@ni-c/mcp-hub 0.6.3 → 0.7.0

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA+B7B,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAEpF,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,gDAAgD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,GAAsB;IAC1E,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA8B,EAAE,GAAsB;IACvF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;IAE3F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oBAAoB,IAAI,iCAAiC,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QACpC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC3I,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iDAAiD,CAAC,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAC1C,GAAG;YACH,OAAO,EAAE,YAAY,CAAC,OAAiC,EAAE,GAAG,CAAC;YAC7D,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QAC/I,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6CAA6C,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC;QAC1C,IAAI,EAAG,IAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACxD,GAAG,EAAE,YAAY,CAAC,QAAkC,EAAE,GAAG,CAAC;QAC1D,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC5E,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA+B,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/G,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAI,GAA+D,CAAC,UAAU,CAAC;IAC5F,MAAM,MAAM,GAAc,IAAI,GAAG,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,0BAA0B,YAAY,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7D,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,KAAgB;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IAK1B,QAAQ;IAClB,OAAO;IACG,GAAG;IACH,cAAc;IAPzB,OAAO,CAAgB;IACvB,QAAQ,CAAkB;IAElC,YACmB,QAAgB,EAC1B,OAAkB,EACR,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,cAAc,GAAG,KAAK;QAEvC,KAAK,EAAE,CAAC;wBALS,QAAQ;uBAClB,OAAO;mBACG,GAAG;8BACH,cAAc;IAGjC,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO;YACnD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,sCAAsC;QACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACrE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM;QACZ,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI;QACF,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA2F7B,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACpF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AACzE,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,gDAAgD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD,SAAS,WAAW,CAAC,GAAsB,EAAE,OAAiC;IAC5E,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;IACrD,OAAO,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,MAAgB;IACpE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnI,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,sCAAsC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0DAA0D,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,yDAAyD,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+EAA+E,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,MAAgB,EAAE,GAAY;IACrG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,8EAA8E,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACnC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4CAA4C,oBAAoB,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,cAAc,MAAM,0DAA0D,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC/H,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,mBAAmB,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,uDAAuD,CAAC,CAAC;QAC1H,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,mBAAmB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;IAC/H,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC3C,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,KAAK,CAAC,IAAI,IAAI,CAAC;YACf,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CACnB,WAAW,IAAI,OAAO,SAAS,kHAAkH,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACjD,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpJ,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1H,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO;QACP,KAAK;QACL,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB;QAC5F,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAE,KAAK,CAAC,SAAoB,CAAC,CAAC,CAAC,yBAAyB;QAClG,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,KAAK;QAClC,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,IAAoB,EAAE,MAAgB,EAAE,GAAY;IAC3H,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,IAAI,yDAAyD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wDAAwD,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAK,IAAe,GAAG,CAAC,IAAK,IAAe,GAAG,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,GAAG,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA8B,EAAE,GAAsB,EAAE,OAAsB;IAC/G,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhG,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;IAE3F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oBAAoB,IAAI,oDAAoD,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAC1C,GAAG;YACH,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACtB,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACpG,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA+B,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/G,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAI,GAA+D,CAAC,UAAU,CAAC;IAC5F,MAAM,MAAM,GAAc,IAAI,GAAG,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,0BAA0B,YAAY,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACvG,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,SAAS,GAAG,SAAS;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1E,OAAO,CAAC,IAAI,CACV,GAAG,SAAS,oBAAoB,IAAI,mCAAmC,KAAK,CAAC,KAAK,KAAK;YACrF,kFAAkF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,KAAgB;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IAK1B,QAAQ;IAClB,OAAO;IACG,GAAG;IACH,cAAc;IACd,YAAY;IACZ,QAAQ;IATnB,OAAO,CAAgB;IACvB,QAAQ,CAAkB;IAElC,YACmB,QAAgB,EAC1B,OAAkB,EACR,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,cAAc,GAAG,KAAK,EACtB,YAA2B,EAC3B,QAAsC;QAEvD,KAAK,EAAE,CAAC;wBAPS,QAAQ;uBAClB,OAAO;mBACG,GAAG;8BACH,cAAc;4BACd,YAAY;wBACZ,QAAQ;IAG3B,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO;YACnD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,sCAAsC;QACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACrE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM;QACZ,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI;QACF,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/docker-proxy/index.js

@@ -0,0 +1,106 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { ConfigWatcher, loadConfig, warnMutableDockerImages } from '../config.js';
+import { installFileLogging } from '../logfile.js';
+import { VERSION } from '../version.js';
+import { createDockerProxy } from './server.js';
+import { SecretStore, validateConfigSecrets } from './secrets.js';
+/**
+ * mcp-hub-docker-proxy: the only component that touches /var/run/docker.sock.
+ *
+ * It reads the same mcp.json as the hub — read-only, owned by the host — and
+ * lets through exactly the container operations that file describes. The hub
+ * itself never gets the daemon socket, so a compromise of the internet-facing
+ * component cannot create a privileged container or mount the host filesystem.
+ *
+ * It parses the config with `expand: false`: it holds none of the hub's
+ * secrets and must never need them.
+ */
+function env(name, fallback) {
+    const value = process.env[name];
+    return value === undefined || value.length === 0 ? fallback : value;
+}
+const configPath = env('CONFIG_PATH', '/config/mcp.json');
+const listenSocket = env('LISTEN_SOCKET', '/run/proxy/docker.sock');
+const dockerSocket = env('DOCKER_SOCKET', '/var/run/docker.sock');
+const secretsDir = env('SANDBOX_SECRETS_DIR', '/run/secrets');
+const socketMode = Number.parseInt(env('SOCKET_MODE', '0660'), 8);
+if (process.env.LOG_FILE) {
+    installFileLogging(process.env.LOG_FILE);
+}
+let config;
+try {
+    config = loadConfig(configPath, process.env, { expand: false });
+}
+catch (error) {
+    console.error(`mcp-hub-docker-proxy: cannot read ${configPath}: ${error.message}`);
+    process.exit(1);
+}
+// Fail loudly at startup rather than at the first create: a missing or
+// world-readable secret file is an operator mistake, and finding out about it
+// when a sandbox refuses to start is finding out too late.
+const secrets = new SecretStore(secretsDir);
+try {
+    validateConfigSecrets(config, secrets);
+}
+catch (error) {
+    console.error(`mcp-hub-docker-proxy: invalid sandbox secrets: ${error.message}`);
+    process.exit(1);
+}
+warnMutableDockerImages(config, 'mcp-hub-docker-proxy');
+for (const [name, entry] of config) {
+    if (entry.kind !== 'docker' || entry.secretsFrom === undefined)
+        continue;
+    const keys = Object.keys(secrets.load(entry.secretsFrom));
+    console.log(`mcp-hub-docker-proxy: ${name} gets ${keys.length} variable(s) from ${entry.secretsFrom}.env`);
+}
+const watcher = new ConfigWatcher(configPath, config, process.env, 3_000, { expand: false }, next => validateConfigSecrets(next, secrets));
+watcher.on('change', (_next, diff) => {
+    warnMutableDockerImages(_next, 'mcp-hub-docker-proxy');
+    console.log(`mcp-hub-docker-proxy: policy reloaded (added: ${diff.added.join(',') || '-'} removed: ${diff.removed.join(',') || '-'} changed: ${diff.changed.join(',') || '-'})`);
+});
+watcher.on('error', error => console.error(`mcp-hub-docker-proxy: ignoring broken config update: ${error.message}`));
+watcher.start();
+const server = createDockerProxy({ dockerSocket, config: () => watcher.current, secretsDir });
+// A leftover socket file from an unclean exit would make listen() fail with
+// EADDRINUSE forever; there is no other writer for this path.
+try {
+    const existing = fs.statSync(listenSocket);
+    if (existing.isSocket())
+        fs.unlinkSync(listenSocket);
+}
+catch {
+    // Nothing there, which is the normal case.
+}
+fs.mkdirSync(path.dirname(listenSocket), { recursive: true });
+server.listen(listenSocket, () => {
+    // The hub connects as a different user, so the socket needs group access —
+    // and must not be world-writable, which would hand the policy to anyone on
+    // the host with a shell. (Connecting to a Unix socket requires write
+    // permission on it, so the mode is the access control.)
+    fs.chmodSync(listenSocket, socketMode);
+    if (socketMode & 0o002) {
+        console.warn(`mcp-hub-docker-proxy: SOCKET_MODE ${socketMode.toString(8)} is world-writable — anything on this host can drive the sandbox API`);
+    }
+    const dockerServers = [...watcher.current.values()].filter(entry => entry.kind === 'docker').length;
+    console.log(`mcp-hub-docker-proxy ${VERSION} listening on ${listenSocket} -> ${dockerSocket} (${dockerServers} sandbox server(s))`);
+});
+const shutdown = (signal) => {
+    console.log(`mcp-hub-docker-proxy: received ${signal}, shutting down`);
+    watcher.stop();
+    server.close();
+    try {
+        fs.unlinkSync(listenSocket);
+    }
+    catch {
+        // Already gone.
+    }
+    process.exit(0);
+};
+process.on('SIGTERM', () => shutdown('SIGTERM'));
+process.on('SIGINT', () => shutdown('SIGINT'));
+process.on('unhandledRejection', reason => {
+    console.error(`mcp-hub-docker-proxy: unhandled rejection: ${reason instanceof Error ? (reason.stack ?? reason.message) : String(reason)}`);
+});
+//# sourceMappingURL=index.js.map

package/dist/docker-proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/docker-proxy/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAkB,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;GAUG;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAElE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,MAAiB,CAAC;AACtB,IAAI,CAAC;IACH,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,kDAAmD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS,IAAI,CAAC,MAAM,qBAAqB,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3I,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnC,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CACpK,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,EAAE,CAAC;AAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAAC,MAAM,CAAC;IACP,2CAA2C;AAC7C,CAAC;AACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,iBAAiB,YAAY,OAAO,YAAY,KAAK,aAAa,qBAAqB,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,iBAAiB,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;IACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC"}

package/dist/docker-proxy/policy.js

@@ -0,0 +1,278 @@
+import { buildCreateRequest, containerName, serverNameFromContainer, OWNER_LABEL, OWNER_VALUE } from '../sandbox/container-spec.js';
+import { splitImageRef } from '../sandbox/docker-client.js';
+const API_PREFIX = /^\/v\d+\.\d+(?=\/)/;
+/** Control characters would let a caller forge lines in a log fail2ban reads. */
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+const SANDBOX_ID = /^mcp-sandbox-[a-zA-Z0-9_-]+$/;
+const MAX_ENV_ENTRIES = 200;
+function deny(reason, status = 403) {
+    return { allow: false, status, reason: reason.replace(CONTROL_CHARACTERS, '?') };
+}
+function dockerServers(config) {
+    const result = new Map();
+    for (const [name, entry] of config)
+        if (entry.kind === 'docker')
+            result.set(name, entry);
+    return result;
+}
+/**
+ * Structural equality with one exception: `Env` values.
+ *
+ * The proxy parses mcp.json without expanding `${VAR}` — it holds none of the
+ * hub's secrets and must not need them. Every other field is required to be
+ * literal in the config (parseConfig enforces that), so everything else is
+ * compared byte for byte.
+ */
+export function diffCreateBody(expected, actual, path = '') {
+    if (expected === null || typeof expected !== 'object') {
+        return Object.is(expected, actual) ? undefined : `${path || 'body'}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`;
+    }
+    if (Array.isArray(expected)) {
+        if (!Array.isArray(actual))
+            return `${path}: expected an array`;
+        if (expected.length !== actual.length)
+            return `${path}: expected ${expected.length} entries, got ${actual.length}`;
+        for (const [index, value] of expected.entries()) {
+            const mismatch = diffCreateBody(value, actual[index], `${path}[${index}]`);
+            if (mismatch)
+                return mismatch;
+        }
+        return undefined;
+    }
+    if (actual === null || typeof actual !== 'object' || Array.isArray(actual))
+        return `${path || 'body'}: expected an object`;
+    const expectedRecord = expected;
+    const actualRecord = actual;
+    // hasOwn, not `in`: `in` walks the prototype chain, so a body carrying
+    // "toString" or "constructor" would not register as an extra field. It would
+    // still be caught when its value is compared, but "not allowed" is the right
+    // answer and default-deny should not depend on a second line of defence.
+    const extra = Object.keys(actualRecord).find(key => !Object.hasOwn(expectedRecord, key));
+    if (extra !== undefined)
+        return `${path}.${extra}: not allowed`;
+    for (const [key, value] of Object.entries(expectedRecord)) {
+        const mismatch = diffCreateBody(value, actualRecord[key], `${path}.${key}`);
+        if (mismatch)
+            return mismatch;
+    }
+    return undefined;
+}
+function envKeys(entries, label) {
+    if (!Array.isArray(entries) || !entries.every(entry => typeof entry === 'string'))
+        return { error: `${label} must be an array of strings` };
+    if (entries.length > MAX_ENV_ENTRIES)
+        return { error: `${label} has more than ${MAX_ENV_ENTRIES} entries` };
+    const keys = [];
+    for (const entry of entries) {
+        const separator = entry.indexOf('=');
+        if (separator <= 0)
+            return { error: `${label} entry is not KEY=VALUE` };
+        keys.push(entry.slice(0, separator));
+    }
+    if (new Set(keys).size !== keys.length)
+        return { error: `${label} contains duplicate keys` };
+    return { keys };
+}
+/**
+ * Denials that hold no matter what the configuration says.
+ *
+ * The structural comparison above already rejects all of these — every one of
+ * them is either an extra field or a changed value. They are checked again
+ * anyway, and first: a bug in the derivation must not silently turn into a
+ * host takeover, and a proxy that says "Privileged is never allowed" is a
+ * clearer promise than one that says "your body did not match".
+ */
+export function hardDenials(body) {
+    const host = (body.HostConfig ?? {});
+    if (host.Privileged === true)
+        return 'Privileged containers are never allowed';
+    if (Array.isArray(host.CapAdd) && host.CapAdd.length > 0)
+        return 'CapAdd is never allowed';
+    if (Array.isArray(host.Devices) && host.Devices.length > 0)
+        return 'Devices are never allowed';
+    if (host.Mounts !== undefined)
+        return 'Mounts are never allowed (use "volumes" in the config, which becomes Binds)';
+    if (host.UsernsMode === 'host')
+        return 'UsernsMode=host is never allowed';
+    for (const field of ['PidMode', 'IpcMode', 'UTSMode', 'CgroupnsMode', 'NetworkMode']) {
+        if (host[field] === 'host')
+            return `${field}=host is never allowed`;
+    }
+    if (typeof host.NetworkMode === 'string' && host.NetworkMode.startsWith('container:')) {
+        return 'joining another container\'s network namespace is never allowed';
+    }
+    const binds = Array.isArray(host.Binds) ? host.Binds : [];
+    for (const bind of binds) {
+        if (typeof bind !== 'string')
+            return 'Binds must be strings';
+        const source = bind.split(':')[0];
+        if (source.includes('..'))
+            return `bind source "${source}" contains ".."`;
+        if (!source.startsWith('/'))
+            continue; // named volume
+        const normalized = source.replace(/\/+$/, '') || '/';
+        for (const forbidden of ['/', '/proc', '/sys', '/dev', '/etc', '/boot', '/root', '/var/run', '/run', '/var/lib/docker']) {
+            if (normalized === forbidden || normalized.startsWith(`${forbidden}/`))
+                return `bind source "${source}" is inside ${forbidden}`;
+        }
+    }
+    if (host.Privileged !== false)
+        return 'HostConfig.Privileged must be present and false';
+    return undefined;
+}
+function authorizeCreate(url, body, context, version) {
+    const requested = url.searchParams.get('name');
+    if (requested === null)
+        return deny('containers must be created with an explicit ?name=');
+    if ([...url.searchParams.keys()].some(key => key !== 'name'))
+        return deny('only ?name= is allowed on create');
+    const server = serverNameFromContainer(requested);
+    if (server === undefined)
+        return deny(`container name "${requested}" is outside the mcp-sandbox- namespace`);
+    const config = dockerServers(context.config).get(server);
+    if (!config)
+        return deny(`"${server}" is not a docker server in the configuration`);
+    if (body === null || typeof body !== 'object' || Array.isArray(body))
+        return deny('create needs a JSON object body', 400);
+    const actual = body;
+    const forbidden = hardDenials(actual);
+    if (forbidden)
+        return deny(forbidden);
+    const expected = buildCreateRequest(server, config).body;
+    const actualEnv = envKeys(actual.Env, 'Env');
+    if ('error' in actualEnv)
+        return deny(actualEnv.error, 400);
+    const expectedKeys = Object.keys(config.env);
+    if (actualEnv.keys.length !== expectedKeys.length || actualEnv.keys.some(key => !expectedKeys.includes(key))) {
+        return deny(`Env keys do not match the configuration (allowed: ${expectedKeys.join(', ') || 'none'})`);
+    }
+    const mismatch = diffCreateBody({ ...expected, Env: null }, { ...actual, Env: null });
+    if (mismatch)
+        return deny(`create request does not match the configuration — ${mismatch}`);
+    // Only now, on a request that is already known-good, are the secrets added.
+    const injected = [];
+    if (config.secretsFrom !== undefined) {
+        let secrets;
+        try {
+            secrets = context.secrets.load(config.secretsFrom);
+        }
+        catch (error) {
+            return deny(`cannot inject secrets for "${server}": ${error.message}`, 500);
+        }
+        for (const [key, value] of Object.entries(secrets)) {
+            if (expectedKeys.includes(key))
+                return deny(`secret "${key}" collides with an env key of server "${server}"`, 500);
+            injected.push(`${key}=${value}`);
+        }
+    }
+    return {
+        allow: true,
+        method: 'POST',
+        path: `${version}/containers/create?name=${encodeURIComponent(containerName(server))}`,
+        // Env values come from the hub — it holds the ${VAR} expansions and this
+        // proxy deliberately does not — but only under keys the config names, and
+        // followed by the secrets only this proxy can read. Every other field is
+        // taken from `expected`, so what reaches the daemon is this proxy's own
+        // serialization of the configuration, not the bytes the hub sent.
+        body: { ...expected, Env: [...actual.Env, ...injected] }
+    };
+}
+/**
+ * Decide one request.
+ *
+ * The returned path is rebuilt from scratch, never forwarded verbatim: a
+ * canonical request is immune to anything hidden in duplicate query
+ * parameters, odd encodings or extra JSON keys.
+ */
+export function authorize(method, rawUrl, body, context) {
+    let url;
+    try {
+        url = new URL(rawUrl, 'http://docker');
+    }
+    catch {
+        return deny('unparseable request URL', 400);
+    }
+    // The caller pins an API version it was written against; keep it on the way
+    // out so the daemon does not silently answer a newer dialect than the client
+    // expects. The pattern itself is the only thing trusted from it.
+    const version = API_PREFIX.exec(url.pathname)?.[0] ?? '';
+    const path = url.pathname.slice(version.length);
+    const servers = dockerServers(context.config);
+    if (method === 'GET' && (path === '/_ping' || path === '/version')) {
+        return { allow: true, method, path: `${version}${path}` };
+    }
+    if (method === 'HEAD' && path === '/_ping') {
+        return { allow: true, method, path: `${version}${path}` };
+    }
+    if (method === 'POST' && path === '/containers/create') {
+        return authorizeCreate(url, body, context, version);
+    }
+    const containerAction = /^\/containers\/([^/]+)\/(start|stop|wait|attach)$/.exec(path);
+    if (containerAction) {
+        const id = decodeURIComponent(containerAction[1]);
+        const action = containerAction[2];
+        if (method !== 'POST')
+            return deny(`${method} is not allowed on ${path}`);
+        if (!SANDBOX_ID.test(id))
+            return deny(`container "${id}" is outside the mcp-sandbox- namespace`);
+        const server = serverNameFromContainer(id);
+        // Stopping and waiting must keep working for a server that was just
+        // removed from the config — that is how the hub cleans up after itself.
+        if ((action === 'start' || action === 'attach') && !servers.has(server)) {
+            return deny(`"${server}" is not a docker server in the configuration`);
+        }
+        if (action === 'attach') {
+            return {
+                allow: true,
+                method,
+                path: `${version}/containers/${encodeURIComponent(id)}/attach?stream=1&stdin=1&stdout=1&stderr=1`,
+                upgrade: true,
+                container: { id, server }
+            };
+        }
+        return { allow: true, method, path: `${version}/containers/${encodeURIComponent(id)}/${action}`, container: { id, server } };
+    }
+    const containerDelete = /^\/containers\/([^/]+)$/.exec(path);
+    if (containerDelete && method === 'DELETE') {
+        const id = decodeURIComponent(containerDelete[1]);
+        if (!SANDBOX_ID.test(id))
+            return deny(`container "${id}" is outside the mcp-sandbox- namespace`);
+        return {
+            allow: true,
+            method,
+            path: `${version}/containers/${encodeURIComponent(id)}?force=1&v=0`,
+            container: { id, server: serverNameFromContainer(id) }
+        };
+    }
+    if (method === 'GET' && path === '/containers/json') {
+        // Rebuilt with our own filter: listing every container on the host would
+        // be an information leak, and the hub only ever wants its own.
+        const filters = JSON.stringify({ label: [`${OWNER_LABEL}=${OWNER_VALUE}`] });
+        return { allow: true, method, path: `${version}/containers/json?all=1&filters=${encodeURIComponent(filters)}` };
+    }
+    const imageInspect = /^\/images\/(.+)\/json$/.exec(path);
+    if (imageInspect && method === 'GET') {
+        const ref = decodeURIComponent(imageInspect[1]);
+        if (![...servers.values()].some(server => server.image === ref))
+            return deny(`image "${ref}" is not used by any configured server`);
+        return { allow: true, method, path: `${version}/images/${encodeURIComponent(ref)}/json` };
+    }
+    if (method === 'POST' && path === '/images/create') {
+        const fromImage = url.searchParams.get('fromImage') ?? '';
+        const tag = url.searchParams.get('tag') ?? '';
+        const pullable = [...servers.values()].filter(server => server.pull === 'missing');
+        const match = pullable.find(server => {
+            const split = splitImageRef(server.image);
+            return split.fromImage === fromImage && split.tag === tag;
+        });
+        if (!match)
+            return deny(`pulling "${fromImage}:${tag}" is not allowed (no configured server has it with "pull": "missing")`);
+        return {
+            allow: true,
+            method,
+            path: `${version}/images/create?fromImage=${encodeURIComponent(fromImage)}&tag=${encodeURIComponent(tag)}`
+        };
+    }
+    return deny(`${method} ${path} is not allowed`);
+}
+//# sourceMappingURL=policy.js.map

package/dist/docker-proxy/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/docker-proxy/policy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,uBAAuB,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACpI,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAuC5D,MAAM,UAAU,GAAG,oBAAoB,CAAC;AACxC,iFAAiF;AACjF,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AACpD,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAClD,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,SAAS,IAAI,CAAC,MAAc,EAAE,MAAM,GAAG,GAAG;IACxC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM;QAAE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAiB,EAAE,MAAe,EAAE,IAAI,GAAG,EAAE;IAC1E,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,MAAM,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5I,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,GAAG,IAAI,qBAAqB,CAAC;QAChE,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAAE,OAAO,GAAG,IAAI,cAAc,QAAQ,CAAC,MAAM,iBAAiB,MAAM,CAAC,MAAM,EAAE,CAAC;QACnH,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;YAC3E,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAC;QAChC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,GAAG,IAAI,IAAI,MAAM,sBAAsB,CAAC;IAC3H,MAAM,cAAc,GAAG,QAAmC,CAAC;IAC3D,MAAM,YAAY,GAAG,MAAiC,CAAC;IACvD,uEAAuE;IACvE,6EAA6E;IAC7E,6EAA6E;IAC7E,yEAAyE;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC;IACzF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,IAAI,KAAK,eAAe,CAAC;IAChE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5E,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;IAChC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,KAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,8BAA8B,EAAE,CAAC;IAC5I,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,kBAAkB,eAAe,UAAU,EAAE,CAAC;IAC5G,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAmB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,yBAAyB,EAAE,CAAC;QACxE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAAK,0BAA0B,EAAE,CAAC;IAC7F,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,IAA6B;IACvD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IAChE,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI;QAAE,OAAO,yCAAyC,CAAC;IAC/E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,yBAAyB,CAAC;IAC3F,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,2BAA2B,CAAC;IAC/F,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,6EAA6E,CAAC;IACpH,IAAI,IAAI,CAAC,UAAU,KAAK,MAAM;QAAE,OAAO,kCAAkC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,CAAC,EAAE,CAAC;QACrF,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,MAAM;YAAE,OAAO,GAAG,KAAK,wBAAwB,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,OAAO,uBAAuB,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,gBAAgB,MAAM,iBAAiB,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,eAAe;QACtD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACxH,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;gBAAE,OAAO,gBAAgB,MAAM,eAAe,SAAS,EAAE,CAAC;QAClI,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;QAAE,OAAO,iDAAiD,CAAC;IACxF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CAAC,GAAQ,EAAE,IAAa,EAAE,OAAsB,EAAE,OAAe;IACvF,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC1F,IAAI,CAAC,GAAG,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC9G,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,mBAAmB,SAAS,yCAAyC,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,IAAI,MAAM,+CAA+C,CAAC,CAAC;IACpF,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,iCAAiC,EAAE,GAAG,CAAC,CAAC;IAE1H,MAAM,MAAM,GAAG,IAA+B,CAAC;IAC/C,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAEtC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7G,OAAO,IAAI,CAAC,qDAAqD,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAE3F,4EAA4E;IAC5E,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACrC,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,8BAA8B,MAAM,MAAO,KAAqB,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/F,CAAC;QACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,WAAW,GAAG,yCAAyC,MAAM,GAAG,EAAE,GAAG,CAAC,CAAC;YACnH,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;IACD,OAAO;QACL,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,GAAG,OAAO,2BAA2B,kBAAkB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE;QACtF,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,kEAAkE;QAClE,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,CAAC,GAAI,MAAM,CAAC,GAAgB,EAAE,GAAG,QAAQ,CAAC,EAAE;KACvE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc,EAAE,IAAa,EAAE,OAAsB;IAC7F,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,4EAA4E;IAC5E,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAE9C,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,GAAG,IAAI,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACvD,OAAO,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAED,MAAM,eAAe,GAAG,mDAAmD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvF,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,IAAI,CAAC,GAAG,MAAM,sBAAsB,IAAI,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,uBAAuB,CAAC,EAAE,CAAE,CAAC;QAC5C,oEAAoE;QACpE,wEAAwE;QACxE,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC,IAAI,MAAM,+CAA+C,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,MAAM;gBACN,IAAI,EAAE,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,4CAA4C;gBACjG,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE;aAC1B,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;IAC/H,CAAC;IAED,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,eAAe,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC,cAAc,EAAE,yCAAyC,CAAC,CAAC;QACjG,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM;YACN,IAAI,EAAE,GAAG,OAAO,eAAe,kBAAkB,CAAC,EAAE,CAAC,cAAc;YACnE,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,CAAC,EAAE,CAAE,EAAE;SACxD,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACpD,yEAAyE;QACzE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,kCAAkC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;IAClH,CAAC;IAED,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,YAAY,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,UAAU,GAAG,wCAAwC,CAAC,CAAC;QACpI,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,WAAW,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACnD,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YACnC,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,YAAY,SAAS,IAAI,GAAG,uEAAuE,CAAC,CAAC;QAC7H,OAAO;YACL,KAAK,EAAE,IAAI;YACX,MAAM;YACN,IAAI,EAAE,GAAG,OAAO,4BAA4B,kBAAkB,CAAC,SAAS,CAAC,QAAQ,kBAAkB,CAAC,GAAG,CAAC,EAAE;SAC3G,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,GAAG,MAAM,IAAI,IAAI,iBAAiB,CAAC,CAAC;AAClD,CAAC"}

package/dist/docker-proxy/secrets.js

@@ -0,0 +1,111 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * Environment files the *proxy* owns.
+ *
+ * This is what keeps a sandbox's credentials out of the hub: the hub's config
+ * only names a secret set (`"secretsFrom": "scraper"`), and the proxy appends the
+ * actual variables to the create request after it has validated it. The hub
+ * process — and therefore every stdio child running under the same uid, which
+ * can read /proc/1/environ — never sees them.
+ */
+const NAME_PATTERN = /^[a-zA-Z0-9_-]+$/;
+const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const MAX_SECRET_FILE_BYTES = 64 * 1024;
+export const MAX_SECRET_ENTRIES = 100;
+export class SecretError extends Error {
+}
+export function parseEnvFile(content) {
+    if (content.includes('\0'))
+        throw new SecretError('contains a NUL byte');
+    const result = {};
+    let entries = 0;
+    for (const [index, raw] of content.split('\n').entries()) {
+        const line = raw.trim();
+        if (line.length === 0 || line.startsWith('#'))
+            continue;
+        const withoutExport = line.startsWith('export ') ? line.slice('export '.length).trim() : line;
+        const separator = withoutExport.indexOf('=');
+        if (separator === -1)
+            throw new SecretError(`line ${index + 1} is not KEY=VALUE`);
+        const key = withoutExport.slice(0, separator).trim();
+        if (!KEY_PATTERN.test(key))
+            throw new SecretError(`line ${index + 1} has an invalid variable name "${key}"`);
+        if (Object.hasOwn(result, key))
+            throw new SecretError(`line ${index + 1} duplicates variable "${key}"`);
+        if (++entries > MAX_SECRET_ENTRIES)
+            throw new SecretError(`contains more than ${MAX_SECRET_ENTRIES} variables`);
+        let value = withoutExport.slice(separator + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        result[key] = value;
+    }
+    return result;
+}
+export class SecretStore {
+    dir;
+    constructor(dir) {
+        this.dir = dir;
+    }
+    /** Absolute path of a secret set, refusing anything that escapes the directory. */
+    pathFor(name) {
+        if (!NAME_PATTERN.test(name))
+            throw new SecretError(`invalid secret set name "${name}"`);
+        const file = path.resolve(this.dir, `${name}.env`);
+        if (path.dirname(file) !== path.resolve(this.dir))
+            throw new SecretError(`secret set "${name}" escapes ${this.dir}`);
+        return file;
+    }
+    load(name) {
+        const file = this.pathFor(name);
+        let stat;
+        try {
+            stat = fs.lstatSync(file);
+        }
+        catch {
+            throw new SecretError(`secret file ${file} does not exist`);
+        }
+        if (stat.isSymbolicLink())
+            throw new SecretError(`secret file ${file} must not be a symlink`);
+        if (!stat.isFile())
+            throw new SecretError(`secret file ${file} is not a regular file`);
+        if (stat.size > MAX_SECRET_FILE_BYTES) {
+            throw new SecretError(`secret file ${file} exceeds ${MAX_SECRET_FILE_BYTES} bytes`);
+        }
+        // Owner read/write and group read are sufficient. Reject group write,
+        // every permission for other users, and execute bits.
+        if (stat.mode & 0o137) {
+            throw new SecretError(`secret file ${file} is world-readable or has otherwise unsafe permissions (use chmod 640 or stricter)`);
+        }
+        try {
+            const content = fs.readFileSync(file);
+            if (content.length > MAX_SECRET_FILE_BYTES) {
+                throw new SecretError(`secret file ${file} exceeds ${MAX_SECRET_FILE_BYTES} bytes`);
+            }
+            return parseEnvFile(content.toString('utf8'));
+        }
+        catch (error) {
+            if (error instanceof SecretError)
+                throw new SecretError(`${file}: ${error.message}`);
+            throw new SecretError(`cannot read ${file}: ${error.message}`);
+        }
+    }
+}
+/** Validate every referenced set as one atomic policy operation. */
+export function validateConfigSecrets(config, store) {
+    for (const [name, entry] of config) {
+        if (entry.kind !== 'docker' || entry.secretsFrom === undefined)
+            continue;
+        try {
+            const secrets = store.load(entry.secretsFrom);
+            const collision = Object.keys(secrets).find(key => Object.hasOwn(entry.env, key));
+            if (collision)
+                throw new SecretError(`secret "${collision}" collides with a configured env key`);
+        }
+        catch (error) {
+            throw new SecretError(`server "${name}": ${error.message}`);
+        }
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/docker-proxy/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/docker-proxy/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;GAQG;AAEH,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,WAAW,GAAG,0BAA0B,CAAC;AAC/C,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,IAAI,CAAC;AAC/C,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAEtC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;IACzE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACxD,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9F,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAClF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,GAAG,CAAC,kCAAkC,GAAG,GAAG,CAAC,CAAC;QAC7G,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,QAAQ,KAAK,GAAG,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;QACxG,IAAI,EAAE,OAAO,GAAG,kBAAkB;YAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,kBAAkB,YAAY,CAAC,CAAC;QAChH,IAAI,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACrG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,WAAW;IACO,GAAG;IAAhC,YAA6B,GAAW;mBAAX,GAAG;IAAW,CAAC;IAE5C,mFAAmF;IACnF,OAAO,CAAC,IAAY;QAClB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,4BAA4B,IAAI,GAAG,CAAC,CAAC;QACzF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,IAAY;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,iBAAiB,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,wBAAwB,CAAC,CAAC;QAC9F,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,wBAAwB,CAAC,CAAC;QACvF,IAAI,IAAI,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;YACtC,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,YAAY,qBAAqB,QAAQ,CAAC,CAAC;QACtF,CAAC;QACD,sEAAsE;QACtE,sDAAsD;QACtD,IAAI,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,oFAAoF,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,OAAO,CAAC,MAAM,GAAG,qBAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,YAAY,qBAAqB,QAAQ,CAAC,CAAC;YACtF,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,IAAI,WAAW,CAAC,GAAG,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,MAAM,IAAI,WAAW,CAAC,eAAe,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;CACF;AAED,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CAAC,MAAwC,EAAE,KAAkB;IAChG,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,SAAS;QACzE,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;YAClF,IAAI,SAAS;gBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,SAAS,sCAAsC,CAAC,CAAC;QACnG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,MAAO,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;AACH,CAAC"}