@the-librarian/cli 1.20.1 → 1.21.1

package/dist/server/deploy-state.js

@@ -8,16 +8,56 @@
 //
 // SECURITY (AGENTS.md / spec §11): this file is NON-SECRET by construction. It
 // carries ONLY non-secret fields — a bind host, a volume name (and an optional
-// host data dir), a ref, an image tag, and the container name. It NEVER carries
-// a bearer token, master
-// key, or admin token. `writeDeployState` whitelists exactly those fields, so a
+// host data dir), a ref, image identity/provenance, and the container name. It
+// NEVER carries a bearer token, master key, or admin token. `writeDeployState`
+// whitelists exactly those fields, so a
 // caller that accidentally passes extra keys (a smuggled secret) cannot leak
 // them into the file. The master key / admin token are surfaced to stdout once
 // by `up` and persisted nowhere host-side — that contract is unchanged.
 import fs from "node:fs";
 import path from "node:path";
-/** The keys we ever persist — the whitelist that keeps secrets out of the file. */
-const STATE_KEYS = ["containerName", "host", "dataVolume", "ref", "imageTag"];
+import { CANONICAL_IMAGE_NAME, isReleasedVersionRef } from "./deployment-image.js";
+/** Required legacy keys; optional fields are individually picked and validated below. */
+const REQUIRED_STATE_KEYS = ["containerName", "host", "dataVolume", "ref", "imageTag"];
+const PERSISTED_STATE_KEYS = new Set([
+    ...REQUIRED_STATE_KEYS,
+    "dataDir",
+    "dashboardPort",
+    "imageSource",
+    "imageRef",
+    "imageDigest",
+]);
+const IMAGE_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const VERSION_IMAGE_PREFIX = `${CANONICAL_IMAGE_NAME}:`;
+const DIGEST_IMAGE_PREFIX = `${CANONICAL_IMAGE_NAME}@`;
+function isCanonicalVersionImageRef(imageRef) {
+    return (imageRef.startsWith(VERSION_IMAGE_PREFIX) &&
+        isReleasedVersionRef(imageRef.slice(VERSION_IMAGE_PREFIX.length)));
+}
+function isCanonicalDigestImageRef(imageRef) {
+    return (imageRef.startsWith(DIGEST_IMAGE_PREFIX) &&
+        IMAGE_DIGEST_PATTERN.test(imageRef.slice(DIGEST_IMAGE_PREFIX.length)));
+}
+function validImageMetadata(state) {
+    if (state.imageSource === undefined) {
+        return state.imageRef === undefined && state.imageDigest === undefined;
+    }
+    if (state.imageSource === "source") {
+        return state.imageRef === state.imageTag && state.imageDigest === undefined;
+    }
+    if (state.imageSource !== "registry")
+        return false;
+    const expectedVersionRef = `${CANONICAL_IMAGE_NAME}:${state.ref}`;
+    return (isReleasedVersionRef(state.ref) &&
+        state.imageRef === expectedVersionRef &&
+        isCanonicalVersionImageRef(state.imageRef) &&
+        state.imageTag === expectedVersionRef &&
+        state.imageDigest !== undefined &&
+        isCanonicalDigestImageRef(state.imageDigest));
+}
+function hasOnlyPersistedStateKeys(state) {
+    return Reflect.ownKeys(state).every((key) => typeof key === "string" && PERSISTED_STATE_KEYS.has(key));
+}
 /** `<dir>/deploy-state.json` — the deploy-state file path within a deploy dir. */
 export function deployStatePath(dir) {
     return path.join(dir, "deploy-state.json");
@@ -25,11 +65,16 @@ export function deployStatePath(dir) {
 /**
  * Write the deploy-state to `<dir>/deploy-state.json`, creating `dir` if absent.
  *
- * Only the five declared fields are persisted — a `pick`, not a spread — so no
- * extra key (e.g. a smuggled token) can ride along into the file. The file is
- * non-secret, so it gets ordinary (not 0600) permissions.
+ * Inputs with undeclared own keys are rejected, then declared fields are picked
+ * explicitly. The file is non-secret, so it gets ordinary permissions.
  */
 export function writeDeployState(dir, state) {
+    if (!hasOnlyPersistedStateKeys(state)) {
+        throw new TypeError("Invalid deploy state fields: only whitelisted non-secret deployment metadata is allowed; unexpected own keys are rejected.");
+    }
+    if (!validImageMetadata(state)) {
+        throw new TypeError("Invalid deploy image metadata: expected legacy fields only; source with imageRef matching imageTag and no digest; or registry with a matching canonical version tag and full lowercase sha256 digest reference.");
+    }
     fs.mkdirSync(dir, { recursive: true });
     // Pick ONLY the whitelisted keys — never spread `state`, which could carry
     // extra (secret-shaped) properties a caller smuggled in.
@@ -48,6 +93,12 @@ export function writeDeployState(dir, state) {
     // written before this field stays byte-compatible until the next write).
     if (state.dashboardPort !== undefined)
         safe.dashboardPort = state.dashboardPort;
+    if (state.imageSource !== undefined)
+        safe.imageSource = state.imageSource;
+    if (state.imageRef !== undefined)
+        safe.imageRef = state.imageRef;
+    if (state.imageDigest !== undefined)
+        safe.imageDigest = state.imageDigest;
     fs.writeFileSync(deployStatePath(dir), `${JSON.stringify(safe, null, 2)}\n`, "utf8");
 }
 /**
@@ -73,7 +124,9 @@ export function readDeployState(dir) {
     if (typeof parsed !== "object" || parsed === null)
         return null;
     const obj = parsed;
-    for (const key of STATE_KEYS) {
+    if (!hasOnlyPersistedStateKeys(obj))
+        return null;
+    for (const key of REQUIRED_STATE_KEYS) {
         if (typeof obj[key] !== "string")
             return null;
     }
@@ -84,6 +137,21 @@ export function readDeployState(dir) {
         ref: obj.ref,
         imageTag: obj.imageTag,
     };
+    if (obj.imageSource !== undefined &&
+        obj.imageSource !== "registry" &&
+        obj.imageSource !== "source") {
+        return null;
+    }
+    if (obj.imageRef !== undefined && typeof obj.imageRef !== "string")
+        return null;
+    if (obj.imageDigest !== undefined && typeof obj.imageDigest !== "string")
+        return null;
+    if (obj.imageSource !== undefined)
+        result.imageSource = obj.imageSource;
+    if (typeof obj.imageRef === "string")
+        result.imageRef = obj.imageRef;
+    if (typeof obj.imageDigest === "string")
+        result.imageDigest = obj.imageDigest;
     // Optional, back-compatible: present only on `--data-dir` deploys written after
     // this field existed; left undefined otherwise (old states still validate).
     if (typeof obj.dataDir === "string")
@@ -95,6 +163,6 @@ export function readDeployState(dir) {
     if (typeof obj.dashboardPort === "number" && Number.isInteger(obj.dashboardPort)) {
         result.dashboardPort = obj.dashboardPort;
     }
-    return result;
+    return validImageMetadata(result) ? result : null;
 }
 //# sourceMappingURL=deploy-state.js.map

package/dist/server/deploy-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-state.js","sourceRoot":"","sources":["../../src/server/deploy-state.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAChF,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AAExE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAkC7B,mFAAmF;AACnF,MAAM,UAAU,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAEvF,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAkB;IAC9D,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,IAAI,GAAgB;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChD,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAChF,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAgB;QAC1B,aAAa,EAAE,GAAG,CAAC,aAAuB;QAC1C,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAkB;KACjC,CAAC;IACF,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAClE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"deploy-state.js","sourceRoot":"","sources":["../../src/server/deploy-state.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,+EAA+E;AAC/E,wCAAwC;AACxC,6EAA6E;AAC7E,+EAA+E;AAC/E,wEAAwE;AAExE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AA+DnF,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,CAAU,CAAC;AAChG,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAC3C,GAAG,mBAAmB;IACtB,SAAS;IACT,eAAe;IACf,aAAa;IACb,UAAU;IACV,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,oBAAoB,GAAG,GAAG,oBAAoB,GAAG,CAAC;AACxD,MAAM,mBAAmB,GAAG,GAAG,oBAAoB,GAAG,CAAC;AAEvD,SAAS,0BAA0B,CAAC,QAAgB;IAClD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACzC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IACjD,OAAO,CACL,QAAQ,CAAC,UAAU,CAAC,mBAAmB,CAAC;QACxC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAA2B;IACrD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IACnD,MAAM,kBAAkB,GAAG,GAAG,oBAAoB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;IAClE,OAAO,CACL,oBAAoB,CAAC,KAAK,CAAC,GAAG,CAAC;QAC/B,KAAK,CAAC,QAAQ,KAAK,kBAAkB;QACrC,0BAA0B,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1C,KAAK,CAAC,QAAQ,KAAK,kBAAkB;QACrC,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,yBAAyB,CAAC,KAAK,CAAC,WAAW,CAAC,CAC7C,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CACjC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,KAAkB;IAC9D,IAAI,CAAC,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,4HAA4H,CAC7H,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CACjB,iNAAiN,CAClN,CAAC;IACJ,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,2EAA2E;IAC3E,yDAAyD;IACzD,MAAM,IAAI,GAAoC;QAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,CAAC;IACF,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,KAAK,CAAC,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAChD,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAChF,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IACjE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC;IAC1E,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAyB;QACnC,aAAa,EAAE,GAAG,CAAC,aAAuB;QAC1C,IAAI,EAAE,GAAG,CAAC,IAAc;QACxB,UAAU,EAAE,GAAG,CAAC,UAAoB;QACpC,GAAG,EAAE,GAAG,CAAC,GAAa;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAkB;KACjC,CAAC;IACF,IACE,GAAG,CAAC,WAAW,KAAK,SAAS;QAC7B,GAAG,CAAC,WAAW,KAAK,UAAU;QAC9B,GAAG,CAAC,WAAW,KAAK,QAAQ,EAC5B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACtF,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACxE,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC;IACrE,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QAAE,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IAC9E,gFAAgF;IAChF,4EAA4E;IAC5E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAClE,4EAA4E;IAC5E,uEAAuE;IACvE,yEAAyE;IACzE,gCAAgC;IAChC,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;IAC3C,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}

package/dist/server/deployment-image.d.ts

@@ -0,0 +1,65 @@
+/** The immutable release image published by the repository release workflow. */
+export declare const CANONICAL_IMAGE_NAME = "ghcr.io/code-ministry-ltd/the-librarian";
+/** Canonical source label stamped by the release workflow. */
+export declare const CANONICAL_SOURCE_REPOSITORY = "https://github.com/code-ministry-ltd/the-librarian";
+/** Conventional display form: the first 12 hexadecimal characters of a sha256 digest. */
+export declare function shortImageDigest(imageDigest: string): string;
+/** A pulled release image whose provenance and immutable identity were verified. */
+export interface PreparedRegistryImage {
+    imageSource: "registry";
+    ref: string;
+    /** Human-readable canonical version tag retained in deploy state. */
+    imageRef: string;
+    /** Immutable canonical repository digest passed to `docker run`. */
+    imageDigest: string;
+    /** Source commit stamped by the release workflow. */
+    revision: string;
+}
+/** A fail-closed, human-facing registry preparation failure. */
+export declare class DeploymentImageError extends Error {
+    constructor(message: string);
+}
+export interface ReleaseProvenance {
+    revision: string;
+    imageDigest: string;
+}
+export interface PublicHttpResponse {
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}
+export type PublicGithubFetch = (url: string, init: {
+    redirect: "error" | "follow";
+    headers?: Record<string, string>;
+}) => Promise<PublicHttpResponse>;
+export declare function setPublicGithubFetch(next: PublicGithubFetch): void;
+export declare function resetPublicGithubFetch(): void;
+export type ReleaseProvenanceResolver = (ref: string) => Promise<ReleaseProvenance>;
+export declare function setReleaseProvenanceResolver(next: ReleaseProvenanceResolver): void;
+export declare function resetReleaseProvenanceResolver(): void;
+/** A stable released deployment, resolved to a concrete release in the pull flow. */
+export interface RegistryDeploymentTarget {
+    imageSource: "registry";
+    /** Absent when the caller omitted `--ref`; the latest release is resolved later. */
+    ref?: string | undefined;
+}
+/** A branch, tag, commit, or malformed release-like ref that must build from source. */
+export interface SourceDeploymentTarget {
+    imageSource: "source";
+    ref: string;
+}
+export type DeploymentTarget = RegistryDeploymentTarget | SourceDeploymentTarget;
+/** Exact release refs only: `vMAJOR.MINOR.PATCH`, with strict numeric components. */
+export declare function isReleasedVersionRef(ref: string): boolean;
+/**
+ * Select the deployment strategy without doing network or Docker work.
+ * Omitted/blank refs stay unresolved for the later latest-release lookup.
+ */
+export declare function selectDeploymentTarget(ref: string | undefined): DeploymentTarget;
+/**
+ * Pull and validate a stable release image, returning the digest-pinned run target.
+ * This is shared preparation for `up` now and the B3 update flow later.
+ */
+export declare function prepareRegistryImage(ref: string, onProgress: (chunk: string) => void): Promise<PreparedRegistryImage>;
+//# sourceMappingURL=deployment-image.d.ts.map

package/dist/server/deployment-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-image.d.ts","sourceRoot":"","sources":["../../src/server/deployment-image.ts"],"names":[],"mappings":"AAGA,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,4CAA4C,CAAC;AAE9E,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,uDAAuD,CAAC;AAOhG,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,oFAAoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,UAAU,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,gEAAgE;AAChE,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,iBAAiB,GAAG,CAC9B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,KACrE,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAKjC,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAElE;AAED,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAED,MAAM,MAAM,yBAAyB,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AA+BpF,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,yBAAyB,GAAG,IAAI,CAElF;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAED,qFAAqF;AACrF,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,UAAU,CAAC;IACxB,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1B;AAED,wFAAwF;AACxF,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,QAAQ,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,MAAM,gBAAgB,GAAG,wBAAwB,GAAG,sBAAsB,CAAC;AAEjF,qFAAqF;AACrF,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEzD;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,CAMhF;AAmHD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAClC,OAAO,CAAC,qBAAqB,CAAC,CAoFhC"}

package/dist/server/deployment-image.js

@@ -0,0 +1,281 @@
+import { run, stream } from "./docker.js";
+import { redactSecrets } from "./redact.js";
+/** The immutable release image published by the repository release workflow. */
+export const CANONICAL_IMAGE_NAME = "ghcr.io/code-ministry-ltd/the-librarian";
+/** Canonical source label stamped by the release workflow. */
+export const CANONICAL_SOURCE_REPOSITORY = "https://github.com/code-ministry-ltd/the-librarian";
+const IMAGE_DIGEST_PATTERN = /^sha256:[0-9a-f]{64}$/;
+const REVISION_PATTERN = /^[0-9a-f]{40}$/;
+const REQUIRED_PLATFORM = "linux/amd64";
+const GITHUB_API = "https://api.github.com/repos/code-ministry-ltd/the-librarian";
+/** Conventional display form: the first 12 hexadecimal characters of a sha256 digest. */
+export function shortImageDigest(imageDigest) {
+    const match = /@sha256:([0-9a-f]{64})$/.exec(imageDigest);
+    return match?.[1]?.slice(0, 12) ?? imageDigest;
+}
+/** A fail-closed, human-facing registry preparation failure. */
+export class DeploymentImageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "DeploymentImageError";
+    }
+}
+const realPublicGithubFetch = (url, init) => fetch(url, init);
+let publicGithubFetch = realPublicGithubFetch;
+export function setPublicGithubFetch(next) {
+    publicGithubFetch = next;
+}
+export function resetPublicGithubFetch() {
+    publicGithubFetch = realPublicGithubFetch;
+}
+const defaultReleaseProvenanceResolver = async (ref) => {
+    const reference = await fetchGithubJson(`${GITHUB_API}/git/ref/tags/${encodeURIComponent(ref)}`);
+    let object = gitObject(reference);
+    for (let depth = 0; object.type === "tag" && depth < 5; depth += 1) {
+        object = gitObject(await fetchGithubJson(`${GITHUB_API}/git/tags/${object.sha}`));
+    }
+    if (object.type !== "commit" || !REVISION_PATTERN.test(object.sha)) {
+        throw new Error(`GitHub tag ${ref} did not peel to a full commit SHA.`);
+    }
+    const release = await fetchGithubJson(`${GITHUB_API}/releases/tags/${encodeURIComponent(ref)}`);
+    const assets = objectRecord(release).assets;
+    const receiptUrl = Array.isArray(assets)
+        ? assets.map(objectRecord).find((asset) => asset.name === "docker-image-digest.txt")
+            ?.browser_download_url
+        : undefined;
+    const expectedReceiptUrl = `${CANONICAL_SOURCE_REPOSITORY}/releases/download/${ref}/docker-image-digest.txt`;
+    if (receiptUrl !== expectedReceiptUrl) {
+        throw new Error(`GitHub release ${ref} has no docker-image-digest.txt receipt.`);
+    }
+    const receipt = (await fetchGithubText(receiptUrl)).trim();
+    const prefix = `${CANONICAL_IMAGE_NAME}@`;
+    if (!receipt.startsWith(prefix) || !IMAGE_DIGEST_PATTERN.test(receipt.slice(prefix.length))) {
+        throw new Error(`GitHub release ${ref} has an invalid Docker digest receipt.`);
+    }
+    return { revision: object.sha, imageDigest: receipt };
+};
+let releaseProvenanceResolver = defaultReleaseProvenanceResolver;
+export function setReleaseProvenanceResolver(next) {
+    releaseProvenanceResolver = next;
+}
+export function resetReleaseProvenanceResolver() {
+    releaseProvenanceResolver = defaultReleaseProvenanceResolver;
+}
+/** Exact release refs only: `vMAJOR.MINOR.PATCH`, with strict numeric components. */
+export function isReleasedVersionRef(ref) {
+    return /^v(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.test(ref);
+}
+/**
+ * Select the deployment strategy without doing network or Docker work.
+ * Omitted/blank refs stay unresolved for the later latest-release lookup.
+ */
+export function selectDeploymentTarget(ref) {
+    if (ref === undefined || ref.trim().length === 0)
+        return { imageSource: "registry" };
+    if (isReleasedVersionRef(ref)) {
+        return { imageSource: "registry", ref };
+    }
+    return { imageSource: "source", ref };
+}
+function imageFailure(message) {
+    return new DeploymentImageError(`${message} The release image was not used and source fallback is disabled for stable ` +
+        "releases. Resolve the registry/image problem, then re-run `librarian server up`.");
+}
+function objectRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : {};
+}
+function gitObject(value) {
+    const object = objectRecord(objectRecord(value).object);
+    const type = typeof object.type === "string" ? object.type : "";
+    const sha = typeof object.sha === "string" ? object.sha : "";
+    if ((type !== "tag" && type !== "commit") || !REVISION_PATTERN.test(sha)) {
+        throw new Error("GitHub returned malformed tag provenance.");
+    }
+    return { type, sha };
+}
+async function fetchGithubJson(url) {
+    const response = await publicGithubFetch(url, {
+        redirect: "error",
+        headers: {
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+        },
+    });
+    if (!response.ok)
+        throw new Error(`GitHub API returned HTTP ${response.status}.`);
+    return response.json();
+}
+async function fetchGithubText(url) {
+    const response = await publicGithubFetch(url, { redirect: "follow" });
+    if (!response.ok)
+        throw new Error(`GitHub receipt download returned HTTP ${response.status}.`);
+    return response.text();
+}
+function normalizedPlatform(os, architecture) {
+    const normalizedOs = typeof os === "string" ? os.trim().toLowerCase() : "";
+    const rawArch = typeof architecture === "string" ? architecture.trim().toLowerCase() : "";
+    const normalizedArch = ["amd64", "x86_64", "x86-64"].includes(rawArch)
+        ? "amd64"
+        : ["arm64", "aarch64"].includes(rawArch)
+            ? "arm64"
+            : rawArch;
+    return normalizedOs && normalizedArch ? `${normalizedOs}/${normalizedArch}` : "";
+}
+async function inspectDockerDaemon() {
+    let result;
+    try {
+        result = await run("docker", ["info", "--format", "{{json .}}"]);
+    }
+    catch (error) {
+        const detail = redactSecrets(error instanceof Error ? error.message : String(error));
+        throw imageFailure(`Could not inspect the active Docker server platform: ${detail}`);
+    }
+    if (result.code !== 0) {
+        const detail = redactSecrets(result.stderr.trim() || result.stdout.trim());
+        throw imageFailure(`Could not inspect the active Docker server platform${detail ? `: ${detail}` : "."}`);
+    }
+    try {
+        const parsed = JSON.parse(result.stdout.trim());
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            throw new Error();
+        return parsed;
+    }
+    catch {
+        throw imageFailure("Docker returned malformed server platform metadata.");
+    }
+}
+function redactingStream(onProgress) {
+    let buffered = "";
+    const emitCompleteRecords = () => {
+        const boundary = Math.max(buffered.lastIndexOf("\n"), buffered.lastIndexOf("\r"));
+        if (boundary < 0)
+            return;
+        const complete = buffered.slice(0, boundary + 1);
+        buffered = buffered.slice(boundary + 1);
+        onProgress(redactSecrets(complete));
+    };
+    return {
+        write(chunk) {
+            buffered += chunk;
+            emitCompleteRecords();
+        },
+        flush() {
+            if (!buffered)
+                return;
+            onProgress(redactSecrets(buffered));
+            buffered = "";
+        },
+    };
+}
+/**
+ * Pull and validate a stable release image, returning the digest-pinned run target.
+ * This is shared preparation for `up` now and the B3 update flow later.
+ */
+export async function prepareRegistryImage(ref, onProgress) {
+    if (!isReleasedVersionRef(ref)) {
+        throw imageFailure(`Expected an exact release ref like v1.20.1, got '${ref}'.`);
+    }
+    const daemon = await inspectDockerDaemon();
+    const daemonPlatform = normalizedPlatform(daemon.OSType, daemon.Architecture);
+    if (daemonPlatform !== REQUIRED_PLATFORM) {
+        throw imageFailure(`The active Docker server reports '${daemonPlatform || "unknown"}', but the supported platform is ${REQUIRED_PLATFORM}. ` +
+            "Switch Docker context to a Linux amd64 server or install on a supported host.");
+    }
+    const imageRef = `${CANONICAL_IMAGE_NAME}:${ref}`;
+    const stdout = redactingStream(onProgress);
+    const stderr = redactingStream(onProgress);
+    let pullCode;
+    try {
+        pullCode = await stream("docker", ["pull", imageRef], {
+            onStdout: stdout.write,
+            onStderr: stderr.write,
+        });
+    }
+    catch (error) {
+        stdout.flush();
+        stderr.flush();
+        const detail = redactSecrets(error instanceof Error ? error.message : String(error));
+        throw imageFailure(`\`docker pull ${imageRef}\` could not start${detail ? `: ${detail}` : "."}`);
+    }
+    stdout.flush();
+    stderr.flush();
+    if (pullCode !== 0) {
+        throw imageFailure(`\`docker pull ${imageRef}\` failed (exit ${pullCode ?? "signal"}). Check registry access, ` +
+            "authentication, network connectivity, and whether this release supports your architecture.");
+    }
+    let inspected;
+    try {
+        inspected = await run("docker", ["image", "inspect", "--format", "{{json .}}", imageRef]);
+    }
+    catch (error) {
+        const detail = redactSecrets(error instanceof Error ? error.message : String(error));
+        throw imageFailure(`Docker metadata inspection failed for ${imageRef}${detail ? `: ${detail}` : "."}`);
+    }
+    if (inspected.code !== 0) {
+        const detail = redactSecrets(inspected.stderr.trim() || inspected.stdout.trim());
+        throw imageFailure(`Docker pulled ${imageRef}, but its local metadata could not be inspected` +
+            (detail ? `: ${detail}` : "."));
+    }
+    let record;
+    try {
+        const parsed = JSON.parse(inspected.stdout.trim());
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed))
+            throw new Error();
+        record = parsed;
+    }
+    catch {
+        throw imageFailure(`Docker returned malformed image metadata for ${imageRef}.`);
+    }
+    const validated = validateRegistryImage(ref, imageRef, record, daemonPlatform);
+    let authoritative;
+    try {
+        authoritative = await releaseProvenanceResolver(ref);
+    }
+    catch (error) {
+        const detail = redactSecrets(error instanceof Error ? error.message : String(error));
+        throw imageFailure(`Could not verify ${ref} against authoritative GitHub release provenance${detail ? `: ${detail}` : "."}`);
+    }
+    if (validated.revision !== authoritative.revision) {
+        throw imageFailure(`Image revision ${validated.revision} does not match GitHub tag ${ref} commit ${authoritative.revision}.`);
+    }
+    if (validated.imageDigest !== authoritative.imageDigest) {
+        throw imageFailure(`Image digest ${validated.imageDigest} does not match the GitHub release receipt ${authoritative.imageDigest}.`);
+    }
+    return validated;
+}
+function validateRegistryImage(ref, imageRef, record, daemonPlatform) {
+    const labels = record.Config?.Labels ?? {};
+    const version = labels["org.opencontainers.image.version"];
+    const source = labels["org.opencontainers.image.source"];
+    const revision = labels["org.opencontainers.image.revision"];
+    const expectedVersion = ref.slice(1);
+    if (!Array.isArray(record.RepoTags) || !record.RepoTags.includes(imageRef)) {
+        throw imageFailure(`The pulled image does not carry the requested tag ${imageRef}.`);
+    }
+    if (version !== expectedVersion) {
+        throw imageFailure(`Image version metadata mismatch: expected '${expectedVersion}' for ${ref}, got '${redactSecrets(String(version))}'.`);
+    }
+    if (source !== CANONICAL_SOURCE_REPOSITORY) {
+        throw imageFailure(`Image source metadata mismatch: expected ${CANONICAL_SOURCE_REPOSITORY}, got '${redactSecrets(String(source))}'.`);
+    }
+    if (typeof revision !== "string" || !REVISION_PATTERN.test(revision)) {
+        throw imageFailure(`Image revision metadata is missing or invalid; expected a full 40-character Git commit for traceability.`);
+    }
+    const imagePlatform = normalizedPlatform(record.Os, record.Architecture);
+    if (imagePlatform !== REQUIRED_PLATFORM || imagePlatform !== daemonPlatform) {
+        throw imageFailure(`The pulled image platform/architecture metadata is '${imagePlatform || "unknown"}', but the supported platform is ${REQUIRED_PLATFORM} and must match the active Docker server.`);
+    }
+    const digestPrefix = `${CANONICAL_IMAGE_NAME}@`;
+    const imageDigest = Array.isArray(record.RepoDigests)
+        ? record.RepoDigests.find((value) => typeof value === "string" &&
+            value.startsWith(digestPrefix) &&
+            IMAGE_DIGEST_PATTERN.test(value.slice(digestPrefix.length)))
+        : undefined;
+    if (!imageDigest) {
+        throw imageFailure(`Docker metadata for ${imageRef} has no full canonical repository digest (${CANONICAL_IMAGE_NAME}@sha256:<64 lowercase hex characters>).`);
+    }
+    return { imageSource: "registry", ref, imageRef, imageDigest, revision };
+}
+//# sourceMappingURL=deployment-image.js.map

package/dist/server/deployment-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-image.js","sourceRoot":"","sources":["../../src/server/deployment-image.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,EAAkB,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,yCAAyC,CAAC;AAE9E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,oDAAoD,CAAC;AAEhG,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAC1C,MAAM,iBAAiB,GAAG,aAAa,CAAC;AACxC,MAAM,UAAU,GAAG,8DAA8D,CAAC;AAElF,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,MAAM,KAAK,GAAG,yBAAyB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC;AACjD,CAAC;AAcD,gEAAgE;AAChE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAmBD,MAAM,qBAAqB,GAAsB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACjF,IAAI,iBAAiB,GAAG,qBAAqB,CAAC;AAE9C,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,iBAAiB,GAAG,IAAI,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,iBAAiB,GAAG,qBAAqB,CAAC;AAC5C,CAAC;AAID,MAAM,gCAAgC,GAA8B,KAAK,EAAE,GAAG,EAAE,EAAE;IAChF,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,GAAG,UAAU,iBAAiB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjG,IAAI,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,GAAG,SAAS,CAAC,MAAM,eAAe,CAAC,GAAG,UAAU,aAAa,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,qCAAqC,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,GAAG,UAAU,kBAAkB,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,CAAC;YAChF,EAAE,oBAAoB;QAC1B,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,kBAAkB,GAAG,GAAG,2BAA2B,sBAAsB,GAAG,0BAA0B,CAAC;IAC7G,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,0CAA0C,CAAC,CAAC;IACnF,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,GAAG,oBAAoB,GAAG,CAAC;IAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,wCAAwC,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AACxD,CAAC,CAAC;AAEF,IAAI,yBAAyB,GAAG,gCAAgC,CAAC;AAEjE,MAAM,UAAU,4BAA4B,CAAC,IAA+B;IAC1E,yBAAyB,GAAG,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,yBAAyB,GAAG,gCAAgC,CAAC;AAC/D,CAAC;AAiBD,qFAAqF;AACrF,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,6CAA6C,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAuB;IAC5D,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrF,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;AACxC,CAAC;AAeD,SAAS,YAAY,CAAC,OAAe;IACnC,OAAO,IAAI,oBAAoB,CAC7B,GAAG,OAAO,6EAA6E;QACrF,kFAAkF,CACrF,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE;QAC5C,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE;YACP,MAAM,EAAE,6BAA6B;YACrC,sBAAsB,EAAE,YAAY;SACrC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAClF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtE,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IAC/F,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAW,EAAE,YAAqB;IAC5D,MAAM,YAAY,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,OAAO,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1F,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpE,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACtC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC;IACd,OAAO,YAAY,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,IAAI,MAAiB,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,MAAM,YAAY,CAAC,wDAAwD,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,YAAY,CAChB,sDAAsD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9F,OAAO,MAA0B,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,qDAAqD,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,UAAmC;IAI1D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,MAAM,mBAAmB,GAAG,GAAS,EAAE;QACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,GAAG,CAAC,CAAC,CAAC;QACjD,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACxC,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,KAAK;YACT,QAAQ,IAAI,KAAK,CAAC;YAClB,mBAAmB,EAAE,CAAC;QACxB,CAAC;QACD,KAAK;YACH,IAAI,CAAC,QAAQ;gBAAE,OAAO;YACtB,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;YACpC,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,UAAmC;IAEnC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,YAAY,CAAC,oDAAoD,GAAG,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IAC9E,IAAI,cAAc,KAAK,iBAAiB,EAAE,CAAC;QACzC,MAAM,YAAY,CAChB,qCAAqC,cAAc,IAAI,SAAS,oCAAoC,iBAAiB,IAAI;YACvH,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,oBAAoB,IAAI,GAAG,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;YACpD,QAAQ,EAAE,MAAM,CAAC,KAAK;YACtB,QAAQ,EAAE,MAAM,CAAC,KAAK;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,MAAM,YAAY,CAChB,iBAAiB,QAAQ,qBAAqB,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,MAAM,CAAC,KAAK,EAAE,CAAC;IACf,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,YAAY,CAChB,iBAAiB,QAAQ,mBAAmB,QAAQ,IAAI,QAAQ,4BAA4B;YAC1F,4FAA4F,CAC/F,CAAC;IACJ,CAAC;IAED,IAAI,SAAoB,CAAC;IACzB,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,MAAM,YAAY,CAChB,yCAAyC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACjF,MAAM,YAAY,CAChB,iBAAiB,QAAQ,iDAAiD;YACxE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACjC,CAAC;IACJ,CAAC;IAED,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAC9F,MAAM,GAAG,MAA4B,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAAC,gDAAgD,QAAQ,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAC/E,IAAI,aAAgC,CAAC;IACrC,IAAI,CAAC;QACH,aAAa,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACrF,MAAM,YAAY,CAChB,oBAAoB,GAAG,mDAAmD,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,QAAQ,KAAK,aAAa,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,YAAY,CAChB,kBAAkB,SAAS,CAAC,QAAQ,8BAA8B,GAAG,WAAW,aAAa,CAAC,QAAQ,GAAG,CAC1G,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,WAAW,KAAK,aAAa,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,YAAY,CAChB,gBAAgB,SAAS,CAAC,WAAW,8CAA8C,aAAa,CAAC,WAAW,GAAG,CAChH,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAC5B,GAAW,EACX,QAAgB,EAChB,MAA0B,EAC1B,cAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3E,MAAM,YAAY,CAAC,qDAAqD,QAAQ,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;QAChC,MAAM,YAAY,CAChB,8CAA8C,eAAe,SAAS,GAAG,UAAU,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,2BAA2B,EAAE,CAAC;QAC3C,MAAM,YAAY,CAChB,4CAA4C,2BAA2B,UAAU,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CACnH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrE,MAAM,YAAY,CAChB,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,aAAa,KAAK,iBAAiB,IAAI,aAAa,KAAK,cAAc,EAAE,CAAC;QAC5E,MAAM,YAAY,CAChB,uDAAuD,aAAa,IAAI,SAAS,oCAAoC,iBAAiB,2CAA2C,CAClL,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,GAAG,oBAAoB,GAAG,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;QACnD,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CACrB,CAAC,KAAK,EAAmB,EAAE,CACzB,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;YAC9B,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAC9D;QACH,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,YAAY,CAChB,uBAAuB,QAAQ,6CAA6C,oBAAoB,yCAAyC,CAC1I,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC;AAC3E,CAAC"}

package/dist/server/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/server/docker.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAIhE,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3B;AA8ED,wEAAwE;AACxE,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE/F;AAED,gFAAgF;AAChF,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED,yDAAyD;AACzD,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAIxD;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjG;AAkBD,6EAA6E;AAC7E,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAIjF;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/server/docker.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAEhE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAIhE,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,kEAAkE;IAClE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CACpC;AAED;;;;;GAKG;AACH,MAAM,WAAW,QAAQ;IACvB,MAAM,CACJ,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAC3B;AAmGD,wEAAwE;AACxE,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAE/F;AAED,gFAAgF;AAChF,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEzD;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CACpB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED,yDAAyD;AACzD,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAIxD;AAED,2DAA2D;AAC3D,wBAAgB,aAAa,IAAI,IAAI,CAEpC;AAID;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CACjG;AAkBD,6EAA6E;AAC7E,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,IAAI,CAAC,EAAE,UAAU,GAChB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAED,2EAA2E;AAC3E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,GAAG,iBAAiB,CAIjF;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/server/docker.js

@@ -28,6 +28,8 @@
 //     independently (`setRunner`/`setStreamer`) so a test stubs exactly what it
 //     exercises, and neither ever spawns a real `docker`.
 import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
 // --- the real, process-spawning runner -----------------------------------
 const realRunner = {
     run(cmd, args, opts = {}) {
@@ -53,22 +55,40 @@ const realRunner = {
         });
     },
     async which(cmd) {
-        const probe = process.platform === "win32" ? "where" : "which";
-        try {
-            const { stdout, code } = await realRunner.run(probe, [cmd]);
-            if (code !== 0)
-                return null;
-            const first = stdout
-                .split("\n")
-                .map((l) => l.trim())
-                .find((l) => l.length > 0);
-            return first ?? null;
-        }
-        catch {
-            return null;
-        }
+        return resolveExecutable(cmd);
     },
 };
+/** Resolve an executable without depending on a host `which`/`where` utility. */
+async function resolveExecutable(cmd) {
+    const isWindows = process.platform === "win32";
+    const hasSeparator = cmd.includes("/") || (isWindows && cmd.includes("\\"));
+    const directories = hasSeparator ? [""] : (process.env.PATH ?? "").split(path.delimiter);
+    const extensions = isWindows
+        ? commandExtensions(cmd, process.env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD")
+        : [""];
+    for (const directory of directories) {
+        const base = hasSeparator ? cmd : path.resolve(directory || ".", cmd);
+        for (const extension of extensions) {
+            const candidate = `${base}${extension}`;
+            try {
+                await fs.promises.access(candidate, isWindows ? fs.constants.F_OK : fs.constants.X_OK);
+                if ((await fs.promises.stat(candidate)).isFile())
+                    return path.resolve(candidate);
+            }
+            catch {
+                // Not an executable file; continue searching PATH.
+            }
+        }
+    }
+    return null;
+}
+function commandExtensions(cmd, pathExt) {
+    const extensions = pathExt
+        .split(";")
+        .filter(Boolean)
+        .map((extension) => extension.toLowerCase());
+    return extensions.some((extension) => cmd.toLowerCase().endsWith(extension)) ? [""] : extensions;
+}
 // --- the real, process-spawning streamer ----------------------------------
 const realStreamer = {
     stream(cmd, args, handlers, opts = {}) {

package/dist/server/docker.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/server/docker.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,sBAAsB;AACtB,EAAE;AACF,2BAA2B;AAC3B,4EAA4E;AAC5E,gFAAgF;AAChF,iEAAiE;AACjE,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,yEAAyE;AACzE,gFAAgF;AAChF,0DAA0D;AAE1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AA8B3C,4EAA4E;AAE5E,MAAM,UAAU,GAAW;IACzB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;QACtB,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YACH,qEAAqE;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5D,IAAI,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM;iBACjB,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7B,OAAO,KAAK,IAAI,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAC;AAEF,6EAA6E;AAE7E,MAAM,YAAY,GAAa;IAC7B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnC,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,uEAAuE;gBACvE,iEAAiE;gBACjE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,qEAAqE;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,yEAAyE;YACzE,wEAAwE;YACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,4EAA4E;AAE5E,IAAI,OAAO,GAAW,UAAU,CAAC;AACjC,IAAI,eAAe,GAAa,YAAY,CAAC;AAE7C,wEAAwE;AACxE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAE,IAAiB;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CACpB,GAAW,EACX,IAAuB,EACvB,QAAwB,EACxB,IAAiB;IAEjB,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,GAAG,MAAM,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,UAAU,CAAC;AACvB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC;IAC7B,eAAe,GAAG,QAAQ,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa;IAC3B,eAAe,GAAG,YAAY,CAAC;AACjC,CAAC;AAeD,MAAM,qBAAqB,GAAsB;IAC/C,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;QACjC,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,KAAK,EAAE,SAAS,EAAE,uDAAuD;aAC1E,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,IAAI,kBAAkB,GAAsB,qBAAqB,CAAC;AAElE,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,IAAuB,EACvB,IAAiB;IAEjB,OAAO,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,kBAAkB,GAAG,MAAM,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB;IACpC,kBAAkB,GAAG,qBAAqB,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"docker.js","sourceRoot":"","sources":["../../src/server/docker.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,oCAAoC;AACpC,EAAE;AACF,yEAAyE;AACzE,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,8CAA8C;AAC9C,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,sBAAsB;AACtB,EAAE;AACF,2BAA2B;AAC3B,4EAA4E;AAC5E,gFAAgF;AAChF,iEAAiE;AACjE,kFAAkF;AAClF,iFAAiF;AACjF,mFAAmF;AACnF,yEAAyE;AACzE,gFAAgF;AAChF,0DAA0D;AAE1D,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AA8B7B,4EAA4E;AAE5E,MAAM,UAAU,GAAW;IACzB,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;QACtB,OAAO,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACnC,CAAC,CAAC,CAAC;YACH,qEAAqE;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAG;QACb,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;CACF,CAAC;AAEF,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,GAAW;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5E,MAAM,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzF,MAAM,UAAU,GAAG,SAAS;QAC1B,CAAC,CAAC,iBAAiB,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC;QACtE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAET,KAAK,MAAM,SAAS,IAAI,WAAW,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QACtE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACvF,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE;oBAAE,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACnF,CAAC;YAAC,MAAM,CAAC;gBACP,mDAAmD;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW,EAAE,OAAe;IACrD,MAAM,UAAU,GAAG,OAAO;SACvB,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AACnG,CAAC;AAED,6EAA6E;AAE7E,MAAM,YAAY,GAAa;IAC7B,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE;QACnC,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,uEAAuE;gBACvE,iEAAiE;gBACjE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;YACH,qEAAqE;YACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,yEAAyE;YACzE,wEAAwE;YACxE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,4EAA4E;AAE5E,IAAI,OAAO,GAAW,UAAU,CAAC;AACjC,IAAI,eAAe,GAAa,YAAY,CAAC;AAE7C,wEAAwE;AACxE,MAAM,UAAU,GAAG,CAAC,GAAW,EAAE,IAAuB,EAAE,IAAiB;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CACpB,GAAW,EACX,IAAuB,EACvB,QAAwB,EACxB,IAAiB;IAEjB,OAAO,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC3D,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,SAAS,CAAC,MAAc;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,GAAG,MAAM,CAAC;IACjB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,WAAW;IACzB,OAAO,GAAG,UAAU,CAAC;AACvB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,eAAe,CAAC;IAC7B,eAAe,GAAG,QAAQ,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa;IAC3B,eAAe,GAAG,YAAY,CAAC;AACjC,CAAC;AAeD,MAAM,qBAAqB,GAAsB;IAC/C,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE;QACjC,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBAClC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;gBAC7D,KAAK,EAAE,SAAS,EAAE,uDAAuD;aAC1E,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,IAAI,kBAAkB,GAAsB,qBAAqB,CAAC;AAElE,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAC5B,GAAW,EACX,IAAuB,EACvB,IAAiB;IAEjB,OAAO,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,oBAAoB,CAAC,MAAyB;IAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC;IAChC,kBAAkB,GAAG,MAAM,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB;IACpC,kBAAkB,GAAG,qBAAqB,CAAC;AAC7C,CAAC"}