@git.zone/cli 3.2.1 → 4.0.0

package/dist_ts/mod_services/classes.servicedatamarker.d.ts

@@ -6,14 +6,20 @@
  * `@git.zone/tsdeploy` (`deriveRequiredCapabilities`), so the strings and the
  * array shape must never change here.
  */
-export type TServiceName = 'mongodb' | 'minio' | 'elasticsearch';
+export type TServiceName = 'mongodb' | 'objectstorage' | 'elasticsearch';
+export type TLegacyServiceName = 'minio';
 export declare const serviceNames: TServiceName[];
+export declare const objectStorageImage = "code.foss.global/lossless.zone/objectstorage@sha256:43b60897eed17b54feb4e363808ce540ed1d9d27201871c5c8a869300d41e1b8";
 /** Owner recorded in markers and container labels. */
 export declare const serviceDataOwner = "@git.zone/cli";
 /** Value of the `git.zone.tool` label on containers created by `gitzone services`. */
 export declare const serviceToolLabel = "gitzone-services";
 /** Marker file name, stored in `<projectPath>/.nogit/`. */
 export declare const serviceDataMarkerFile = ".gitzone-services.json";
+export declare const serviceDataMarkerSchemaVersion = 2;
+export declare const legacyMinioDataDirectoryName = "miniodata";
+export declare const serviceOperationLabel = "git.zone.operation";
+export declare const serviceBindOperation = "service-bind-operation";
 /**
  * Directory basename used below `.nogit/` for each service's bind-mounted data.
  * This mapping is the only shape `gitzone services` ever creates, and prune
@@ -24,7 +30,7 @@ export declare const serviceDataDirectoryNames: {
 };
 /**
  * Image used to run each service, and therefore the image available to perform
- * a privileged cleanup of that service's data directory: if the data exists,
+ * a root-helper cleanup of that service's data directory: if the data exists,
  * the service ran, so its image is present locally.
  */
 export declare const serviceImages: {
@@ -37,22 +43,31 @@ export interface IServiceDataMarkerEntry {
 export interface IServiceDataMarker {
     owner: string;
     kind: 'service-data';
-    schemaVersion: 1;
+    schemaVersion: 2;
     projectPath: string;
     safeToPrune: true;
     createdAt: string;
     dataDirectories: IServiceDataMarkerEntry[];
+    legacyDataDirectories?: ILegacyServiceDataMarkerEntry[];
+}
+export interface ILegacyServiceDataMarkerEntry {
+    service: TLegacyServiceName;
+    path: string;
+    safeToPrune: false;
 }
 /** Absolute path of the marker file for a project. */
 export declare const getServiceDataMarkerPath: (projectPathArg: string) => string;
+export declare const getServiceDataMarkerLockPath: (projectPathArg: string) => string;
 /**
  * Expected absolute data directory path for a service in a project.
  * `mod_services` must always derive data paths through this helper so that
  * creation and reclamation agree on a single shape.
  */
 export declare const getServiceDataDirectory: (projectPathArg: string, serviceArg: TServiceName) => string;
+/** Exact legacy path retained only for migration detection. */
+export declare const getLegacyMinioDataDirectory: (projectPathArg: string) => string;
 /**
- * True only when `candidatePathArg` is exactly one of the three data
+ * True only when `candidatePathArg` is exactly one of the canonical data
  * directories `gitzone services` creates for `projectPathArg`.
  *
  * This is an allowlist, not a denylist: any path that is not byte-for-byte one
@@ -60,16 +75,17 @@ export declare const getServiceDataDirectory: (projectPathArg: string, serviceAr
  * before a recursive delete.
  */
 export declare const isSafeServiceDataPath: (projectPathArg: string, candidatePathArg: string) => boolean;
-/** Validate an unknown value as a usable marker. */
+/** Validate an unknown value as a canonical v2 marker. */
 export declare const isValidServiceDataMarker: (markerArg: unknown) => markerArg is IServiceDataMarker;
 /** Read and validate the marker for a project, or undefined when absent/invalid. */
 export declare const readServiceDataMarker: (projectPathArg: string) => Promise<IServiceDataMarker | undefined>;
+export declare const markerProvesServiceDataDirectory: (markerArg: IServiceDataMarker | undefined, projectPathArg: string, serviceArg: TServiceName) => boolean;
 /**
  * Record that `gitzone services` owns a data directory for this project.
  *
  * The marker lives in `.nogit/` rather than inside the bind-mounted data
- * directory itself, so it can never confuse mongod, MinIO or Elasticsearch at
- * runtime. Entries are merged so enabling a service later does not drop the
+ * directory itself, so it can never confuse a service runtime. Entries are
+ * merged so enabling a service later does not drop the
  * claim on previously created directories.
  */
 export declare const recordServiceDataDirectory: (projectPathArg: string, serviceArg: TServiceName) => Promise<void>;
@@ -87,7 +103,16 @@ export declare const getServiceContainerLabels: (optionsArg: {
 }) => {
     [key: string]: string;
 };
+export declare const hasExactServiceContainerLabels: (labelsArg: Record<string, string>, expectedArg: Record<string, string>) => boolean;
 /** True when a container's labels prove `gitzone services` created it. */
 export declare const isServiceOwnedByLabels: (labelsArg: {
     [key: string]: string;
 }) => boolean;
+/** Legacy provider evidence is retained for migration, never active lifecycle ownership. */
+export declare const isLegacyMinioContainerLabels: (labelsArg: {
+    [key: string]: string;
+}) => boolean;
+/** Transient bind-operation containers are owned by their invocation, not by prune. */
+export declare const isServiceOperationHelperLabels: (labelsArg: {
+    [key: string]: string;
+}) => boolean;

package/dist_ts/mod_services/classes.servicedatamarker.js

@@ -1,11 +1,17 @@
 import * as plugins from './mod.plugins.js';
-export const serviceNames = ['mongodb', 'minio', 'elasticsearch'];
+import { withInterProcessLock } from './classes.interprocesslock.js';
+export const serviceNames = ['mongodb', 'objectstorage', 'elasticsearch'];
+export const objectStorageImage = 'code.foss.global/lossless.zone/objectstorage@sha256:43b60897eed17b54feb4e363808ce540ed1d9d27201871c5c8a869300d41e1b8';
 /** Owner recorded in markers and container labels. */
 export const serviceDataOwner = '@git.zone/cli';
 /** Value of the `git.zone.tool` label on containers created by `gitzone services`. */
 export const serviceToolLabel = 'gitzone-services';
 /** Marker file name, stored in `<projectPath>/.nogit/`. */
 export const serviceDataMarkerFile = '.gitzone-services.json';
+export const serviceDataMarkerSchemaVersion = 2;
+export const legacyMinioDataDirectoryName = 'miniodata';
+export const serviceOperationLabel = 'git.zone.operation';
+export const serviceBindOperation = 'service-bind-operation';
 /**
  * Directory basename used below `.nogit/` for each service's bind-mounted data.
  * This mapping is the only shape `gitzone services` ever creates, and prune
@@ -13,26 +19,30 @@ export const serviceDataMarkerFile = '.gitzone-services.json';
  */
 export const serviceDataDirectoryNames = {
     mongodb: 'mongodata',
-    minio: 'miniodata',
+    objectstorage: 'objectstoragedata',
     elasticsearch: 'esdata',
 };
 /**
  * Image used to run each service, and therefore the image available to perform
- * a privileged cleanup of that service's data directory: if the data exists,
+ * a root-helper cleanup of that service's data directory: if the data exists,
  * the service ran, so its image is present locally.
  */
 export const serviceImages = {
     mongodb: 'mongo:7.0',
-    minio: 'minio/minio',
+    objectstorage: objectStorageImage,
     elasticsearch: 'elasticsearch:8.11.0',
 };
 const isPlainObject = (value) => {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 };
+const hasOnlyKeys = (valueArg, allowedKeysArg) => Object.keys(valueArg).every((keyArg) => allowedKeysArg.includes(keyArg));
 /** Absolute path of the marker file for a project. */
 export const getServiceDataMarkerPath = (projectPathArg) => {
     return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataMarkerFile);
 };
+export const getServiceDataMarkerLockPath = (projectPathArg) => {
+    return `${getServiceDataMarkerPath(projectPathArg)}.lock`;
+};
 /**
  * Expected absolute data directory path for a service in a project.
  * `mod_services` must always derive data paths through this helper so that
@@ -41,8 +51,12 @@ export const getServiceDataMarkerPath = (projectPathArg) => {
 export const getServiceDataDirectory = (projectPathArg, serviceArg) => {
     return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', serviceDataDirectoryNames[serviceArg]);
 };
+/** Exact legacy path retained only for migration detection. */
+export const getLegacyMinioDataDirectory = (projectPathArg) => {
+    return plugins.path.join(plugins.path.resolve(projectPathArg), '.nogit', legacyMinioDataDirectoryName);
+};
 /**
- * True only when `candidatePathArg` is exactly one of the three data
+ * True only when `candidatePathArg` is exactly one of the canonical data
  * directories `gitzone services` creates for `projectPathArg`.
  *
  * This is an allowlist, not a denylist: any path that is not byte-for-byte one
@@ -58,31 +72,39 @@ export const isSafeServiceDataPath = (projectPathArg, candidatePathArg) => {
     }
     return false;
 };
-/** Validate an unknown value as a usable marker. */
+const hasValidMarkerEnvelope = (markerArg) => {
+    return (markerArg.owner === serviceDataOwner &&
+        markerArg.kind === 'service-data' &&
+        markerArg.safeToPrune === true &&
+        typeof markerArg.projectPath === 'string' &&
+        markerArg.projectPath.length > 0 &&
+        typeof markerArg.createdAt === 'string' &&
+        markerArg.createdAt.length > 0 &&
+        Array.isArray(markerArg.dataDirectories));
+};
+/** Validate an unknown value as a canonical v2 marker. */
 export const isValidServiceDataMarker = (markerArg) => {
     if (!isPlainObject(markerArg)) {
         return false;
     }
-    if (markerArg.owner !== serviceDataOwner) {
-        return false;
-    }
-    if (markerArg.kind !== 'service-data') {
-        return false;
-    }
-    if (markerArg.schemaVersion !== 1) {
-        return false;
-    }
-    if (markerArg.safeToPrune !== true) {
-        return false;
-    }
-    if (typeof markerArg.projectPath !== 'string' || !markerArg.projectPath) {
-        return false;
-    }
-    if (!Array.isArray(markerArg.dataDirectories)) {
+    if (!hasOnlyKeys(markerArg, [
+        'owner',
+        'kind',
+        'schemaVersion',
+        'projectPath',
+        'safeToPrune',
+        'createdAt',
+        'dataDirectories',
+        'legacyDataDirectories',
+    ]) ||
+        !hasValidMarkerEnvelope(markerArg) ||
+        markerArg.schemaVersion !== serviceDataMarkerSchemaVersion) {
         return false;
     }
+    const projectPath = plugins.path.resolve(markerArg.projectPath);
+    const seenServices = new Set();
     for (const entry of markerArg.dataDirectories) {
-        if (!isPlainObject(entry)) {
+        if (!isPlainObject(entry) || !hasOnlyKeys(entry, ['service', 'path'])) {
             return false;
         }
         if (!serviceNames.includes(entry.service)) {
@@ -91,9 +113,52 @@ export const isValidServiceDataMarker = (markerArg) => {
         if (typeof entry.path !== 'string' || !entry.path) {
             return false;
         }
+        if (seenServices.has(entry.service) ||
+            plugins.path.resolve(entry.path) !== getServiceDataDirectory(projectPath, entry.service)) {
+            return false;
+        }
+        seenServices.add(entry.service);
+    }
+    if (markerArg.legacyDataDirectories !== undefined) {
+        if (!Array.isArray(markerArg.legacyDataDirectories)) {
+            return false;
+        }
+        for (const entry of markerArg.legacyDataDirectories) {
+            if (!isPlainObject(entry) ||
+                !hasOnlyKeys(entry, ['service', 'path', 'safeToPrune']) ||
+                entry.service !== 'minio' ||
+                entry.safeToPrune !== false ||
+                typeof entry.path !== 'string' ||
+                plugins.path.resolve(entry.path) !== getLegacyMinioDataDirectory(projectPath)) {
+                return false;
+            }
+        }
+        if (markerArg.legacyDataDirectories.length > 1) {
+            return false;
+        }
     }
     return true;
 };
+const writeServiceDataMarker = async (projectPathArg, markerArg) => {
+    const markerPath = getServiceDataMarkerPath(projectPathArg);
+    await plugins.smartfs.directory(plugins.path.dirname(markerPath)).recursive().create();
+    const tempPath = `${markerPath}.tmp-${process.pid}-${plugins.crypto
+        .randomBytes(12)
+        .toString('hex')}`;
+    try {
+        await plugins.fs.writeFile(tempPath, `${JSON.stringify(markerArg, null, 2)}\n`, {
+            encoding: 'utf8',
+            flag: 'wx',
+        });
+        await plugins.fs.rename(tempPath, markerPath);
+    }
+    catch (error) {
+        await plugins.fs.rm(tempPath, { force: true }).catch(() => { });
+        throw new Error(`Could not persist service data marker atomically: ${markerPath}`, {
+            cause: error,
+        });
+    }
+};
 /** Read and validate the marker for a project, or undefined when absent/invalid. */
 export const readServiceDataMarker = async (projectPathArg) => {
     const markerPath = getServiceDataMarkerPath(projectPathArg);
@@ -103,44 +168,59 @@ export const readServiceDataMarker = async (projectPathArg) => {
         }
         const content = (await plugins.smartfs.file(markerPath).encoding('utf8').read());
         const parsed = JSON.parse(content);
-        return isValidServiceDataMarker(parsed) ? parsed : undefined;
+        return isValidServiceDataMarker(parsed) &&
+            plugins.path.resolve(parsed.projectPath) === plugins.path.resolve(projectPathArg)
+            ? parsed
+            : undefined;
     }
     catch {
         return undefined;
     }
 };
+export const markerProvesServiceDataDirectory = (markerArg, projectPathArg, serviceArg) => {
+    const expectedPath = getServiceDataDirectory(projectPathArg, serviceArg);
+    return !!markerArg?.dataDirectories.some((entry) => entry.service === serviceArg && plugins.path.resolve(entry.path) === expectedPath);
+};
 /**
  * Record that `gitzone services` owns a data directory for this project.
  *
  * The marker lives in `.nogit/` rather than inside the bind-mounted data
- * directory itself, so it can never confuse mongod, MinIO or Elasticsearch at
- * runtime. Entries are merged so enabling a service later does not drop the
+ * directory itself, so it can never confuse a service runtime. Entries are
+ * merged so enabling a service later does not drop the
  * claim on previously created directories.
  */
 export const recordServiceDataDirectory = async (projectPathArg, serviceArg) => {
     const projectPath = plugins.path.resolve(projectPathArg);
-    const dataPath = getServiceDataDirectory(projectPath, serviceArg);
-    const existingMarker = await readServiceDataMarker(projectPath);
-    const entries = existingMarker
-        ? existingMarker.dataDirectories.filter((entry) => entry.service !== serviceArg)
-        : [];
-    entries.push({ service: serviceArg, path: dataPath });
-    entries.sort((entryA, entryB) => entryA.service.localeCompare(entryB.service));
-    const marker = {
-        owner: serviceDataOwner,
-        kind: 'service-data',
-        schemaVersion: 1,
-        projectPath,
-        safeToPrune: true,
-        createdAt: existingMarker?.createdAt || new Date().toISOString(),
-        dataDirectories: entries,
-    };
-    const markerPath = getServiceDataMarkerPath(projectPath);
-    await plugins.smartfs.directory(plugins.path.dirname(markerPath)).recursive().create();
-    await plugins.smartfs
-        .file(markerPath)
-        .encoding('utf8')
-        .write(`${JSON.stringify(marker, null, 2)}\n`);
+    await withInterProcessLock({
+        lockPath: getServiceDataMarkerLockPath(projectPath),
+        description: 'Service data marker',
+    }, async () => {
+        const dataPath = getServiceDataDirectory(projectPath, serviceArg);
+        const markerPath = getServiceDataMarkerPath(projectPath);
+        const markerExists = await plugins.smartfs.file(markerPath).exists();
+        const existingMarker = await readServiceDataMarker(projectPath);
+        if (markerExists && !existingMarker) {
+            throw new Error(`Refusing to overwrite invalid or foreign service data marker: ${markerPath}`);
+        }
+        const entries = existingMarker
+            ? existingMarker.dataDirectories.filter((entry) => entry.service !== serviceArg)
+            : [];
+        entries.push({ service: serviceArg, path: dataPath });
+        entries.sort((entryA, entryB) => entryA.service.localeCompare(entryB.service));
+        const marker = {
+            owner: serviceDataOwner,
+            kind: 'service-data',
+            schemaVersion: serviceDataMarkerSchemaVersion,
+            projectPath,
+            safeToPrune: true,
+            createdAt: existingMarker?.createdAt || new Date().toISOString(),
+            dataDirectories: entries,
+            ...(existingMarker?.legacyDataDirectories
+                ? { legacyDataDirectories: existingMarker.legacyDataDirectories }
+                : {}),
+        };
+        await writeServiceDataMarker(projectPath, marker);
+    });
 };
 /**
  * Labels applied to every container `gitzone services` creates.
@@ -158,9 +238,25 @@ export const getServiceContainerLabels = (optionsArg) => {
         'git.zone.safe-to-prune': 'true',
     };
 };
+export const hasExactServiceContainerLabels = (labelsArg, expectedArg) => {
+    const actualGitZoneLabels = Object.entries(labelsArg).filter(([key]) => key.startsWith('git.zone.'));
+    const expectedGitZoneLabels = Object.entries(expectedArg).filter(([key]) => key.startsWith('git.zone.'));
+    return (actualGitZoneLabels.length === expectedGitZoneLabels.length &&
+        expectedGitZoneLabels.every(([key, value]) => labelsArg[key] === value));
+};
 /** True when a container's labels prove `gitzone services` created it. */
 export const isServiceOwnedByLabels = (labelsArg) => {
     return (labelsArg['git.zone.tool'] === serviceToolLabel &&
         labelsArg['git.zone.safe-to-prune'] === 'true');
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zZXJ2aWNlZGF0YW1hcmtlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL21vZF9zZXJ2aWNlcy9jbGFzc2VzLnNlcnZpY2VkYXRhbWFya2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFZNUMsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFtQixDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFFbEYsc0RBQXNEO0FBQ3RELE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLGVBQWUsQ0FBQztBQUVoRCxzRkFBc0Y7QUFDdEYsTUFBTSxDQUFDLE1BQU0sZ0JBQWdCLEdBQUcsa0JBQWtCLENBQUM7QUFFbkQsMkRBQTJEO0FBQzNELE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLHdCQUF3QixDQUFDO0FBRTlEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBc0M7SUFDMUUsT0FBTyxFQUFFLFdBQVc7SUFDcEIsS0FBSyxFQUFFLFdBQVc7SUFDbEIsYUFBYSxFQUFFLFFBQVE7Q0FDeEIsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxhQUFhLEdBQXNDO0lBQzlELE9BQU8sRUFBRSxXQUFXO0lBQ3BCLEtBQUssRUFBRSxhQUFhO0lBQ3BCLGFBQWEsRUFBRSxzQkFBc0I7Q0FDdEMsQ0FBQztBQWlCRixNQUFNLGFBQWEsR0FBRyxDQUFDLEtBQWMsRUFBZ0MsRUFBRTtJQUNyRSxPQUFPLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUM5RSxDQUFDLENBQUM7QUFFRixzREFBc0Q7QUFDdEQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxjQUFzQixFQUFVLEVBQUU7SUFDekUsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsRUFBRSxRQUFRLEVBQUUscUJBQXFCLENBQUMsQ0FBQztBQUNsRyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sdUJBQXVCLEdBQUcsQ0FDckMsY0FBc0IsRUFDdEIsVUFBd0IsRUFDaEIsRUFBRTtJQUNWLE9BQU8sT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQ3RCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxFQUNwQyxRQUFRLEVBQ1IseUJBQXlCLENBQUMsVUFBVSxDQUFDLENBQ3RDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7Ozs7OztHQU9HO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FDbkMsY0FBc0IsRUFDdEIsZ0JBQXdCLEVBQ2YsRUFBRTtJQUNYLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDekQsS0FBSyxNQUFNLE9BQU8sSUFBSSxZQUFZLEVBQUUsQ0FBQztRQUNuQyxJQUFJLHVCQUF1QixDQUFDLGNBQWMsRUFBRSxPQUFPLENBQUMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNuRSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxLQUFLLENBQUM7QUFDZixDQUFDLENBQUM7QUFFRixvREFBb0Q7QUFDcEQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxTQUFrQixFQUFtQyxFQUFFO0lBQzlGLElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5QixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxLQUFLLEtBQUssZ0JBQWdCLEVBQUUsQ0FBQztRQUN6QyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssY0FBYyxFQUFFLENBQUM7UUFDdEMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsYUFBYSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLFdBQVcsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNuQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLE9BQU8sU0FBUyxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDeEUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDOUMsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxTQUFTLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDOUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzFDLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELElBQUksT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxJQUFJLENBQUM7QUFDZCxDQUFDLENBQUM7QUFFRixvRkFBb0Y7QUFDcEYsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsS0FBSyxFQUN4QyxjQUFzQixFQUNtQixFQUFFO0lBQzNDLE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLGNBQWMsQ0FBQyxDQUFDO0lBQzVELElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFXLENBQUM7UUFDM0YsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuQyxPQUFPLHdCQUF3QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUMvRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzdDLGNBQXNCLEVBQ3RCLFVBQXdCLEVBQ1QsRUFBRTtJQUNqQixNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN6RCxNQUFNLFFBQVEsR0FBRyx1QkFBdUIsQ0FBQyxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbEUsTUFBTSxjQUFjLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUVoRSxNQUFNLE9BQU8sR0FBOEIsY0FBYztRQUN2RCxDQUFDLENBQUMsY0FBYyxDQUFDLGVBQWUsQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxPQUFPLEtBQUssVUFBVSxDQUFDO1FBQ2hGLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDUCxPQUFPLENBQUMsSUFBSSxDQUFDLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUN0RCxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7SUFFL0UsTUFBTSxNQUFNLEdBQXVCO1FBQ2pDLEtBQUssRUFBRSxnQkFBZ0I7UUFDdkIsSUFBSSxFQUFFLGNBQWM7UUFDcEIsYUFBYSxFQUFFLENBQUM7UUFDaEIsV0FBVztRQUNYLFdBQVcsRUFBRSxJQUFJO1FBQ2pCLFNBQVMsRUFBRSxjQUFjLEVBQUUsU0FBUyxJQUFJLElBQUksSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFO1FBQ2hFLGVBQWUsRUFBRSxPQUFPO0tBQ3pCLENBQUM7SUFFRixNQUFNLFVBQVUsR0FBRyx3QkFBd0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUN6RCxNQUFNLE9BQU8sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxFQUFFLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDdkYsTUFBTSxPQUFPLENBQUMsT0FBTztTQUNsQixJQUFJLENBQUMsVUFBVSxDQUFDO1NBQ2hCLFFBQVEsQ0FBQyxNQUFNLENBQUM7U0FDaEIsS0FBSyxDQUFDLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUNuRCxDQUFDLENBQUM7QUFFRjs7Ozs7O0dBTUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRyxDQUFDLFVBSXpDLEVBQTZCLEVBQUU7SUFDOUIsT0FBTztRQUNMLGVBQWUsRUFBRSxnQkFBZ0I7UUFDakMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLE9BQU87UUFDdEMsdUJBQXVCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQztRQUNyRSxvQkFBb0IsRUFBRSxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQy9ELHdCQUF3QixFQUFFLE1BQU07S0FDakMsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLDBFQUEwRTtBQUMxRSxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFNBQW9DLEVBQVcsRUFBRTtJQUN0RixPQUFPLENBQ0wsU0FBUyxDQUFDLGVBQWUsQ0FBQyxLQUFLLGdCQUFnQjtRQUMvQyxTQUFTLENBQUMsd0JBQXdCLENBQUMsS0FBSyxNQUFNLENBQy9DLENBQUM7QUFDSixDQUFDLENBQUMifQ==
+/** Legacy provider evidence is retained for migration, never active lifecycle ownership. */
+export const isLegacyMinioContainerLabels = (labelsArg) => {
+    return (labelsArg['git.zone.tool'] === serviceToolLabel &&
+        labelsArg['git.zone.service'] === 'minio');
+};
+/** Transient bind-operation containers are owned by their invocation, not by prune. */
+export const isServiceOperationHelperLabels = (labelsArg) => {
+    return (labelsArg['git.zone.tool'] === serviceToolLabel &&
+        labelsArg[serviceOperationLabel] === serviceBindOperation);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zZXJ2aWNlZGF0YW1hcmtlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL21vZF9zZXJ2aWNlcy9jbGFzc2VzLnNlcnZpY2VkYXRhbWFya2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFDNUMsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sK0JBQStCLENBQUM7QUFhckUsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUFtQixDQUFDLFNBQVMsRUFBRSxlQUFlLEVBQUUsZUFBZSxDQUFDLENBQUM7QUFFMUYsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQzdCLHNIQUFzSCxDQUFDO0FBRXpILHNEQUFzRDtBQUN0RCxNQUFNLENBQUMsTUFBTSxnQkFBZ0IsR0FBRyxlQUFlLENBQUM7QUFFaEQsc0ZBQXNGO0FBQ3RGLE1BQU0sQ0FBQyxNQUFNLGdCQUFnQixHQUFHLGtCQUFrQixDQUFDO0FBRW5ELDJEQUEyRDtBQUMzRCxNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyx3QkFBd0IsQ0FBQztBQUM5RCxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUFDLENBQUM7QUFDaEQsTUFBTSxDQUFDLE1BQU0sNEJBQTRCLEdBQUcsV0FBVyxDQUFDO0FBQ3hELE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLG9CQUFvQixDQUFDO0FBQzFELE1BQU0sQ0FBQyxNQUFNLG9CQUFvQixHQUFHLHdCQUF3QixDQUFDO0FBRTdEOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBc0M7SUFDMUUsT0FBTyxFQUFFLFdBQVc7SUFDcEIsYUFBYSxFQUFFLG1CQUFtQjtJQUNsQyxhQUFhLEVBQUUsUUFBUTtDQUN4QixDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBc0M7SUFDOUQsT0FBTyxFQUFFLFdBQVc7SUFDcEIsYUFBYSxFQUFFLGtCQUFrQjtJQUNqQyxhQUFhLEVBQUUsc0JBQXNCO0NBQ3RDLENBQUM7QUF3QkYsTUFBTSxhQUFhLEdBQUcsQ0FBQyxLQUFjLEVBQWdDLEVBQUU7SUFDckUsT0FBTyxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7QUFDOUUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxRQUE2QixFQUFFLGNBQWlDLEVBQVcsRUFBRSxDQUNoRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0FBRTNFLHNEQUFzRDtBQUN0RCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLGNBQXNCLEVBQVUsRUFBRTtJQUN6RSxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO0FBQ2xHLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsY0FBc0IsRUFBVSxFQUFFO0lBQzdFLE9BQU8sR0FBRyx3QkFBd0IsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDO0FBQzVELENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSx1QkFBdUIsR0FBRyxDQUNyQyxjQUFzQixFQUN0QixVQUF3QixFQUNoQixFQUFFO0lBQ1YsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FDdEIsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQ3BDLFFBQVEsRUFDUix5QkFBeUIsQ0FBQyxVQUFVLENBQUMsQ0FDdEMsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGLCtEQUErRDtBQUMvRCxNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLGNBQXNCLEVBQVUsRUFBRTtJQUM1RSxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUN0QixPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsRUFDcEMsUUFBUSxFQUNSLDRCQUE0QixDQUM3QixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQ25DLGNBQXNCLEVBQ3RCLGdCQUF3QixFQUNmLEVBQUU7SUFDWCxNQUFNLFNBQVMsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3pELEtBQUssTUFBTSxPQUFPLElBQUksWUFBWSxFQUFFLENBQUM7UUFDbkMsSUFBSSx1QkFBdUIsQ0FBQyxjQUFjLEVBQUUsT0FBTyxDQUFDLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbkUsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFNBQThCLEVBQVcsRUFBRTtJQUN6RSxPQUFPLENBQ0wsU0FBUyxDQUFDLEtBQUssS0FBSyxnQkFBZ0I7UUFDcEMsU0FBUyxDQUFDLElBQUksS0FBSyxjQUFjO1FBQ2pDLFNBQVMsQ0FBQyxXQUFXLEtBQUssSUFBSTtRQUM5QixPQUFPLFNBQVMsQ0FBQyxXQUFXLEtBQUssUUFBUTtRQUN6QyxTQUFTLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQ2hDLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1FBQ3ZDLFNBQVMsQ0FBQyxTQUFTLENBQUMsTUFBTSxHQUFHLENBQUM7UUFDOUIsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLENBQ3pDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwwREFBMEQ7QUFDMUQsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxTQUFrQixFQUFtQyxFQUFFO0lBQzlGLElBQUksQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUM5QixPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUNFLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRTtRQUN0QixPQUFPO1FBQ1AsTUFBTTtRQUNOLGVBQWU7UUFDZixhQUFhO1FBQ2IsYUFBYTtRQUNiLFdBQVc7UUFDWCxpQkFBaUI7UUFDakIsdUJBQXVCO0tBQ3hCLENBQUM7UUFDRixDQUFDLHNCQUFzQixDQUFDLFNBQVMsQ0FBQztRQUNsQyxTQUFTLENBQUMsYUFBYSxLQUFLLDhCQUE4QixFQUMxRCxDQUFDO1FBQ0QsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sWUFBWSxHQUFHLElBQUksR0FBRyxFQUFnQixDQUFDO0lBQzdDLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQzlDLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxFQUFFLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RSxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUMxQyxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLE9BQU8sS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbEQsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsSUFDRSxZQUFZLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7WUFDL0IsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLHVCQUF1QixDQUFDLFdBQVcsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQ3hGLENBQUM7WUFDRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxZQUFZLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUNsQyxDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMscUJBQXFCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDbEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLHFCQUFxQixDQUFDLEVBQUUsQ0FBQztZQUNwRCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFNBQVMsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1lBQ3BELElBQ0UsQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDO2dCQUNyQixDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLGFBQWEsQ0FBQyxDQUFDO2dCQUN2RCxLQUFLLENBQUMsT0FBTyxLQUFLLE9BQU87Z0JBQ3pCLEtBQUssQ0FBQyxXQUFXLEtBQUssS0FBSztnQkFDM0IsT0FBTyxLQUFLLENBQUMsSUFBSSxLQUFLLFFBQVE7Z0JBQzlCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSywyQkFBMkIsQ0FBQyxXQUFXLENBQUMsRUFDN0UsQ0FBQztnQkFDRCxPQUFPLEtBQUssQ0FBQztZQUNmLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxTQUFTLENBQUMscUJBQXFCLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQy9DLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsS0FBSyxFQUNsQyxjQUFzQixFQUN0QixTQUE2QixFQUNkLEVBQUU7SUFDakIsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDNUQsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFNBQVMsRUFBRSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3ZGLE1BQU0sUUFBUSxHQUFHLEdBQUcsVUFBVSxRQUFRLE9BQU8sQ0FBQyxHQUFHLElBQUksT0FBTyxDQUFDLE1BQU07U0FDaEUsV0FBVyxDQUFDLEVBQUUsQ0FBQztTQUNmLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0lBQ3JCLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUU7WUFDOUUsUUFBUSxFQUFFLE1BQU07WUFDaEIsSUFBSSxFQUFFLElBQUk7U0FDWCxDQUFDLENBQUM7UUFDSCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNoRCxDQUFDO0lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztRQUNmLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUMsUUFBUSxFQUFFLEVBQUUsS0FBSyxFQUFFLElBQUksRUFBRSxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxHQUFFLENBQUMsQ0FBQyxDQUFDO1FBQy9ELE1BQU0sSUFBSSxLQUFLLENBQUMscURBQXFELFVBQVUsRUFBRSxFQUFFO1lBQ2pGLEtBQUssRUFBRSxLQUFLO1NBQ2IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLG9GQUFvRjtBQUNwRixNQUFNLENBQUMsTUFBTSxxQkFBcUIsR0FBRyxLQUFLLEVBQ3hDLGNBQXNCLEVBQ21CLEVBQUU7SUFDM0MsTUFBTSxVQUFVLEdBQUcsd0JBQXdCLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDNUQsSUFBSSxDQUFDO1FBQ0gsSUFBSSxDQUFDLENBQUMsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxFQUFFLENBQUM7WUFDdkQsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLENBQUMsTUFBTSxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQVcsQ0FBQztRQUMzRixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ25DLE9BQU8sd0JBQXdCLENBQUMsTUFBTSxDQUFDO1lBQ3JDLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsS0FBSyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUM7WUFDakYsQ0FBQyxDQUFDLE1BQU07WUFDUixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsQ0FDOUMsU0FBeUMsRUFDekMsY0FBc0IsRUFDdEIsVUFBd0IsRUFDZixFQUFFO0lBQ1gsTUFBTSxZQUFZLEdBQUcsdUJBQXVCLENBQUMsY0FBYyxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3pFLE9BQU8sQ0FBQyxDQUFDLFNBQVMsRUFBRSxlQUFlLENBQUMsSUFBSSxDQUN0QyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLFlBQVksQ0FDN0YsQ0FBQztBQUNKLENBQUMsQ0FBQztBQUVGOzs7Ozs7O0dBT0c7QUFDSCxNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzdDLGNBQXNCLEVBQ3RCLFVBQXdCLEVBQ1QsRUFBRTtJQUNqQixNQUFNLFdBQVcsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUN6RCxNQUFNLG9CQUFvQixDQUN4QjtRQUNFLFFBQVEsRUFBRSw0QkFBNEIsQ0FBQyxXQUFXLENBQUM7UUFDbkQsV0FBVyxFQUFFLHFCQUFxQjtLQUNuQyxFQUNELEtBQUssSUFBSSxFQUFFO1FBQ1QsTUFBTSxRQUFRLEdBQUcsdUJBQXVCLENBQUMsV0FBVyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ3pELE1BQU0sWUFBWSxHQUFHLE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDckUsTUFBTSxjQUFjLEdBQUcsTUFBTSxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsQ0FBQztRQUNoRSxJQUFJLFlBQVksSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3BDLE1BQU0sSUFBSSxLQUFLLENBQ2IsaUVBQWlFLFVBQVUsRUFBRSxDQUM5RSxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sT0FBTyxHQUE4QixjQUFjO1lBQ3ZELENBQUMsQ0FBQyxjQUFjLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLENBQUM7WUFDaEYsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQ3RELE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUUvRSxNQUFNLE1BQU0sR0FBdUI7WUFDakMsS0FBSyxFQUFFLGdCQUFnQjtZQUN2QixJQUFJLEVBQUUsY0FBYztZQUNwQixhQUFhLEVBQUUsOEJBQThCO1lBQzdDLFdBQVc7WUFDWCxXQUFXLEVBQUUsSUFBSTtZQUNqQixTQUFTLEVBQUUsY0FBYyxFQUFFLFNBQVMsSUFBSSxJQUFJLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRTtZQUNoRSxlQUFlLEVBQUUsT0FBTztZQUN4QixHQUFHLENBQUMsY0FBYyxFQUFFLHFCQUFxQjtnQkFDdkMsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLEVBQUUsY0FBYyxDQUFDLHFCQUFxQixFQUFFO2dCQUNqRSxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ1IsQ0FBQztRQUVGLE1BQU0sc0JBQXNCLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQ3BELENBQUMsQ0FDRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7OztHQU1HO0FBQ0gsTUFBTSxDQUFDLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxVQUl6QyxFQUE2QixFQUFFO0lBQzlCLE9BQU87UUFDTCxlQUFlLEVBQUUsZ0JBQWdCO1FBQ2pDLGtCQUFrQixFQUFFLFVBQVUsQ0FBQyxPQUFPO1FBQ3RDLHVCQUF1QixFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUM7UUFDckUsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztRQUMvRCx3QkFBd0IsRUFBRSxNQUFNO0tBQ2pDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxDQUM1QyxTQUFpQyxFQUNqQyxXQUFtQyxFQUMxQixFQUFFO0lBQ1gsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUNyRSxHQUFHLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUM1QixDQUFDO0lBQ0YsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUN6RSxHQUFHLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUM1QixDQUFDO0lBQ0YsT0FBTyxDQUNMLG1CQUFtQixDQUFDLE1BQU0sS0FBSyxxQkFBcUIsQ0FBQyxNQUFNO1FBQzNELHFCQUFxQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLEtBQUssS0FBSyxDQUFDLENBQ3hFLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRiwwRUFBMEU7QUFDMUUsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxTQUFvQyxFQUFXLEVBQUU7SUFDdEYsT0FBTyxDQUNMLFNBQVMsQ0FBQyxlQUFlLENBQUMsS0FBSyxnQkFBZ0I7UUFDL0MsU0FBUyxDQUFDLHdCQUF3QixDQUFDLEtBQUssTUFBTSxDQUMvQyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsNEZBQTRGO0FBQzVGLE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQUMsU0FFNUMsRUFBVyxFQUFFO0lBQ1osT0FBTyxDQUNMLFNBQVMsQ0FBQyxlQUFlLENBQUMsS0FBSyxnQkFBZ0I7UUFDL0MsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEtBQUssT0FBTyxDQUMxQyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsdUZBQXVGO0FBQ3ZGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLENBQUMsU0FFOUMsRUFBVyxFQUFFO0lBQ1osT0FBTyxDQUNMLFNBQVMsQ0FBQyxlQUFlLENBQUMsS0FBSyxnQkFBZ0I7UUFDL0MsU0FBUyxDQUFDLHFCQUFxQixDQUFDLEtBQUssb0JBQW9CLENBQzFELENBQUM7QUFDSixDQUFDLENBQUMifQ==

package/dist_ts/mod_services/classes.servicemanager.d.ts

@@ -1,6 +1,7 @@
+import * as plugins from './mod.plugins.js';
 import { ServiceConfiguration } from './classes.serviceconfiguration.js';
-import { DockerContainer } from './classes.dockercontainer.js';
 import { type TServiceName } from './classes.servicedatamarker.js';
+import { type TServiceMigrationScope } from '../../dist_ts_migration/index.js';
 import type { ContainerStatus } from './classes.dockercontainer.js';
 import type { TServiceOptionSource } from './classes.serviceoptions.js';
 export interface IServiceStatus {
@@ -18,7 +19,12 @@ export interface IServiceStatus {
     authEnabled?: boolean;
     /** MongoDB only: whether the auth mode is declared in committed config. */
     authSource?: TServiceOptionSource;
+    /** ObjectStorage only: an unowned same-name container is a conflict, not managed state. */
+    ownership?: 'owned' | 'conflict' | 'absent';
+    managementUi?: string;
 }
+export type TServiceManagerOperation = 'auth' | 'clean' | 'compass' | 'config' | 'logs' | 'remove' | 'reconfigure' | 'restart' | 'start' | 'status' | 'stop';
+export declare const getServiceManagerMigrationScopes: (operationArg: TServiceManagerOperation) => TServiceMigrationScope[];
 export interface IServicesStatus {
     project: {
         name: string;
@@ -27,9 +33,14 @@ export interface IServicesStatus {
     };
     services: {
         mongodb: IServiceStatus;
-        minio: IServiceStatus;
+        objectstorage: IServiceStatus;
         elasticsearch: IServiceStatus;
     };
+    legacy: {
+        minioContainer?: string;
+        minioDataDirectory: string;
+        minioDataExists: boolean;
+    };
     totalDataBytes: number;
 }
 export declare const mongoServiceUlimits: {
@@ -38,33 +49,47 @@ export declare const mongoServiceUlimits: {
         readonly hard: 65536;
     };
 };
-export declare const minioReconciliationTimeoutMs = 30000;
-export interface IMinioReconciliationClock {
+export declare const objectStorageReconciliationTimeoutMs = 30000;
+export interface IObjectStorageReconciliationClock {
     now(): number;
     delay(millisecondsArg: number): Promise<void>;
 }
-export interface IMinioReconciliationOptions {
-    docker: Pick<DockerContainer, 'execArgv'>;
-    /** Full immutable Docker container id; mutable names are never accepted here. */
-    containerId: string;
+export interface IObjectStorageBucketReconciliationOptions {
+    smartBucket: Pick<plugins.smartbucket.SmartBucket, 'checkReadiness' | 'close'> & {
+        storageClient: {
+            send(commandArg: plugins.s3.HeadBucketCommand | plugins.s3.CreateBucketCommand, optionsArg?: {
+                abortSignal?: AbortSignal;
+            }): Promise<unknown>;
+        };
+    };
     bucket: string;
-    /** Shared absolute deadline. Defaults to 30 seconds from this call. */
     deadlineAt?: number;
-    clock?: IMinioReconciliationClock;
+    clock?: IObjectStorageReconciliationClock;
 }
-/** Converge a running MinIO container to an authenticated, verified bucket. */
-export declare const reconcileMinioBucket: (optionsArg: IMinioReconciliationOptions) => Promise<void>;
+export declare const objectStorageExpectedEntrypoint: string[];
+export declare const objectStorageExpectedCommand: string[];
+export declare const objectStorageExpectedHealthcheck: {
+    test: string[];
+    interval: number;
+    timeout: number;
+    startPeriod: number;
+    retries: number;
+};
+/** Create the configured bucket only after an authenticated 404, then verify by HEAD. */
+export declare const reconcileObjectStorageBucket: (optionsArg: IObjectStorageBucketReconciliationOptions) => Promise<void>;
 export declare class ServiceManager {
     private config;
     private docker;
     private enabledServices;
     private globalRegistry;
-    private minioClock;
+    private objectStorageClock;
+    private fetchImplementation;
+    private smartBucketFactory;
     constructor();
     /**
      * Initialize the service manager
      */
-    init(): Promise<void>;
+    init(operationArg: TServiceManagerOperation): Promise<void>;
     /**
      * Human phrasing for where the auth mode came from. A declared auth-off is
      * committed to the repository and therefore affects everyone who clones it,
@@ -86,7 +111,7 @@ export declare class ServiceManager {
     /**
      * Check if a service is enabled
      */
-    private isServiceEnabled;
+    isServiceEnabled(service: TServiceName): boolean;
     /**
      * Prepare a service's data directory: create it and record tool ownership.
      *
@@ -94,6 +119,7 @@ export declare class ServiceManager {
      * prove the directory is reclaimable instead of guessing from its path.
      */
     private prepareDataDirectory;
+    private createDataDirectory;
     /**
      * Register this project with the global registry.
      *
@@ -124,6 +150,8 @@ export declare class ServiceManager {
      * (localhost:MONGODB_PORT) is reachable from host and container alike.
      */
     startMongoDB(): Promise<void>;
+    private assertNoPendingDataDeletion;
+    private startMongoDBLocked;
     /**
      * Create the MongoDB container as a single-node replica set
      */
@@ -150,31 +178,42 @@ export declare class ServiceManager {
      * Initiate the single-node replica set once mongod is reachable
      */
     private ensureMongoReplicaSetInitiated;
-    private inspectMinioContainer;
-    private assertMinioOwnership;
-    private revalidateMinioContainer;
-    /**
-     * Start MinIO service
-     */
-    startMinIO(): Promise<void>;
-    /** Create stopped MinIO, inspect its id, and prove exact current labels. */
-    private createMinioContainer;
+    private inspectObjectStorageContainer;
+    private inspectObjectStorageIdentity;
+    private discoverContainerIdByExactName;
+    private assertObjectStorageOwnership;
+    private revalidateObjectStorageContainer;
+    private objectStorageConfigurationMatches;
+    private assertNoSymlinkedObjectStoragePath;
+    private prepareObjectStorageDataDirectory;
+    private repairObjectStorageMarkerFromOwnedContainer;
+    private assertNoLegacyMinioResources;
+    /** Read-only preflight used before restart or reconfigure may stop anything. */
+    assertObjectStorageStartupAllowed(): Promise<void>;
+    private assertObjectStorageConfigurationSafe;
+    private waitForObjectStorageReadiness;
+    private createObjectStorageContainer;
+    /** Start or reconcile the canonical ObjectStorage service. */
+    startObjectStorage(): Promise<void>;
+    private startObjectStorageLocked;
     /**
      * Start Elasticsearch service
      */
     startElasticsearch(): Promise<void>;
+    private startElasticsearchLocked;
     /**
      * Stop MongoDB service
      */
     stopMongoDB(): Promise<void>;
-    /**
-     * Stop MinIO service
-     */
-    stopMinIO(): Promise<void>;
+    private stopMongoDBLocked;
+    /** Stop only an exactly owned canonical ObjectStorage container. */
+    stopObjectStorage(): Promise<void>;
+    private stopObjectStorageLocked;
     /**
      * Stop Elasticsearch service
      */
     stopElasticsearch(): Promise<void>;
+    private stopElasticsearchLocked;
     /**
      * Collect service status as structured data.
      *
@@ -210,6 +249,8 @@ export declare class ServiceManager {
      * Remove containers
      */
     removeContainers(): Promise<void>;
+    private removeContainersLocked;
+    private withProjectServiceLocks;
     /**
      * Clean data directories
      */
@@ -222,4 +263,5 @@ export declare class ServiceManager {
      * Reconfigure services with new ports
      */
     reconfigure(): Promise<void>;
+    private reconfigureLocked;
 }