typekro 0.27.0 → 0.28.0

package/dist/core/containers/exec.js

@@ -1,108 +1,124 @@
-/**
- * Docker CLI Execution Helper
- *
- * Wraps Bun.spawn for Docker commands with streaming output,
- * timeout support, and actionable error messages.
- */
+import { spawn } from 'node:child_process';
 import { getComponentLogger } from '../logging/index.js';
 import { ContainerBuildError } from './errors.js';
 const logger = getComponentLogger('container-exec');
-/** Valid Docker build-arg key pattern. */
 const VALID_BUILD_ARG_KEY = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
-/**
- * Validate that build arg keys are safe Docker ARG names.
- * Prevents flag injection via malicious keys like "--platform".
- */
+const MAX_CAPTURED_OUTPUT_CHARS = 1_048_576;
+const FORCE_KILL_GRACE_MS = 1_000;
 export function validateBuildArgs(buildArgs) {
     for (const [key, value] of Object.entries(buildArgs)) {
         if (!VALID_BUILD_ARG_KEY.test(key)) {
-            throw new ContainerBuildError(`Invalid build arg key: "${key}". Must match ${VALID_BUILD_ARG_KEY.source}`, 'INVALID_BUILD_ARG', ['Build arg keys must be valid Docker ARG names (alphanumeric + underscore, starting with letter/underscore).']);
+            throw new ContainerBuildError(`Invalid build arg key: "${key}". Must match ${VALID_BUILD_ARG_KEY.source}`, 'INVALID_BUILD_ARG', ['Build arg keys must be valid Docker ARG names.']);
         }
-        if (typeof value === 'string' && value.includes('\n')) {
-            throw new ContainerBuildError(`Build arg value for "${key}" contains newlines, which may break Docker --build-arg parsing.`, 'INVALID_BUILD_ARG', ['Remove newlines from build arg values.']);
+        if (value.includes('\n')) {
+            throw new ContainerBuildError(`Build arg value for "${key}" contains newlines.`, 'INVALID_BUILD_ARG', ['Remove newlines from build arg values.']);
         }
     }
 }
-/**
- * Execute a Docker CLI command.
- *
- * Streams output to the logger in real-time unless `quiet` is set.
- * Throws ContainerBuildError on non-zero exit or timeout.
- */
+function redact(value, sensitiveValues) {
+    return sensitiveValues.reduce((current, sensitive) => (sensitive ? current.split(sensitive).join('***') : current), value);
+}
+function redactedDockerArgs(args) {
+    return args.map((arg, index) => {
+        if (args[index - 1] === '--build-arg' && arg.includes('=')) {
+            return `${arg.slice(0, arg.indexOf('='))}=***`;
+        }
+        if (args[index - 1] === '--password')
+            return '***';
+        return arg;
+    });
+}
+function appendBounded(current, chunk) {
+    const combined = current + chunk;
+    return combined.length <= MAX_CAPTURED_OUTPUT_CHARS
+        ? combined
+        : combined.slice(-MAX_CAPTURED_OUTPUT_CHARS);
+}
+/** Execute Docker through a Node-compatible process boundary with timeout and cancellation. */
 export async function execDocker(args, options = {}) {
-    const { stdin, quiet = false, timeout = 300_000 } = options;
-    // Redact --build-arg values in logs to prevent secret leakage
-    const redactedArgs = args.map((arg, i) => args[i - 1] === '--build-arg' && arg.includes('=')
-        ? `${arg.split('=')[0]}=***`
-        : arg);
-    logger.debug('Executing docker command', { args: ['docker', ...redactedArgs] });
-    const proc = Bun.spawn(['docker', ...args], {
-        stdout: 'pipe',
-        stderr: 'pipe',
-        stdin: stdin ? 'pipe' : undefined,
+    const { stdin, quiet = false, timeout = 300_000, signal, environment = {}, sensitiveValues = [], } = options;
+    if (signal?.aborted)
+        throw ContainerBuildError.cancelled();
+    const safeArgs = redactedDockerArgs(args);
+    logger.debug('Executing docker command', { args: ['docker', ...safeArgs] });
+    const child = spawn('docker', args, {
+        env: { ...process.env, ...environment },
+        stdio: ['pipe', 'pipe', 'pipe'],
     });
-    if (stdin && proc.stdin) {
-        proc.stdin.write(stdin);
-        proc.stdin.end();
-    }
-    // Start reading streams immediately (before awaiting exit) to prevent
-    // resource leaks if the process is killed by timeout.
-    const stdoutPromise = new Response(proc.stdout).text().catch(() => '');
-    const stderrPromise = new Response(proc.stderr).text().catch(() => '');
-    // Race exit against timeout. The timeout promise has a .catch() no-op to
-    // prevent unhandled rejections if the timeout fires at the exact moment
-    // the process exits (race condition at the boundary).
-    let timeoutTimer;
-    const timeoutPromise = new Promise((_, reject) => {
-        timeoutTimer = setTimeout(() => {
-            proc.kill();
-            reject(new ContainerBuildError(`Docker command timed out after ${timeout}ms: docker ${redactedArgs.join(' ')}`, 'BUILD_TIMEOUT', ['Increase the timeout option.', 'Check network connectivity for pulls.']));
-        }, timeout);
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+        stdout = appendBounded(stdout, chunk);
     });
-    timeoutPromise.catch(() => { });
-    const exitCode = await Promise.race([proc.exited, timeoutPromise]).finally(() => {
-        if (timeoutTimer !== undefined)
-            clearTimeout(timeoutTimer);
+    child.stderr.on('data', (chunk) => {
+        stderr = appendBounded(stderr, chunk);
     });
-    const stdout = await stdoutPromise;
-    const stderr = await stderrPromise;
-    if (!quiet && stdout.trim()) {
-        for (const line of stdout.trim().split('\n').slice(-20)) {
+    child.stdin.on('error', (error) => {
+        if (error.code !== 'EPIPE')
+            logger.debug('Docker stdin closed unexpectedly', { error: error.message });
+    });
+    if (stdin !== undefined)
+        child.stdin.end(stdin);
+    else
+        child.stdin.end();
+    let timedOut = false;
+    let cancelled = false;
+    let forceKillHandle;
+    const terminate = () => {
+        child.kill('SIGTERM');
+        forceKillHandle ??= setTimeout(() => child.kill('SIGKILL'), FORCE_KILL_GRACE_MS);
+    };
+    const timeoutHandle = setTimeout(() => {
+        timedOut = true;
+        terminate();
+    }, timeout);
+    const abort = () => {
+        cancelled = true;
+        terminate();
+    };
+    signal?.addEventListener('abort', abort, { once: true });
+    const exitCode = await new Promise((resolve, reject) => {
+        child.once('error', reject);
+        child.once('close', (code) => resolve(code ?? 1));
+    }).finally(() => {
+        clearTimeout(timeoutHandle);
+        if (forceKillHandle)
+            clearTimeout(forceKillHandle);
+        signal?.removeEventListener('abort', abort);
+    });
+    if (cancelled)
+        throw ContainerBuildError.cancelled();
+    if (timedOut) {
+        throw ContainerBuildError.timeout(timeout, `docker ${safeArgs.join(' ')}`);
+    }
+    const safeStdout = redact(stdout, sensitiveValues);
+    const safeStderr = redact(stderr, sensitiveValues);
+    if (!quiet && safeStdout.trim()) {
+        for (const line of safeStdout.trim().split('\n').slice(-20))
             logger.info(line);
-        }
     }
     if (exitCode !== 0) {
         if (!quiet) {
-            for (const line of stderr.trim().split('\n')) {
+            for (const line of safeStderr.trim().split('\n').slice(-40))
                 logger.error(line);
-            }
         }
-        throw ContainerBuildError.buildFailed(exitCode, stderr);
+        throw ContainerBuildError.commandFailed(exitCode, safeArgs, safeStderr);
     }
-    return { exitCode, stdout, stderr };
+    return { exitCode, stdout: safeStdout, stderr: safeStderr };
 }
-/**
- * Check if Docker is available and the daemon is running.
- */
-export async function checkDockerAvailable() {
+export async function checkDockerAvailable(signal) {
     try {
-        const proc = Bun.spawn(['docker', 'version', '--format', '{{.Server.Version}}'], {
-            stdout: 'pipe',
-            stderr: 'pipe',
+        const result = await execDocker(['version', '--format', '{{.Server.Version}}'], {
+            quiet: true,
+            timeout: 15_000,
+            ...(signal ? { signal } : {}),
         });
-        // Read both streams concurrently before awaiting exit
-        const stdoutPromise = new Response(proc.stdout).text().catch(() => '');
-        const stderrPromise = new Response(proc.stderr).text().catch(() => '');
-        const exitCode = await proc.exited;
-        const stdout = await stdoutPromise;
-        const stderr = await stderrPromise;
-        if (exitCode !== 0) {
-            throw ContainerBuildError.dockerNotAvailable(stderr.trim());
-        }
-        logger.debug('Docker available', { version: stdout.trim() });
+        logger.debug('Docker available', { version: result.stdout.trim() });
     }
     catch (error) {
-        if (error instanceof ContainerBuildError)
+        if (error instanceof ContainerBuildError && error.code === 'BUILD_CANCELLED')
             throw error;
         throw ContainerBuildError.dockerNotAvailable(error instanceof Error ? error.message : String(error));
     }

package/dist/core/containers/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/core/containers/exec.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AAEpD,0CAA0C;AAC1C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAiBvD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiC;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,GAAG,iBAAiB,mBAAmB,CAAC,MAAM,EAAE,EAC3E,mBAAmB,EACnB,CAAC,6GAA6G,CAAC,CAChH,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,GAAG,kEAAkE,EAC7F,mBAAmB,EACnB,CAAC,wCAAwC,CAAC,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,GAAG,OAAO,CAAC;IAE5D,8DAA8D;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CACvC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC;QAChD,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM;QAC5B,CAAC,CAAC,GAAG,CACR,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAEhF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;QAC1C,MAAM,EAAE,MAAM;QACd,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAClC,CAAC,CAAC;IAEH,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACnB,CAAC;IAED,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAEvE,yEAAyE;IACzE,wEAAwE;IACxE,sDAAsD;IACtD,IAAI,YAAuD,CAAC;IAC5D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QACtD,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;YACZ,MAAM,CAAC,IAAI,mBAAmB,CAC5B,kCAAkC,OAAO,cAAc,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAC/E,eAAe,EACf,CAAC,8BAA8B,EAAE,uCAAuC,CAAC,CAC1E,CAAC,CAAC;QACL,CAAC,EAAE,OAAO,CAAC,CAAC;IACd,CAAC,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,CAAC,GAAG,EAAE,GAAsD,CAAC,CAAC,CAAC;IAEnF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAC9E,IAAI,YAAY,KAAK,SAAS;YAAE,YAAY,CAAC,YAAY,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;IAEnC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,MAAM,mBAAmB,CAAC,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QACH,sDAAsD;QACtD,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC;QAEnC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,MAAM,mBAAmB,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB;YAAE,MAAM,KAAK,CAAC;QACtD,MAAM,mBAAmB,CAAC,kBAAkB,CAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../../src/core/containers/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,MAAM,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;AACpD,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AACvD,MAAM,yBAAyB,GAAG,SAAS,CAAC;AAC5C,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAkBlC,MAAM,UAAU,iBAAiB,CAAC,SAAiC;IACjE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,mBAAmB,CAC3B,2BAA2B,GAAG,iBAAiB,mBAAmB,CAAC,MAAM,EAAE,EAC3E,mBAAmB,EACnB,CAAC,gDAAgD,CAAC,CACnD,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,mBAAmB,CAC3B,wBAAwB,GAAG,sBAAsB,EACjD,mBAAmB,EACnB,CAAC,wCAAwC,CAAC,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,eAAkC;IAC/D,OAAO,eAAe,CAAC,MAAM,CAC3B,CAAC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EACpF,KAAK,CACN,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAuB;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;QAC7B,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,aAAa,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QACjD,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,YAAY;YAAE,OAAO,KAAK,CAAC;QACnD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,CAAC;IACjC,OAAO,QAAQ,CAAC,MAAM,IAAI,yBAAyB;QACjD,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,yBAAyB,CAAC,CAAC;AACjD,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,EACJ,KAAK,EACL,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,OAAO,EACjB,MAAM,EACN,WAAW,GAAG,EAAE,EAChB,eAAe,GAAG,EAAE,GACrB,GAAG,OAAO,CAAC;IACZ,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC;IAE3D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,GAAG,QAAQ,CAAC,EAAE,CAAC,CAAC;IAE5E,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE;QAClC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE;QACvC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACjC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACxC,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO;YACxB,MAAM,CAAC,KAAK,CAAC,kCAAkC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;;QAC3C,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IAEvB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAA0D,CAAC;IAC/D,MAAM,SAAS,GAAG,GAAG,EAAE;QACrB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtB,eAAe,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnF,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QACpC,QAAQ,GAAG,IAAI,CAAC;QAChB,SAAS,EAAE,CAAC;IACd,CAAC,EAAE,OAAO,CAAC,CAAC;IACZ,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,SAAS,GAAG,IAAI,CAAC;QACjB,SAAS,EAAE,CAAC;IACd,CAAC,CAAC;IACF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEzD,MAAM,QAAQ,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACd,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,IAAI,eAAe;YAAE,YAAY,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS;QAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC;IACrD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,mBAAmB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QACnB,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;gBAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,mBAAmB,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,MAAoB;IAC7D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE;YAC9E,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,MAAM;YACf,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAAE,MAAM,KAAK,CAAC;QAC1F,MAAM,mBAAmB,CAAC,kBAAkB,CAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/containers/image.d.ts

@@ -10,8 +10,9 @@
  * that: you `await` it. It is NOT a deferred reference — resolve images in (async) setup code before
  * composing, then feed the resulting literals into resources or chart values.
  *
- * Memoization: the build is keyed by container identity (`id ?? imageName`) and cached, so awaiting
- * the same container many times (e.g. several deployments sharing one image) builds it exactly ONCE.
+ * Memoization: the build is keyed by the effective content, target, registry, and build options, so
+ * awaiting the same container many times builds it once while a changed context or registry cannot
+ * accidentally reuse a different image.
  *
  * @example
  * ```typescript
@@ -28,16 +29,19 @@
 import type { ContainerBuildOptions, ContainerBuildResult } from './registries/types.js';
 /** A built container image, resolved to a literal — both the full URI and its split parts. */
 export interface ContainerImage {
-    /** Full image URI, e.g. `123.dkr.ecr.us-east-1.amazonaws.com/app:sha-abc`. */
+    /** Immutable digest URI for remote images, or the local tagged URI. */
     readonly imageUri: string;
-    /** The URI without the tag, e.g. `123.dkr.ecr.us-east-1.amazonaws.com/app`. */
+    /** Human-readable tagged URI retained for inspection and retention policy. */
+    readonly taggedImageUri: string;
     readonly repository: string;
-    /** The tag, e.g. `sha-abc`. */
     readonly tag: string;
+    /** Registry-verified digest. Omitted for local, non-pushed images. */
+    readonly digest?: string;
+    readonly platforms: readonly string[];
 }
-/** Options for {@link container}: the {@link ContainerBuildOptions} plus an optional stable identity. */
+/** Options for {@link container}: the {@link ContainerBuildOptions} plus an optional diagnostic identity. */
 export interface ContainerOptions extends ContainerBuildOptions {
-    /** Stable identity for build memoization; defaults to `imageName`. Set when two containers share one. */
+    /** Stable diagnostic identity included in, but never substituted for, the complete cache key. */
     id?: string;
 }
 /**

package/dist/core/containers/image.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/core/containers/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,yGAAyG;AACzG,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,yGAAyG;IACzG,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQ9E;AAKD,uGAAuG;AACvG,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AASjF;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,gBAAgB,EACzB,KAAK,GAAE,OAAwB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAQzB;AAED,sGAAsG;AACtG,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}
+{"version":3,"file":"image.d.ts","sourceRoot":"","sources":["../../../src/core/containers/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAEzF,8FAA8F;AAC9F,MAAM,WAAW,cAAc;IAC7B,uEAAuE;IACvE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,6GAA6G;AAC7G,MAAM,WAAW,gBAAiB,SAAQ,qBAAqB;IAC7D,iGAAiG;IACjG,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAQ9E;AAOD,uGAAuG;AACvG,KAAK,OAAO,GAAG,CAAC,OAAO,EAAE,qBAAqB,KAAK,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAiGjF;;;;GAIG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,gBAAgB,EACzB,KAAK,GAAE,OAAwB,GAC9B,OAAO,CAAC,cAAc,CAAC,CAazB;AAED,sGAAsG;AACtG,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C"}

package/dist/core/containers/image.js

@@ -10,8 +10,9 @@
  * that: you `await` it. It is NOT a deferred reference — resolve images in (async) setup code before
  * composing, then feed the resulting literals into resources or chart values.
  *
- * Memoization: the build is keyed by container identity (`id ?? imageName`) and cached, so awaiting
- * the same container many times (e.g. several deployments sharing one image) builds it exactly ONCE.
+ * Memoization: the build is keyed by the effective content, target, registry, and build options, so
+ * awaiting the same container many times builds it once while a changed context or registry cannot
+ * accidentally reuse a different image.
  *
  * @example
  * ```typescript
@@ -25,7 +26,10 @@
  * // or for a Helm chart's split image values: { repository: img.repository, tag: img.tag }
  * ```
  */
-import { buildContainer } from './build.js';
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { buildContainer, computeContentHash } from './build.js';
 /**
  * Split a full image URI into `{ repository, tag }`. Handles digest form (`repo@sha256:…`) and tag
  * form (`repo:tag`), registry-port-colon aware (a colon in `host:port/...` is not the tag separator).
@@ -40,13 +44,92 @@ export function splitImageUri(uri) {
         ? { repository: uri.slice(0, colon), tag: uri.slice(colon + 1) }
         : { repository: uri, tag: 'latest' };
 }
-/** Build memoization, keyed by container identity (`id ?? imageName`) — builds each image once. */
+/** Build memoization, keyed by effective content/options — builds each exact image once. */
 const buildCache = new Map();
+const objectIdentities = new WeakMap();
+let nextObjectIdentity = 1;
 async function buildAndShape(options, build) {
     const { id: _id, ...buildOptions } = options;
     const result = await build({ ...buildOptions, tag: buildOptions.tag ?? 'content-hash' });
-    const { repository, tag } = splitImageUri(result.imageUri);
-    return { imageUri: result.imageUri, repository, tag };
+    return {
+        imageUri: result.imageUri,
+        taggedImageUri: result.taggedImageUri,
+        repository: result.repository,
+        tag: result.tag,
+        ...(result.digest ? { digest: result.digest } : {}),
+        platforms: result.platforms,
+    };
+}
+function objectIdentity(value) {
+    if (!value)
+        return undefined;
+    let identity = objectIdentities.get(value);
+    if (!identity) {
+        identity = nextObjectIdentity++;
+        objectIdentities.set(value, identity);
+    }
+    return identity;
+}
+function sortedRecord(value) {
+    return value
+        ? Object.fromEntries(Object.entries(value).sort(([left], [right]) => left.localeCompare(right)))
+        : undefined;
+}
+function registryIdentity(registry) {
+    switch (registry.type) {
+        case 'oci':
+            return {
+                type: registry.type,
+                registry: registry.registry,
+                repositoryPrefix: registry.repositoryPrefix,
+                dockerConfigPath: registry.dockerConfigPath,
+                tls: registry.tls,
+                credentialProvider: objectIdentity(registry.credentialProvider),
+            };
+        case 'ecr':
+            return {
+                type: registry.type,
+                accountId: registry.accountId,
+                region: registry.region,
+                createRepository: registry.createRepository,
+                credentials: objectIdentity(registry.credentials),
+            };
+        case 'custom':
+            return { type: registry.type, handler: objectIdentity(registry.handler) };
+        default:
+            return registry;
+    }
+}
+async function resolvedBuildOptions(options, build) {
+    const context = resolve(options.context);
+    const dockerfile = options.dockerfile ?? 'Dockerfile';
+    let tag = options.tag ?? 'content-hash';
+    if (tag === 'content-hash' &&
+        build === buildContainer &&
+        existsSync(context) &&
+        existsSync(join(context, dockerfile))) {
+        tag = await computeContentHash(context, join(context, dockerfile));
+    }
+    return { ...options, context, dockerfile, tag };
+}
+function buildCacheKey(options, build) {
+    const identity = {
+        id: options.id,
+        context: options.context,
+        dockerfile: options.dockerfile,
+        imageName: options.imageName,
+        tag: options.tag,
+        platform: options.platform,
+        platforms: options.platforms ? [...options.platforms] : undefined,
+        buildArgs: sortedRecord(options.buildArgs),
+        target: options.target,
+        timeout: options.timeout,
+        signal: objectIdentity(options.signal),
+        extraDockerArgs: options.extraDockerArgs ? [...options.extraDockerArgs] : undefined,
+        registry: registryIdentity(options.registry),
+        builder: objectIdentity(build),
+    };
+    return createHash('sha256').update(JSON.stringify(identity)).digest('hex');
 }
 /**
  * Build a container image (delegating to {@link buildContainer}) and resolve to its shaped result.
@@ -54,13 +137,19 @@ async function buildAndShape(options, build) {
  * pass only `options`.
  */
 export function container(options, build = buildContainer) {
-    const key = options.id ?? options.imageName;
-    let pending = buildCache.get(key);
-    if (!pending) {
-        pending = buildAndShape(options, build);
-        buildCache.set(key, pending);
-    }
-    return pending;
+    return resolvedBuildOptions(options, build).then((resolved) => {
+        const key = buildCacheKey(resolved, build);
+        let pending = buildCache.get(key);
+        if (!pending) {
+            pending = buildAndShape(resolved, build);
+            buildCache.set(key, pending);
+            pending.catch(() => {
+                if (buildCache.get(key) === pending)
+                    buildCache.delete(key);
+            });
+        }
+        return pending;
+    });
 }
 /** Clear the build memoization cache. Intended for tests/long-lived processes that need a rebuild. */
 export function clearContainerCache() {

package/dist/core/containers/image.js.map

@@ -1 +1 @@
-{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/core/containers/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAmB5C;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,GAAG,KAAK;QAClB,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;QAChE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;AAK9D,KAAK,UAAU,aAAa,CAAC,OAAyB,EAAE,KAAc;IACpE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;IACzF,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACxD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,OAAyB,EACzB,QAAiB,cAAc;IAE/B,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,SAAS,CAAC;IAC5C,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,mBAAmB;IACjC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}
+{"version":3,"file":"image.js","sourceRoot":"","sources":["../../../src/core/containers/image.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAsBhE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,KAAK,GAAG,KAAK;QAClB,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE;QAChE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AACzC,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAmC,CAAC;AAC9D,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAkB,CAAC;AACvD,IAAI,kBAAkB,GAAG,CAAC,CAAC;AAK3B,KAAK,UAAU,aAAa,CAAC,OAAyB,EAAE,KAAc;IACpE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;IAC7C,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,EAAE,GAAG,YAAY,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,IAAI,cAAc,EAAE,CAAC,CAAC;IACzF,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,GAAG,kBAAkB,EAAE,CAAC;QAChC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CACnB,KAAmD;IAEnD,OAAO,KAAK;QACV,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA2C;IACnE,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,KAAK;YACR,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,GAAG,EAAE,QAAQ,CAAC,GAAG;gBACjB,kBAAkB,EAAE,cAAc,CAAC,QAAQ,CAAC,kBAAkB,CAAC;aAChE,CAAC;QACJ,KAAK,KAAK;YACR,OAAO;gBACL,IAAI,EAAE,QAAQ,CAAC,IAAI;gBACnB,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,WAAW,EAAE,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;aAClD,CAAC;QACJ,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5E;YACE,OAAO,QAAQ,CAAC;IACpB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAAyB,EACzB,KAAc;IAEd,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,YAAY,CAAC;IACtD,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,cAAc,CAAC;IACxC,IACE,GAAG,KAAK,cAAc;QACtB,KAAK,KAAK,cAAc;QACxB,UAAU,CAAC,OAAO,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,EACrC,CAAC;QACD,GAAG,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,OAAyB,EAAE,KAAc;IAC9D,MAAM,QAAQ,GAAG;QACf,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACjE,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC;QAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,eAAe,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC5C,OAAO,EAAE,cAAc,CAAC,KAAK,CAAC;KAC/B,CAAC;IACF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,OAAyB,EACzB,QAAiB,cAAc;IAE/B,OAAO,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC5D,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjB,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;oBAAE,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC9D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,mBAAmB;IACjC,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/core/containers/index.d.ts

@@ -21,5 +21,9 @@
 export { buildContainer } from './build.js';
 export { ContainerBuildError } from './errors.js';
 export { type ContainerImage, type ContainerOptions, clearContainerCache, container, splitImageUri, } from './image.js';
-export type { ContainerBuildOptions, ContainerBuildResult, EcrRegistryConfig, OrbstackRegistryConfig, RegistryConfig, } from './registries/types.js';
+export type { ContainerBuildProgress, ContainerBuildOptions, ContainerBuildResult, CustomRegistryConfig, EcrRegistryConfig, HarborRegistryConfig, OciRegistryConfig, OciRegistryCredential, OciRegistryCredentialProvider, OciRegistryTlsConfig, OrbstackRegistryConfig, RegistryConfig, RegistryHandler, RegistrySession, } from './registries/types.js';
+export { kubernetesSecretRegistryCredentials } from './registries/credentials.js';
+export type { KubernetesRegistrySecretReader, KubernetesSecretRegistryCredentialOptions, } from './registries/credentials.js';
+export { harbor } from './registries/harbor.js';
+export { ociRegistry } from './registries/oci.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/containers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/containers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,cAAc,GACf,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/containers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,mBAAmB,EACnB,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAClF,YAAY,EACV,8BAA8B,EAC9B,yCAAyC,GAC1C,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/core/containers/index.js

@@ -21,4 +21,7 @@
 export { buildContainer } from './build.js';
 export { ContainerBuildError } from './errors.js';
 export { clearContainerCache, container, splitImageUri, } from './image.js';
+export { kubernetesSecretRegistryCredentials } from './registries/credentials.js';
+export { harbor } from './registries/harbor.js';
+export { ociRegistry } from './registries/oci.js';
 //# sourceMappingURL=index.js.map

package/dist/core/containers/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/containers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAGL,mBAAmB,EACnB,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/containers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAGL,mBAAmB,EACnB,SAAS,EACT,aAAa,GACd,MAAM,YAAY,CAAC;AAiBpB,OAAO,EAAE,mCAAmC,EAAE,MAAM,6BAA6B,CAAC;AAKlF,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/core/containers/registries/credentials.d.ts

@@ -0,0 +1,30 @@
+import type { OciRegistryCredentialProvider } from './types.js';
+export interface KubernetesSecretRegistryCredentialOptions {
+    namespace: string;
+    name: string;
+    /** Registry host used when resolving a kubernetes.io/dockerconfigjson entry. */
+    registry?: string;
+    /** Non-secret username paired with passwordKey. Mutually exclusive with usernameKey. */
+    username?: string;
+    usernameKey?: string;
+    passwordKey?: string;
+    dockerConfigJsonKey?: string;
+    context?: string;
+    kubeconfigPath?: string;
+    /** Optional embedding/test seam. Production defaults to the selected Kubernetes client. */
+    secretReader?: KubernetesRegistrySecretReader;
+}
+export type KubernetesRegistrySecretReader = (request: {
+    readonly namespace: string;
+    readonly name: string;
+    readonly context?: string;
+    readonly kubeconfigPath?: string;
+}) => Promise<Readonly<Record<string, string>>>;
+/**
+ * Resolve an OCI credential from a selected Kubernetes Secret at execution time.
+ *
+ * The returned closure retains only Secret coordinates; decoded values exist only during the
+ * registry session and are never written to TypeKro state or generated resources.
+ */
+export declare function kubernetesSecretRegistryCredentials(options: KubernetesSecretRegistryCredentialOptions): OciRegistryCredentialProvider;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/core/containers/registries/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../../src/core/containers/registries/credentials.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAyB,6BAA6B,EAAE,MAAM,YAAY,CAAC;AAEvF,MAAM,WAAW,yCAAyC;IACxD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,2FAA2F;IAC3F,YAAY,CAAC,EAAE,8BAA8B,CAAC;CAC/C;AAED,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,EAAE;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAoDhD;;;;;GAKG;AACH,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yCAAyC,GACjD,6BAA6B,CAwC/B"}

package/dist/core/containers/registries/credentials.js

@@ -0,0 +1,87 @@
+import { Buffer } from 'node:buffer';
+import { createKubernetesClientProvider, } from '../../kubernetes/client-provider.js';
+import { ContainerBuildError } from '../errors.js';
+function decodeSecretValue(value, key) {
+    if (!value) {
+        throw new ContainerBuildError(`Registry credential Secret is missing key "${key}".`, 'REGISTRY_SECRET_INVALID', ['Verify the Secret name, namespace, and configured key names.']);
+    }
+    return Buffer.from(value, 'base64').toString('utf8');
+}
+function registryHost(value) {
+    const withScheme = value.includes('://') ? value : `https://${value}`;
+    return new URL(withScheme).host;
+}
+function credentialFromDockerConfig(encodedConfig, registry) {
+    const decoded = Buffer.from(encodedConfig, 'base64').toString('utf8');
+    const parsed = JSON.parse(decoded);
+    const entries = Object.entries(parsed.auths ?? {});
+    const selected = registry
+        ? entries.find(([name]) => registryHost(name) === registryHost(registry))
+        : entries.length === 1
+            ? entries[0]
+            : undefined;
+    if (!selected) {
+        throw new ContainerBuildError('Docker config Secret does not contain an unambiguous credential for the registry.', 'REGISTRY_SECRET_INVALID', ['Set the registry option or use explicit usernameKey and passwordKey values.']);
+    }
+    const entry = selected[1];
+    if (entry.username && entry.password)
+        return entry;
+    const auth = entry.auth ? Buffer.from(entry.auth, 'base64').toString('utf8') : '';
+    const separator = auth.indexOf(':');
+    if (separator <= 0) {
+        throw new ContainerBuildError('Docker config Secret credential is missing username/password material.', 'REGISTRY_SECRET_INVALID');
+    }
+    return { username: auth.slice(0, separator), password: auth.slice(separator + 1) };
+}
+/**
+ * Resolve an OCI credential from a selected Kubernetes Secret at execution time.
+ *
+ * The returned closure retains only Secret coordinates; decoded values exist only during the
+ * registry session and are never written to TypeKro state or generated resources.
+ */
+export function kubernetesSecretRegistryCredentials(options) {
+    if (options.username !== undefined && options.usernameKey !== undefined) {
+        throw new ContainerBuildError('Registry credential options must select either username or usernameKey, not both.', 'REGISTRY_SECRET_INVALID');
+    }
+    if (options.username !== undefined && options.username.trim().length === 0) {
+        throw new ContainerBuildError('Registry credential username must not be empty.', 'REGISTRY_SECRET_INVALID');
+    }
+    return async (signal) => {
+        if (signal?.aborted)
+            throw ContainerBuildError.cancelled();
+        const request = {
+            namespace: options.namespace,
+            name: options.name,
+            ...(options.context ? { context: options.context } : {}),
+            ...(options.kubeconfigPath ? { kubeconfigPath: options.kubeconfigPath } : {}),
+        };
+        const data = options.secretReader
+            ? await options.secretReader(request)
+            : await readKubernetesSecret(request);
+        if (signal?.aborted)
+            throw ContainerBuildError.cancelled();
+        const dockerConfigKey = options.dockerConfigJsonKey ?? '.dockerconfigjson';
+        if (data[dockerConfigKey]) {
+            return credentialFromDockerConfig(data[dockerConfigKey], options.registry);
+        }
+        const passwordKey = options.passwordKey ?? 'password';
+        return {
+            username: options.username ??
+                decodeSecretValue(data[options.usernameKey ?? 'username'], options.usernameKey ?? 'username'),
+            password: decodeSecretValue(data[passwordKey], passwordKey),
+        };
+    };
+}
+async function readKubernetesSecret(request) {
+    const config = {
+        ...(request.context ? { context: request.context } : {}),
+        ...(request.kubeconfigPath ? { kubeconfigPath: request.kubeconfigPath } : {}),
+    };
+    const provider = createKubernetesClientProvider(config);
+    const secret = await provider.getCoreV1Api().readNamespacedSecret({
+        namespace: request.namespace,
+        name: request.name,
+    });
+    return secret.data ?? {};
+}
+//# sourceMappingURL=credentials.js.map

package/dist/core/containers/registries/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../../src/core/containers/registries/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,OAAO,EACL,8BAA8B,GAE/B,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AA0BnD,SAAS,iBAAiB,CAAC,KAAyB,EAAE,GAAW;IAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,mBAAmB,CAC3B,8CAA8C,GAAG,IAAI,EACrD,yBAAyB,EACzB,CAAC,8DAA8D,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC;IACtE,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC;AAClC,CAAC;AAED,SAAS,0BAA0B,CACjC,aAAqB,EACrB,QAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAEhC,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzE,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YACpB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACZ,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,mBAAmB,CAC3B,mFAAmF,EACnF,yBAAyB,EACzB,CAAC,6EAA6E,CAAC,CAChF,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ;QAAE,OAAO,KAA8B,CAAC;IAC5E,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,wEAAwE,EACxE,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,EAAE,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mCAAmC,CACjD,OAAkD;IAElD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAmB,CAC3B,mFAAmF,EACnF,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,mBAAmB,CAC3B,iDAAiD,EACjD,yBAAyB,CAC1B,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG;YACd,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9E,CAAC;QACF,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY;YAC/B,CAAC,CAAC,MAAM,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC;YACrC,CAAC,CAAC,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,mBAAmB,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,IAAI,mBAAmB,CAAC;QAC3E,IAAI,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC1B,OAAO,0BAA0B,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC;QACtD,OAAO;YACL,QAAQ,EACN,OAAO,CAAC,QAAQ;gBAChB,iBAAiB,CACf,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,UAAU,CAAC,EACvC,OAAO,CAAC,WAAW,IAAI,UAAU,CAClC;YACH,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;SAC5D,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAKnC;IACC,MAAM,MAAM,GAA2B;QACrC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9E,CAAC;IACF,MAAM,QAAQ,GAAG,8BAA8B,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,EAAE,CAAC,oBAAoB,CAAC;QAChE,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;AAC3B,CAAC"}