ysk-server-core 1.0.0 → 1.1.9

package/dist/hosting/docker/argv.js

@@ -0,0 +1,274 @@
+/**
+ * Fail-closed docker argv classifier for HostExecutor + manager.
+ * Read inventory is allowed without EXECUTE; everything else is mutating.
+ */
+const READ_TOP = new Set([
+    'version',
+    'info',
+    'ps',
+    'images',
+    'inspect',
+    'logs',
+    'stats',
+]);
+const READ_COMPOSE = new Set(['version', 'ls', 'ps', 'logs', 'config']);
+const MUTATE_TOP = new Set([
+    'start',
+    'stop',
+    'restart',
+    'rm',
+    'rmi',
+    'pull',
+    'run',
+    'update',
+    'tag',
+    'container',
+    'image',
+    'volume',
+    'network',
+    'system',
+    'compose',
+]);
+const BLOCKED_TOP = new Set([
+    'build',
+    'login',
+    'logout',
+    'attach',
+    'swarm',
+    'stack',
+    'plugin',
+    'checkpoint',
+    'import',
+    'export',
+    'load',
+    'save',
+    'commit',
+    'cp',
+    'builder',
+    'buildx',
+    'context',
+    'trust',
+    'secret',
+    'config',
+]);
+const BLOCKED_FLAGS = [
+    '--privileged',
+    '--pid=host',
+    '--userns=host',
+    '--ipc=host',
+    '--cgroupns=host',
+    '--cap-add=ALL',
+    '--cap-add',
+];
+const EXEC_BINS = new Set([
+    'geth',
+    'reth',
+    'nethermind',
+    'lighthouse',
+    'lighthousebn',
+    'beacon-chain',
+    'teku',
+    'nimbus_beacon_node',
+    'avalanchego',
+    'neard',
+    'cardano-node',
+    'cardano-cli',
+    'bitcoind',
+    'bitcoin-cli',
+    'gaiad',
+    'sui',
+    'aptos',
+    'agave-validator',
+    'solana',
+    'polkadot',
+    'busybox',
+    'ls',
+    'cat',
+    'hostname',
+    'id',
+    'printenv',
+]);
+const EXEC_BLOCKED_BINS = new Set([
+    'sh',
+    'bash',
+    'ash',
+    'dash',
+    'zsh',
+    'fish',
+    'python',
+    'python3',
+    'perl',
+    'ruby',
+    'node',
+    'npm',
+    'curl',
+    'wget',
+    'chmod',
+    'chown',
+    'su',
+    'sudo',
+]);
+export function classifyDockerExec(args) {
+    let i = 0;
+    while (i < args.length && String(args[i]).startsWith('-')) {
+        const a = args[i];
+        if (a === '-it' || a === '-ti' || a === '-t' || a === '--tty' || a === '-i' || a === '--interactive') {
+            return 'blocked';
+        }
+        if (a === '--privileged' || a.startsWith('--privileged='))
+            return 'blocked';
+        if (a === '-d' || a === '--detach')
+            return 'blocked';
+        if (a === '-e' || a === '--env' || a === '-w' || a === '--workdir' || a === '-u' || a === '--user') {
+            i += 2;
+            continue;
+        }
+        i += 1;
+    }
+    const container = args[i] ?? '';
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(container))
+        return 'blocked';
+    const cmd = args.slice(i + 1).map(String);
+    if (!cmd.length || cmd.length > 16)
+        return 'blocked';
+    const bin = cmd[0].includes('/') ? cmd[0].slice(cmd[0].lastIndexOf('/') + 1) : cmd[0];
+    if (EXEC_BLOCKED_BINS.has(bin.toLowerCase()) || !EXEC_BINS.has(bin))
+        return 'blocked';
+    for (const t of cmd) {
+        if (!/^[A-Za-z0-9._:/=+-]+$/.test(t))
+            return 'blocked';
+    }
+    return 'mutate';
+}
+function hasFollow(args) {
+    return args.includes('-f') || args.includes('--follow');
+}
+function composeSub(args) {
+    let file;
+    let project;
+    const rest = [];
+    for (let i = 0; i < args.length; i += 1) {
+        const a = args[i];
+        if (a === '-f' || a === '--file') {
+            file = args[i + 1];
+            i += 1;
+            continue;
+        }
+        if (a === '-p' || a === '--project-name') {
+            project = args[i + 1];
+            i += 1;
+            continue;
+        }
+        rest.push(a);
+    }
+    return { file, project, sub: rest[0] ?? '', rest: rest.slice(1) };
+}
+export function classifyDockerArgv(argv) {
+    if (argv[0] !== 'docker')
+        return 'blocked';
+    const args = argv.slice(1).filter((a) => a !== '--');
+    if (args.length === 0)
+        return 'read';
+    if (args[0] === '--version' || args[0] === '-v')
+        return 'read';
+    const joined = args.join(' ');
+    if (/--privileged|--pid=host|--userns=host|--ipc=host|--cgroupns=host/i.test(joined)) {
+        return 'blocked';
+    }
+    for (let i = 0; i < args.length; i += 1) {
+        if (args[i] !== '-v' && args[i] !== '--volume')
+            continue;
+        const spec = args[i + 1] ?? '';
+        const src = spec.split(':')[0] ?? '';
+        if (src === '/' || /^(?:\/boot|\/etc|\/root|\/proc|\/sys|\/dev)(?:\/|$)/.test(src)) {
+            return 'blocked';
+        }
+    }
+    if (args.includes('--network') && args[args.indexOf('--network') + 1] === 'host') {
+        return 'blocked';
+    }
+    if (args.includes('--cap-add'))
+        return 'blocked';
+    const top = args[0] ?? '';
+    if (top === 'exec')
+        return classifyDockerExec(args.slice(1));
+    if (BLOCKED_TOP.has(top))
+        return 'blocked';
+    for (const f of BLOCKED_FLAGS) {
+        if (args.includes(f))
+            return 'blocked';
+    }
+    if (top === 'compose') {
+        const c = composeSub(args.slice(1));
+        if (!c.sub || READ_COMPOSE.has(c.sub)) {
+            if (c.sub === 'logs' && hasFollow(c.rest))
+                return 'blocked';
+            return 'read';
+        }
+        if (c.sub === 'up' || c.sub === 'down' || c.sub === 'pull' || c.sub === 'restart' || c.sub === 'stop' || c.sub === 'start' || c.sub === 'rm') {
+            return 'mutate';
+        }
+        return 'blocked';
+    }
+    if (top === 'volume') {
+        const sub = args[1] ?? 'ls';
+        if (sub === 'ls' || sub === 'inspect')
+            return 'read';
+        if (sub === 'create' || sub === 'rm' || sub === 'prune')
+            return 'mutate';
+        return 'blocked';
+    }
+    if (top === 'network') {
+        const sub = args[1] ?? 'ls';
+        if (sub === 'ls' || sub === 'inspect')
+            return 'read';
+        if (sub === 'create' || sub === 'rm' || sub === 'prune')
+            return 'mutate';
+        return 'blocked';
+    }
+    if (top === 'container') {
+        const sub = args[1] ?? '';
+        if (sub === 'ls' || sub === 'inspect' || sub === 'logs') {
+            if (hasFollow(args))
+                return 'blocked';
+            return 'read';
+        }
+        if (sub === 'start' || sub === 'stop' || sub === 'restart' || sub === 'rm' || sub === 'prune') {
+            return 'mutate';
+        }
+        return 'blocked';
+    }
+    if (top === 'image') {
+        const sub = args[1] ?? '';
+        if (sub === 'ls' || sub === 'inspect')
+            return 'read';
+        if (sub === 'pull' || sub === 'rm' || sub === 'prune')
+            return 'mutate';
+        return 'blocked';
+    }
+    if (top === 'system') {
+        const sub = args[1] ?? '';
+        if (sub === 'df' || sub === 'info')
+            return 'read';
+        if (sub === 'prune')
+            return 'mutate';
+        return 'blocked';
+    }
+    if (READ_TOP.has(top)) {
+        if (top === 'logs' && hasFollow(args.slice(1)))
+            return 'blocked';
+        if (top === 'stats' && !args.includes('--no-stream'))
+            return 'blocked';
+        return 'read';
+    }
+    if (MUTATE_TOP.has(top))
+        return 'mutate';
+    return 'blocked';
+}
+export function isReadOnlyDockerArgv(argv) {
+    return classifyDockerArgv(argv) === 'read';
+}
+export function isBlockedDockerArgv(argv) {
+    return classifyDockerArgv(argv) === 'blocked';
+}
+//# sourceMappingURL=argv.js.map

package/dist/hosting/docker/argv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argv.js","sourceRoot":"","sources":["../../../src/hosting/docker/argv.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;IACvB,SAAS;IACT,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,SAAS;IACT,MAAM;IACN,OAAO;CACR,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAExE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,OAAO;IACP,MAAM;IACN,SAAS;IACT,IAAI;IACJ,KAAK;IACL,MAAM;IACN,KAAK;IACL,QAAQ;IACR,KAAK;IACL,WAAW;IACX,OAAO;IACP,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,OAAO;IACP,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,QAAQ;IACR,SAAS;IACT,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG;IACpB,cAAc;IACd,YAAY;IACZ,eAAe;IACf,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,WAAW;CACZ,CAAC;AAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;IACxB,MAAM;IACN,MAAM;IACN,YAAY;IACZ,YAAY;IACZ,cAAc;IACd,cAAc;IACd,MAAM;IACN,oBAAoB;IACpB,aAAa;IACb,OAAO;IACP,cAAc;IACd,aAAa;IACb,UAAU;IACV,aAAa;IACb,OAAO;IACP,KAAK;IACL,OAAO;IACP,iBAAiB;IACjB,QAAQ;IACR,UAAU;IACV,SAAS;IACT,IAAI;IACJ,KAAK;IACL,UAAU;IACV,IAAI;IACJ,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,IAAI;IACJ,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,OAAO;IACP,OAAO;IACP,IAAI;IACJ,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;YACrG,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,KAAK,cAAc,IAAI,CAAC,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5E,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,SAAS,CAAC;QACrD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACnG,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;IAC1F,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACzD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,SAAS,CAAC,IAAc;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,IAAI,IAAwB,CAAC;IAC7B,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjC,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACnB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACzC,OAAO,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACf,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU;YAAE,SAAS;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,GAAG,KAAK,GAAG,IAAI,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnF,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;QACjF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IAEjD,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,GAAG,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACzC,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YAC5D,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,CAAC,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAC7I,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACrD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;QAC5B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACrD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACzE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACxD,IAAI,SAAS,CAAC,IAAI,CAAC;gBAAE,OAAO,SAAS,CAAC;YACtC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC9F,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACrD,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACvE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC;QAClD,IAAI,GAAG,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,GAAG,KAAK,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACjE,IAAI,GAAG,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,OAAO,SAAS,CAAC;QACvE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACzC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAChD,CAAC"}

package/dist/hosting/docker/daemon.d.ts

@@ -0,0 +1,27 @@
+import { type DockerDaemonSettings } from 'ysk-server-shared';
+export declare const DOCKER_DAEMON_JSON = "/etc/docker/daemon.json";
+export type DockerDaemonPatch = {
+    logDriver?: string;
+    logMaxSize?: string;
+    logMaxFile?: string;
+    liveRestore?: boolean;
+    registryMirrors?: string[];
+    insecureRegistries?: string[];
+};
+export declare function readDaemonSettings(path?: string): DockerDaemonSettings;
+export declare function applyDaemonPatch(current: Record<string, unknown>, patch: DockerDaemonPatch): {
+    ok: true;
+    next: Record<string, unknown>;
+} | {
+    ok: false;
+    notes: string[];
+};
+export declare function writeDaemonSettings(input: {
+    path?: string;
+    next: Record<string, unknown>;
+    execute: boolean;
+}): {
+    written: string[];
+    notes: string[];
+};
+//# sourceMappingURL=daemon.d.ts.map

package/dist/hosting/docker/daemon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/hosting/docker/daemon.ts"],"names":[],"mappings":"AAKA,OAAO,EAAM,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAElE,eAAO,MAAM,kBAAkB,4BAA4B,CAAC;AAM5D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC/B,CAAC;AAOF,wBAAgB,kBAAkB,CAAC,IAAI,SAAqB,GAAG,oBAAoB,CA2ClF;AAED,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,EAAE,iBAAiB,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CA0C9E;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,OAAO,EAAE,OAAO,CAAC;CAClB,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBzC"}

package/dist/hosting/docker/daemon.js

@@ -0,0 +1,125 @@
+/**
+ * Safe subset of /etc/docker/daemon.json.
+ */
+import { copyFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { tl } from 'ysk-server-shared';
+export const DOCKER_DAEMON_JSON = '/etc/docker/daemon.json';
+const ALLOWED_LOG_DRIVERS = new Set(['json-file', 'local', 'journald']);
+const ALLOWED_SIZES = new Set(['1m', '10m', '20m', '50m', '100m', '200m']);
+const ALLOWED_FILES = new Set(['1', '2', '3', '5', '10']);
+function asStringArray(v) {
+    if (!Array.isArray(v))
+        return [];
+    return v.map((x) => String(x).trim()).filter(Boolean);
+}
+export function readDaemonSettings(path = DOCKER_DAEMON_JSON) {
+    if (!existsSync(path)) {
+        return {
+            path,
+            exists: false,
+            logDriver: 'json-file',
+            logMaxSize: '10m',
+            logMaxFile: '3',
+            liveRestore: false,
+            registryMirrors: [],
+            insecureRegistries: [],
+            raw: {},
+        };
+    }
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        const opts = (raw['log-opts'] && typeof raw['log-opts'] === 'object'
+            ? raw['log-opts']
+            : {});
+        return {
+            path,
+            exists: true,
+            logDriver: String(raw['log-driver'] ?? 'json-file'),
+            logMaxSize: String(opts['max-size'] ?? '10m'),
+            logMaxFile: String(opts['max-file'] ?? '3'),
+            liveRestore: raw['live-restore'] === true,
+            registryMirrors: asStringArray(raw['registry-mirrors']),
+            insecureRegistries: asStringArray(raw['insecure-registries']),
+            raw,
+        };
+    }
+    catch {
+        return {
+            path,
+            exists: true,
+            logDriver: 'json-file',
+            logMaxSize: '10m',
+            logMaxFile: '3',
+            liveRestore: false,
+            registryMirrors: [],
+            insecureRegistries: [],
+            raw: {},
+        };
+    }
+}
+export function applyDaemonPatch(current, patch) {
+    const notes = [];
+    const next = { ...current };
+    if (patch.logDriver != null) {
+        if (!ALLOWED_LOG_DRIVERS.has(patch.logDriver)) {
+            notes.push(tl('docker.errors.badDaemon'));
+            return { ok: false, notes };
+        }
+        next['log-driver'] = patch.logDriver;
+    }
+    const opts = {
+        ...(next['log-opts'] && typeof next['log-opts'] === 'object'
+            ? next['log-opts']
+            : {}),
+    };
+    if (patch.logMaxSize != null) {
+        if (!ALLOWED_SIZES.has(patch.logMaxSize)) {
+            return { ok: false, notes: [tl('docker.errors.badDaemon')] };
+        }
+        opts['max-size'] = patch.logMaxSize;
+    }
+    if (patch.logMaxFile != null) {
+        if (!ALLOWED_FILES.has(patch.logMaxFile)) {
+            return { ok: false, notes: [tl('docker.errors.badDaemon')] };
+        }
+        opts['max-file'] = patch.logMaxFile;
+    }
+    if (Object.keys(opts).length)
+        next['log-opts'] = opts;
+    if (patch.liveRestore != null)
+        next['live-restore'] = patch.liveRestore;
+    if (patch.registryMirrors) {
+        if (patch.registryMirrors.some((u) => !/^https?:\/\//i.test(u))) {
+            return { ok: false, notes: [tl('docker.errors.badDaemon')] };
+        }
+        next['registry-mirrors'] = patch.registryMirrors;
+    }
+    if (patch.insecureRegistries) {
+        next['insecure-registries'] = patch.insecureRegistries;
+    }
+    delete next.iptables;
+    delete next.experimental;
+    delete next['storage-driver'];
+    return { ok: true, next };
+}
+export function writeDaemonSettings(input) {
+    const path = input.path ?? DOCKER_DAEMON_JSON;
+    const written = [];
+    const notes = [];
+    if (!input.execute) {
+        notes.push(tl('docker.notes.dryDaemon'));
+        return { written, notes };
+    }
+    mkdirSync(dirname(path), { recursive: true });
+    if (existsSync(path)) {
+        const bak = `${path}.ysk-bak`;
+        copyFileSync(path, bak);
+        written.push(bak);
+    }
+    writeFileSync(path, `${JSON.stringify(input.next, null, 2)}\n`, 'utf8');
+    written.push(path);
+    notes.push(tl('docker.notes.daemonWrote'));
+    return { written, notes };
+}
+//# sourceMappingURL=daemon.js.map

package/dist/hosting/docker/daemon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon.js","sourceRoot":"","sources":["../../../src/hosting/docker/daemon.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3F,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,EAAE,EAA6B,MAAM,mBAAmB,CAAC;AAElE,MAAM,CAAC,MAAM,kBAAkB,GAAG,yBAAyB,CAAC;AAE5D,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACxE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3E,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AAW1D,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAI,GAAG,kBAAkB;IAC1D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,EAAE;YACnB,kBAAkB,EAAE,EAAE;YACtB,GAAG,EAAE,EAAE;SACR,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;QAC9E,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ;YAClE,CAAC,CAAE,GAAG,CAAC,UAAU,CAA6B;YAC9C,CAAC,CAAC,EAAE,CAA4B,CAAC;QACnC,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,WAAW,CAAC;YACnD,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC;YAC7C,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC;YAC3C,WAAW,EAAE,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI;YACzC,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACvD,kBAAkB,EAAE,aAAa,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;YAC7D,GAAG;SACJ,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,WAAW;YACtB,UAAU,EAAE,KAAK;YACjB,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,KAAK;YAClB,eAAe,EAAE,EAAE;YACnB,kBAAkB,EAAE,EAAE;YACtB,GAAG,EAAE,EAAE;SACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,KAAwB;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,GAAG;QACX,GAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ;YAC3D,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAClB,CAAC,CAAC,EAAE,CAA6B;KACpC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACtC,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;QAAE,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACtD,IAAI,KAAK,CAAC,WAAW,IAAI,IAAI;QAAE,IAAI,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;IACxE,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;QAC1B,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,IAAI,CAAC,qBAAqB,CAAC,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACrB,OAAO,IAAI,CAAC,YAAY,CAAC;IACzB,OAAO,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAC9B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAInC;IACC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,kBAAkB,CAAC;IAC9C,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5B,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,GAAG,IAAI,UAAU,CAAC;QAC9B,YAAY,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC"}

package/dist/hosting/docker/honesty.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Honest mutation results for Docker host ops.
+ */
+import { type OpsResultDto } from 'ysk-server-shared';
+import { type BlockReason } from '../system-apply.js';
+export type DockerOpsResult = OpsResultDto & {
+    dryRun?: boolean;
+    executed?: boolean;
+};
+export declare function blockedDockerOp(input: {
+    reason: BlockReason;
+    notes?: string[];
+    written?: string[];
+}): DockerOpsResult;
+export declare function writtenDockerOp(input: {
+    notes: string[];
+    written?: string[];
+}): DockerOpsResult;
+export declare function appliedDockerOp(input: {
+    notes: string[];
+    written?: string[];
+}): DockerOpsResult;
+export declare function failedDockerOp(input: {
+    notes: string[];
+    written?: string[];
+}): DockerOpsResult;
+//# sourceMappingURL=honesty.d.ts.map

package/dist/hosting/docker/honesty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"honesty.d.ts","sourceRoot":"","sources":["../../../src/hosting/docker/honesty.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAGL,KAAK,YAAY,EAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,eAAe,GAAG,YAAY,GAAG;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAEF,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,eAAe,CAalB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,eAAe,CAUlB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,eAAe,CASlB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB,GAAG,eAAe,CAQlB"}

package/dist/hosting/docker/honesty.js

@@ -0,0 +1,50 @@
+/**
+ * Honest mutation results for Docker host ops.
+ */
+import { assertHonestOps, } from 'ysk-server-shared';
+import { panelBlockMessage } from '../system-apply.js';
+export function blockedDockerOp(input) {
+    return assertHonestOps({
+        ok: false,
+        blocked: true,
+        apply_status: 'blocked',
+        blockMessage: panelBlockMessage(input.reason),
+        requiresExecute: input.reason === 'no_execute',
+        requiresRoot: input.reason === 'no_root',
+        notes: input.notes ?? [panelBlockMessage(input.reason)],
+        written: input.written,
+        dryRun: input.reason === 'no_execute',
+        executed: false,
+    });
+}
+export function writtenDockerOp(input) {
+    return assertHonestOps({
+        ok: true,
+        apply_status: 'written',
+        notes: input.notes,
+        written: input.written,
+        dryRun: true,
+        executed: false,
+        requiresExecute: true,
+    });
+}
+export function appliedDockerOp(input) {
+    return assertHonestOps({
+        ok: true,
+        apply_status: 'applied',
+        notes: input.notes,
+        written: input.written,
+        dryRun: false,
+        executed: true,
+    });
+}
+export function failedDockerOp(input) {
+    return assertHonestOps({
+        ok: false,
+        apply_status: 'failed',
+        notes: input.notes,
+        written: input.written,
+        executed: true,
+    });
+}
+//# sourceMappingURL=honesty.js.map

package/dist/hosting/docker/honesty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"honesty.js","sourceRoot":"","sources":["../../../src/hosting/docker/honesty.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EACL,eAAe,GAGhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAoB,MAAM,oBAAoB,CAAC;AAOzE,MAAM,UAAU,eAAe,CAAC,KAI/B;IACC,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,SAA+B;QAC7C,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC7C,eAAe,EAAE,KAAK,CAAC,MAAM,KAAK,YAAY;QAC9C,YAAY,EAAE,KAAK,CAAC,MAAM,KAAK,SAAS;QACxC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvD,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,YAAY;QACrC,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,KAAK;QACf,eAAe,EAAE,IAAI;KACtB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAG/B;IACC,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,IAAI;QACR,YAAY,EAAE,SAAS;QACvB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAG9B;IACC,OAAO,eAAe,CAAC;QACrB,EAAE,EAAE,KAAK;QACT,YAAY,EAAE,QAAQ;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC"}

package/dist/hosting/docker/index.d.ts

@@ -0,0 +1,6 @@
+export * from './argv.js';
+export * from './honesty.js';
+export * from './parse.js';
+export * from './daemon.js';
+export * from './manager.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/hosting/docker/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/hosting/docker/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}

package/dist/hosting/docker/index.js

@@ -0,0 +1,6 @@
+export * from './argv.js';
+export * from './honesty.js';
+export * from './parse.js';
+export * from './daemon.js';
+export * from './manager.js';
+//# sourceMappingURL=index.js.map

package/dist/hosting/docker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/hosting/docker/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,cAAc,CAAC"}