@omnitron-dev/omnitron 0.1.3 → 0.2.0

package/dist/infrastructure/phantom-endpoint-janitor.js

@@ -0,0 +1,149 @@
+/**
+ * Phantom-endpoint janitor (T#75).
+ *
+ * Docker networks accumulate "phantom endpoint" records when a
+ * container is removed while the dockerd daemon is restarting,
+ * during host suspend/resume cycles, or when a `docker rm -f`
+ * arrives mid-network-disconnect. The network's internal endpoint
+ * table keeps a stale row pointing at a container that no longer
+ * exists. The visible symptom is a recreation failure with:
+ *
+ *     Error response from daemon: endpoint with name X
+ *     already exists in network managed-net
+ *
+ * The existing T#58 work avoids the bridge default to sidestep the
+ * worst class of this. The managed network is still susceptible
+ * after dockerd / host restarts, just less frequently. T#75 is the
+ * active cleanup: every interval, list the endpoints in each
+ * managed network, look each one up as a container, and force-
+ * disconnect every endpoint whose container has vanished.
+ *
+ * Implementation notes:
+ *   - We shell out to `docker network inspect` / `docker network
+ *     disconnect` rather than the engine adapter — the adapter
+ *     doesn't expose network APIs and this code path is rare
+ *     (one sweep per `intervalMs`).
+ *   - The whole loop is wrapped in a single in-flight guard so
+ *     two overlapping sweeps can't both try to disconnect the
+ *     same endpoint and produce noisy errors.
+ *   - All errors are caught and logged — a docker-daemon hiccup
+ *     during one sweep must NOT prevent the next one from running.
+ */
+import { spawn } from 'node:child_process';
+export class PhantomEndpointJanitor {
+    opts;
+    timer = null;
+    sweeping = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    start() {
+        if (this.timer)
+            return;
+        const intervalMs = this.opts.intervalMs ?? 60_000;
+        this.timer = setInterval(() => {
+            void this.sweepAll().catch((err) => {
+                this.opts.logger.error({ err }, 'phantom-endpoint janitor: sweep loop crashed');
+            });
+        }, intervalMs);
+        this.timer.unref();
+        this.opts.logger.info({ networks: this.opts.networks, intervalMs }, 'phantom-endpoint janitor: started (T#75)');
+    }
+    stop() {
+        if (!this.timer)
+            return;
+        clearInterval(this.timer);
+        this.timer = null;
+    }
+    /** Run a single sweep across every managed network. Public for tests + ops triggers. */
+    async sweepAll() {
+        if (this.sweeping)
+            return 0;
+        this.sweeping = true;
+        let totalCleaned = 0;
+        try {
+            for (const net of this.opts.networks) {
+                try {
+                    const cleaned = await this.sweepNetwork(net);
+                    totalCleaned += cleaned;
+                    this.opts.onCleanup?.(net, cleaned);
+                }
+                catch (err) {
+                    this.opts.logger.warn({ err, network: net }, 'phantom-endpoint janitor: per-network sweep failed (continuing)');
+                }
+            }
+        }
+        finally {
+            this.sweeping = false;
+        }
+        return totalCleaned;
+    }
+    async sweepNetwork(network) {
+        const inspect = await this.runDocker(['network', 'inspect', network]);
+        if (!inspect.ok) {
+            // Network doesn't exist or docker daemon unreachable. Either
+            // way, nothing to clean.
+            return 0;
+        }
+        let networks = [];
+        try {
+            networks = JSON.parse(inspect.stdout);
+        }
+        catch {
+            return 0;
+        }
+        const endpoints = networks[0]?.Containers ?? {};
+        let cleaned = 0;
+        for (const [containerId, info] of Object.entries(endpoints)) {
+            // Check whether the container still exists. `docker inspect`
+            // returns exit code 1 with "No such object" when it doesn't.
+            const exists = await this.runDocker(['inspect', '--type=container', '--format', '{{.Id}}', containerId]);
+            if (exists.ok)
+                continue;
+            // Phantom — force-disconnect.
+            const disconnect = await this.runDocker(['network', 'disconnect', network, containerId, '--force']);
+            if (disconnect.ok) {
+                cleaned++;
+                this.opts.logger.info({ network, containerId, name: info?.Name }, 'phantom-endpoint janitor: disconnected phantom endpoint (T#75)');
+            }
+            else {
+                this.opts.logger.warn({ network, containerId, stderr: disconnect.stderr }, 'phantom-endpoint janitor: failed to disconnect phantom — will retry next sweep');
+            }
+        }
+        return cleaned;
+    }
+    /**
+     * Run `docker <args>` and return stdout/stderr/exit-code. Never throws —
+     * a missing docker binary or a hung daemon shouldn't crash the daemon.
+     *
+     * Visible for testing via subclassing — overrides go through this
+     * single seam so tests can drive deterministic responses without
+     * needing a real Docker daemon. Production callers should not
+     * subclass.
+     */
+    runDocker(args) {
+        return new Promise((resolve) => {
+            const child = spawn('docker', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+            let stdout = '';
+            let stderr = '';
+            const timeout = setTimeout(() => {
+                try {
+                    child.kill('SIGKILL');
+                }
+                catch { /* */ }
+                resolve({ ok: false, stdout, stderr: stderr + '\n[janitor: timeout]' });
+            }, 10_000);
+            child.stdout?.on('data', (c) => { stdout += c.toString(); });
+            child.stderr?.on('data', (c) => { stderr += c.toString(); });
+            child.on('error', () => {
+                clearTimeout(timeout);
+                resolve({ ok: false, stdout, stderr: stderr + '\n[janitor: spawn error]' });
+            });
+            child.on('close', (code) => {
+                clearTimeout(timeout);
+                resolve({ ok: code === 0, stdout, stderr });
+            });
+        });
+    }
+}
+//# sourceMappingURL=phantom-endpoint-janitor.js.map

package/dist/infrastructure/phantom-endpoint-janitor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phantom-endpoint-janitor.js","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkB3C,MAAM,OAAO,sBAAsB;IAIJ;IAHrB,KAAK,GAA0B,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;IAAG,CAAC;IAEpE,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;oBAC7C,YAAY,IAAI,OAAO,CAAC;oBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EACrB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,6DAA6D;YAC7D,yBAAyB;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,QAAQ,GAA8D,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAoB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACzG,IAAI,MAAM,CAAC,EAAE;gBAAE,SAAS;YACxB,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;YACpG,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC1C,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EACnD,gFAAgF,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACO,SAAS,CAAC,IAAc;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAAC,CAAC;YAC1E,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/infrastructure/presets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAM/C;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAStD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAO/C;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,cAAc,CAUtD"}

package/dist/infrastructure/presets/index.js

@@ -10,6 +10,7 @@ import { postgresPreset } from './postgres.js';
 import { redisPreset } from './redis.js';
 import { minioPreset } from './minio.js';
 import { gatewayOpenrestyPreset } from './gateway-openresty.js';
+import { torPreset } from './tor.js';
 /**
  * Create a PresetRegistry populated with all built-in presets.
  */
@@ -19,6 +20,7 @@ export function createDefaultRegistry() {
     registry.register(redisPreset);
     registry.register(minioPreset);
     registry.register(gatewayOpenrestyPreset);
+    registry.register(torPreset);
     return registry;
 }
 //# sourceMappingURL=index.js.map

package/dist/infrastructure/presets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAEhE;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAE1C,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC;;GAEG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IAEtC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC1C,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAE7B,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/infrastructure/presets/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cA2E5B,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cAiF5B,CAAC"}

package/dist/infrastructure/presets/postgres.js

@@ -11,11 +11,17 @@ export const postgresPreset = {
     defaultPorts: { main: 5432 },
     defaultSecrets: { user: 'postgres', password: 'postgres' },
     defaultHealthCheck: {
+        // pg_isready returns 0 the moment the postmaster accepts connections
+        // — but the moment isn't quite app-ready: WAL replay or extension
+        // creation can still be running. Use a real `SELECT 1` against
+        // postgres user (always exists) so we don't mark healthy until the
+        // executor is functional. Higher retry count covers slow boots
+        // (volume create + WAL replay can take 15s+).
         type: 'command',
-        target: 'pg_isready -U postgres',
-        interval: '5s',
+        target: 'sh -c "psql -U postgres -d postgres -h /var/run/postgresql -tAc \\"SELECT 1\\" | grep -q 1"',
+        interval: '3s',
         timeout: '5s',
-        retries: 5,
+        retries: 30,
     },
     defaultDocker: {
         command: [

package/dist/infrastructure/presets/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,mEAAmE;YACnE,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAAwC,CAAC;QACrF,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,6FAA6F;QACrG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,aAAa,EAAE;QACb,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,mEAAmE;YACnE,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAAwC,CAAC;QACrF,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cA2BzB,CAAC"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cAiCzB,CAAC"}

package/dist/infrastructure/presets/redis.js

@@ -11,11 +11,17 @@ export const redisPreset = {
     defaultPorts: { main: 6379 },
     defaultSecrets: {},
     defaultHealthCheck: {
+        // The naive `redis-cli ping` exits 0 even when redis is still
+        // loading its RDB and replies "LOADING Redis is loading the dataset
+        // in memory" — Docker's HEALTHCHECK then marks the container healthy
+        // and apps that try to connect get told their commands aren't
+        // accepted yet. The grep below requires the literal "PONG" reply,
+        // which redis only sends once it has fully loaded.
         type: 'command',
-        target: 'redis-cli ping',
-        interval: '5s',
-        timeout: '5s',
-        retries: 5,
+        target: 'sh -c "redis-cli ping | grep -q PONG"',
+        interval: '3s',
+        timeout: '3s',
+        retries: 30,
     },
     defaultDocker: {
         command: ['redis-server', '--appendonly', 'yes', '--maxmemory-policy', 'allkeys-lru'],

package/dist/infrastructure/presets/redis.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,8DAA8D;QAC9D,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAE7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAItC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB;CAkE/E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAE7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAItC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB;CA6E/E"}

package/dist/infrastructure/presets/registry.js

@@ -50,6 +50,18 @@ export class PresetRegistry {
             dockerEnv['MINIO_ROOT_USER'] = mergedSecrets['accessKey'] ?? 'minioadmin';
             dockerEnv['MINIO_ROOT_PASSWORD'] = mergedSecrets['secretKey'] ?? 'minioadmin';
         }
+        else if (preset.name === 'tor') {
+            // Tor preset reads its hidden-service map from a single JSON env var —
+            // simpler than parametrising arbitrary numbers of HiddenServiceDir/Port
+            // pairs through individual variables. The torrc generator (see
+            // tor.ts ENTRYPOINT_SHELL) iterates over this list with `jq`.
+            const torCfg = (config.config ?? {});
+            const hsArr = Array.isArray(torCfg.hiddenServices) ? torCfg.hiddenServices : [];
+            dockerEnv['OMNITRON_TOR_HIDDEN_SERVICES_JSON'] = JSON.stringify(hsArr);
+            if (Array.isArray(torCfg.extraTorrc) && torCfg.extraTorrc.length > 0) {
+                dockerEnv['OMNITRON_TOR_EXTRA_TORRC'] = torCfg.extraTorrc.join('\n');
+            }
+        }
         if (config.docker?.environment) {
             Object.assign(dockerEnv, config.docker.environment);
         }

package/dist/infrastructure/presets/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAEhE,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,sBAAsB;QACtB,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,MAAM,CAAC,MAAM;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,iBAAiB,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAEhE,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA0D,CAAC;YAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,SAAS,CAAC,mCAAmC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,SAAS,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,sBAAsB;QACtB,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,MAAM,CAAC,MAAM;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,iBAAiB,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/infrastructure/presets/tor.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Tor Hidden Service Preset
+ *
+ * Runs a Tor daemon configured for **hidden-service-only** operation —
+ * SocksPort/ORPort/ExitPolicy are all locked down so the container cannot
+ * be abused as a relay or open SOCKS proxy. Hidden services map onion
+ * addresses to backend services declared in `config.hiddenServices`.
+ *
+ * Design choices for industrial-grade anonymity:
+ *
+ *   - HiddenServiceVersion 3 (256-bit Ed25519, default in modern tor).
+ *   - SocksPort 0          → no client SOCKS proxy is opened.
+ *   - ClientOnly 0          → we are not relaying client circuits.
+ *   - ORPort 0 / DirPort 0  → not a relay, not a directory server.
+ *   - ExitPolicy reject *:* → never serve as exit node.
+ *   - DisableDebuggerAttachment 1 — prevents ptrace + similar leaks.
+ *   - HardwareAccel 1       — uses CPU AES-NI when available.
+ *   - SafeLogging 1         — log scrubbing of identifying info.
+ *   - HiddenServiceEnableIntroDoSDefense 1 — circuit-level rate limiting
+ *     against introduction-point flooding (tor 0.4.7+).
+ *   - HiddenServicePoWDefensesEnabled 1     — proof-of-work mitigation
+ *     for the introduction layer (tor 0.4.8+).
+ *
+ * Networking:
+ *
+ *   The container needs to reach backend services that may be running on
+ *   the host (e.g. omnitron's webapp via omnitron-nginx, or any user-bound
+ *   dev/prod service). We add `host.docker.internal` → `host-gateway` so
+ *   HiddenServicePort targets like `host.docker.internal:9800` work
+ *   identically on macOS, Linux, and Windows.
+ *
+ * State:
+ *
+ *   `/var/lib/tor` is a persistent volume — that's where hidden service
+ *   keys live (`<name>/hs_ed25519_secret_key`, `<name>/hostname`). Losing
+ *   that volume rotates the .onion address. CLI command `omnitron tor`
+ *   reads the hostname files via `docker exec`.
+ *
+ * Configuration in omnitron.config.ts:
+ *
+ *     services: {
+ *       tor: {
+ *         preset: 'tor',
+ *         config: {
+ *           hiddenServices: [
+ *             { name: 'webapp', virtualPort: 80, target: 'host.docker.internal:9800' },
+ *             { name: 'portal', virtualPort: 80, target: 'host.docker.internal:7080' },
+ *           ],
+ *         },
+ *       },
+ *     },
+ */
+import type { IServicePreset } from './types.js';
+/** User-provided per-hidden-service config. */
+export interface ITorHiddenServiceConfig {
+    /** Logical name — also the directory name under /var/lib/tor/. */
+    name: string;
+    /** Port advertised on the .onion address (clients connect here). */
+    virtualPort: number;
+    /** Backend address `host:port` that tor forwards plaintext traffic to. */
+    target: string;
+}
+/** User-provided tor preset config. */
+export interface ITorPresetConfig {
+    /** Hidden services to expose. Each gets its own .onion address. */
+    hiddenServices: ITorHiddenServiceConfig[];
+    /**
+     * Extra raw torrc lines appended verbatim. Use sparingly — most
+     * hardening is already applied by the preset.
+     */
+    extraTorrc?: string[];
+}
+export declare const torPreset: IServicePreset;
+//# sourceMappingURL=tor.d.ts.map

package/dist/infrastructure/presets/tor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,cAAc,EAAE,uBAAuB,EAAE,CAAC;IAC1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAwFD,eAAO,MAAM,SAAS,EAAE,cAyCvB,CAAC"}

package/dist/infrastructure/presets/tor.js

@@ -0,0 +1,176 @@
+/**
+ * Tor Hidden Service Preset
+ *
+ * Runs a Tor daemon configured for **hidden-service-only** operation —
+ * SocksPort/ORPort/ExitPolicy are all locked down so the container cannot
+ * be abused as a relay or open SOCKS proxy. Hidden services map onion
+ * addresses to backend services declared in `config.hiddenServices`.
+ *
+ * Design choices for industrial-grade anonymity:
+ *
+ *   - HiddenServiceVersion 3 (256-bit Ed25519, default in modern tor).
+ *   - SocksPort 0          → no client SOCKS proxy is opened.
+ *   - ClientOnly 0          → we are not relaying client circuits.
+ *   - ORPort 0 / DirPort 0  → not a relay, not a directory server.
+ *   - ExitPolicy reject *:* → never serve as exit node.
+ *   - DisableDebuggerAttachment 1 — prevents ptrace + similar leaks.
+ *   - HardwareAccel 1       — uses CPU AES-NI when available.
+ *   - SafeLogging 1         — log scrubbing of identifying info.
+ *   - HiddenServiceEnableIntroDoSDefense 1 — circuit-level rate limiting
+ *     against introduction-point flooding (tor 0.4.7+).
+ *   - HiddenServicePoWDefensesEnabled 1     — proof-of-work mitigation
+ *     for the introduction layer (tor 0.4.8+).
+ *
+ * Networking:
+ *
+ *   The container needs to reach backend services that may be running on
+ *   the host (e.g. omnitron's webapp via omnitron-nginx, or any user-bound
+ *   dev/prod service). We add `host.docker.internal` → `host-gateway` so
+ *   HiddenServicePort targets like `host.docker.internal:9800` work
+ *   identically on macOS, Linux, and Windows.
+ *
+ * State:
+ *
+ *   `/var/lib/tor` is a persistent volume — that's where hidden service
+ *   keys live (`<name>/hs_ed25519_secret_key`, `<name>/hostname`). Losing
+ *   that volume rotates the .onion address. CLI command `omnitron tor`
+ *   reads the hostname files via `docker exec`.
+ *
+ * Configuration in omnitron.config.ts:
+ *
+ *     services: {
+ *       tor: {
+ *         preset: 'tor',
+ *         config: {
+ *           hiddenServices: [
+ *             { name: 'webapp', virtualPort: 80, target: 'host.docker.internal:9800' },
+ *             { name: 'portal', virtualPort: 80, target: 'host.docker.internal:7080' },
+ *           ],
+ *         },
+ *       },
+ *     },
+ */
+/**
+ * Inline shell that installs tor (~5s on first run, cached afterward),
+ * generates a hardened torrc from `OMNITRON_TOR_HIDDEN_SERVICES_JSON`,
+ * and execs the daemon as the `tor` user.
+ *
+ * Why inline rather than a custom Dockerfile: keeps the preset hermetic.
+ * No image build step, no separate registry, no image-tag drift.
+ */
+const ENTRYPOINT_SHELL = `set -eu
+
+# Install tor + jq. The Alpine tor package automatically creates a
+# 'tor' system user (uid 100, gid 101). Idempotent across restarts.
+apk add --no-cache tor jq >/dev/null 2>&1 || apk add tor jq >/dev/null 2>&1
+
+# Build torrc from the env-passed JSON config.
+TORRC=/etc/tor/torrc
+mkdir -p /etc/tor /var/lib/tor
+cat > "$TORRC" <<'TORRC_EOF'
+# ============================================================
+# Hidden-service-only Tor configuration (omnitron preset)
+# ============================================================
+# Process identity — tor drops privileges to this user after binding.
+User tor
+
+# Lockdown: no client/relay/exit functionality, only HSes.
+SocksPort 0
+ClientOnly 0
+ORPort 0
+DirPort 0
+ExitRelay 0
+ExitPolicy reject *:*
+ExitPolicy reject6 *:*
+BridgeRelay 0
+
+# Operational hardening
+DataDirectory /var/lib/tor
+RunAsDaemon 0
+HardwareAccel 1
+DisableDebuggerAttachment 1
+SafeLogging 1
+LogTimeGranularity 1000
+Log notice stdout
+
+# IPv4 only by default — IPv6 onion service traffic still works
+ClientUseIPv6 0
+ClientPreferIPv6ORPort 0
+
+# Avoid filesystem races on shared volumes
+AvoidDiskWrites 1
+TORRC_EOF
+
+# Append per-hidden-service stanzas. Each gets:
+#   - HiddenServiceVersion 3 (Ed25519, 56-char .onion)
+#   - HiddenServiceEnableIntroDoSDefense (DoS mitigation at intro layer)
+#   - HiddenServicePoWDefensesEnabled    (PoW puzzles for clients)
+echo "$OMNITRON_TOR_HIDDEN_SERVICES_JSON" | jq -c '.[]' | while IFS= read -r svc; do
+  name=$(printf '%s' "$svc" | jq -r .name)
+  vport=$(printf '%s' "$svc" | jq -r .virtualPort)
+  target=$(printf '%s' "$svc" | jq -r .target)
+  {
+    echo
+    echo "# --- Hidden service: $name ---"
+    echo "HiddenServiceDir /var/lib/tor/$name"
+    echo "HiddenServiceVersion 3"
+    echo "HiddenServiceEnableIntroDoSDefense 1"
+    echo "HiddenServicePoWDefensesEnabled 1"
+    echo "HiddenServicePort $vport $target"
+  } >> "$TORRC"
+done
+
+# Append any user-provided raw torrc lines.
+if [ -n "\${OMNITRON_TOR_EXTRA_TORRC:-}" ]; then
+  printf '\\n# --- User-provided torrc additions ---\\n%s\\n' "$OMNITRON_TOR_EXTRA_TORRC" >> "$TORRC"
+fi
+
+# Hidden service directories must be owned by the tor user with mode 0700,
+# otherwise tor refuses to start. Re-apply on every boot in case the volume
+# was created externally with different permissions.
+chown -R tor:tor /var/lib/tor 2>/dev/null || true
+chmod 700 /var/lib/tor
+
+# Run tor as root and let it drop privileges via the 'User tor' directive.
+# This avoids needing su-exec/gosu, which aren't in alpine by default.
+exec tor -f "$TORRC"
+`;
+export const torPreset = {
+    name: 'tor',
+    type: 'gateway',
+    defaultImage: 'alpine:3.20',
+    // No host-side ports: hidden services are reachable only via the Tor
+    // network. Exposing 9050 etc. would defeat the entire point.
+    defaultPorts: {},
+    defaultSecrets: {},
+    defaultHealthCheck: {
+        // Tor takes 30-90s to bootstrap an HS on first start. We watch for the
+        // hostname file to be written — that's the unambiguous signal that the
+        // hidden service has been published.
+        type: 'command',
+        target: 'pgrep tor >/dev/null && [ "$(ls /var/lib/tor 2>/dev/null | wc -l)" -gt 0 ] || exit 1',
+        interval: '15s',
+        timeout: '5s',
+        retries: 20,
+        startPeriod: '120s',
+    },
+    defaultDocker: {
+        command: ['sh', '-c', ENTRYPOINT_SHELL],
+        volumes: {
+            data: { source: '', target: '/var/lib/tor' },
+        },
+        // host-gateway lets the container reach host-bound services (vite dev
+        // server, omnitron-nginx published port) on every platform.
+        extraHosts: ['host.docker.internal:host-gateway'],
+        environment: {
+            // Default torrc has tor user; keep umask tight on key files.
+            UMASK: '077',
+        },
+    },
+    generateEnvTemplates() {
+        // No app-facing env: backends remain agnostic to whether they're being
+        // accessed via Tor or directly. Use `omnitron tor` to inspect onions.
+        return {};
+    },
+};
+//# sourceMappingURL=tor.js.map

package/dist/infrastructure/presets/tor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tor.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4ExB,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,qEAAqE;IACrE,6DAA6D;IAC7D,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,EAAE,SAAS;QACf,MAAM,EACJ,sFAAsF;QACxF,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,MAAM;KACpB;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;SAC7C;QACD,sEAAsE;QACtE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,WAAW,EAAE;YACX,6DAA6D;YAC7D,KAAK,EAAE,KAAK;SACb;KACF;IAED,oBAAoB;QAClB,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/infrastructure/service-resolver.d.ts

@@ -12,6 +12,37 @@ import type { InfrastructureConfig, GatewayServiceConfig, ResolvedContainer, ISe
 export declare function setContainerPrefix(project: string, env: string): void;
 /** Get current prefix */
 export declare function getContainerPrefix(): string;
+/**
+ * Convention-derived managed network name.
+ *
+ * Every container provisioned by omnitron lives on a named bridge network
+ * (instead of docker's default `bridge`). This is the central piece that
+ * eliminates a whole class of failures we observed in production:
+ *
+ *   - Docker's default `bridge` accumulates **phantom endpoint records**
+ *     after dockerd restarts (host sleep/wake on macOS, dockerd crash).
+ *     Recreating any container by name then fails with
+ *     `endpoint with name X already exists in network bridge` — and
+ *     `docker network disconnect -f bridge X` reports "not found" because
+ *     the endpoint is dangling in dockerd's internal state, not actually
+ *     attached. A named network has no such global pollution; if it gets
+ *     corrupted we can blow it away and rebuild it without touching every
+ *     other container on the host.
+ *   - Inter-service DNS-by-name only works on named networks, so apps that
+ *     need to reach `postgres:5432` from another container can do so
+ *     without leaking host ports.
+ *
+ * Convention `${project}_default` matches what docker-compose creates by
+ * default for `${project}` → seamless coexistence with compose-managed
+ * adjacent infrastructure.
+ */
+export declare function getManagedNetwork(): string;
+/**
+ * Stamp the managed network onto a container spec when it doesn't already
+ * declare one. Centralised so every resolver — preset and built-in alike —
+ * gets the same defaults without each having to remember.
+ */
+export declare function applyManagedDefaults(spec: ResolvedContainer): ResolvedContainer;
 /** Set stack labels for subsequent container creation calls */
 export declare function setStackLabels(project: string, stack: string): void;
 /** Clear stack labels (for internal/global containers) */

package/dist/infrastructure/service-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAaD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,GAAG,IAAI,CAmE1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,EAAE,CA0BrB;AAgFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAgEnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,iBAAiB,CAiCpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,iBAAiB,EAAE,CAKrB"}
+{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAG/E;AASD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,GAAG,IAAI,CAyE1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,EAAE,CA0BrB;AAiFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAgEnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,iBAAiB,CAwCpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,iBAAiB,EAAE,CAKrB"}