@ninedeploy/schemas 0.10.6 → 0.16.1

package/dist/backupPolicy.js

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+// ── Per-database backup policy (0.12) ──────────────────────────────────────
+/** Bounds for both retention counts. At least one dump is always kept, so a
+ *  policy can never prune a database's last good backup. */
+export const BACKUP_RETAIN_MIN = 1;
+export const BACKUP_RETAIN_MAX = 365;
+/** What a database WITHOUT a policy gets: the built-in schedule. */
+export const DEFAULT_BACKUP_RETAIN_COUNT = 7;
+const retain = z.number().int().min(BACKUP_RETAIN_MIN).max(BACKUP_RETAIN_MAX);
+/**
+ * PUT /v1/databases/:id/backup-policy — the whole policy (PUT replaces).
+ * The cron expression is validated with croner (5-part) at the route, the
+ * same rule scheduled jobs use; the schema package has no cron dependency.
+ */
+export const backupPolicyInput = z
+    .object({
+    enabled: z.boolean().default(true),
+    cron: z.string().trim().min(1).max(120),
+    retainCount: retain,
+    /** Remote copies kept; null/omitted = the remote copies of the newest `retainCount` dumps. */
+    retainRemoteCount: retain.nullable().optional().transform((v) => v ?? null),
+    /** A `backup_destinations` id; null/omitted = the active destination. */
+    destinationId: z.number().int().positive().nullable().optional().transform((v) => v ?? null),
+    /** true = keep this database's scheduled dumps on the panel host only. */
+    localOnly: z.boolean().optional().transform((v) => v ?? false),
+})
+    .refine((p) => !(p.localOnly && p.destinationId != null), {
+    message: 'localOnly and destinationId are mutually exclusive',
+    path: ['destinationId'],
+})
+    .refine((p) => !(p.localOnly && p.retainRemoteCount != null), {
+    message: 'retainRemoteCount has no effect on a local-only policy',
+    path: ['retainRemoteCount'],
+});
+/** GET/PUT response. `configured: false` = no policy row: the built-in
+ *  schedule (daily, 7 kept, active destination) applies and `cron` is null. */
+export const backupPolicy = z.object({
+    databaseId: z.number().int(),
+    configured: z.boolean(),
+    enabled: z.boolean(),
+    cron: z.string().nullable(),
+    retainCount: z.number().int(),
+    retainRemoteCount: z.number().int().nullable(),
+    destinationId: z.number().int().nullable(),
+    localOnly: z.boolean(),
+    /** Next scheduled run for a configured, enabled policy (ISO); null otherwise. */
+    nextRunAt: z.string().nullable(),
+    updatedAt: z.string().nullable(),
+});
+//# sourceMappingURL=backupPolicy.js.map

package/dist/backupPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backupPolicy.js","sourceRoot":"","sources":["../src/backupPolicy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E;4DAC4D;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AACrC,oEAAoE;AACpE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,MAAM;IACnB,8FAA8F;IAC9F,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;IAC3E,yEAAyE;IACzE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5F,0EAA0E;IAC1E,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC,EAAE;IACxD,OAAO,EAAE,oDAAoD;IAC7D,IAAI,EAAE,CAAC,eAAe,CAAC;CACxB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,iBAAiB,IAAI,IAAI,CAAC,EAAE;IAC5D,OAAO,EAAE,wDAAwD;IACjE,IAAI,EAAE,CAAC,mBAAmB,CAAC;CAC5B,CAAC,CAAC;AAGL;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC5B,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC7B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC9C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,iFAAiF;IACjF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC"}

package/dist/common.d.ts

@@ -30,6 +30,20 @@ export declare const httpPath: z.ZodString;
  * scheme is pinned here rather than relying on the toolchain to stay strict.
  */
 export declare const gitRepoUrl: z.ZodURL;
+/**
+ * 0.13: the base URL of an operator-supplied git provider API or web UI
+ * (a Gitea instance, GitHub Enterprise Server, `https://github.com`).
+ *
+ * `http:` is accepted HERE on purpose: whether plain http is allowed depends on
+ * the server's `NINEDEPLOY_ALLOW_PRIVATE_EGRESS` escape hatch, which this
+ * package cannot see. The server refuses `http:` unless that flag is set, and
+ * every call still goes through its egress guard. Rejecting http in the schema
+ * would make the documented escape hatch (an internal http-only Gitea)
+ * unusable. Userinfo, query and fragment are refused — a base URL never needs
+ * them, and userinfo would smuggle credentials into a URL that gets logged.
+ * Trailing slashes are dropped so `${base}/api/v1/…` joins cleanly.
+ */
+export declare const providerBaseUrl: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodURL>, z.ZodTransform<string, string>>;
 /**
  * A git branch/ref name. Reaches `git checkout` / `git pull` as an argv
  * element, so a value starting with `-` would be read as an option rather
@@ -48,11 +62,13 @@ export declare const repoBaseDir: z.ZodString;
  */
 export declare const containerPath: z.ZodString;
 /**
- * Docker named-volume name. Lowercase letters, digits, underscores, hyphens
- * and dots; must start with alnum; max 64 chars (the volume driver limit
- * on most filesystems). The managed prefixes `nd-svc-` / `nd-db-` are
- * accepted; clients sending a non-managed name attach a pre-existing volume
- * they have created out-of-band.
+ * Docker named-volume name: letters (BOTH cases — the `i` flag is deliberate,
+ * r474: docker itself accepts uppercase volume names, and rejecting them
+ * would break attach flows against pre-existing out-of-band volumes), digits,
+ * underscores, hyphens and dots; must start with alnum; max 64 chars (the
+ * volume driver limit on most filesystems). The managed prefixes `nd-svc-` /
+ * `nd-db-` are lowercased by construction; a non-managed name attaches a
+ * pre-existing volume the client created out-of-band.
  */
 export declare const dockerVolumeName: z.ZodString;
 /** Cursor-style pagination params. */

package/dist/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,eAAO,MAAM,IAAI,aAIqE,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ,eAAO,MAAM,EAAE,aAA8B,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,aAMlB,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAInB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,SAAS,aAKyE,CAAC;AAqBhG,eAAO,MAAM,gBAAgB,aAIuD,CAAC;AAErF,iFAAiF;AACjF,eAAO,MAAM,WAAW,aAAmB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,aAIuD,CAAC;AAElF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,aAIoC,CAAC;AAElE,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,mDAAmD;AACnD,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yBAAyB;AACzB,wBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;;;;kBAMnD"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,eAAO,MAAM,IAAI,aAIqE,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ,eAAO,MAAM,EAAE,aAA8B,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,aAMlB,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAInB,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,6EASsB,CAAC;AAEnD;;;;;GAKG;AACH,eAAO,MAAM,SAAS,aAKyE,CAAC;AAqBhG,eAAO,MAAM,gBAAgB,aAIuD,CAAC;AAErF,iFAAiF;AACjF,eAAO,MAAM,WAAW,aAAmB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,aAQmE,CAAC;AAE9F;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB,aAIoC,CAAC;AAElE,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,mDAAmD;AACnD,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yBAAyB;AACzB,wBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;;;;kBAMnD"}

package/dist/common.js

@@ -44,6 +44,29 @@ export const gitRepoUrl = z
     .refine((value) => /^(?:https?|ssh):\/\//i.test(value), {
     message: 'repoUrl must be an http(s) or ssh URL',
 });
+/**
+ * 0.13: the base URL of an operator-supplied git provider API or web UI
+ * (a Gitea instance, GitHub Enterprise Server, `https://github.com`).
+ *
+ * `http:` is accepted HERE on purpose: whether plain http is allowed depends on
+ * the server's `NINEDEPLOY_ALLOW_PRIVATE_EGRESS` escape hatch, which this
+ * package cannot see. The server refuses `http:` unless that flag is set, and
+ * every call still goes through its egress guard. Rejecting http in the schema
+ * would make the documented escape hatch (an internal http-only Gitea)
+ * unusable. Userinfo, query and fragment are refused — a base URL never needs
+ * them, and userinfo would smuggle credentials into a URL that gets logged.
+ * Trailing slashes are dropped so `${base}/api/v1/…` joins cleanly.
+ */
+export const providerBaseUrl = z
+    .string()
+    .trim()
+    .max(2048)
+    .pipe(z.url({ protocol: /^https?$/, message: 'must be an http(s) URL' }))
+    // Everything after the scheme: no `@` (userinfo), `?` or `#`.
+    .refine((value) => !/[@?#]/.test(value.slice(value.indexOf(':') + 3)), {
+    message: 'must be a base URL without credentials, query or fragment',
+})
+    .transform((value) => value.replace(/\/+$/, ''));
 /**
  * A git branch/ref name. Reaches `git checkout` / `git pull` as an argv
  * element, so a value starting with `-` would be read as an option rather
@@ -90,13 +113,19 @@ export const containerPath = z
     .string()
     .min(1)
     .max(1024)
-    .regex(/^\/[^/].*|^\/$/, 'must be an absolute path starting with a single "/"');
+    // Anchored on both ends: the old `^\/[^/].*` prefix-match let `/a/../b`,
+    // embedded NUL/newline and interior `//` through. Segments are non-empty,
+    // slash-free and control-char-free; a lone `/` stays valid.
+    .regex(/^\/(?:[^/\0\n\r]+\/?)*$/, 'must be an absolute path starting with a single "/"')
+    .refine((v) => !v.split('/').includes('..'), { message: 'must not contain ".." segments' });
 /**
- * Docker named-volume name. Lowercase letters, digits, underscores, hyphens
- * and dots; must start with alnum; max 64 chars (the volume driver limit
- * on most filesystems). The managed prefixes `nd-svc-` / `nd-db-` are
- * accepted; clients sending a non-managed name attach a pre-existing volume
- * they have created out-of-band.
+ * Docker named-volume name: letters (BOTH cases — the `i` flag is deliberate,
+ * r474: docker itself accepts uppercase volume names, and rejecting them
+ * would break attach flows against pre-existing out-of-band volumes), digits,
+ * underscores, hyphens and dots; must start with alnum; max 64 chars (the
+ * volume driver limit on most filesystems). The managed prefixes `nd-svc-` /
+ * `nd-db-` are lowercased by construction; a non-managed name attaches a
+ * pre-existing volume the client created out-of-band.
  */
 export const dockerVolumeName = z
     .string()

package/dist/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,EAAE,uCAAuC,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CACJ,0BAA0B,EAC1B,oGAAoG,CACrG,CAAC;AAEJ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,yCAAyC,EACzC,+DAA+D,CAChE,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,iCAAiC,EAAE,qBAAqB,CAAC;KAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5C,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;AAErF,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,gBAAgB,EAAE,qDAAqD,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH,yBAAyB;AACzB,MAAM,UAAU,IAAI,CAAyB,IAAO;IAClD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,EAAE,uCAAuC,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CACJ,0BAA0B,EAC1B,oGAAoG,CACrG,CAAC;AAEJ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,yCAAyC,EACzC,+DAA+D,CAChE,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEL;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,IAAI,CAAC;KACT,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACzE,8DAA8D;KAC7D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;IACrE,OAAO,EAAE,2DAA2D;CACrE,CAAC;KACD,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,iCAAiC,EAAE,qBAAqB,CAAC;KAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5C,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;AAErF,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;IACV,yEAAyE;IACzE,0EAA0E;IAC1E,4DAA4D;KAC3D,KAAK,CAAC,yBAAyB,EAAE,qDAAqD,CAAC;KACvF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;AAE9F;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH,yBAAyB;AACzB,MAAM,UAAU,IAAI,CAAyB,IAAO;IAClD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/databaseImport.d.ts

@@ -0,0 +1,145 @@
+import { z } from 'zod';
+/** 8 MiB. Advertised by the server on every import; chunks arrive in order. */
+export declare const DATABASE_IMPORT_CHUNK_SIZE: number;
+/** Mirrors `databaseImportSource` in `@ninedeploy/db`. */
+export declare const databaseImportSource: z.ZodEnum<{
+    s3: "s3";
+    upload: "upload";
+}>;
+export type DatabaseImportSource = z.infer<typeof databaseImportSource>;
+/** Mirrors `databaseImportStatus` in `@ninedeploy/db`. */
+export declare const databaseImportStatus: z.ZodEnum<{
+    cancelled: "cancelled";
+    completed: "completed";
+    completed_with_warnings: "completed_with_warnings";
+    expired: "expired";
+    failed: "failed";
+    pending: "pending";
+    running: "running";
+    uploading: "uploading";
+}>;
+export type DatabaseImportStatus = z.infer<typeof databaseImportStatus>;
+/** Mirrors `databaseImportFormat` in `@ninedeploy/db`. */
+export declare const databaseImportFormat: z.ZodEnum<{
+    mongo_archive: "mongo_archive";
+    mysql_sql: "mysql_sql";
+    pg_custom: "pg_custom";
+    pg_plain: "pg_plain";
+    rdb: "rdb";
+}>;
+export type DatabaseImportFormat = z.infer<typeof databaseImportFormat>;
+/**
+ * Import options. Strict: an unknown key is refused, not dropped. The server
+ * further refuses keys that do not apply to the database's engine, and
+ * applies `singleTransaction: true` when it is omitted (postgres).
+ */
+export declare const databaseImportOptions: z.ZodObject<{
+    clean: z.ZodOptional<z.ZodBoolean>;
+    singleTransaction: z.ZodOptional<z.ZodBoolean>;
+    drop: z.ZodOptional<z.ZodBoolean>;
+    confirmReplace: z.ZodOptional<z.ZodBoolean>;
+    skipSafetyBackup: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type DatabaseImportOptions = z.infer<typeof databaseImportOptions>;
+/**
+ * The engines an import accepts, and the option keys each one applies. The
+ * server refuses (422) any other engine, and any key not listed for the
+ * database's engine. clickhouse, meilisearch and rabbitmq have no import.
+ */
+export declare const DATABASE_IMPORT_ENGINE_OPTIONS: {
+    readonly postgres: readonly ["clean", "singleTransaction", "skipSafetyBackup"];
+    readonly mysql: readonly ["skipSafetyBackup"];
+    readonly mariadb: readonly ["skipSafetyBackup"];
+    readonly mongo: readonly ["drop", "skipSafetyBackup"];
+    readonly redis: readonly ["confirmReplace", "skipSafetyBackup"];
+    readonly valkey: readonly ["confirmReplace", "skipSafetyBackup"];
+    readonly keydb: readonly ["confirmReplace", "skipSafetyBackup"];
+    readonly dragonfly: readonly ["confirmReplace", "skipSafetyBackup"];
+};
+export type DatabaseImportEngine = keyof typeof DATABASE_IMPORT_ENGINE_OPTIONS;
+/** POST /v1/databases/:id/imports. */
+export declare const databaseImportCreate: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    source: z.ZodLiteral<"upload">;
+    sizeBytes: z.ZodNumber;
+    sha256: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    filename: z.ZodOptional<z.ZodString>;
+    options: z.ZodDefault<z.ZodObject<{
+        clean: z.ZodOptional<z.ZodBoolean>;
+        singleTransaction: z.ZodOptional<z.ZodBoolean>;
+        drop: z.ZodOptional<z.ZodBoolean>;
+        confirmReplace: z.ZodOptional<z.ZodBoolean>;
+        skipSafetyBackup: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strip>, z.ZodObject<{
+    source: z.ZodLiteral<"s3">;
+    destinationId: z.ZodNumber;
+    key: z.ZodString;
+    options: z.ZodDefault<z.ZodObject<{
+        clean: z.ZodOptional<z.ZodBoolean>;
+        singleTransaction: z.ZodOptional<z.ZodBoolean>;
+        drop: z.ZodOptional<z.ZodBoolean>;
+        confirmReplace: z.ZodOptional<z.ZodBoolean>;
+        skipSafetyBackup: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>>;
+}, z.core.$strip>], "source">;
+export type DatabaseImportCreate = z.input<typeof databaseImportCreate>;
+/** One import row as the API returns it. */
+export declare const databaseImport: z.ZodObject<{
+    id: z.ZodNumber;
+    databaseId: z.ZodNumber;
+    source: z.ZodEnum<{
+        s3: "s3";
+        upload: "upload";
+    }>;
+    status: z.ZodEnum<{
+        cancelled: "cancelled";
+        completed: "completed";
+        completed_with_warnings: "completed_with_warnings";
+        expired: "expired";
+        failed: "failed";
+        pending: "pending";
+        running: "running";
+        uploading: "uploading";
+    }>;
+    format: z.ZodNullable<z.ZodEnum<{
+        mongo_archive: "mongo_archive";
+        mysql_sql: "mysql_sql";
+        pg_custom: "pg_custom";
+        pg_plain: "pg_plain";
+        rdb: "rdb";
+    }>>;
+    sizeBytes: z.ZodNumber;
+    receivedBytes: z.ZodNumber;
+    chunkSize: z.ZodNumber;
+    sha256: z.ZodNullable<z.ZodString>;
+    filename: z.ZodNullable<z.ZodString>;
+    destinationId: z.ZodNullable<z.ZodNumber>;
+    objectKey: z.ZodNullable<z.ZodString>;
+    options: z.ZodObject<{
+        clean: z.ZodOptional<z.ZodBoolean>;
+        singleTransaction: z.ZodOptional<z.ZodBoolean>;
+        drop: z.ZodOptional<z.ZodBoolean>;
+        confirmReplace: z.ZodOptional<z.ZodBoolean>;
+        skipSafetyBackup: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+    safetyBackupId: z.ZodNullable<z.ZodNumber>;
+    error: z.ZodNullable<z.ZodString>;
+    createdByUserId: z.ZodNullable<z.ZodNumber>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    startedAt: z.ZodNullable<z.ZodString>;
+    completedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type DatabaseImport = z.infer<typeof databaseImport>;
+/** GET /v1/backup-destinations/:id/objects?prefix= (operator). */
+export declare const backupDestinationObjectsQuery: z.ZodObject<{
+    prefix: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type BackupDestinationObjectsQuery = z.infer<typeof backupDestinationObjectsQuery>;
+export declare const backupDestinationObject: z.ZodObject<{
+    key: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    lastModified: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type BackupDestinationObject = z.infer<typeof backupDestinationObject>;
+//# sourceMappingURL=databaseImport.d.ts.map

package/dist/databaseImport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseImport.d.ts","sourceRoot":"","sources":["../src/databaseImport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAUxB,+EAA+E;AAC/E,eAAO,MAAM,0BAA0B,QAAkB,CAAC;AAE1D,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB;;;EAA2B,CAAC;AAC7D,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB;;;;;;;;;EAS/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB;;;;;;EAAyE,CAAC;AAC3G,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;kBAavB,CAAC;AACZ,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;CASoC,CAAC;AAChF,MAAM,MAAM,oBAAoB,GAAG,MAAM,OAAO,8BAA8B,CAAC;AA2B/E,sCAAsC;AACtC,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;6BAA2D,CAAC;AAC7F,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,4CAA4C;AAC5C,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAqBzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,kEAAkE;AAClE,eAAO,MAAM,6BAA6B;;iBAExC,CAAC;AACH,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAE1F,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/databaseImport.js

@@ -0,0 +1,115 @@
+import { z } from 'zod';
+import { id } from './common.js';
+// ── Database dump import (0.14) ────────────────────────────────────────────
+// Request and response shapes for `/v1/databases/:id/imports` and
+// `/v1/backup-destinations/:id/objects`. Uploads are chunked and resumable
+// (Traefik's 60s read timeout would cut a single multi-GB request). The
+// server detects the format by magic bytes, refuses engines and options that
+// do not apply, and enforces size, disk and role rules. Design: DESIGN.md §3.
+/** 8 MiB. Advertised by the server on every import; chunks arrive in order. */
+export const DATABASE_IMPORT_CHUNK_SIZE = 8 * 1024 * 1024;
+/** Mirrors `databaseImportSource` in `@ninedeploy/db`. */
+export const databaseImportSource = z.enum(['upload', 's3']);
+/** Mirrors `databaseImportStatus` in `@ninedeploy/db`. */
+export const databaseImportStatus = z.enum([
+    'uploading',
+    'pending',
+    'running',
+    'completed',
+    'completed_with_warnings',
+    'failed',
+    'cancelled',
+    'expired',
+]);
+/** Mirrors `databaseImportFormat` in `@ninedeploy/db`. */
+export const databaseImportFormat = z.enum(['pg_custom', 'pg_plain', 'mysql_sql', 'mongo_archive', 'rdb']);
+/**
+ * Import options. Strict: an unknown key is refused, not dropped. The server
+ * further refuses keys that do not apply to the database's engine, and
+ * applies `singleTransaction: true` when it is omitted (postgres).
+ */
+export const databaseImportOptions = z
+    .object({
+    /** postgres custom format: `--clean --if-exists`. */
+    clean: z.boolean().optional(),
+    /** postgres: wrap the restore in one transaction (server default true). */
+    singleTransaction: z.boolean().optional(),
+    /** mongo: `--drop`. */
+    drop: z.boolean().optional(),
+    /** redis/valkey/keydb/dragonfly: required, the RDB replaces the whole dataset. */
+    confirmReplace: z.boolean().optional(),
+    /** Operator, or a database initialised in the last 10 minutes, only. */
+    skipSafetyBackup: z.boolean().optional(),
+})
+    .strict();
+/**
+ * The engines an import accepts, and the option keys each one applies. The
+ * server refuses (422) any other engine, and any key not listed for the
+ * database's engine. clickhouse, meilisearch and rabbitmq have no import.
+ */
+export const DATABASE_IMPORT_ENGINE_OPTIONS = {
+    postgres: ['clean', 'singleTransaction', 'skipSafetyBackup'],
+    mysql: ['skipSafetyBackup'],
+    mariadb: ['skipSafetyBackup'],
+    mongo: ['drop', 'skipSafetyBackup'],
+    redis: ['confirmReplace', 'skipSafetyBackup'],
+    valkey: ['confirmReplace', 'skipSafetyBackup'],
+    keydb: ['confirmReplace', 'skipSafetyBackup'],
+    dragonfly: ['confirmReplace', 'skipSafetyBackup'],
+};
+const sha256Hex = z
+    .string()
+    .trim()
+    .regex(/^[A-Fa-f0-9]{64}$/, 'sha256 must be 64 hex characters')
+    .transform((v) => v.toLowerCase());
+/** Display only; the staging path is always chosen by the server. */
+const importFilename = z.string().trim().min(1).max(255);
+const uploadSource = z.object({
+    source: z.literal('upload'),
+    sizeBytes: z.number().int().positive(),
+    sha256: sha256Hex.optional(),
+    filename: importFilename.optional(),
+    options: databaseImportOptions.default({}),
+});
+/** S3 imports are operator only (checked in the handler). */
+const s3Source = z.object({
+    source: z.literal('s3'),
+    destinationId: id,
+    key: z.string().min(1).max(1024),
+    options: databaseImportOptions.default({}),
+});
+/** POST /v1/databases/:id/imports. */
+export const databaseImportCreate = z.discriminatedUnion('source', [uploadSource, s3Source]);
+/** One import row as the API returns it. */
+export const databaseImport = z.object({
+    id: z.number().int(),
+    databaseId: z.number().int(),
+    source: databaseImportSource,
+    status: databaseImportStatus,
+    format: databaseImportFormat.nullable(),
+    sizeBytes: z.number().int(),
+    receivedBytes: z.number().int(),
+    chunkSize: z.number().int(),
+    sha256: z.string().nullable(),
+    filename: z.string().nullable(),
+    destinationId: z.number().int().nullable(),
+    objectKey: z.string().nullable(),
+    options: databaseImportOptions,
+    safetyBackupId: z.number().int().nullable(),
+    error: z.string().nullable(),
+    createdByUserId: z.number().int().nullable(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    startedAt: z.string().nullable(),
+    completedAt: z.string().nullable(),
+});
+/** GET /v1/backup-destinations/:id/objects?prefix= (operator). */
+export const backupDestinationObjectsQuery = z.object({
+    prefix: z.string().max(1024).optional(),
+});
+export const backupDestinationObject = z.object({
+    key: z.string(),
+    sizeBytes: z.number().int(),
+    lastModified: z.string().nullable(),
+});
+//# sourceMappingURL=databaseImport.js.map

package/dist/databaseImport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseImport.js","sourceRoot":"","sources":["../src/databaseImport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAEjC,8EAA8E;AAC9E,kEAAkE;AAClE,2EAA2E;AAC3E,wEAAwE;AACxE,6EAA6E;AAC7E,8EAA8E;AAE9E,+EAA+E;AAC/E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAG7D,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,WAAW;IACX,SAAS;IACT,SAAS;IACT,WAAW;IACX,yBAAyB;IACzB,QAAQ;IACR,WAAW;IACX,SAAS;CACV,CAAC,CAAC;AAGH,0DAA0D;AAC1D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAG3G;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,2EAA2E;IAC3E,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACzC,uBAAuB;IACvB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,kFAAkF;IAClF,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AAGZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG;IAC5C,QAAQ,EAAE,CAAC,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,CAAC;IAC5D,KAAK,EAAE,CAAC,kBAAkB,CAAC;IAC3B,OAAO,EAAE,CAAC,kBAAkB,CAAC;IAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACnC,KAAK,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC7C,MAAM,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC9C,KAAK,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;IAC7C,SAAS,EAAE,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;CAC4B,CAAC;AAGhF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,mBAAmB,EAAE,kCAAkC,CAAC;KAC9D,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAErC,qEAAqE;AACrE,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AAEzD,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACtC,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE;IACnC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACvB,aAAa,EAAE,EAAE;IACjB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAChC,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3C,CAAC,CAAC;AAEH,sCAAsC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;AAG7F,4CAA4C;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC5B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB;IAC5B,MAAM,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,OAAO,EAAE,qBAAqB;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,kEAAkE;AAClE,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACpD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC"}

package/dist/doctor.d.ts

@@ -34,8 +34,12 @@ export declare const doctorFindingKind: z.ZodEnum<{
     invalid_slug: "invalid_slug";
     orphan_network: "orphan_network";
     orphan_volume: "orphan_volume";
+    panel_plaintext_exposure: "panel_plaintext_exposure";
+    repo_insights_leak: "repo_insights_leak";
+    sandbox_plugin_network: "sandbox_plugin_network";
     service_runtime_desync: "service_runtime_desync";
     stuck_deployment: "stuck_deployment";
+    templates_source_plaintext: "templates_source_plaintext";
 }>;
 export type DoctorFindingKind = z.infer<typeof doctorFindingKind>;
 /** Executable repair actions. Every one re-validates its precondition against
@@ -66,8 +70,12 @@ export declare const doctorFinding: z.ZodObject<{
         invalid_slug: "invalid_slug";
         orphan_network: "orphan_network";
         orphan_volume: "orphan_volume";
+        panel_plaintext_exposure: "panel_plaintext_exposure";
+        repo_insights_leak: "repo_insights_leak";
+        sandbox_plugin_network: "sandbox_plugin_network";
         service_runtime_desync: "service_runtime_desync";
         stuck_deployment: "stuck_deployment";
+        templates_source_plaintext: "templates_source_plaintext";
     }>;
     severity: z.ZodEnum<{
         critical: "critical";
@@ -149,8 +157,12 @@ export declare const doctorReport: z.ZodObject<{
             invalid_slug: "invalid_slug";
             orphan_network: "orphan_network";
             orphan_volume: "orphan_volume";
+            panel_plaintext_exposure: "panel_plaintext_exposure";
+            repo_insights_leak: "repo_insights_leak";
+            sandbox_plugin_network: "sandbox_plugin_network";
             service_runtime_desync: "service_runtime_desync";
             stuck_deployment: "stuck_deployment";
+            templates_source_plaintext: "templates_source_plaintext";
         }>;
         severity: z.ZodEnum<{
             critical: "critical";
@@ -246,8 +258,12 @@ export declare const doctorFixResponse: z.ZodObject<{
                 invalid_slug: "invalid_slug";
                 orphan_network: "orphan_network";
                 orphan_volume: "orphan_volume";
+                panel_plaintext_exposure: "panel_plaintext_exposure";
+                repo_insights_leak: "repo_insights_leak";
+                sandbox_plugin_network: "sandbox_plugin_network";
                 service_runtime_desync: "service_runtime_desync";
                 stuck_deployment: "stuck_deployment";
+                templates_source_plaintext: "templates_source_plaintext";
             }>;
             severity: z.ZodEnum<{
                 critical: "critical";

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;8EAG8E;AAC9E,eAAO,MAAM,cAAc;;;;EAAuC,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;EAc3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;EA4B5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;uEACuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAkB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAcxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAErD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;8EAG8E;AAC9E,eAAO,MAAM,cAAc;;;;EAAuC,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;EAc3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;EAqD5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE;uEACuE;AACvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;EAkB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAcxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;iBAO1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,gBAAgB;;iBAE3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAChE,MAAM,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAErD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/doctor.js

@@ -47,6 +47,31 @@ export const doctorFindingKind = z.enum([
      * without re-validating. Such a row is a record its own API rejects on PATCH.
      */
     'invalid_slug',
+    /**
+     * r575: the panel's own port listens on a non-loopback address over plain
+     * HTTP (bare-metal default 0.0.0.0:3000) — logins and API tokens crossing
+     * it are readable on the network. Advisory: changing the bind is the
+     * operator's call (it cuts off whoever reaches the panel at http://ip:3000).
+     */
+    'panel_plaintext_exposure',
+    /**
+     * r600: enabled sandbox plugins on a Node whose permission model has no
+     * network scope (< 25) — their code can reach anything the host can.
+     * Advisory: they keep loading (upgrade-safe); upgrading Node closes it.
+     */
+    'sandbox_plugin_network',
+    /**
+     * r620: a stored repository analysis holds a nodeVersion that is not a
+     * version — host file content captured through a symlinked .nvmrc before
+     * 0.10.41. Critical: the exposed secrets must be rotated.
+     */
+    'repo_insights_leak',
+    /**
+     * r655: the Hub's remote template registry is fetched over plain http, so
+     * anyone on the path can swap the catalog (images, env defaults). Advisory:
+     * the source keeps loading (upgrade-safe); new http sources are refused.
+     */
+    'templates_source_plaintext',
 ]);
 /** Executable repair actions. Every one re-validates its precondition against
  *  current state inside the fix path; the enum is the full surface. */

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,WAAW;IACX,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,YAAY;IACZ,MAAM;IACN,qEAAqE;IACrE,SAAS;IACT,WAAW;IACX,QAAQ;IACR,eAAe;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,sEAAsE;IACtE,kBAAkB;IAClB,8DAA8D;IAC9D,eAAe;IACf,0EAA0E;IAC1E,gBAAgB;IAChB,gEAAgE;IAChE,iBAAiB;IACjB,gDAAgD;IAChD,aAAa;IACb,sDAAsD;IACtD,eAAe;IACf,0DAA0D;IAC1D,eAAe;IACf,kEAAkE;IAClE,gBAAgB;IAChB,yEAAyE;IACzE,wBAAwB;IACxB,sEAAsE;IACtE,kBAAkB;IAClB;;;;;OAKG;IACH,cAAc;CACf,CAAC,CAAC;AAGH;uEACuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB;;;;;OAKG;IACH,aAAa;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1B,CAAC;IACF,oEAAoE;IACpE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC;IACF,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;8EAG8E;AAC9E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,WAAW;IACX,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;IACV,SAAS;IACT,YAAY;IACZ,MAAM;IACN,qEAAqE;IACrE,SAAS;IACT,WAAW;IACX,QAAQ;IACR,eAAe;CAChB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,sEAAsE;IACtE,kBAAkB;IAClB,8DAA8D;IAC9D,eAAe;IACf,0EAA0E;IAC1E,gBAAgB;IAChB,gEAAgE;IAChE,iBAAiB;IACjB,gDAAgD;IAChD,aAAa;IACb,sDAAsD;IACtD,eAAe;IACf,0DAA0D;IAC1D,eAAe;IACf,kEAAkE;IAClE,gBAAgB;IAChB,yEAAyE;IACzE,wBAAwB;IACxB,sEAAsE;IACtE,kBAAkB;IAClB;;;;;OAKG;IACH,cAAc;IACd;;;;;OAKG;IACH,0BAA0B;IAC1B;;;;OAIG;IACH,wBAAwB;IACxB;;;;OAIG;IACH,oBAAoB;IACpB;;;;OAIG;IACH,4BAA4B;CAC7B,CAAC,CAAC;AAGH;uEACuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC;IACrC,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,uBAAuB;IACvB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,qBAAqB;IACrB,cAAc;IACd,mBAAmB;IACnB;;;;;OAKG;IACH,aAAa;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,iBAAiB;IACvB,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC1B,CAAC;IACF,oEAAoE;IACpE,MAAM,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;QACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC7B,CAAC;IACF,IAAI,EAAE,eAAe;IACrB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,gBAAgB;IACxB,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC"}