@ni-c/mcp-hub 0.6.3 → 0.7.0

package/dist/sandbox/container-spec.js

@@ -0,0 +1,115 @@
+/**
+ * The container a `type: "docker"` entry describes — derived from the config
+ * and from nothing else.
+ *
+ * This module is the reason the docker proxy can enforce a policy without a
+ * second policy file: the hub builds its create request here, and the proxy
+ * rebuilds the expected request from the same config with the same function
+ * and compares. Any field the hub adds, drops or changes on the way is a
+ * mismatch by construction, so the policy cannot drift from the code that
+ * sends the request.
+ *
+ * Everything that could only ever weaken the sandbox is fixed here rather than
+ * taken from the config: capabilities are always dropped, no-new-privileges is
+ * always set, privileged is always false, and there is never a restart policy
+ * (the hub supervises, and a Docker-level restart would resurrect a container
+ * whose stdio stream nobody is holding).
+ */
+export const CONTAINER_PREFIX = 'mcp-sandbox-';
+export const OWNER_LABEL = 'io.mcp-hub.owner';
+export const SERVER_LABEL = 'io.mcp-hub.server';
+export const OWNER_VALUE = 'mcp-hub';
+/** Watchtower would otherwise try to update images the hub pins deliberately. */
+export const WATCHTOWER_LABEL = 'com.centurylinklabs.watchtower.enable';
+/**
+ * Blanked, not set: an image built with `docker compose build` carries its
+ * project label, and a container inherits every label of its image. A sandbox
+ * would therefore look like part of that Compose project, and a `docker compose
+ * down` in the directory the image was built in would collect a container the
+ * hub owns and is holding the stdio of. An empty value matches no project.
+ */
+export const COMPOSE_PROJECT_LABEL = 'com.docker.compose.project';
+const PORT_PATTERN = /^(?:(\d{1,3}(?:\.\d{1,3}){3}):)?(\d{1,5}):(\d{1,5})(?:\/(tcp|udp))?$/;
+export function containerName(server) {
+    return `${CONTAINER_PREFIX}${server}`;
+}
+/** `mcp-sandbox-scraper` -> `scraper`; undefined for anything outside our namespace. */
+export function serverNameFromContainer(container) {
+    const name = container.startsWith('/') ? container.slice(1) : container;
+    if (!name.startsWith(CONTAINER_PREFIX))
+        return undefined;
+    const server = name.slice(CONTAINER_PREFIX.length);
+    return /^[a-zA-Z0-9_-]+$/.test(server) ? server : undefined;
+}
+function portBindings(ports) {
+    const exposed = {};
+    const bindings = {};
+    for (const port of ports) {
+        const match = PORT_PATTERN.exec(port);
+        if (!match)
+            throw new Error(`invalid port mapping "${port}"`); // parseConfig rejects these first
+        const [, hostIp, hostPort, containerPort, proto] = match;
+        const key = `${containerPort}/${proto ?? 'tcp'}`;
+        exposed[key] = {};
+        (bindings[key] ??= []);
+        bindings[key].push({ HostIp: hostIp ?? '127.0.0.1', HostPort: hostPort });
+    }
+    return { exposed, bindings };
+}
+function tmpfsMounts(tmpfs) {
+    return Object.fromEntries(tmpfs.map(entry => {
+        const separator = entry.indexOf(':');
+        if (separator === -1)
+            return [entry, 'rw,nosuid,nodev,size=64m'];
+        return [entry.slice(0, separator), entry.slice(separator + 1)];
+    }));
+}
+export function buildCreateRequest(server, config) {
+    const { exposed, bindings } = portBindings(config.ports);
+    const body = {
+        Image: config.image,
+        // stdio is the whole point: keep stdin open for the life of the container
+        // and never allocate a TTY, because a TTY merges stdout and stderr into one
+        // unframed stream and the protocol would drown in the server's log lines.
+        OpenStdin: true,
+        StdinOnce: false,
+        AttachStdin: true,
+        AttachStdout: true,
+        AttachStderr: true,
+        Tty: false,
+        Env: Object.entries(config.env).map(([key, value]) => `${key}=${value}`),
+        Labels: {
+            [OWNER_LABEL]: OWNER_VALUE,
+            [SERVER_LABEL]: server,
+            [WATCHTOWER_LABEL]: 'false',
+            [COMPOSE_PROJECT_LABEL]: ''
+        },
+        HostConfig: {
+            // The hub removes the container itself on close; AutoRemove covers the
+            // case where the server exits on its own.
+            AutoRemove: true,
+            Binds: [...config.volumes],
+            PortBindings: bindings,
+            NetworkMode: config.network,
+            ReadonlyRootfs: config.readOnly,
+            Tmpfs: tmpfsMounts(config.tmpfs),
+            CapDrop: ['ALL'],
+            CapAdd: [],
+            Privileged: false,
+            SecurityOpt: ['no-new-privileges:true'],
+            RestartPolicy: { Name: '' },
+            // stdout carries the protocol, so a log driver that keeps every byte of
+            // it would fill the disk with a transcript of the session.
+            LogConfig: { Type: 'json-file', Config: { 'max-size': '1m', 'max-file': '1' } },
+            Memory: config.memory,
+            PidsLimit: config.pidsLimit,
+            NanoCpus: Math.round(config.cpus * 1_000_000_000)
+        },
+        ...(Object.keys(exposed).length > 0 ? { ExposedPorts: exposed } : {}),
+        ...(config.command !== undefined ? { Cmd: config.command } : {}),
+        ...(config.entrypoint !== undefined ? { Entrypoint: config.entrypoint } : {}),
+        ...(config.user !== undefined ? { User: config.user } : {})
+    };
+    return { name: containerName(server), body };
+}
+//# sourceMappingURL=container-spec.js.map

package/dist/sandbox/container-spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-spec.js","sourceRoot":"","sources":["../../src/sandbox/container-spec.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AAC9C,MAAM,CAAC,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AACrC,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACxE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAElE,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAS5F,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,OAAO,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;AACxC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,SAAiB;IACvD,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;QAAE,OAAO,SAAS,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9D,CAAC;AAED,SAAS,YAAY,CAAC,KAAe;IACnC,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,GAAG,CAAC,CAAC,CAAC,kCAAkC;QACjG,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QACzD,MAAM,GAAG,GAAG,GAAG,aAAa,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAe,CAAC,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IAClC,OAAO,MAAM,CAAC,WAAW,CACvB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QAChB,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAA0B;IAC3E,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,IAAI,GAA4B;QACpC,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,0EAA0E;QAC1E,4EAA4E;QAC5E,0EAA0E;QAC1E,SAAS,EAAE,IAAI;QACf,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,IAAI;QAClB,GAAG,EAAE,KAAK;QACV,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QACxE,MAAM,EAAE;YACN,CAAC,WAAW,CAAC,EAAE,WAAW;YAC1B,CAAC,YAAY,CAAC,EAAE,MAAM;YACtB,CAAC,gBAAgB,CAAC,EAAE,OAAO;YAC3B,CAAC,qBAAqB,CAAC,EAAE,EAAE;SAC5B;QACD,UAAU,EAAE;YACV,uEAAuE;YACvE,0CAA0C;YAC1C,UAAU,EAAE,IAAI;YAChB,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAC1B,YAAY,EAAE,QAAQ;YACtB,WAAW,EAAE,MAAM,CAAC,OAAO;YAC3B,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;YAChC,OAAO,EAAE,CAAC,KAAK,CAAC;YAChB,MAAM,EAAE,EAAE;YACV,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,CAAC,wBAAwB,CAAC;YACvC,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YAC3B,wEAAwE;YACxE,2DAA2D;YAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE;YAC/E,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,GAAG,aAAa,CAAC;SAClD;QACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5D,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC"}

package/dist/sandbox/docker-client.js

@@ -0,0 +1,291 @@
+import http from 'node:http';
+import { OWNER_LABEL, OWNER_VALUE, serverNameFromContainer } from './container-spec.js';
+import { DOCKER_POLICY_NAME, DOCKER_POLICY_PATH, DOCKER_POLICY_VERSION } from './policy-protocol.js';
+/**
+ * The slice of the Docker Engine API the hub needs, over a Unix socket or TCP.
+ *
+ * Deliberately hand-rolled instead of pulling in dockerode: the hub is meant
+ * to be small enough to audit and to run on a Pi, and everything used here is
+ * five endpoints plus one connection upgrade. The upgrade is the interesting
+ * part — `POST /containers/{id}/attach` hands back the raw connection, and
+ * that connection is the container's stdio.
+ */
+const DEFAULT_SOCKET = '/var/run/docker.sock';
+/** Highest API version this client was written against; older daemons win. */
+const MAX_API_VERSION = '1.44';
+const REQUEST_TIMEOUT_MS = 30_000;
+const PULL_TIMEOUT_MS = 15 * 60_000;
+const MAX_RESPONSE_BYTES = 4 * 1024 * 1024;
+export class DockerError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+/** `unix:///var/run/docker.sock`, `/var/run/docker.sock` or `tcp://host:2375`. */
+export function parseDockerHost(value) {
+    if (!value || value.length === 0)
+        return { socketPath: DEFAULT_SOCKET };
+    if (value.startsWith('/'))
+        return { socketPath: value };
+    if (value.startsWith('unix://'))
+        return { socketPath: value.slice('unix://'.length) };
+    if (value.startsWith('tcp://') || value.startsWith('http://')) {
+        const url = new URL(value.replace(/^tcp:\/\//, 'http://'));
+        return { host: url.hostname, port: Number(url.port || 2375) };
+    }
+    throw new Error(`DOCKER_HOST must be a unix:// path or a tcp:// address, got "${value}"`);
+}
+/**
+ * Docker sandboxing is safe only through the matching policy proxy. An absent
+ * variable used to fall back to the root-equivalent daemon socket; refuse that
+ * configuration before making any request.
+ */
+export function parseSandboxDockerHost(value) {
+    if (!value)
+        throw new Error('DOCKER_HOST is required for docker servers and must point to the mcp-hub Docker policy proxy');
+    const endpoint = parseDockerHost(value);
+    if (endpoint.socketPath === DEFAULT_SOCKET) {
+        throw new Error('DOCKER_HOST points directly at /var/run/docker.sock; use the mcp-hub Docker policy proxy socket');
+    }
+    return endpoint;
+}
+function compareApiVersions(a, b) {
+    const [aMajor = 0, aMinor = 0] = a.split('.').map(Number);
+    const [bMajor = 0, bMinor = 0] = b.split('.').map(Number);
+    return aMajor - bMajor || aMinor - bMinor;
+}
+export function splitImageRef(ref) {
+    const at = ref.indexOf('@');
+    if (at !== -1)
+        return { fromImage: ref.slice(0, at), tag: ref.slice(at + 1) };
+    const slash = ref.lastIndexOf('/');
+    const colon = ref.lastIndexOf(':');
+    if (colon > slash)
+        return { fromImage: ref.slice(0, colon), tag: ref.slice(colon + 1) };
+    return { fromImage: ref, tag: 'latest' };
+}
+export class DockerClient {
+    endpoint;
+    apiVersion;
+    policyVerified = false;
+    constructor(endpoint = { socketPath: DEFAULT_SOCKET }) {
+        this.endpoint = endpoint;
+    }
+    describe() {
+        return this.endpoint.socketPath ?? `${this.endpoint.host}:${this.endpoint.port}`;
+    }
+    /**
+     * Pin the API version once per process. Unversioned requests are served by
+     * whatever the daemon currently defaults to, which is a moving target for a
+     * client that hard-codes field names.
+     */
+    async version() {
+        if (this.apiVersion)
+            return this.apiVersion;
+        await this.verifyPolicyProxy();
+        const info = await this.send('GET', '/version', { versioned: false });
+        const daemon = info?.ApiVersion ?? MAX_API_VERSION;
+        this.apiVersion = compareApiVersions(daemon, MAX_API_VERSION) < 0 ? daemon : MAX_API_VERSION;
+        return this.apiVersion;
+    }
+    async verifyPolicyProxy() {
+        if (this.policyVerified)
+            return;
+        let handshake;
+        try {
+            handshake = await this.send('GET', DOCKER_POLICY_PATH, { versioned: false });
+        }
+        catch (error) {
+            throw new DockerError(`Docker endpoint ${this.describe()} is not a reachable mcp-hub policy proxy: ${error.message}`, error.status);
+        }
+        if (handshake?.name !== DOCKER_POLICY_NAME || handshake.daemon !== 'ok') {
+            throw new DockerError(`Docker endpoint ${this.describe()} did not return a valid policy handshake`);
+        }
+        if (handshake.policyVersion !== DOCKER_POLICY_VERSION) {
+            throw new DockerError(`Docker policy version mismatch: hub requires ${DOCKER_POLICY_VERSION}, proxy provides ${String(handshake.policyVersion)}`);
+        }
+        this.policyVerified = true;
+    }
+    async path(path, query) {
+        const search = query ? `?${new URLSearchParams(query).toString()}` : '';
+        return `/v${await this.version()}${path}${search}`;
+    }
+    connectionOptions() {
+        return this.endpoint.socketPath ? { socketPath: this.endpoint.socketPath } : { host: this.endpoint.host, port: this.endpoint.port };
+    }
+    send(method, path, options = {}) {
+        const payload = options.body === undefined ? undefined : Buffer.from(JSON.stringify(options.body), 'utf8');
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                ...this.connectionOptions(),
+                method,
+                path,
+                headers: {
+                    Host: 'docker',
+                    'Content-Type': 'application/json',
+                    ...(payload ? { 'Content-Length': String(payload.length) } : {})
+                }
+            }, response => {
+                const chunks = [];
+                let size = 0;
+                response.on('data', (chunk) => {
+                    size += chunk.length;
+                    if (size > MAX_RESPONSE_BYTES) {
+                        response.destroy();
+                        reject(new DockerError(`response from ${method} ${path} exceeded ${MAX_RESPONSE_BYTES} bytes`));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                response.on('end', () => {
+                    const text = Buffer.concat(chunks).toString('utf8');
+                    const status = response.statusCode ?? 0;
+                    if (status >= 400) {
+                        let message = text.slice(0, 500);
+                        try {
+                            message = JSON.parse(text).message ?? message;
+                        }
+                        catch {
+                            // Not JSON; the raw body is the best message we have.
+                        }
+                        reject(new DockerError(`${method} ${path}: ${status} ${message}`, status));
+                        return;
+                    }
+                    if (options.expectStream) {
+                        // Progress streams (image pull) report failures inside the body
+                        // with a 200 status, so the status code alone means nothing.
+                        const failure = text
+                            .split('\n')
+                            .filter(Boolean)
+                            .map(line => {
+                            try {
+                                return JSON.parse(line);
+                            }
+                            catch {
+                                return {};
+                            }
+                        })
+                            .find(entry => entry.error);
+                        if (failure?.error) {
+                            reject(new DockerError(`${method} ${path}: ${failure.error}`));
+                            return;
+                        }
+                        resolve(undefined);
+                        return;
+                    }
+                    if (text.length === 0) {
+                        resolve(undefined);
+                        return;
+                    }
+                    try {
+                        resolve(JSON.parse(text));
+                    }
+                    catch {
+                        reject(new DockerError(`${method} ${path}: response is not JSON`));
+                    }
+                });
+            });
+            request.setTimeout(options.timeoutMs ?? REQUEST_TIMEOUT_MS, () => {
+                request.destroy(new DockerError(`${method} ${path}: timed out`));
+            });
+            request.on('error', error => reject(new DockerError(`${method} ${path}: ${error.message}`)));
+            if (payload)
+                request.write(payload);
+            request.end();
+        });
+    }
+    async ping() {
+        await this.version();
+    }
+    async createContainer(name, body) {
+        const created = await this.send('POST', await this.path('/containers/create', { name }), { body });
+        return created.Id;
+    }
+    async startContainer(id) {
+        await this.send('POST', await this.path(`/containers/${encodeURIComponent(id)}/start`));
+    }
+    async removeContainer(id) {
+        try {
+            await this.send('DELETE', await this.path(`/containers/${encodeURIComponent(id)}`, { force: '1', v: '0' }));
+        }
+        catch (error) {
+            // 404 (already gone) and 409 (removal already in progress, which is what
+            // AutoRemove looks like from here) are the normal endings, not failures.
+            const status = error.status;
+            if (status !== 404 && status !== 409)
+                throw error;
+        }
+    }
+    async imageExists(ref) {
+        try {
+            await this.send('GET', await this.path(`/images/${encodeURIComponent(ref)}/json`));
+            return true;
+        }
+        catch (error) {
+            if (error.status === 404)
+                return false;
+            throw error;
+        }
+    }
+    async pullImage(ref) {
+        const { fromImage, tag } = splitImageRef(ref);
+        await this.send('POST', await this.path('/images/create', { fromImage, tag }), {
+            expectStream: true,
+            timeoutMs: PULL_TIMEOUT_MS
+        });
+    }
+    /** Containers this hub created, whether running or not. */
+    async listOwnedContainers() {
+        const filters = JSON.stringify({ label: [`${OWNER_LABEL}=${OWNER_VALUE}`] });
+        const containers = await this.send('GET', await this.path('/containers/json', { all: '1', filters }));
+        return (containers ?? []).map(container => {
+            const name = (container.Names?.[0] ?? '').replace(/^\//, '');
+            return { id: container.Id, name, server: serverNameFromContainer(name) };
+        });
+    }
+    /**
+     * Attach to a container's stdio and return the raw connection.
+     *
+     * Docker answers `101 UPGRADED` and then hands over the socket, so this has
+     * to go through Node's upgrade event rather than a normal response. Bytes
+     * that arrived in the same packet as the headers are unshifted back, or the
+     * first protocol frame would be lost.
+     */
+    async attach(id) {
+        const path = await this.path(`/containers/${encodeURIComponent(id)}/attach`, {
+            stream: '1',
+            stdin: '1',
+            stdout: '1',
+            stderr: '1'
+        });
+        return new Promise((resolve, reject) => {
+            const request = http.request({
+                ...this.connectionOptions(),
+                method: 'POST',
+                path,
+                headers: {
+                    Host: 'docker',
+                    'Content-Type': 'application/json',
+                    Connection: 'Upgrade',
+                    Upgrade: 'tcp'
+                }
+            });
+            request.on('upgrade', (_response, socket, head) => {
+                if (head?.length)
+                    socket.unshift(head);
+                socket.setTimeout(0);
+                resolve(socket);
+            });
+            request.on('response', response => {
+                response.resume();
+                reject(new DockerError(`attach to ${id}: daemon answered ${response.statusCode} instead of upgrading`, response.statusCode));
+            });
+            request.on('error', error => reject(new DockerError(`attach to ${id}: ${error.message}`)));
+            request.setTimeout(REQUEST_TIMEOUT_MS, () => request.destroy(new DockerError(`attach to ${id}: timed out`)));
+            request.end();
+        });
+    }
+}
+//# sourceMappingURL=docker-client.js.map

package/dist/sandbox/docker-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker-client.js","sourceRoot":"","sources":["../../src/sandbox/docker-client.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACxF,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,qBAAqB,EAA8B,MAAM,sBAAsB,CAAC;AAEjI;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAC9C,8EAA8E;AAC9E,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,eAAe,GAAG,EAAE,GAAG,MAAM,CAAC;AACpC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAQ3C,MAAM,OAAO,WAAY,SAAQ,KAAK;IAGzB,MAAM;IAFjB,YACE,OAAe,EACN,MAAe;QAExB,KAAK,CAAC,OAAO,CAAC,CAAC;sBAFN,MAAM;IAGjB,CAAC;CACF;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,KAAc;IAC5C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;IACxE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACxD,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;IACtF,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,KAAK,GAAG,CAAC,CAAC;AAC5F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8FAA8F,CAAC,CAAC;IAC5H,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1D,OAAO,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK;QAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;IACxF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,YAAY;IAIM,QAAQ;IAH7B,UAAU,CAAU;IACpB,cAAc,GAAG,KAAK,CAAC;IAE/B,YAA6B,QAAQ,GAAmB,EAAE,UAAU,EAAE,cAAc,EAAE;wBAAzD,QAAQ;IAAoD,CAAC;IAE1F,QAAQ;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnF,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO;QACnB,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC;QAC5C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAA0B,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/F,MAAM,MAAM,GAAG,IAAI,EAAE,UAAU,IAAI,eAAe,CAAC;QACnD,IAAI,CAAC,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC;QAC7F,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,iBAAiB;QACrB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,SAAgC,CAAC;QACrC,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAwB,KAAK,EAAE,kBAAkB,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,WAAW,CACnB,mBAAmB,IAAI,CAAC,QAAQ,EAAE,6CAA8C,KAAe,CAAC,OAAO,EAAE,EACxG,KAAqB,CAAC,MAAM,CAC9B,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,EAAE,IAAI,KAAK,kBAAkB,IAAI,SAAS,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,WAAW,CAAC,mBAAmB,IAAI,CAAC,QAAQ,EAAE,0CAA0C,CAAC,CAAC;QACtG,CAAC;QACD,IAAI,SAAS,CAAC,aAAa,KAAK,qBAAqB,EAAE,CAAC;YACtD,MAAM,IAAI,WAAW,CACnB,gDAAgD,qBAAqB,oBAAoB,MAAM,CAAC,SAAS,CAAC,aAAa,CAAC,EAAE,CAC3H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,KAA8B;QAC7D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,MAAM,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,EAAE,CAAC;IACrD,CAAC;IAEO,iBAAiB;QACvB,OAAO,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtI,CAAC;IAEO,IAAI,CACV,MAAc,EACd,IAAY,EACZ,OAAO,GAAwF,EAAE;QAEjG,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3G,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAC1B;gBACE,GAAG,IAAI,CAAC,iBAAiB,EAAE;gBAC3B,MAAM;gBACN,IAAI;gBACJ,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,cAAc,EAAE,kBAAkB;oBAClC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACjE;aACF,EACD,QAAQ,CAAC,EAAE;gBACT,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;gBACb,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;oBACpC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;oBACrB,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;wBAC9B,QAAQ,CAAC,OAAO,EAAE,CAAC;wBACnB,MAAM,CAAC,IAAI,WAAW,CAAC,iBAAiB,MAAM,IAAI,IAAI,aAAa,kBAAkB,QAAQ,CAAC,CAAC,CAAC;wBAChG,OAAO;oBACT,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC,CAAC,CAAC;gBACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;oBACtB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBACpD,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,CAAC,CAAC;oBACxC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;wBAClB,IAAI,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;wBACjC,IAAI,CAAC;4BACH,OAAO,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0B,CAAC,OAAO,IAAI,OAAO,CAAC;wBAC1E,CAAC;wBAAC,MAAM,CAAC;4BACP,sDAAsD;wBACxD,CAAC;wBACD,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;wBAC3E,OAAO;oBACT,CAAC;oBACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;wBACzB,gEAAgE;wBAChE,6DAA6D;wBAC7D,MAAM,OAAO,GAAG,IAAI;6BACjB,KAAK,CAAC,IAAI,CAAC;6BACX,MAAM,CAAC,OAAO,CAAC;6BACf,GAAG,CAAC,IAAI,CAAC,EAAE;4BACV,IAAI,CAAC;gCACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;4BAChD,CAAC;4BAAC,MAAM,CAAC;gCACP,OAAO,EAAE,CAAC;4BACZ,CAAC;wBACH,CAAC,CAAC;6BACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;wBAC9B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;4BACnB,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,MAAM,IAAI,IAAI,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;4BAC/D,OAAO;wBACT,CAAC;wBACD,OAAO,CAAC,SAAc,CAAC,CAAC;wBACxB,OAAO;oBACT,CAAC;oBACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;wBACtB,OAAO,CAAC,SAAc,CAAC,CAAC;wBACxB,OAAO;oBACT,CAAC;oBACD,IAAI,CAAC;wBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC,CAAC;oBACjC,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,MAAM,IAAI,IAAI,wBAAwB,CAAC,CAAC,CAAC;oBACrE,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CACF,CAAC;YACF,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,IAAI,kBAAkB,EAAE,GAAG,EAAE;gBAC/D,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,GAAG,MAAM,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC;YACnE,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,GAAG,MAAM,IAAI,IAAI,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACxG,IAAI,OAAO;gBAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,IAAY,EAAE,IAA6B;QAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAiB,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnH,OAAO,OAAO,CAAC,EAAE,CAAC;IACpB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,kBAAkB,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1F,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,EAAU;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9G,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,MAAM,GAAI,KAAqB,CAAC,MAAM,CAAC;YAC7C,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG;gBAAE,MAAM,KAAK,CAAC;QACpD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW;QAC3B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;YACnF,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAAqB,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,KAAK,CAAC;YACxD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW;QACzB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE;YAC7E,YAAY,EAAE,IAAI;YAClB,SAAS,EAAE,eAAe;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,mBAAmB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,WAAW,IAAI,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAChC,KAAK,EACL,MAAM,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAC3D,CAAC;QACF,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE;YACxC,MAAM,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE;YAC3E,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,GAAG;YACX,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;QACH,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;gBAC3B,GAAG,IAAI,CAAC,iBAAiB,EAAE;gBAC3B,MAAM,EAAE,MAAM;gBACd,IAAI;gBACJ,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,cAAc,EAAE,kBAAkB;oBAClC,UAAU,EAAE,SAAS;oBACrB,OAAO,EAAE,KAAK;iBACf;aACF,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;gBAChD,IAAI,IAAI,EAAE,MAAM;oBAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE;gBAChC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAClB,MAAM,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,qBAAqB,QAAQ,CAAC,UAAU,uBAAuB,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/H,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACtG,OAAO,CAAC,UAAU,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;YAC7G,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/sandbox/policy-protocol.js

@@ -0,0 +1,11 @@
+/**
+ * Wire contract between the internet-facing hub and the Docker policy proxy.
+ *
+ * Bump this whenever either side changes the meaning of an allowed Docker
+ * request. A release version is deliberately not used: patch releases that do
+ * not change the policy remain interoperable, while policy drift fails closed.
+ */
+export const DOCKER_POLICY_VERSION = 1;
+export const DOCKER_POLICY_PATH = '/_mcp_hub/policy';
+export const DOCKER_POLICY_NAME = 'mcp-hub-docker-proxy';
+//# sourceMappingURL=policy-protocol.js.map

package/dist/sandbox/policy-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-protocol.js","sourceRoot":"","sources":["../../src/sandbox/policy-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AACrD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC"}

package/dist/supervisor.js

@@ -3,7 +3,11 @@ import { StdioClientTransport, getDefaultEnvironment } from '@modelcontextprotoc
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js';
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js';
 import { VERSION } from './version.js';
+import { MAX_TOOL_LIST_PAGES, MAX_TOOLS, MAX_TOOL_METADATA_BYTES, jsonSize } from './mcp-limits.js';
 import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js';
+import { SocketTransport } from './transports/socket.js';
+import { DockerTransport } from './transports/docker.js';
+import { DockerClient, parseSandboxDockerHost } from './sandbox/docker-client.js';
 /**
  * Remote upstreams get their configured headers on EVERY request via a fetch
  * wrapper — requestInit alone does not cover the SSE stream GET.
@@ -24,11 +28,47 @@ function buildRemoteTransport(config) {
     }
     return new StreamableHTTPClientTransport(url, { requestInit: { headers }, fetch: fetchWithHeaders });
 }
+let sharedDockerClient;
+/**
+ * One Docker connection for the whole hub, pointed at DOCKER_HOST — which in
+ * the documented deployment is not the daemon but the policy proxy's socket.
+ */
+export function dockerClient() {
+    return (sharedDockerClient ??= new DockerClient(parseSandboxDockerHost(process.env.DOCKER_HOST)));
+}
+/** Tests inject a stub here; passing undefined restores the DOCKER_HOST client. */
+export function setDockerClient(client) {
+    sharedDockerClient = client;
+}
 const BACKOFF_INITIAL_MS = 1_000;
 const BACKOFF_MAX_MS = 5 * 60_000;
 const BACKOFF_RESET_AFTER_MS = 5 * 60_000;
 const PING_INTERVAL_MS = 60_000;
 const PING_TIMEOUT_MS = 30_000;
+export async function listAllTools(client) {
+    const tools = [];
+    let cursor;
+    let pages = 0;
+    let metadataBytes = 0;
+    const seenCursors = new Set();
+    do {
+        if (++pages > MAX_TOOL_LIST_PAGES)
+            throw new Error(`tools/list exceeded ${MAX_TOOL_LIST_PAGES} pages`);
+        const page = await client.listTools({ cursor });
+        metadataBytes += jsonSize(page.tools);
+        if (metadataBytes > MAX_TOOL_METADATA_BYTES)
+            throw new Error(`tools/list metadata exceeded ${MAX_TOOL_METADATA_BYTES} bytes`);
+        tools.push(...page.tools);
+        if (tools.length > MAX_TOOLS)
+            throw new Error(`tools/list exceeded ${MAX_TOOLS} tools`);
+        cursor = page.nextCursor;
+        if (cursor && seenCursors.has(cursor))
+            throw new Error('tools/list repeated a pagination cursor');
+        if (cursor)
+            seenCursors.add(cursor);
+    } while (cursor);
+    return tools;
+}
 export class ManagedServer {
     name;
     config;
@@ -49,22 +89,41 @@ export class ManagedServer {
         this.config = config;
     }
     buildTransport() {
-        if (this.config.kind === 'remote') {
-            return buildRemoteTransport(this.config);
+        switch (this.config.kind) {
+            case 'remote':
+                return buildRemoteTransport(this.config);
+            case 'socket':
+                return new SocketTransport(this.config);
+            case 'docker':
+                return new DockerTransport(this.name, this.config, dockerClient());
+            case 'stdio':
+                return new StdioClientTransport({
+                    command: this.config.command,
+                    args: this.config.args,
+                    env: { ...getDefaultEnvironment(), ...this.config.env },
+                    stderr: 'inherit'
+                });
+        }
+    }
+    /** What "it went away" means for this kind of server, in the operator's words. */
+    exitReason() {
+        switch (this.config.kind) {
+            case 'remote':
+                return 'connection closed';
+            case 'socket':
+                return 'socket closed';
+            case 'docker':
+                return 'container exited';
+            case 'stdio':
+                return 'child process exited';
         }
-        return new StdioClientTransport({
-            command: this.config.command,
-            args: this.config.args,
-            env: { ...getDefaultEnvironment(), ...this.config.env },
-            stderr: 'inherit'
-        });
     }
     async start() {
         this.stopping = false;
         this.state = 'starting';
         const transport = this.buildTransport();
         const client = new Client({ name: 'mcp-hub', version: VERSION }, { capabilities: {} });
-        transport.onclose = () => this.onExit(this.config.kind === 'remote' ? 'connection closed' : 'child process exited');
+        transport.onclose = () => this.onExit(this.exitReason());
         try {
             await client.connect(transport);
         }
@@ -92,14 +151,7 @@ export class ManagedServer {
         if (!client)
             return;
         try {
-            const tools = [];
-            let cursor;
-            do {
-                const page = await client.listTools({ cursor });
-                tools.push(...page.tools);
-                cursor = page.nextCursor;
-            } while (cursor);
-            this.tools = tools;
+            this.tools = await listAllTools(client);
         }
         catch (error) {
             console.error(`[${this.name}] failed to list tools: ${error.message}`);
@@ -191,6 +243,27 @@ export class Supervisor {
     async waitUntilSettled() {
         await Promise.all(this.initialStarts);
     }
+    /**
+     * Remove sandbox containers this hub owns that no longer have a config entry.
+     *
+     * AutoRemove only fires when a container stops, so an unclean hub exit — or
+     * a server deleted from the config while the hub was down — leaves a
+     * container running with nobody holding its stdio. Containers of *active*
+     * servers are left alone here; DockerTransport.start() replaces those by
+     * name anyway.
+     */
+    async reapOrphans() {
+        const active = new Set([...this.config.entries()].filter(([, cfg]) => cfg.kind === 'docker').map(([name]) => name));
+        if (active.size === 0)
+            return; // never touch Docker for a hub that does not use it
+        const owned = await dockerClient().listOwnedContainers();
+        for (const container of owned) {
+            if (container.server !== undefined && active.has(container.server))
+                continue;
+            console.log(`mcp-hub: removing orphaned sandbox container ${container.name}`);
+            await dockerClient().removeContainer(container.name);
+        }
+    }
     get(name) {
         return this.servers.get(name);
     }

package/dist/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAMvF;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,gBAAgB,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC1C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,OAAO,aAAa;IAgBb,IAAI;IACN,MAAM;IAhBf,KAAK,GAAgB,UAAU,CAAC;IAChC,MAAM,CAAU;IAChB,UAAU,CAAkB;IAC5B,YAAY,CAAsB;IAClC,KAAK,GAAW,EAAE,CAAC;IACnB,QAAQ,GAAG,CAAC,CAAC;IACb,SAAS,CAAU;IAEX,SAAS,GAAG,kBAAkB,CAAC;IAC/B,SAAS,GAAG,CAAC,CAAC;IACd,YAAY,CAAkB;IAC9B,SAAS,CAAkB;IAC3B,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,IAAY,EACd,MAAoB;oBADlB,IAAI;sBACN,MAAM;IACZ,CAAC;IAEI,cAAc;QACpB,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC;YAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;YACtB,GAAG,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;YACvD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACvF,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACpH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,oBAAqB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,IAAI,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,sBAAsB,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAW,EAAE,CAAC;YACzB,IAAI,MAA0B,CAAC;YAC/B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChD,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;YAC3B,CAAC,QAAQ,MAAM,EAAE;YACjB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,2BAA4B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAC9D,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;YAC/E,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,WAAW,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtG,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,UAAU;IAID,MAAM;IAHjB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,aAAa,GAAoB,EAAE,CAAC;IAE5C,YAAoB,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAEzC;;;;;OAKG;IACH,KAAK;QACH,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,sDAAsD;IACtD,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAiB,EAAE,IAAgB;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,sBAAsB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;gBAClG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,sBAAsB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;CACF"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,2CAA2C,CAAC;AACxG,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAE7E,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AACpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,oCAAoC,CAAC;AAGvF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAIlF;;;GAGG;AACH,SAAS,oBAAoB,CAAC,MAA0B;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,gBAAgB,GAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC;IACF,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,kBAAkB,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,IAAI,kBAA4C,CAAC;AAEjD;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,OAAO,CAAC,kBAAkB,KAAK,IAAI,YAAY,CAAC,sBAAsB,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;AACpG,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,MAAgC;IAC9D,kBAAkB,GAAG,MAAM,CAAC;AAC9B,CAAC;AAED,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AAC1C,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAiC;IAClE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,IAAI,MAA0B,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,GAAG,CAAC;QACF,IAAI,EAAE,KAAK,GAAG,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,mBAAmB,QAAQ,CAAC,CAAC;QACvG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAChD,aAAa,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,aAAa,GAAG,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,uBAAuB,QAAQ,CAAC,CAAC;QAC9H,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,QAAQ,CAAC,CAAC;QACxF,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QACzB,IAAI,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAClG,IAAI,MAAM;YAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC,QAAQ,MAAM,EAAE;IACjB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,aAAa;IAgBb,IAAI;IACN,MAAM;IAhBf,KAAK,GAAgB,UAAU,CAAC;IAChC,MAAM,CAAU;IAChB,UAAU,CAAkB;IAC5B,YAAY,CAAsB;IAClC,KAAK,GAAW,EAAE,CAAC;IACnB,QAAQ,GAAG,CAAC,CAAC;IACb,SAAS,CAAU;IAEX,SAAS,GAAG,kBAAkB,CAAC;IAC/B,SAAS,GAAG,CAAC,CAAC;IACd,YAAY,CAAkB;IAC9B,SAAS,CAAkB;IAC3B,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,IAAY,EACd,MAAoB;oBADlB,IAAI;sBACN,MAAM;IACZ,CAAC;IAEI,cAAc;QACpB,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC3C,KAAK,QAAQ;gBACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1C,KAAK,QAAQ;gBACX,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACrE,KAAK,OAAO;gBACV,OAAO,IAAI,oBAAoB,CAAC;oBAC9B,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;oBAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI;oBACtB,GAAG,EAAE,EAAE,GAAG,qBAAqB,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE;oBACvD,MAAM,EAAE,SAAS;iBAClB,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAED,kFAAkF;IAC1E,UAAU;QAChB,QAAQ,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,mBAAmB,CAAC;YAC7B,KAAK,QAAQ;gBACX,OAAO,eAAe,CAAC;YACzB,KAAK,QAAQ;gBACX,OAAO,kBAAkB,CAAC;YAC5B,KAAK,OAAO;gBACV,OAAO,sBAAsB,CAAC;QAClC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;QACvF,SAAS,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,oBAAqB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,qBAAqB,EAAE,CAAC;QACnD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,SAAS,IAAI,CAAC,UAAU,EAAE,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAClH,IAAI,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC7B,MAAM,CAAC,sBAAsB,CAAC,iCAAiC,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACjG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,EAAE,gBAAgB,CAAC,CAAC;QAC7E,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,yEAAyE;QACzE,wEAAwE;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,2BAA4B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,2EAA2E;QAC3E,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,8DAA8D;QAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,8BAA+B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YACrF,wEAAwE;YACxE,yEAAyE;YACzE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,4EAA4E;QAC5E,uEAAuE;QACvE,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QAC9D,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC;QACxB,IAAI,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,GAAG,sBAAsB,EAAE,CAAC;YAC/E,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC;QACtC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,WAAW,MAAM,oBAAoB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACtG,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAClC,IAAI,CAAC,QAAQ,EAAE,CAAC;YAChB,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAChC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9B,uEAAuE;QACvE,4EAA4E;QAC5E,uEAAuE;QACvE,gEAAgE;QAChE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrC,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;CACF;AAED,MAAM,OAAO,UAAU;IAID,MAAM;IAHjB,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,aAAa,GAAoB,EAAE,CAAC;IAE5C,YAAoB,MAAiB;sBAAjB,MAAM;IAAc,CAAC;IAEzC;;;;;OAKG;IACH,KAAK;QACH,IAAI,CAAC,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE;YAClE,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACxC,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACpH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,CAAC,oDAAoD;QACnF,MAAM,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACzD,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;YAC9B,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC7E,OAAO,CAAC,GAAG,CAAC,gDAAgD,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YAC9E,MAAM,YAAY,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,sDAAsD;IACtD,UAAU;QACR,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAiB,EAAE,IAAgB;QACjD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,sBAAsB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;gBAClG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;YAC1C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,sBAAsB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC;YAC9F,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;CACF"}