(`Server "${name}": unknown type "${type}" (supported: stdio, http, sse, docker, unix, tcp)`);
         }
         if (typeof entry.url !== 'string' || entry.url.length === 0) {
             throw new ConfigError(`Server "${name}": remote servers need a "url" string`);
@@ -39,11 +217,8 @@ function parseServer(name, entry, env) {
         if (entry.command !== undefined) {
             throw new ConfigError(`Server "${name}": "command" and "url" are mutually exclusive`);
         }
-        const headers = entry.headers ?? {};
-        if (typeof headers !== 'object' || headers === null || Array.isArray(headers) || !Object.values(headers).every(v => typeof v === 'string')) {
-            throw new ConfigError(`Server "${name}": "headers" must be an object of string values`);
-        }
-        const url = expandEnvVars(entry.url, env);
+        const headers = requireStringRecord(name, 'headers', entry.headers ?? {});
+        const url = expand(entry.url);
         try {
             new URL(url);
         }
@@ -54,30 +229,24 @@ function parseServer(name, entry, env) {
             kind: 'remote',
             transport: type === 'sse' ? 'sse' : 'http',
             url,
-            headers: expandRecord(headers, env),
+            headers: expandRecord(headers, expand),
             hub
         };
     }
     if (typeof entry.command !== 'string' || entry.command.length === 0) {
         throw new ConfigError(`Server "${name}" is missing a "command" string`);
     }
-    const args = entry.args ?? [];
-    if (!Array.isArray(args) || !args.every(a => typeof a === 'string')) {
-        throw new ConfigError(`Server "${name}": "args" must be an array of strings`);
-    }
-    const envEntry = entry.env ?? {};
-    if (typeof envEntry !== 'object' || envEntry === null || Array.isArray(envEntry) || !Object.values(envEntry).every(v => typeof v === 'string')) {
-        throw new ConfigError(`Server "${name}": "env" must be an object of string values`);
-    }
+    const args = requireStringArray(name, 'args', entry.args ?? []);
+    const envEntry = requireStringRecord(name, 'env', entry.env ?? {});
     return {
         kind: 'stdio',
-        command: expandEnvVars(entry.command, env),
-        args: args.map(a => expandEnvVars(a, env)),
-        env: expandRecord(envEntry, env),
+        command: expand(entry.command),
+        args: args.map(expand),
+        env: expandRecord(envEntry, expand),
         hub
     };
 }
-export function parseConfig(json, env = process.env) {
+export function parseConfig(json, env = process.env, options) {
     let raw;
     try {
         raw = JSON.parse(json);
@@ -100,12 +269,20 @@ export function parseConfig(json, env = process.env) {
         if (typeof entry !== 'object' || entry === null) {
             throw new ConfigError(`Server "${name}" must be an object`);
         }
-        result.set(name, parseServer(name, entry, env));
+        result.set(name, parseServer(name, entry, env, options));
     }
     return result;
 }
-export function loadConfig(filePath, env = process.env) {
-    return parseConfig(fs.readFileSync(filePath, 'utf8'), env);
+export function loadConfig(filePath, env = process.env, options) {
+    return parseConfig(fs.readFileSync(filePath, 'utf8'), env, options);
+}
+export function warnMutableDockerImages(config, component = 'mcp-hub') {
+    for (const [name, entry] of config) {
+        if (entry.kind !== 'docker' || entry.image.includes('@sha256:'))
+            continue;
+        console.warn(`${component}: docker server "${name}" uses mutable image reference "${entry.image}"; ` +
+            'this is supported for compatibility, but a sha256 digest is strongly recommended');
+    }
 }
 export function diffConfigs(before, after) {
     const added = [...after.keys()].filter(name => !before.has(name));
@@ -126,14 +303,18 @@ export class ConfigWatcher extends EventEmitter {
     current;
     env;
     pollIntervalMs;
+    parseOptions;
+    validate;
     watcher;
     debounce;
-    constructor(filePath, current, env = process.env, pollIntervalMs = 3_000) {
+    constructor(filePath, current, env = process.env, pollIntervalMs = 3_000, parseOptions, validate) {
         super();
         this.filePath = filePath;
         this.current = current;
         this.env = env;
         this.pollIntervalMs = pollIntervalMs;
+        this.parseOptions = parseOptions;
+        this.validate = validate;
     }
     start() {
         const dir = path.dirname(this.filePath);
@@ -159,7 +340,8 @@ export class ConfigWatcher extends EventEmitter {
     reload() {
         let next;
         try {
-            next = loadConfig(this.filePath, this.env);
+            next = loadConfig(this.filePath, this.env, this.parseOptions);
+            this.validate?.(next);
         }
         catch (error) {
             // Keep running with the previous config; a broken edit must not take the hub down.