signalk-container 1.14.0 → 1.15.0-beta.0

package/AGENTS.md

@@ -5,10 +5,11 @@ Shared container runtime management (Podman/Docker) for Signal K plugins. This p
 Key components:
 
 - **`src/index.ts`** — Signal K plugin entrypoint. Wires the runtime probe, exposes the `ContainerManagerApi` on `globalThis`, owns the REST endpoints (`/plugins/signalk-container/api/...`) and the React config panel mount.
-- **`src/containers.ts`** — Thin runtime layer. Pure functions over `execRuntime` for lifecycle (`ensureRunning`, `removeContainer`, `getContainerState`), config-drift detection (`getLiveContainerConfig`, `diffContainerConfig`), and live-state probes (`getLiveResources`, `getActualPortBindings`).
+- **`src/client.ts`** — The dockerode socket client. Owns socket selection (`resolveClient`), the shared `Docker` singleton (`getClient`), the `ContainerClient` injection interface, the `safe()`/`safeInspect()` error-normalizing wrappers, and the log-stream demux helpers. Every runtime call in the plugin goes through here.
+- **`src/containers.ts`** — Thin runtime layer over the dockerode `ContainerClient` for lifecycle (`ensureRunning`, `removeContainer`, `getContainerState`), config-drift detection (`getLiveContainerConfig`, `diffContainerConfig`), and live-state probes (`getLiveResources`, `getActualPortBindings`).
 - **`src/jobs.ts`** — One-shot helper containers via `runJob`. Used by chart-provider and similar plugins that need short-lived workers (GDAL, tippecanoe, etc.).
 - **`src/resources.ts`** — cgroup-limit flag emission + live-update path via `podman/docker update`. The "Bug D" precedent for diff-on-already-running lives here.
-- **`src/runtime.ts`** — Runtime detection (`podman` vs `docker`), version probing, `execRuntime`/`execRuntimeLong` dispatch, `isContainerized()` self-detection.
+- **`src/runtime.ts`** — Runtime detection over the socket (`detectRuntime` resolves a socket via `client.ts`, classifies `podman` vs `docker` from `version()`, reads `isRootless`/`cgroupControllers`), the `userMappingFlags` UID-mapping decision matrix, and `isContainerized()` self-detection.
 - **`src/updates/`** — Centralized image-update detection (digest drift for floating tags, version comparison for semver). Used by all consumer plugins via `containers.updates.register(...)`.
 - **`src/configpanel/`** — React config panel source. Built with Vite + `@module-federation/vite` (see `vite.config.ts`); build artifacts land in `public/`, served via Module Federation into the Signal K Admin UI.
 
@@ -42,7 +43,7 @@ Do not add error handling, fallbacks, or validation for scenarios that cannot ha
   - `npm run test:integration` — integration only (`dist/test/integration/*.test.js`). Requires podman or docker; tests still self-skip on Windows and when no runtime is found.
   - `npm run test:all` — both. The pre-PR full sweep on a dev box.
 - All new code requires tests. Test behavior at the function boundary, not internal control flow.
-- Inject `exec: ExecFn = execRuntime` rather than calling the runtime directly. Tests stub via `fakeExec`. See `src/test/getLiveResources.test.ts` for the canonical pattern: synthetic `{stdout, stderr, exitCode}`, no real podman invocations.
+- Inject `client: ContainerClient = getClient()` rather than calling dockerode directly. Tests stub via `makeMockClient(spec)` from `src/test/helpers/mockClient.ts`. See `src/test/getLiveResources.test.ts` for the canonical pattern: a mock whose `getContainer().inspect()` returns the JSON object under test, no real podman/docker invocations.
 - Container-integration tests (those that actually pull `alpine:3.19`) live under `src/test/integration/` and gate on `hasContainerRuntime()` which returns `null` on Windows. Do not add new tests that pull real Linux images without putting them under `src/test/integration/` AND gating on the helper.
 - All tests must pass on every commit. Run `npm run build:all:integration` (= `build && test:all`) locally before opening a PR; CI's `npm test` covers the unit half and you cover the integration half.
 
@@ -70,11 +71,10 @@ The injection is in `defaultHomeForConfigRoot()` (`src/containers.ts`) and only
 
 ### Container log streaming
 
-Three-layer structure (`src/runtime.ts` → `src/containers.ts` → `src/log-stream-broker.ts`):
+Two-layer structure (`src/containers.ts` → `src/log-stream-broker.ts`):
 
-1. `spawnRuntimeStreaming` (`src/runtime.ts`) — primitive that wraps `child_process.spawn(podman/docker, args)` with a `stop()` handle and a `makeLineSplitter`-fed `onLine` callback. Used for any long-running runtime command that needs streaming output; `tailContainerLogs` is its only current caller. Returns synchronously with a stop-handle — unlike `execRuntimeLong` which awaits process exit.
-2. `tailContainerLogs` (`src/containers.ts`) — thin helper that composes `["logs", "-f", "--tail", N, prefixedName(name)]` and delegates to `spawnRuntimeStreaming`. `getContainerLogs` is the one-shot sibling (no `-f`, returns a `string[]`).
-3. `LogStreamBroker` (`src/log-stream-broker.ts`) — per-container fan-out. First subscribe spawns the tail; last unsubscribe stops it. On tail exit with subscribers still attached the broker auto-respawns with exponential backoff (constants `RESPAWN_DELAY_MS` / `MAX_RESPAWN_DELAY_MS`); a delivered line resets the counter. This is what lets SSE-only consumers recover from auto-recreate or daemon glitches without waiting for a fresh subscribe call. Brokers are keyed by container name on the wrapper and auto-recreate cancels the prior subscription before installing a new one.
+1. `tailContainerLogs` (`src/containers.ts`) — calls `getContainer(name).logs({ follow: true, stdout: true, stderr: true, tail: N })` and pipes the stream through `client.modem.demuxStream` into a `makeLineSplitter`-fed `onLine` callback. Containers run without a TTY (the default), so the log stream is **multiplexed** — every stdout/stderr chunk carries an 8-byte frame header; reading raw bytes leaks that header as binary garbage into rendered lines, so demuxing is mandatory. Returns a `StreamingProcessHandle` whose `stop()` calls `stream.destroy()`. The handle's `pid` is always `undefined` (a socket stream has no process); the broker checks `spawnFailed` instead. `getContainerLogs` is the one-shot sibling (`follow: false`) — it ALSO demuxes (the API returns a multiplexed Buffer; the CLI used to pre-demux for us).
+2. `LogStreamBroker` (`src/log-stream-broker.ts`) — per-container fan-out. First subscribe opens the tail; last unsubscribe destroys it. On stream end/error with subscribers still attached the broker auto-respawns with exponential backoff (constants `RESPAWN_DELAY_MS` / `MAX_RESPAWN_DELAY_MS`); a delivered line resets the counter. A synchronously-failed tail is detected via `handle.spawnFailed` (NOT `pid === undefined` — dockerode handles never carry a pid). This is what lets SSE-only consumers recover from auto-recreate or daemon glitches without waiting for a fresh subscribe call. Brokers are keyed by container name on the wrapper and auto-recreate cancels the prior subscription before installing a new one.
 
 Consumer surfaces:
 
@@ -88,21 +88,15 @@ Lifecycle:
 - `safeInvokeContainerLog` mirrors `safeInvokeVolumeIssue` — sync throws and async rejections from plugin handlers route to `app.error` and never propagate.
 - Combined stdout+stderr (matches `podman logs <name>` semantics). Per-stream separation is out of scope for v1.
 
-See `src/runtime.ts`, `src/containers.ts`, `src/log-stream-broker.ts`, and the tests in `src/test/` for exact timing and lifecycle mechanics.
+See `src/client.ts`, `src/containers.ts`, `src/log-stream-broker.ts`, and the tests in `src/test/` for exact timing and lifecycle mechanics.
 
 ### Podman image qualification
 
-`qualifyImage("foo/bar:tag", podmanRuntime)` prefixes `docker.io/` when needed (podman requires fully qualified names unless `unqualified-search-registries` is set). Docker passes through. Use this everywhere we feed an image string to a runtime command.
+`qualifyImage("foo/bar:tag", podmanRuntime)` prefixes `docker.io/` when needed (podman requires fully qualified names unless `unqualified-search-registries` is set; this holds over the API too). Docker passes through. Use this everywhere we feed an image string to a dockerode call.
 
 ### Inspect-format diff pattern
 
-When we need to read live container state, we use a single `inspect --format` call with a pipe-delimited Go-template format string:
-
-```gotemplate
-{{.HostConfig.NanoCpus}}|{{.HostConfig.Memory}}|...
-```
-
-This works uniformly across podman and docker, parses cheaply, and avoids the JSON-shape divergence between the two runtimes. `getLiveResources` and `getLiveContainerConfig` are the canonical examples. Do not introduce new live-state probes that parse full `inspect` JSON output.
+When we need to read live container state, call `getContainer(name).inspect()` once (through `safeInspect`, which returns `null` on a 404 instead of throwing) and read the JSON fields directly. dockerode returns the same field shapes on podman and docker (verified live: `HostConfig.NanoCpus`, `HostConfig.Memory`, `NetworkSettings.Ports`, `Mounts[].{Type,Source,Destination}`, `Config.{Image,Cmd,Env,Healthcheck}`, etc.), so there's no Go-template parsing and no podman-vs-docker text divergence to guard against. `getLiveResources` and `getLiveContainerConfig` are the canonical examples. `diffContainerConfig` is a pure function over those inspect-derived values — keep new live-state probes reading inspect JSON directly so the diff stays uniform across runtimes.
 
 ### networkMode canonicalization
 
@@ -110,13 +104,13 @@ Docker reports `HostConfig.NetworkMode` as `"default"` or `"bridge"` when no `--
 
 ### `disableUserNamespaceRemap` (rootless-Podman + idmap-incompatible storage)
 
-Some filesystems (ZFS is the canonical case) cannot be id-mapped by the kernel. `--userns=keep-id` either fails outright on container create or triggers Podman's `storage-chown-by-maps` sweep, which is catastrophically slow on CoW metadata. The README's user-facing section documents the host-side primary fix (storage driver swap to `fuse-overlayfs`); the plugin-side escape hatch below covers the case where the operator cannot or will not change storage drivers.
+Some filesystems (ZFS is the canonical case) cannot be id-mapped by the kernel. `HostConfig.UsernsMode: "keep-id"` either fails outright on container create or triggers Podman's `storage-chown-by-maps` sweep, which is catastrophically slow on CoW metadata. The README's user-facing section documents the host-side primary fix (storage driver swap to `fuse-overlayfs`); the plugin-side escape hatch below covers the case where the operator cannot or will not change storage drivers.
 
 Invariants:
 
 - `disableUserNamespaceRemap` is a plugin-config boolean; default `false` preserves the historical `keep-id` behaviour for every existing deployment.
-- The flag affects **only** the rootless-Podman branch of `userMappingFlags()`. Docker and rootful-Podman paths are untouched because they never emit `keep-id` to begin with.
-- When the flag is active, `userMappingFlags()` returns `[]` for rootless-Podman — no `--userns` and no `--user`. The default rootless mapping (in-image UID 0 → host caller's UID) then drives bind-mount ownership for root-by-default images. Non-root images lose host-caller ownership; that's the documented trade-off.
+- The flag affects **only** the rootless-Podman branch of `userMappingFlags()`. Docker and rootful-Podman paths are untouched because they use `User` (a `--user`-equivalent), never `keep-id`. (Aside: `keep-id` is meaningless under rootful Podman — there is no user namespace to map into, so podman silently no-ops it and runs as in-image root. We use `User` on the rootful branches precisely to get caller ownership; this is why accurate `isRootless` detection is correctness-critical, since a misread would silently produce root-owned bind-mount files rather than failing loudly.)
+- `userMappingFlags()` returns a create-payload fragment, not CLI flags: `{ HostConfig: { UsernsMode: "keep-id:uid=N,gid=N" } }` for rootless podman, `{ User: "N:N" }` for docker/rootful podman, `{}` for opt-out. When `disableUserNamespaceRemap` is active it returns `{}` for rootless-Podman — no `UsernsMode` and no `User`. The default rootless mapping (in-image UID 0 → host caller's UID) then drives bind-mount ownership for root-by-default images. Non-root images lose host-caller ownership; that's the documented trade-off.
 - The toggle lives in module state in `src/runtime.ts`, set by `setDisableUserns()` from `plugin.start()` and reset to `false` in `plugin.stop()`. Stop/start cycles must not strand a previous run's setting.
 - Drift detection in `ensureRunning` composes through `userMappingFlags()`, so the toggle is automatically reflected; never add a parallel codepath that re-derives the same decision.
 
@@ -156,17 +150,14 @@ When a consumer plugin sets a restart policy explicitly, it overrides the defaul
 
 ### In-container signalk-server + host-side rootless Podman
 
-The signalk-universal-installer's deployment runs signalk-server itself as a Podman container, with the host's rootless podman socket bind-mounted to `/var/run/docker.sock` inside. The in-container side ships both `podman` and `docker` CLIs (the latter is what consumer plugins effectively reach, since the bind socket is on the docker path). This topology has five sharp edges the runtime detection layer must handle. Future contributors maintaining the runtime layer should know about them as one story:
+The signalk-universal-installer's deployment runs signalk-server itself as a Podman container, with the host's rootless podman socket bind-mounted to `/var/run/docker.sock` inside. signalk-container talks to that socket directly via dockerode — **the socket IS the channel to the host daemon**, so there is no CLI binary, no client-side flag validation, and no `podman --remote` dance. That collapses most of the sharp edges the CLI era had to work around (the docker-shim reclassification, `--remote --url` promotion, `cleanEnv`/`XDG_RUNTIME_DIR` backfill, and `runtimeCmd` binary-flipping are all gone). Two edges remain, in changed form:
 
-| Concern                                                                                                                                                                                                                                                                                                                                                                          | Code                                                                                                                                                                 |
-| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Rootless Podman daemon discovery under system-scoped systemd units (no `XDG_RUNTIME_DIR` in the inherited env), without breaking the in-container case where `/run/user` doesn't exist at all (podman `lstat`s `XDG_RUNTIME_DIR` at startup before honouring `--url <socket>`, so pointing it at a missing directory makes every `podman --remote` probe fail before it can run) | `cleanEnv()` in `runtime.ts` backfills `XDG_RUNTIME_DIR=/run/user/<uid>` only when that path exists                                                                  |
-| Detecting that the in-container `docker` CLI is actually talking to a host-side podman daemon (default `docker --version` doesn't reveal it)                                                                                                                                                                                                                                     | `tryRuntime()` probes `docker info --format {{.DefaultRuntime}}` — `crun` → reclassify to podman                                                                     |
-| Keeping podman-flag semantics (`--userns=keep-id:uid=X,gid=Y`, etc.) once we've reclassified a docker-shim to podman — the in-container docker CLI client-validates podman-specific values and rejects them before forwarding to the daemon                                                                                                                                      | `tryRuntime()` promotes the shim to `podman --remote --url <socket>` when the bind-mounted socket is reachable; `runtimeCmd()` then flips the binary back to podman  |
-| Finding our own container id when HOSTNAME is empty, cgroup is `0::/`, and `Network=host` makes `/etc/hostname` return the host machine name                                                                                                                                                                                                                                     | `parseSelfContainerIdsFromMountinfo()` matches the 64-hex id the runtime stamps into bindfs source paths (`/etc/hostname`, `/etc/resolv.conf`, `/run/.containerenv`) |
-| Detecting rootless mode when `podman info --format {{.Host.Security.Rootless}}` fails (in-container podman can't reach a daemon at its default socket)                                                                                                                                                                                                                           | `probeRootless()` falls back to `docker info --format {{.SecurityOptions}}` and looks for the `name=rootless` token                                                  |
+| Concern                                                                                                                                      | Code                                                                                                                                                                                                                               |
+| -------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Finding our own container id when HOSTNAME is empty, cgroup is `0::/`, and `Network=host` makes `/etc/hostname` return the host machine name | `parseSelfContainerIdsFromMountinfo()` matches the 64-hex id the runtime stamps into bindfs source paths (`/etc/hostname`, `/etc/resolv.conf`, `/run/.containerenv`); each candidate is validated via `getContainer(id).inspect()` |
+| Detecting rootless mode over the socket (dockerode reaches podman's docker-compat `/info`, which does NOT expose `host.security.rootless`)   | `rootlessFromInfo()` in `runtime.ts` reads the compat shape: the top-level `Rootless` boolean, falling back to `SecurityOptions` containing `name=rootless`                                                                        |
 
-The thread that runs through all five: **the in-container signalk-server has no native podman channel back to the host daemon**. Every detection that worked on bare-metal has to be re-derived from artefacts that survive the bind-mount-only topology — env vars set by the runtime, mountinfo paths, the docker compat API, the bind-mounted socket via `podman --remote --url`. When debugging future "signalk-container thinks we're not rootless" / "thinks we're not in a container" / "can't find our own id" / "consumer plugin still failing on `--userns=keep-id`" reports, check whether you're in this deployment shape first.
+When debugging "signalk-container thinks we're not rootless" / "can't find our own id" reports, check whether you're in this deployment shape first — and remember that under the socket the cgroup-controller view comes from the kernel FS (`/sys/fs/cgroup/cgroup.controllers`), not `info()`, because the compat endpoint doesn't expose `CgroupControllers`.
 
 ## Workflow Conventions
 

package/README.md

@@ -6,7 +6,7 @@ Instead of each plugin implementing its own container orchestration, they delega
 
 ## Features
 
-- **Runtime detection** -- Podman preferred, Docker fallback, podman-shim aware. Consumer plugins `await containers.whenReady()` once instead of polling in a loop — resolves when the probe settles in either direction.
+- **Runtime detection** -- resolves the container runtime over its Docker-API socket (Podman preferred, Docker fallback); no podman/docker CLI binary is needed. Consumer plugins `await containers.whenReady()` once instead of polling in a loop — resolves when the probe settles in either direction.
 - **Container lifecycle** -- pull, create, start, stop, remove with `sk-` prefix naming
 - **Automatic config-drift recreation** -- `ensureRunning` compares the requested `ContainerConfig` against the live container on every call. If `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, or `ports` differ, the container is removed and recreated transparently. Consumer plugins no longer need a per-plugin hash file to detect "config changed since last start." See the [developer guide](doc/plugin-developer-guide.md#container-config-changes).
 - **Healthcheck handling** -- image-declared healthchecks are made to work reliably across runtimes. For images that ship **no** healthcheck, consumer plugins set `ContainerConfig.healthcheck` to supply a probe, so the container reports a real health status instead of being stuck in `starting`. See the [developer guide](doc/plugin-developer-guide.md#healthcheck-for-images-that-ship-none).
@@ -20,7 +20,7 @@ Instead of each plugin implementing its own container orchestration, they delega
 - **Zero-config container service connectivity** -- `signalkAccessiblePorts` lets the SignalK process connect back to a service running inside a managed container (e.g. an HTTP or TCP server). signalk-container picks the right networking strategy automatically — port binding on the host loopback for bare-metal deployments, or a shared Docker network with DNS for containerised ones. No host ports are exposed unnecessarily.
 - **SELinux support** -- `:Z` volume flags for Podman bind mounts on Fedora/RHEL; named volumes are handled correctly (`:Z` is not applied)
 - **Per-volume host-source policy** -- volumes accept `{ source, ifMissing: "skip" | "abort" }` for user-managed (USB drives, NFS) or deployment-required (TLS certs) mounts. Plugins subscribe to `onVolumeIssue` events for `'skipped'`, `'aborted'`, and `'recovered'` actions; signalk-container auto-recreates the container when a previously-missing source reappears. See the [developer guide](doc/plugin-developer-guide.md#optional-and-required-volumes).
-- **Container log streaming** -- click **Logs** on any managed-container card to open a live-streaming popup of the container's stdout+stderr (combined, the same shape `podman logs <name>` produces). Plugin authors can also wire `onContainerLog` in `ensureRunning` options to forward the same stream into their plugin's `app.debug` channel — visible in the Signal K server log when debug is enabled. Multiple subscribers share a single underlying tail process. See the [developer guide](doc/plugin-developer-guide.md#streaming-container-logs-into-your-plugins-debug-channel).
+- **Container log streaming** -- click **Logs** on any managed-container card to open a live-streaming popup of the container's stdout+stderr (combined, the same shape `podman logs <name>` produces). Plugin authors can also wire `onContainerLog` in `ensureRunning` options to forward the same stream into their plugin's `app.debug` channel — visible in the Signal K server log when debug is enabled. Multiple subscribers share a single underlying log stream. See the [developer guide](doc/plugin-developer-guide.md#streaming-container-logs-into-your-plugins-debug-channel).
 - **Host-UID ownership alignment** -- managed containers run by default under the Signal K host user's UID/GID (via `--user host:host` on Docker/rootful Podman, `--userns=keep-id` on rootless Podman). Files created on bind mounts are owned by the same identity that runs Signal K, with no `chmod` sweeps. Override per container via `ContainerConfig.user` for images with a non-root `USER` directive, or `user: false` to opt out. See the [developer guide](doc/plugin-developer-guide.md#host-uid-ownership).
 - **Image compliance probes** -- `containers.doctor.imageRunsAsUser(image, user?)` runs the image under the live UID mapping and verifies it can write `/tmp` as the host caller. Surfaces UID-compatibility problems _before_ a container wedges in a restart loop. See the [developer guide](doc/plugin-developer-guide.md#containersdoctorimagerunsasuserimage-user-promiseimageproberesult).
 - **Podman image qualification** -- automatically prefixes `docker.io/` for short image names
@@ -119,69 +119,69 @@ See [doc/plugin-developer-guide.md](doc/plugin-developer-guide.md) for the full
 
 ## API
 
-| Method                                          | Description                                                                                                                                                                                                                                                        |
-| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `getRuntime()`                                  | Returns `{ runtime, version, isPodmanDockerShim }` or `null`                                                                                                                                                                                                       |
-| `whenReady()`                                   | Resolves once runtime detection settles (success OR failure). Replaces the polling-loop pattern; check `getRuntime()` after the await                                                                                                                              |
-| `pullImage(image, onProgress?)`                 | Pull a container image (auto-qualifies for Podman)                                                                                                                                                                                                                 |
-| `imageExists(image)`                            | Check if image exists locally                                                                                                                                                                                                                                      |
-| `getImageDigest(imageOrContainer)`              | Local image ID (sha256) for an image:tag or container                                                                                                                                                                                                              |
-| `ensureRunning(name, config, options?)`         | Create and start container if not running; auto-recreates on config drift across `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, `ports`                                                                                                               |
-| `recreate(name, config, options?)`              | Force-recreate: remove (if present) + ensureRunning. Always replaces an existing container (running or stopped) — use this for "update now" / plugin-startup self-heal flows where correctness must not depend on drift detection (1.12.0+)                        |
-| `start(name)`                                   | Start a stopped container                                                                                                                                                                                                                                          |
-| `stop(name)`                                    | Stop a running container                                                                                                                                                                                                                                           |
-| `remove(name)`                                  | Stop and remove a container                                                                                                                                                                                                                                        |
-| `getState(name)`                                | Returns `running`, `stopped`, `missing`, or `no-runtime`                                                                                                                                                                                                           |
-| `runJob(config)`                                | Execute a one-shot container job                                                                                                                                                                                                                                   |
-| `cleanupOrphanedJobs(filter)`                   | Reap `sk-job-*` containers leaked by a previous server lifecycle, filtered by the caller's `ownerPluginId`. Idempotent — returns `{ reaped: OrphanJobInfo[] }` so the plugin can roll back any per-job state it had written                                        |
-| `getLogs(name, options?)`                       | One-shot fetch of the last N lines of a container's combined stdout+stderr log. `tail` defaults to 200, max 10000; `since` is unix-epoch seconds                                                                                                                   |
-| `prune()`                                       | Remove dangling images                                                                                                                                                                                                                                             |
-| `listContainers()`                              | List all `sk-` prefixed containers                                                                                                                                                                                                                                 |
-| `execInContainer(name, command)`                | Run a command inside a running container                                                                                                                                                                                                                           |
-| `ensureNetwork(name)`                           | Create a Podman/Docker network if it doesn't exist                                                                                                                                                                                                                 |
-| `removeNetwork(name)`                           | Remove a network                                                                                                                                                                                                                                                   |
-| `connectToNetwork(container, network)`          | Add a container to a network (bridge mode only)                                                                                                                                                                                                                    |
-| `disconnectFromNetwork(container, net)`         | Remove a container from a network                                                                                                                                                                                                                                  |
-| `updates.register(reg)`                         | Register a container for update detection                                                                                                                                                                                                                          |
-| `updates.unregister(pluginId)`                  | Stop tracking updates for a plugin                                                                                                                                                                                                                                 |
-| `updates.checkOne(pluginId)`                    | Force a fresh update check (or coalesce with in-flight)                                                                                                                                                                                                            |
-| `updates.getLastResult(pluginId)`               | Cached last result, no network                                                                                                                                                                                                                                     |
-| `manifest.get(pluginId)`                        | Read the persisted manifest for one consumer plugin, or `null` if none. Writes happen automatically after successful `ensureRunning` calls — this is read-only                                                                                                     |
-| `manifest.list()`                               | Return every persisted manifest in the data directory. Order is unspecified                                                                                                                                                                                        |
-| `manifest.getContainerHistory(containerName)`   | Bounded history (max 20 entries) of digest changes for a specific container. Throws "Ambiguous container history" if more than one manifest references the same `containerName` — disambiguate via `manifest.get(pluginId)`                                        |
-| `updateResources(name, limits)`                 | Apply new resource limits live, fall back to recreate                                                                                                                                                                                                              |
-| `getResources(name)`                            | Currently effective limits (plugin defaults ⊕ user override)                                                                                                                                                                                                       |
-| `resolveSignalkDataMount()`                     | Resolve the volume name or host path that backs `app.getDataDirPath()` in the current deployment; returns `null` if the runtime is not yet initialised                                                                                                             |
-| `resolveHostPath(absPath)`                      | Translate an arbitrary absolute path into the `{ source, subPath }` pair the runtime needs to mount it; handles bare-metal, bind, and named-volume topologies                                                                                                      |
-| `resolveContainerAddress(name, port)`           | Return the `host:port` string to reach `port` on a managed container from the SignalK process; call after `ensureRunning()` with `signalkAccessiblePorts` set                                                                                                      |
-| `doctor.imageRunsAsUser(image, user?)`          | Probe whether `image` runs cleanly under the host-UID mapping signalk-container will emit (1.8.0+). Never throws — returns `{ ok, output, error? }`                                                                                                                |
-| `doctor.selfDeployment()`                       | Diagnose the Signal K deployment itself: binary discovery, daemon reachability, rootless/rootful detection, and (when containerized) self-container ID. Returns `{ status, remediation, ... }` — see `SelfDeploymentResult` in `src/types.ts`                      |
-| `doctor.generateSetupSnippet(format?, result?)` | Generate a ready-to-paste compose fragment (`format: "compose"`, default) or `podman/docker run` command (`format: "run"`) tailored to the detected runtime. Pure templating over `SelfDeploymentResult`; bundles a minimal Dockerfile sidecar and operator notes. |
+| Method                                          | Description                                                                                                                                                                                                                                                                                                          |
+| ----------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `getRuntime()`                                  | Returns `{ runtime, version, isRootless, socketPath, ... }` (a `ContainerRuntimeInfo`) or `null`                                                                                                                                                                                                                     |
+| `whenReady()`                                   | Resolves once runtime detection settles (success OR failure). Replaces the polling-loop pattern; check `getRuntime()` after the await                                                                                                                                                                                |
+| `pullImage(image, onProgress?)`                 | Pull a container image (auto-qualifies for Podman)                                                                                                                                                                                                                                                                   |
+| `imageExists(image)`                            | Check if image exists locally                                                                                                                                                                                                                                                                                        |
+| `getImageDigest(imageOrContainer)`              | Local image ID (sha256) for an image:tag or container                                                                                                                                                                                                                                                                |
+| `ensureRunning(name, config, options?)`         | Create and start container if not running; auto-recreates on config drift across `image`, `tag`, `command`, `networkMode`, `env`, `volumes`, `ports`                                                                                                                                                                 |
+| `recreate(name, config, options?)`              | Force-recreate: remove (if present) + ensureRunning. Always replaces an existing container (running or stopped) — use this for "update now" / plugin-startup self-heal flows where correctness must not depend on drift detection (1.12.0+)                                                                          |
+| `start(name)`                                   | Start a stopped container                                                                                                                                                                                                                                                                                            |
+| `stop(name)`                                    | Stop a running container                                                                                                                                                                                                                                                                                             |
+| `remove(name)`                                  | Stop and remove a container                                                                                                                                                                                                                                                                                          |
+| `getState(name)`                                | Returns `running`, `stopped`, `missing`, or `no-runtime`                                                                                                                                                                                                                                                             |
+| `runJob(config)`                                | Execute a one-shot container job                                                                                                                                                                                                                                                                                     |
+| `cleanupOrphanedJobs(filter)`                   | Reap `sk-job-*` containers leaked by a previous server lifecycle, filtered by the caller's `ownerPluginId`. Idempotent — returns `{ reaped: OrphanJobInfo[] }` so the plugin can roll back any per-job state it had written                                                                                          |
+| `getLogs(name, options?)`                       | One-shot fetch of the last N lines of a container's combined stdout+stderr log. `tail` defaults to 200, max 10000; `since` is unix-epoch seconds                                                                                                                                                                     |
+| `prune()`                                       | Remove dangling images                                                                                                                                                                                                                                                                                               |
+| `listContainers()`                              | List all `sk-` prefixed containers                                                                                                                                                                                                                                                                                   |
+| `execInContainer(name, command)`                | Run a command inside a running container                                                                                                                                                                                                                                                                             |
+| `ensureNetwork(name)`                           | Create a Podman/Docker network if it doesn't exist                                                                                                                                                                                                                                                                   |
+| `removeNetwork(name)`                           | Remove a network                                                                                                                                                                                                                                                                                                     |
+| `connectToNetwork(container, network)`          | Add a container to a network (bridge mode only)                                                                                                                                                                                                                                                                      |
+| `disconnectFromNetwork(container, net)`         | Remove a container from a network                                                                                                                                                                                                                                                                                    |
+| `updates.register(reg)`                         | Register a container for update detection                                                                                                                                                                                                                                                                            |
+| `updates.unregister(pluginId)`                  | Stop tracking updates for a plugin                                                                                                                                                                                                                                                                                   |
+| `updates.checkOne(pluginId)`                    | Force a fresh update check (or coalesce with in-flight)                                                                                                                                                                                                                                                              |
+| `updates.getLastResult(pluginId)`               | Cached last result, no network                                                                                                                                                                                                                                                                                       |
+| `manifest.get(pluginId)`                        | Read the persisted manifest for one consumer plugin, or `null` if none. Writes happen automatically after successful `ensureRunning` calls — this is read-only                                                                                                                                                       |
+| `manifest.list()`                               | Return every persisted manifest in the data directory. Order is unspecified                                                                                                                                                                                                                                          |
+| `manifest.getContainerHistory(containerName)`   | Bounded history (max 20 entries) of digest changes for a specific container. Throws "Ambiguous container history" if more than one manifest references the same `containerName` — disambiguate via `manifest.get(pluginId)`                                                                                          |
+| `updateResources(name, limits)`                 | Apply new resource limits live, fall back to recreate                                                                                                                                                                                                                                                                |
+| `getResources(name)`                            | Currently effective limits (plugin defaults ⊕ user override)                                                                                                                                                                                                                                                         |
+| `resolveSignalkDataMount()`                     | Resolve the volume name or host path that backs `app.getDataDirPath()` in the current deployment; returns `null` if the runtime is not yet initialised                                                                                                                                                               |
+| `resolveHostPath(absPath)`                      | Translate an arbitrary absolute path into the `{ source, subPath }` pair the runtime needs to mount it; handles bare-metal, bind, and named-volume topologies                                                                                                                                                        |
+| `resolveContainerAddress(name, port)`           | Return the `host:port` string to reach `port` on a managed container from the SignalK process; call after `ensureRunning()` with `signalkAccessiblePorts` set                                                                                                                                                        |
+| `doctor.imageRunsAsUser(image, user?)`          | Probe whether `image` runs cleanly under the host-UID mapping signalk-container will emit (1.8.0+). Never throws — returns `{ ok, output, error? }`                                                                                                                                                                  |
+| `doctor.selfDeployment()`                       | Diagnose the Signal K deployment itself: socket resolution, daemon reachability, rootless/rootful detection, and (when containerised) self-container ID. Returns `{ status, remediation, ... }` — see `SelfDeploymentResult` in `src/types.ts`                                                                       |
+| `doctor.generateSetupSnippet(format?, result?)` | Generate a ready-to-paste compose fragment (`format: "compose"`, default) or `podman/docker run` command (`format: "run"`) tailored to the detected runtime — wires up the socket bind-mount. Pure templating over `SelfDeploymentResult`; includes a `dockerfile` note (no image change needed) and operator notes. |
 
 ## REST Endpoints
 
 All mounted at `/plugins/signalk-container/api/`:
 
-| Method | Path                                     | Description                                                                                                                                                                                                             |
-| ------ | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| GET    | `/runtime`                               | Detected runtime info                                                                                                                                                                                                   |
-| GET    | `/containers`                            | List managed containers                                                                                                                                                                                                 |
-| GET    | `/containers/:name/state`                | Container state                                                                                                                                                                                                         |
-| POST   | `/containers/:name/start`                | Start a stopped container                                                                                                                                                                                               |
-| POST   | `/containers/:name/stop`                 | Stop a running container                                                                                                                                                                                                |
-| POST   | `/containers/:name/remove`               | Stop and remove a container                                                                                                                                                                                             |
-| GET    | `/containers/:name/logs?tail=N&since=ts` | Last N lines of the container's combined stdout+stderr log (one-shot). `tail` defaults 200, max 10000                                                                                                                   |
-| GET    | `/containers/:name/logs/stream`          | Server-Sent Events stream of live log lines. Closes when the container is removed or the client disconnects                                                                                                             |
-| POST   | `/prune`                                 | Prune dangling images                                                                                                                                                                                                   |
-| GET    | `/updates`                               | List last update-check results                                                                                                                                                                                          |
-| GET    | `/updates/:pluginId`                     | Last update-check result for one plugin                                                                                                                                                                                 |
-| POST   | `/updates/:pluginId/check`               | Force a fresh update check (HTTP 200 even when offline)                                                                                                                                                                 |
-| GET    | `/containers/:name/resources`            | Effective resource limits + user override                                                                                                                                                                               |
-| POST   | `/containers/:name/resources`            | Apply new resource limits (live or recreate). Body is a `ContainerResourceLimits` diff against the consumer plugin's default.                                                                                           |
-| DELETE | `/containers/:name/resources`            | Clear any user override and restore the consumer plugin's pristine default limits to the running container.                                                                                                             |
-| POST   | `/doctor/image`                          | Probe whether an image runs cleanly under the live host-UID mapping. Body: `{ image, tag?, user? }`. Never 5xx for a failed probe — `{ ok: false, error }` is a successful response (1.8.0+).                           |
-| GET    | `/doctor/deployment`                     | Diagnose this Signal K deployment: binary discovery, daemon reachability, rootless/rootful detection, self-container ID cascade. Returns a `SelfDeploymentResult` with `status` and copy-pasteable `remediation` lines. |
-| GET    | `/doctor/snippet?format=compose\|run`    | Generate a ready-to-paste compose fragment or shell command for setting up Signal K with this runtime. `text/plain` by default; pass `Accept: application/json` for the structured `SetupSnippetResult`.                |
+| Method | Path                                     | Description                                                                                                                                                                                                              |
+| ------ | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| GET    | `/runtime`                               | Detected runtime info                                                                                                                                                                                                    |
+| GET    | `/containers`                            | List managed containers                                                                                                                                                                                                  |
+| GET    | `/containers/:name/state`                | Container state                                                                                                                                                                                                          |
+| POST   | `/containers/:name/start`                | Start a stopped container                                                                                                                                                                                                |
+| POST   | `/containers/:name/stop`                 | Stop a running container                                                                                                                                                                                                 |
+| POST   | `/containers/:name/remove`               | Stop and remove a container                                                                                                                                                                                              |
+| GET    | `/containers/:name/logs?tail=N&since=ts` | Last N lines of the container's combined stdout+stderr log (one-shot). `tail` defaults 200, max 10000                                                                                                                    |
+| GET    | `/containers/:name/logs/stream`          | Server-Sent Events stream of live log lines. Closes when the container is removed or the client disconnects                                                                                                              |
+| POST   | `/prune`                                 | Prune dangling images                                                                                                                                                                                                    |
+| GET    | `/updates`                               | List last update-check results                                                                                                                                                                                           |
+| GET    | `/updates/:pluginId`                     | Last update-check result for one plugin                                                                                                                                                                                  |
+| POST   | `/updates/:pluginId/check`               | Force a fresh update check (HTTP 200 even when offline)                                                                                                                                                                  |
+| GET    | `/containers/:name/resources`            | Effective resource limits + user override                                                                                                                                                                                |
+| POST   | `/containers/:name/resources`            | Apply new resource limits (live or recreate). Body is a `ContainerResourceLimits` diff against the consumer plugin's default.                                                                                            |
+| DELETE | `/containers/:name/resources`            | Clear any user override and restore the consumer plugin's pristine default limits to the running container.                                                                                                              |
+| POST   | `/doctor/image`                          | Probe whether an image runs cleanly under the live host-UID mapping. Body: `{ image, tag?, user? }`. Never 5xx for a failed probe — `{ ok: false, error }` is a successful response (1.8.0+).                            |
+| GET    | `/doctor/deployment`                     | Diagnose this Signal K deployment: socket resolution, daemon reachability, rootless/rootful detection, self-container ID cascade. Returns a `SelfDeploymentResult` with `status` and copy-pasteable `remediation` lines. |
+| GET    | `/doctor/snippet?format=compose\|run`    | Generate a ready-to-paste compose fragment or shell command for setting up Signal K with this runtime. `text/plain` by default; pass `Accept: application/json` for the structured `SetupSnippetResult`.                 |
 
 ## Configuration
 
@@ -301,7 +301,7 @@ services:
 
 You'll see "could not detect self container id" in the SignalK log when the cascade has failed; the override resolves it without code changes.
 
-For a full walkthrough of the in-container deployment (socket bind-mount, `DOCKER_HOST` / podman remote-mode fallback, reference quadlet, troubleshooting table) see **[doc/run-in-container.md](doc/run-in-container.md)**.
+For a full walkthrough of the in-container deployment (socket bind-mount, self-container-id override, reference quadlet, troubleshooting table) see **[doc/run-in-container.md](doc/run-in-container.md)**.
 
 ## Connecting back to a container service (`signalkAccessiblePorts`)
 

package/dist/client.d.ts

@@ -0,0 +1,119 @@
+/**
+ * dockerode client: socket selection, the shared singleton, and the `safe()`
+ * error-normalizing wrapper. Every runtime call in the plugin goes through the
+ * `ContainerClient` returned by `getClient()`.
+ *
+ * Why a unix socket and not the podman/docker CLI: the plugin runs inside the
+ * Signal K server container, where the host runtime socket is bind-mounted
+ * (`/var/run/docker.sock` in the universal-installer topology). Talking the
+ * Docker API directly over that socket removes the need for any runtime CLI
+ * binary in the Signal K base image, and removes the whole class of
+ * podman-docker-shim flag-validation workarounds the CLI path needed — the API
+ * accepts podman-specific create fields (e.g. `HostConfig.UsernsMode:
+ * "keep-id"`) with no client-side validation.
+ *
+ * Adapted from signalk-updater-server/src/podman/client.ts (the proven dockerode
+ * wrapper shared across the engine containers).
+ */
+import Docker from "dockerode";
+import { type CategorizedError } from "./errors.js";
+/**
+ * The dockerode surface the plugin actually uses. Production passes the real
+ * `Docker` instance; tests pass a hand-rolled mock implementing only the
+ * methods in play. This is the injection seam that replaced the CLI-era
+ * `ExecFn` stub: instead of feeding canned `{stdout, exitCode}` strings, tests
+ * stub typed dockerode methods and assert object-field access.
+ */
+export interface ContainerClient {
+    getContainer(id: string): Docker.Container;
+    getImage(name: string): Docker.Image;
+    getNetwork(id: string): Docker.Network;
+    createContainer(opts: Docker.ContainerCreateOptions): Promise<Docker.Container>;
+    createNetwork(opts: Docker.NetworkCreateOptions): Promise<Docker.Network>;
+    listContainers(opts?: Docker.ContainerListOptions): Promise<Docker.ContainerInfo[]>;
+    pull(repoTag: string, opts?: object): Promise<NodeJS.ReadableStream>;
+    pruneImages(opts?: object): Promise<Docker.PruneImagesInfo>;
+    version(): Promise<Docker.DockerVersion>;
+    info(): Promise<unknown>;
+    /** docker-modem; typed `any` upstream. Used for followProgress + demuxStream. */
+    modem: {
+        followProgress(stream: NodeJS.ReadableStream, onFinished: (error: Error | null, result: unknown[]) => void, onProgress?: (obj: unknown) => void): void;
+        demuxStream(stream: NodeJS.ReadableStream, stdout: NodeJS.WritableStream, stderr: NodeJS.WritableStream): void;
+    };
+}
+/** Runtime the caller prefers when more than one socket is reachable. */
+export type SocketPreference = "auto" | "podman" | "docker";
+export interface ResolvedClient {
+    /**
+     * The resolved dockerode client, typed as the narrow `ContainerClient`
+     * surface the plugin uses (a real `Docker` instance satisfies it). Consumers
+     * get a usable client with no `as` cast.
+     */
+    client: ContainerClient;
+    socketPath: string;
+}
+/**
+ * Resolve (once) and cache the dockerode client + its socket path. Returns
+ * `null` when no socket answers — the caller surfaces this as "no container
+ * runtime" via the doctor. Re-resolves after `resetClient()`.
+ */
+export declare function resolveClient(preference?: SocketPreference): Promise<ResolvedClient | null>;
+/**
+ * The shared client for code paths that have already resolved a runtime (every
+ * consumer call after `detectRuntime` succeeded). Throws if called before
+ * resolution — that's a programming error, not a runtime condition.
+ */
+export declare function getClient(): ContainerClient;
+/** Path of the resolved socket, for doctor/diagnostic display. */
+export declare function getSocketPath(): string | undefined;
+/**
+ * Drop the cached client. Called from `plugin.stop()` so a stop/start cycle
+ * re-probes the socket, and from tests to reset between cases.
+ */
+export declare function resetClient(): void;
+/**
+ * Test-only: install a specific client + socket path as the resolved singleton,
+ * bypassing socket probing. Pass `null` to clear.
+ */
+export declare function _setClientForTesting(client: ContainerClient | null, socketPath?: string): void;
+/**
+ * Run a dockerode op and normalize any throw into a categorized error. The one
+ * place the `{stdout, stderr, exitCode}` CLI contract is replaced: callers
+ * branch on `result.ok` instead of inspecting an exit code.
+ */
+export declare function safe<T>(op: () => Promise<T>): Promise<{
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: CategorizedError;
+}>;
+/**
+ * `inspect`-style convenience: returns `null` when the resource is absent (404)
+ * and rethrows anything else. Replaces the CLI-era "exitCode !== 0 → missing"
+ * idiom, which couldn't distinguish "not found" from "daemon broken".
+ */
+export declare function safeInspect<T>(op: () => Promise<T>): Promise<T | null>;
+/**
+ * Demultiplex a dockerode logs/exec stream into combined plain text.
+ *
+ * Containers started without a TTY (the dockerode default, and how every
+ * managed container starts) deliver logs as a multiplexed stream: each
+ * stdout/stderr chunk is prefixed with an 8-byte header
+ * (`[stream-type, 0, 0, 0, len32]`). Reading the raw bytes as UTF-8 leaks those
+ * headers into rendered log lines as binary garbage. `modem.demuxStream` splits
+ * the framing into two writable sinks; we merge both into one text callback
+ * because the plugin surfaces combined stdout+stderr (matching `podman logs`
+ * semantics). The CLI used to pre-demux for us — over the API we must do it.
+ *
+ * Returns a function that, given a finished/destroyed source stream, has piped
+ * all demuxed text into `onText`. Caller wires `onText` to a line splitter.
+ */
+export declare function demuxToText(modem: ContainerClient["modem"], source: NodeJS.ReadableStream, onText: (chunk: string) => void): void;
+/**
+ * Read a finished (non-follow) logs/exec stream fully and return the demuxed
+ * combined text. Used by one-shot `getContainerLogs` and `execInContainer`,
+ * which under the CLI got pre-demuxed text and now must demux a buffer.
+ */
+export declare function demuxBufferToText(modem: ContainerClient["modem"], source: NodeJS.ReadableStream): Promise<string>;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,MAAM,MAAM,WAAW,CAAC;AAG/B,OAAO,EAAmB,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC;IACrC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;IACvC,eAAe,CACb,IAAI,EAAE,MAAM,CAAC,sBAAsB,GAClC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7B,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC1E,cAAc,CACZ,IAAI,CAAC,EAAE,MAAM,CAAC,oBAAoB,GACjC,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrE,WAAW,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,iFAAiF;IACjF,KAAK,EAAE;QACL,cAAc,CACZ,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,EAC5D,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,GAClC,IAAI,CAAC;QACR,WAAW,CACT,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,IAAI,CAAC;KACT,CAAC;CACH;AAED,yEAAyE;AACzE,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAuF5D,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,EAAE,eAAe,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAID;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,UAAU,GAAE,gBAAyB,GACpC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAMhC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,IAAI,eAAe,CAO3C;AAED,kEAAkE;AAClE,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,GAAG,IAAI,EAC9B,UAAU,SAAsB,GAC/B,IAAI,CAEN;AAED;;;;GAIG;AACH,wBAAsB,IAAI,CAAC,CAAC,EAC1B,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACnB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAM1E;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAK5E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,cAAc,EAC7B,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,GAC9B,IAAI,CAON;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,EAC/B,MAAM,EAAE,MAAM,CAAC,cAAc,GAC5B,OAAO,CAAC,MAAM,CAAC,CAUjB"}