@ni-c/mcp-hub 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -7,6 +7,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- #region changelog -->
 
+## [0.9.0] - 2026-08-20
+
+### Added
+
+- **On-demand servers.** Stdio and docker servers now start when they are used
+  and go to sleep after `IDLE_TIMEOUT_MINUTES` (default 60) without a forwarded
+  request — on a small host, a dozen configured servers cost only the memory of
+  the ones actually in use. While a server sleeps, `initialize` and
+  `tools/list` are answered from a persistent snapshot
+  (`TOOL_CACHE_PATH`, default `/data/tool-cache.json`), so a client
+  enumerating its connectors wakes nothing; the first real tool call wakes the
+  server and blocks until it is up (120 s budget). `/hub`'s `list_tools` and
+  `get_tool_schema` answer from the snapshot and pre-warm the server in the
+  background. Per-server control: `"keepAlive": true` keeps a server always
+  running (the previous behaviour), `"idleMinutes"` overrides the global
+  timeout; `IDLE_TIMEOUT_MINUTES=0` disables the feature entirely. New `/hub`
+  meta-tools `wake_server` and `sleep_server` steer the lifecycle manually. An
+  on-demand server that crashes five restarts in a row without being used is
+  parked as `sleeping` (error kept visible) instead of restarting forever.
+  `/health` treats `sleeping` as healthy. The docker-proxy and its policy are
+  unchanged — `DOCKER_POLICY_VERSION` stays at 1.
+- **`hub: false` servers are lifecycle-managed through `/hub`.** `list_servers`
+  now includes them with a `hidden` marker and `wake_server`/`sleep_server`
+  accept them — hiding a server's tools no longer means its lifecycle can only
+  be reached by the idle sweep. Tool access (`list_tools`, `get_tool_schema`,
+  `call_tool`) still refuses hidden servers, now pointing at the server's own
+  endpoint instead of pretending it does not exist.
+- **Single-file config mounts log a startup warning.** A
+  `-v ./mcp.json:/config/mcp.json` bind mount silently loses every editor save
+  that goes through a rename (new inode), killing hot reload. The hub and the
+  docker-proxy now detect that setup via `/proc/self/mountinfo` and say so at
+  startup.
+- **stdio mode.** `mcp-hub --stdio` (or the `mcp-hub-stdio` binary) serves the
+  `/hub` aggregate — the same six meta-tools, the same `mcp.json`, the same
+  supervision, on-demand lifecycle and hot reload — on stdin/stdout, for
+  clients that can only spawn a local process. No listener, no OAuth, no
+  `EXTERNAL_URL`; the trust boundary is the local user account. `CONFIG_PATH`
+  defaults to `mcp.json` in the working directory, the tool cache to
+  `.mcp-hub/tool-cache.json` beside it, and a missing config starts an empty
+  hub instead of failing, because a client-spawned process has nowhere to show
+  a startup error. `console.log`/`console.info` are moved to stderr for the
+  life of the process: stdout carries the protocol. The MCP Registry entry
+  follows: the npm package is now listed as a **stdio** package
+  (`npx @ni-c/mcp-hub --stdio`), so the hub can be installed straight from the
+  registry. The OCI package stays `streamable-http` — that is the container
+  deployment.
+
+### Changed
+
+- **Examples and docs mount the config directory, not the file.** The
+  recommended layout is `./config/mcp.json` mounted as `./config:/config:ro` in
+  both the hub and the docker-proxy — rename-style editor saves then hot-reload
+  correctly. `CONFIG_PATH` and its default `/config/mcp.json` are unchanged, so
+  existing single-file deployments keep working (with the warning above).
+
+### Fixed
+
+- The release workflow now has a concurrency group and skips an npm publish,
+  MCP Registry publish or GitHub release that already exists. A tag push
+  delivered twice used to start two releases, and the loser died on npm's 403
+  for an already-published version — a permanently red check on a commit that
+  is also main's HEAD. Every publishing step is now idempotent, so a re-run can
+  finish the half that is missing; the manual `mcp-registry` workflow carries
+  the same guard.
+
+## [0.8.0] - 2026-08-18
+
+### Added
+
+- **Secrets hot-reload.** The docker-proxy now watches the sandbox secrets
+  directory: when the content of a referenced `<set>.env` changes, it stops the
+  affected sandbox container (after the same daemon-side ownership check as
+  every other container action), and the hub's supervisor recreates it — the
+  replacement create reads the file fresh. Rotating a token is now an edit, not
+  a hub restart. Content is compared by parsed entries, so a `touch` or a
+  comment-only edit triggers nothing; a broken edit (permissions, symlink,
+  parse error, a key colliding with the entry's `env`) is logged and ignored so
+  it cannot crash-loop a running server. Opt out with
+  `SANDBOX_SECRETS_WATCH=false`. The hub is unchanged and
+  `DOCKER_POLICY_VERSION` stays at 1 — 0.7.0 hubs interoperate.
+
 ## [0.7.0] - 2026-08-18
 
 ### Added

package/README.md

@@ -37,10 +37,20 @@ replaces N containers with one process:
 - **Config is exactly Claude Code's `mcpServers` format** — copy entries 1:1.
 - **Path-based routing**: `https://host/paperless`, `https://host/homeassistant`, …
 - **`/hub` aggregate**: register a *single* connector and reach every server
-  through 4 meta-tools (`list_servers`, `list_tools`, `get_tool_schema`,
-  `call_tool`) without flooding the model context with N×tools schemas.
-- **Supervision**: children are spawned at boot, pinged, and restarted with
-  exponential backoff when they die. A down server answers 503, not silence.
+  through 6 meta-tools (`list_servers`, `list_tools`, `get_tool_schema`,
+  `call_tool`, `wake_server`, `sleep_server`) without flooding the model
+  context with N×tools schemas.
+- **Also without HTTP**: `mcp-hub --stdio` serves that same aggregate on
+  stdin/stdout for clients that can only spawn a local process (Claude Desktop,
+  Codex, …) — same `mcp.json`, no TLS, no reverse proxy, no login. Auth exists
+  for the network endpoints; over stdio the trust boundary is the local user.
+- **On-demand lifecycle**: stdio and docker servers start when used and sleep
+  after 60 idle minutes, answering `initialize`/`tools/list` from a persistent
+  snapshot meanwhile — a dozen servers cost only the memory of the ones in
+  use. `keepAlive: true` exempts a server, `IDLE_TIMEOUT_MINUTES=0` the hub.
+- **Supervision**: children are pinged and restarted with exponential backoff
+  when they die. A down server answers 503, not silence; a crash-looping
+  server nobody uses is parked instead of restarted forever.
 - **Hot reload**: edits to `mcp.json` start/stop/restart only the affected
   servers.
 - **Stateless Streamable HTTP**: no session state, so claude.ai's
@@ -103,7 +113,8 @@ belongs in its own container — and it does not have to speak HTTP to get there
   a separate `mcp-hub-docker-proxy` container holds it and allows only the
   container operations `mcp.json` describes — nothing privileged, no host
   mounts, no other images. Credentials can live with the proxy (`secretsFrom`)
-  so the hub process never holds them.
+  so the hub process never holds them — and rotating one is just an edit: the
+  proxy watches the file and recreates the sandbox with the new values.
 - `type: "unix"` / `"tcp"` — you start the container, the hub connects to a
   socket. Costs the hub no privileges at all, and a Unix socket reaches a
   sandbox running with `network_mode: none`.
@@ -194,7 +205,7 @@ services:
 
 ```sh
 cp docker-compose.example.yml docker-compose.yml   # adjust, swap build → image
-cp mcp.json.example mcp.json                        # adjust
+mkdir -p config && cp mcp.json.example config/mcp.json  # adjust
 mkdir -p data && sudo chown -R 1000:1000 data       # container runs as uid 1000
 docker compose up -d
 ```
@@ -208,7 +219,7 @@ docker run -d --name mcp-hub \
   -e EXTERNAL_URL="https://mcp.example.net" \
   -e PASSWORD_HASH="$(htpasswd -bnBC 10 '' 'yourpassword' | tr -d ':\n')" \
   -e TRUSTED_PROXIES="192.168.1.0/24" \
-  -v "$PWD/mcp.json:/config/mcp.json:ro" \
+  -v "$PWD/config:/config:ro" \
   -v "$PWD/data:/data" \
   ghcr.io/ni-c/mcp-hub:0.6.0
 ```
@@ -220,7 +231,7 @@ Update to a newer image with `docker compose pull && docker compose up -d`
 
 ```sh
 cp docker-compose.example.yml docker-compose.yml   # adjust
-cp mcp.json.example mcp.json                        # adjust
+mkdir -p config && cp mcp.json.example config/mcp.json  # adjust
 docker compose up -d --build
 ```
 

package/dist/config.js

@@ -76,6 +76,26 @@ function requireLiteral(name, field, value) {
     }
     return value;
 }
+function parseLifecycle(name, entry) {
+    if (entry.keepAlive !== undefined && typeof entry.keepAlive !== 'boolean') {
+        throw new ConfigError(`Server "${name}": "keepAlive" must be a boolean`);
+    }
+    const idleMinutes = entry.idleMinutes;
+    if (idleMinutes !== undefined && (!Number.isSafeInteger(idleMinutes) || idleMinutes < 1)) {
+        throw new ConfigError(`Server "${name}": "idleMinutes" must be a positive integer`);
+    }
+    if (entry.keepAlive === true && idleMinutes !== undefined) {
+        throw new ConfigError(`Server "${name}": "keepAlive" and "idleMinutes" are mutually exclusive`);
+    }
+    return { keepAlive: entry.keepAlive === true, ...(idleMinutes !== undefined ? { idleMinutes: idleMinutes } : {}) };
+}
+function rejectLifecycle(name, entry, kind) {
+    for (const field of ['keepAlive', 'idleMinutes']) {
+        if (entry[field] !== undefined) {
+            throw new ConfigError(`Server "${name}": "${field}" is only supported on stdio and docker servers — the hub does not manage the lifetime of ${kind} servers`);
+        }
+    }
+}
 function parseDockerServer(name, entry, expand, hub) {
     if (entry.command !== undefined && !Array.isArray(entry.command)) {
         throw new ConfigError(`Server "${name}": for docker servers "command" is an array of strings (the container's Cmd)`);
@@ -170,7 +190,8 @@ function parseDockerServer(name, entry, expand, hub) {
         readOnly: entry.readOnly !== false,
         tmpfs,
         ...(entry.user !== undefined ? { user: requireLiteral(name, 'user', entry.user) } : {}),
-        hub
+        hub,
+        ...parseLifecycle(name, entry)
     };
 }
 function parseSocketServer(name, entry, type, expand, hub) {
@@ -204,10 +225,13 @@ function parseServer(name, entry, env, options) {
     }
     if (type === 'docker')
         return parseDockerServer(name, entry, expand, hub);
-    if (type === 'unix' || type === 'tcp')
+    if (type === 'unix' || type === 'tcp') {
+        rejectLifecycle(name, entry, type);
         return parseSocketServer(name, entry, type, expand, hub);
+    }
     const isRemote = (typeof type === 'string' && type !== 'stdio') || entry.url !== undefined;
     if (isRemote) {
+        rejectLifecycle(name, entry, 'remote');
         if (typeof type === 'string' && type !== 'stdio' && !REMOTE_TYPES.has(type)) {
             throw new ConfigError(`Server "${name}": unknown type "${type}" (supported: stdio, http, sse, docker, unix, tcp)`);
         }
@@ -243,7 +267,8 @@ function parseServer(name, entry, env, options) {
         command: expand(entry.command),
         args: args.map(expand),
         env: expandRecord(envEntry, expand),
-        hub
+        hub,
+        ...parseLifecycle(name, entry)
     };
 }
 export function parseConfig(json, env = process.env, options) {
@@ -329,7 +354,8 @@ export class ConfigWatcher extends EventEmitter {
         // host-side edits do not cross the mount boundary, so directory watching
         // never fires there. Stat polling catches in-place content changes.
         // (Host edits must rewrite the file in place — a rename/replace creates a
-        // new inode the mount cannot follow.)
+        // new inode the mount cannot follow. warnSingleFileMount() flags that
+        // setup at startup; the recommended directory mount has neither problem.)
         fs.watchFile(this.filePath, { interval: this.pollIntervalMs }, (curr, prev) => {
             if (curr.mtimeMs === prev.mtimeMs && curr.size === prev.size)
                 return;

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA2F7B,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACpF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AACzE,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,gDAAgD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD,SAAS,WAAW,CAAC,GAAsB,EAAE,OAAiC;IAC5E,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;IACrD,OAAO,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,MAAgB;IACpE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnI,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,sCAAsC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0DAA0D,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,yDAAyD,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+EAA+E,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,MAAgB,EAAE,GAAY;IACrG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,8EAA8E,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACnC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4CAA4C,oBAAoB,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,cAAc,MAAM,0DAA0D,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC/H,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,mBAAmB,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,uDAAuD,CAAC,CAAC;QAC1H,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,mBAAmB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;IAC/H,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC3C,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,KAAK,CAAC,IAAI,IAAI,CAAC;YACf,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CACnB,WAAW,IAAI,OAAO,SAAS,kHAAkH,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACjD,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpJ,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1H,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO;QACP,KAAK;QACL,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB;QAC5F,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAE,KAAK,CAAC,SAAoB,CAAC,CAAC,CAAC,yBAAyB;QAClG,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,KAAK;QAClC,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,IAAoB,EAAE,MAAgB,EAAE,GAAY;IAC3H,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,IAAI,yDAAyD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wDAAwD,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAK,IAAe,GAAG,CAAC,IAAK,IAAe,GAAG,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,GAAG,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA8B,EAAE,GAAsB,EAAE,OAAsB;IAC/G,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAEhG,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;IAE3F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oBAAoB,IAAI,oDAAoD,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAC1C,GAAG;YACH,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACtB,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACpG,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA+B,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/G,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAI,GAA+D,CAAC,UAAU,CAAC;IAC5F,MAAM,MAAM,GAAc,IAAI,GAAG,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,0BAA0B,YAAY,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACvG,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,SAAS,GAAG,SAAS;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1E,OAAO,CAAC,IAAI,CACV,GAAG,SAAS,oBAAoB,IAAI,mCAAmC,KAAK,CAAC,KAAK,KAAK;YACrF,kFAAkF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,KAAgB;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IAK1B,QAAQ;IAClB,OAAO;IACG,GAAG;IACH,cAAc;IACd,YAAY;IACZ,QAAQ;IATnB,OAAO,CAAgB;IACvB,QAAQ,CAAkB;IAElC,YACmB,QAAgB,EAC1B,OAAkB,EACR,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,cAAc,GAAG,KAAK,EACtB,YAA2B,EAC3B,QAAsC;QAEvD,KAAK,EAAE,CAAC;wBAPS,QAAQ;uBAClB,OAAO;mBACG,GAAG;8BACH,cAAc;4BACd,YAAY;wBACZ,QAAQ;IAG3B,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO;YACnD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,sCAAsC;QACtC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACrE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM;QACZ,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI;QACF,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAmG7B,MAAM,YAAY,GAAG,kBAAkB,CAAC;AACxC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACjJ,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACpF,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,qBAAqB,GAAG,0CAA0C,CAAC;AACzE,MAAM,YAAY,GAAG,sEAAsE,CAAC;AAC5F,MAAM,cAAc,GAAG,mBAAmB,CAAC;AAC3C,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACvD,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC9E,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,WAAW,CAAC,gDAAgD,IAAI,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAgBD,SAAS,WAAW,CAAC,GAAsB,EAAE,OAAiC;IAC5E,IAAI,OAAO,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;IACrD,OAAO,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,YAAY,CAAC,MAA8B,EAAE,MAAgB;IACpE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACrE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+BAA+B,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAiB,CAAC;AAC3B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,KAAa,EAAE,KAAc;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACnI,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,sCAAsC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,KAA+B,CAAC;AACzC,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,KAAc;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;QAC/H,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0DAA0D,CAAC,CAAC;IAChI,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,yDAAyD,CAAC,CAAC;IAC5G,MAAM,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;IACxC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;IACpH,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,KAAa,EAAE,KAAa;IAChE,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,+EAA+E,CAAC,CAAC;IACpI,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAQD,SAAS,cAAc,CAAC,IAAY,EAAE,KAA8B;IAClE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,kCAAkC,CAAC,CAAC;IAC3E,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,IAAK,WAAsB,GAAG,CAAC,CAAC,EAAE,CAAC;QACrG,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6CAA6C,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,yDAAyD,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,WAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/H,CAAC;AAED,SAAS,eAAe,CAAC,IAAY,EAAE,KAA8B,EAAE,IAAY;IACjF,KAAK,MAAM,KAAK,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,KAAK,6FAA6F,IAAI,UAAU,CAAC,CAAC;QAChK,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,MAAgB,EAAE,GAAY;IACrG,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,8EAA8E,CAAC,CAAC;IACvH,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC;IACnC,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wCAAwC,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IACtC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;QAC9G,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4CAA4C,oBAAoB,EAAE,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IACtH,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,cAAc,MAAM,0DAA0D,CAAC,CAAC;QACvH,CAAC;QACD,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,2DAA2D,CAAC,CAAC;QACjI,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,KAAK,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;QAC/H,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,mBAAmB,KAAK,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9G,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,uDAAuD,CAAC,CAAC;QAC1H,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,KAAK;gBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,YAAY,IAAI,mBAAmB,CAAC,CAAC;QAC9G,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACrE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;IAC/H,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC3C,wEAAwE;QACxE,kEAAkE;QAClE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oDAAoD,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpH,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,aAAa,KAAK,4BAA4B,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,IAAK,KAAK,CAAC,SAAoB,GAAG,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,2CAA2C,CAAC,CAAC;IACpF,CAAC;IACD,IACE,KAAK,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,KAAK,CAAC,IAAI,IAAI,CAAC;YACf,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;QACtF,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CACnB,WAAW,IAAI,OAAO,SAAS,kHAAkH,CAClJ,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC;QACjD,IAAI;QACJ,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpJ,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1H,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,EAAE,YAAY,CAAC,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC;QAC5E,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,OAAO;QACP,KAAK;QACL,OAAO,EAAE,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC;QACjD,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,qBAAqB;QAC5F,SAAS,EAAE,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAE,KAAK,CAAC,SAAoB,CAAC,CAAC,CAAC,yBAAyB;QAClG,IAAI,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QACjE,QAAQ,EAAE,KAAK,CAAC,QAAQ,KAAK,KAAK;QAClC,KAAK;QACL,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,GAAG;QACH,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAA8B,EAAE,IAAoB,EAAE,MAAgB,EAAE,GAAY;IAC3H,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,OAAO,IAAI,yDAAyD,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,wDAAwD,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACtF,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qCAAqC,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAK,IAAe,GAAG,CAAC,IAAK,IAAe,GAAG,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,kDAAkD,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAc,EAAE,GAAG,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA8B,EAAE,GAAsB,EAAE,OAAsB;IAC/G,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,4BAA4B,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACtC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;QACnC,OAAO,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,CAAC;IAE3F,IAAI,QAAQ,EAAE,CAAC;QACb,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACvC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,oBAAoB,IAAI,oDAAoD,CAAC,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,uCAAuC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,+CAA+C,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,6BAA6B,CAAC,CAAC;QACtE,CAAC;QACD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;YAC1C,GAAG;YACH,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC;YACtC,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,iCAAiC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;QAC9B,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;QACtB,GAAG,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC;QACnC,GAAG;QACH,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACpG,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,WAAW,CAAC,6BAA8B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAA+B,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/G,MAAM,IAAI,WAAW,CAAC,+DAA+D,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAI,GAA+D,CAAC,UAAU,CAAC;IAC5F,MAAM,MAAM,GAAc,IAAI,GAAG,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,0BAA0B,YAAY,GAAG,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,WAAW,CAAC,gBAAgB,IAAI,eAAe,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,IAAI,WAAW,CAAC,WAAW,IAAI,qBAAqB,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,OAAsB;IACvG,OAAO,WAAW,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAiB,EAAE,SAAS,GAAG,SAAS;IAC9E,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,SAAS;QAC1E,OAAO,CAAC,IAAI,CACV,GAAG,SAAS,oBAAoB,IAAI,mCAAmC,KAAK,CAAC,KAAK,KAAK;YACrF,kFAAkF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,WAAW,CAAC,MAAiB,EAAE,KAAgB;IAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,YAAY;IAK1B,QAAQ;IAClB,OAAO;IACG,GAAG;IACH,cAAc;IACd,YAAY;IACZ,QAAQ;IATnB,OAAO,CAAgB;IACvB,QAAQ,CAAkB;IAElC,YACmB,QAAgB,EAC1B,OAAkB,EACR,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,cAAc,GAAG,KAAK,EACtB,YAA2B,EAC3B,QAAsC;QAEvD,KAAK,EAAE,CAAC;wBAPS,QAAQ;uBAClB,OAAO;mBACG,GAAG;8BACH,cAAc;4BACd,YAAY;wBACZ,QAAQ;IAG3B,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YAChD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;gBAAE,OAAO;YACnD,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,qEAAqE;QACrE,yEAAyE;QACzE,oEAAoE;QACpE,0EAA0E;QAC1E,sEAAsE;QACtE,0EAA0E;QAC1E,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;YAC5E,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBAAE,OAAO;YACrE,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC5B,IAAI,CAAC,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,MAAM;QACZ,IAAI,IAAe,CAAC;QACpB,IAAI,CAAC;YACH,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,mFAAmF;YACnF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC9F,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,IAAI;QACF,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/docker-proxy/index.js

@@ -4,8 +4,11 @@ import path from 'node:path';
 import { ConfigWatcher, loadConfig, warnMutableDockerImages } from '../config.js';
 import { installFileLogging } from '../logfile.js';
 import { VERSION } from '../version.js';
-import { createDockerProxy } from './server.js';
+import { containerName } from '../sandbox/container-spec.js';
+import { createDockerProxy, recreateSandbox } from './server.js';
+import { SecretsWatcher } from './secrets-watcher.js';
 import { SecretStore, validateConfigSecrets } from './secrets.js';
+import { warnSingleFileMount } from '../mount-check.js';
 /**
  * mcp-hub-docker-proxy: the only component that touches /var/run/docker.sock.
  *
@@ -37,6 +40,7 @@ catch (error) {
     console.error(`mcp-hub-docker-proxy: cannot read ${configPath}: ${error.message}`);
     process.exit(1);
 }
+warnSingleFileMount(configPath, 'mcp-hub-docker-proxy');
 // Fail loudly at startup rather than at the first create: a missing or
 // world-readable secret file is an operator mistake, and finding out about it
 // when a sandbox refuses to start is finding out too late.
@@ -59,9 +63,34 @@ const watcher = new ConfigWatcher(configPath, config, process.env, 3_000, { expa
 watcher.on('change', (_next, diff) => {
     warnMutableDockerImages(_next, 'mcp-hub-docker-proxy');
     console.log(`mcp-hub-docker-proxy: policy reloaded (added: ${diff.added.join(',') || '-'} removed: ${diff.removed.join(',') || '-'} changed: ${diff.changed.join(',') || '-'})`);
+    secretsWatcher.refresh();
 });
 watcher.on('error', error => console.error(`mcp-hub-docker-proxy: ignoring broken config update: ${error.message}`));
 watcher.start();
+// A secrets edit recreates the affected sandbox: the hub cannot react to it
+// (it never sees these files — that is the point of secretsFrom), and the
+// values are only applied at container create. Without this, a rotated token
+// would sit unused until the next hub restart.
+const secretsWatcher = new SecretsWatcher(secrets, secretsDir, () => watcher.current);
+secretsWatcher.on('change', (set, servers) => {
+    for (const server of servers) {
+        console.log(`mcp-hub-docker-proxy: secrets for "${set}" changed, recreating ${containerName(server)} (the hub restarts it with the new values)`);
+        recreateSandbox({ dockerSocket }, server)
+            .then(result => {
+            if (result === 'absent') {
+                console.log(`mcp-hub-docker-proxy: no running container for "${server}" — the next create picks up the new values`);
+            }
+        })
+            .catch(error => console.error(`mcp-hub-docker-proxy: cannot recreate ${containerName(server)}: ${error.message}`));
+    }
+});
+secretsWatcher.on('error', (error) => console.error(`mcp-hub-docker-proxy: ignoring broken secrets update: ${error.message}`));
+if (env('SANDBOX_SECRETS_WATCH', 'true') !== 'false') {
+    secretsWatcher.start();
+}
+else {
+    console.log('mcp-hub-docker-proxy: SANDBOX_SECRETS_WATCH=false — secrets changes apply on the next container create only');
+}
 const server = createDockerProxy({ dockerSocket, config: () => watcher.current, secretsDir });
 // A leftover socket file from an unclean exit would make listen() fail with
 // EADDRINUSE forever; there is no other writer for this path.
@@ -89,6 +118,7 @@ server.listen(listenSocket, () => {
 const shutdown = (signal) => {
     console.log(`mcp-hub-docker-proxy: received ${signal}, shutting down`);
     watcher.stop();
+    secretsWatcher.stop();
     server.close();
     try {
         fs.unlinkSync(listenSocket);

package/dist/docker-proxy/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/docker-proxy/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAkB,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;;;;;GAUG;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAElE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,MAAiB,CAAC;AACtB,IAAI,CAAC;IACH,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,uEAAuE;AACvE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,kDAAmD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS,IAAI,CAAC,MAAM,qBAAqB,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3I,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnC,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CACpK,CAAC;AACJ,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,EAAE,CAAC;AAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAAC,MAAM,CAAC;IACP,2CAA2C;AAC7C,CAAC;AACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,iBAAiB,YAAY,OAAO,YAAY,KAAK,aAAa,qBAAqB,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,iBAAiB,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;IACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/docker-proxy/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,uBAAuB,EAAkB,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;;;;;;;;GAUG;AAEH,SAAS,GAAG,CAAC,IAAY,EAAE,QAAgB;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,GAAG,GAAG,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAC1D,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,wBAAwB,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,GAAG,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AAElE,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzB,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED,IAAI,MAAiB,CAAC;AACtB,IAAI,CAAC;IACH,MAAM,GAAG,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;AAClE,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,qCAAqC,UAAU,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,mBAAmB,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAC;AAExD,uEAAuE;AACvE,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;AAC5C,IAAI,CAAC;IACH,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACzC,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,KAAK,CAAC,kDAAmD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AACD,uBAAuB,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;AACxD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;IACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,SAAS;IACzE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,SAAS,IAAI,CAAC,MAAM,qBAAqB,KAAK,CAAC,WAAW,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,CAAC,EAAE,CAAC,qBAAqB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3I,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;IACnC,uBAAuB,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CACT,iDAAiD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,aAAa,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CACpK,CAAC;IACF,cAAc,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC,CAAC,CAAC;AACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,wDAAyD,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAChI,OAAO,CAAC,KAAK,EAAE,CAAC;AAEhB,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,+CAA+C;AAC/C,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACtF,cAAc,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAW,EAAE,OAAiB,EAAE,EAAE;IAC7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CACT,sCAAsC,GAAG,yBAAyB,aAAa,CAAC,MAAM,CAAC,4CAA4C,CACpI,CAAC;QACF,eAAe,CAAC,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC;aACtC,IAAI,CAAC,MAAM,CAAC,EAAE;YACb,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,mDAAmD,MAAM,6CAA6C,CAAC,CAAC;YACtH,CAAC;QACH,CAAC,CAAC;aACD,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,yCAAyC,aAAa,CAAC,MAAM,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAClI,CAAC;AACH,CAAC,CAAC,CAAC;AACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,yDAAyD,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACtI,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,KAAK,OAAO,EAAE,CAAC;IACrD,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,GAAG,CAAC,6GAA6G,CAAC,CAAC;AAC7H,CAAC;AAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;AAE9F,4EAA4E;AAC5E,8DAA8D;AAC9D,IAAI,CAAC;IACH,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,QAAQ,EAAE;QAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACvD,CAAC;AAAC,MAAM,CAAC;IACP,2CAA2C;AAC7C,CAAC;AACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9D,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,2EAA2E;IAC3E,2EAA2E;IAC3E,qEAAqE;IACrE,wDAAwD;IACxD,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,KAAK,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qCAAqC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC;IAClJ,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,wBAAwB,OAAO,iBAAiB,YAAY,OAAO,YAAY,KAAK,aAAa,qBAAqB,CAAC,CAAC;AACtI,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;IAClC,OAAO,CAAC,GAAG,CAAC,kCAAkC,MAAM,iBAAiB,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,EAAE,CAAC;IACf,cAAc,CAAC,IAAI,EAAE,CAAC;IACtB,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,gBAAgB;IAClB,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC;AACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;AACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC/C,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,MAAM,CAAC,EAAE;IACxC,OAAO,CAAC,KAAK,CAAC,8CAA8C,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAC7I,CAAC,CAAC,CAAC"}

package/dist/docker-proxy/secrets-watcher.js

@@ -0,0 +1,174 @@
+import { EventEmitter } from 'node:events';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SecretError } from './secrets.js';
+/**
+ * Watches the sandbox secrets directory and reports when the *content* of a
+ * referenced set changes.
+ *
+ * Why this lives in the proxy and not the hub: the hub never sees the secret
+ * values (that is the point of `secretsFrom`), so it cannot know when they
+ * change. The proxy can — and it is also the only component allowed to act on
+ * it, by recreating the affected sandbox container so the next create picks up
+ * the new values. The values themselves are never cached here; `policy.ts`
+ * reads them fresh from disk on every create. This watcher only supplies the
+ * missing trigger.
+ *
+ * Watching strategy mirrors ConfigWatcher: fs.watch on the directory for the
+ * common case, plus stat polling per referenced file as the fallback for
+ * bind mounts where host-side inotify events do not cross the mount boundary.
+ */
+const DEBOUNCE_MS = 1_000;
+/** Content identity of a secret set: key order and formatting do not matter. */
+function fingerprint(secrets) {
+    return JSON.stringify(Object.entries(secrets).sort(([a], [b]) => a.localeCompare(b)));
+}
+/** All docker servers that reference a given secret set. */
+function referencingServers(config, set) {
+    const servers = [];
+    for (const [name, entry] of config) {
+        if (entry.kind === 'docker' && entry.secretsFrom === set)
+            servers.push(name);
+    }
+    return servers;
+}
+function referencedSets(config) {
+    const sets = new Set();
+    for (const entry of config.values()) {
+        if (entry.kind === 'docker' && entry.secretsFrom !== undefined)
+            sets.add(entry.secretsFrom);
+    }
+    return sets;
+}
+export class SecretsWatcher extends EventEmitter {
+    store;
+    dir;
+    config;
+    pollIntervalMs;
+    debounceMs;
+    watcher;
+    debounce = new Map();
+    polled = new Map(); // set name -> watched file path
+    fingerprints = new Map();
+    constructor(store, dir, config, pollIntervalMs = 3_000, debounceMs = DEBOUNCE_MS) {
+        super();
+        this.store = store;
+        this.dir = dir;
+        this.config = config;
+        this.pollIntervalMs = pollIntervalMs;
+        this.debounceMs = debounceMs;
+    }
+    start() {
+        // Baseline first: what is on disk right now is the state the running
+        // containers were created from (index.ts validated it at startup), so it
+        // must not count as a change.
+        this.refresh();
+        try {
+            this.watcher = fs.watch(this.dir, (_event, filename) => {
+                if (filename === null || !filename.endsWith('.env'))
+                    return;
+                this.schedule(filename.slice(0, -'.env'.length));
+            });
+        }
+        catch (error) {
+            // Polling still covers every referenced file; say so rather than dying.
+            this.emit('error', new Error(`cannot watch ${this.dir}, falling back to polling only: ${error.message}`));
+        }
+    }
+    /**
+     * Aligns the polled-file list and baselines with the current config. Called
+     * at start and whenever the config reloads — a set that gained its first
+     * reference starts being watched, one that lost its last stops.
+     */
+    refresh() {
+        const wanted = referencedSets(this.config());
+        for (const [set, file] of this.polled) {
+            if (wanted.has(set))
+                continue;
+            fs.unwatchFile(file);
+            this.polled.delete(set);
+            this.fingerprints.delete(set);
+        }
+        for (const set of wanted) {
+            if (this.polled.has(set))
+                continue;
+            let file;
+            try {
+                file = this.store.pathFor(set);
+            }
+            catch (error) {
+                this.emit('error', error);
+                continue;
+            }
+            fs.watchFile(file, { interval: this.pollIntervalMs }, (curr, prev) => {
+                if (curr.mtimeMs === prev.mtimeMs && curr.size === prev.size)
+                    return;
+                this.schedule(set);
+            });
+            this.polled.set(set, file);
+            // A set that appears without a baseline (new reference after a config
+            // reload) gets one silently: its container, if any, is created after
+            // this point and reads the file fresh anyway.
+            try {
+                this.fingerprints.set(set, fingerprint(this.store.load(set)));
+            }
+            catch {
+                // Leave it without a baseline; the first *valid* read becomes one.
+            }
+        }
+    }
+    schedule(set) {
+        const timer = this.debounce.get(set);
+        if (timer)
+            clearTimeout(timer);
+        // A secrets file is usually edited by hand; a generous debounce keeps a
+        // half-finished save from triggering a container restart per keystroke.
+        this.debounce.set(set, setTimeout(() => {
+            this.debounce.delete(set);
+            this.check(set);
+        }, this.debounceMs));
+    }
+    check(set) {
+        const config = this.config();
+        const servers = referencingServers(config, set);
+        if (servers.length === 0)
+            return; // unreferenced (or no longer referenced): none of our business
+        let secrets;
+        try {
+            secrets = this.store.load(set);
+            // Same collision rule as validateConfigSecrets: a secret must not shadow
+            // a configured env key, whose value the hub already fixed.
+            for (const server of servers) {
+                const entry = config.get(server);
+                if (entry?.kind !== 'docker')
+                    continue;
+                const collision = Object.keys(secrets).find(key => Object.hasOwn(entry.env, key));
+                if (collision)
+                    throw new SecretError(`secret "${collision}" collides with a configured env key of server "${server}"`);
+            }
+        }
+        catch (error) {
+            // Fail safe: a broken edit must not take the running container down —
+            // restarting it now would only produce a create that fails on the same
+            // file. Keep the old baseline so the next valid content still fires.
+            this.emit('error', new Error(`${path.basename(this.polled.get(set) ?? set)}: ${error.message}`));
+            return;
+        }
+        const next = fingerprint(secrets);
+        const previous = this.fingerprints.get(set);
+        this.fingerprints.set(set, next);
+        if (previous === undefined || previous === next)
+            return; // baseline, touch, or comment-only edit
+        this.emit('change', set, servers);
+    }
+    stop() {
+        for (const timer of this.debounce.values())
+            clearTimeout(timer);
+        this.debounce.clear();
+        this.watcher?.close();
+        for (const file of this.polled.values())
+            fs.unwatchFile(file);
+        this.polled.clear();
+    }
+}
+//# sourceMappingURL=secrets-watcher.js.map

package/dist/docker-proxy/secrets-watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-watcher.js","sourceRoot":"","sources":["../../src/docker-proxy/secrets-watcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAe,MAAM,cAAc,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,gFAAgF;AAChF,SAAS,WAAW,CAAC,OAA+B;IAClD,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,4DAA4D;AAC5D,SAAS,kBAAkB,CAAC,MAAiB,EAAE,GAAW;IACxD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,GAAG;YAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,MAAiB;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACpC,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,YAAY;IAO3B,KAAK;IACL,GAAG;IACH,MAAM;IACN,cAAc;IACd,UAAU;IAVrB,OAAO,CAAgB;IACd,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC7C,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,gCAAgC;IACpE,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1D,YACmB,KAAkB,EAClB,GAAW,EACX,MAAuB,EACvB,cAAc,GAAG,KAAK,EACtB,UAAU,GAAG,WAAW;QAEzC,KAAK,EAAE,CAAC;qBANS,KAAK;mBACL,GAAG;sBACH,MAAM;8BACN,cAAc;0BACd,UAAU;IAG7B,CAAC;IAED,KAAK;QACH,qEAAqE;QACrE,yEAAyE;QACzE,8BAA8B;QAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBACrD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;oBAAE,OAAO;gBAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,GAAG,mCAAoC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvH,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,OAAO;QACL,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC9B,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAc,CAAC,CAAC;gBACnC,SAAS;YACX,CAAC;YACD,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;gBACnE,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;oBAAE,OAAO;gBACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,sEAAsE;YACtE,qEAAqE;YACrE,8CAA8C;YAC9C,IAAI,CAAC;gBACH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,mEAAmE;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,QAAQ,CAAC,GAAG,CACf,GAAG,EACH,UAAU,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CACpB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,GAAW;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,+DAA+D;QAEjG,IAAI,OAA+B,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/B,yEAAyE;YACzE,2DAA2D;YAC3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ;oBAAE,SAAS;gBACvC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;gBAClF,IAAI,SAAS;oBAAE,MAAM,IAAI,WAAW,CAAC,WAAW,SAAS,mDAAmD,MAAM,GAAG,CAAC,CAAC;YACzH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,uEAAuE;YACvE,qEAAqE;YACrE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC5G,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,CAAC,wCAAwC;QACjG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,IAAI;QACF,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACtB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE;YAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF"}