@omnitron-dev/omnitron 0.1.3 → 0.3.0

package/dist/infrastructure/service-binding.js

@@ -0,0 +1,90 @@
+/**
+ * How a stack runs a service an application declares: where, on which
+ * network, on which ports, with which credentials.
+ *
+ * Three readers answered this each for itself — the node's container
+ * resolver, its bare-metal planner, and the master's resolver of the
+ * applications' environment — and their answers had drifted apart on the
+ * one service where being wrong costs money. Measured against the test
+ * stack, which runs Bitcoin on mainnet (2026-09-23):
+ *
+ *   - nothing chose between a declaration's `docker` and `bareMetal` blocks:
+ *     a node given the service would make the container AND plan the unit;
+ *   - the bare-metal templates took their credentials from the
+ *     application's declaration — `omni_regtest` / `omni_regtest_dev_password`,
+ *     in git — whatever network the stack ran;
+ *   - the applications' environment for a service provisioned on the node
+ *     read the same declaration: the regtest port and the regtest password,
+ *     beside `BITCOIN_NETWORK=mainnet`.
+ *
+ * One answer now, and one rule for credentials: an application's own
+ * `secrets` belong to the network it declares — a laptop's. A stack that
+ * runs another network gives its own (`serviceOverrides.<name>.secrets`,
+ * vault references), and a credential it does not give is missing, not
+ * borrowed from the laptop.
+ */
+export function bindService(requirement, override) {
+    const networkMode = override?.networkMode ?? requirement.networkMode;
+    const declaredNetwork = networkMode === requirement.networkMode;
+    // The declaration's credentials serve the network it declares, and no other.
+    const own = declaredNetwork ? (requirement.secrets ?? {}) : {};
+    if (override?.disabled) {
+        return { provisioning: 'disabled', networkMode, declaredNetwork, ports: {}, secrets: {} };
+    }
+    if (override?.external) {
+        return {
+            provisioning: 'external',
+            networkMode,
+            declaredNetwork,
+            host: override.external.host,
+            ports: { ...override.external.ports },
+            secrets: { ...own, ...(override.external.secrets ?? {}) },
+        };
+    }
+    const provisioning = override?.provisioning ?? (requirement.docker ? 'docker' : requirement.bareMetal ? 'bareMetal' : 'none');
+    return {
+        provisioning,
+        networkMode,
+        declaredNetwork,
+        // The declaration's, the network's, the stack's.
+        ports: {
+            ...(requirement.ports ?? {}),
+            ...networkPorts(requirement, provisioning, networkMode),
+            ...(override?.ports ?? {}),
+        },
+        secrets: { ...own, ...(override?.secrets ?? {}) },
+    };
+}
+/**
+ * The ports a network's variant of the provisioning block names —
+ * `docker.variants.mainnet.ports`, `bareMetal.variants.mainnet.ports`.
+ *
+ * paysys declares Bitcoin's per network (testnet 18332/18333, mainnet
+ * 8332/8333) and monerod's for mainnet (18081/18080) in its docker variants,
+ * and nothing read them (2026-09-23): a stack running Bitcoin on mainnet in
+ * a container would have published, addressed and health-checked regtest's
+ * 18443 while the daemon listened on 8332, and a stack running it on the
+ * node had to repeat 8332 in its own override.
+ */
+function networkPorts(requirement, provisioning, networkMode) {
+    const block = provisioning === 'docker' ? requirement.docker : provisioning === 'bareMetal' ? requirement.bareMetal : undefined;
+    if (!networkMode || !block || typeof block !== 'object')
+        return {};
+    const variants = block.variants;
+    return { ...(variants?.[networkMode]?.ports ?? {}) };
+}
+/**
+ * The credentials that are values. A reference still standing — the master
+ * did not resolve it, or the vault did not hold it — is left out, so a
+ * template needing it reports it unfilled rather than writing
+ * `[object Object]` into a config file.
+ */
+export function secretValues(binding) {
+    const values = {};
+    for (const [key, value] of Object.entries(binding.secrets)) {
+        if (typeof value === 'string')
+            values[key] = value;
+    }
+    return values;
+}
+//# sourceMappingURL=service-binding.js.map

package/dist/infrastructure/service-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-binding.js","sourceRoot":"","sources":["../../src/infrastructure/service-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA+BH,MAAM,UAAU,WAAW,CAAC,WAAwB,EAAE,QAAuC;IAC3F,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,WAAW,CAAC,WAAW,CAAC;IACrE,MAAM,eAAe,GAAG,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC;IAChE,6EAA6E;IAC7E,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,YAAY,EAAE,UAAU;YACxB,WAAW;YACX,eAAe;YACf,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,QAAQ,EAAE,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE3G,OAAO;QACL,YAAY;QACZ,WAAW;QACX,eAAe;QACf,iDAAiD;QACjD,KAAK,EAAE;YACL,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC;YACvD,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;SAC3B;QACD,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CACnB,WAAwB,EACxB,YAA0B,EAC1B,WAA+B;IAE/B,MAAM,KAAK,GACT,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAI,KAAuF,CAAC,QAAQ,CAAC;IACnH,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwC;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/infrastructure/service-credentials.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Credentials for the services a stack provisions.
+ *
+ * Presets carry defaults — `minioadmin/minioadmin`, `postgres/postgres`,
+ * `omnitron/omnitron` — because a preset has to work before anyone
+ * configures anything, and on a laptop behind loopback that is the right
+ * trade. On a server it is not, and nothing turned it into anything else:
+ * a stack deployed to a public host ran its object store and its database
+ * on the credentials printed in this repository.
+ *
+ * Two things had to be true for generated credentials to be usable, and
+ * both are the whole design here:
+ *
+ *   1. STABLE. A Postgres data directory keeps the password it was
+ *      initialised with. Generating a new one on the next provision
+ *      produces a database that rejects its own application, and the
+ *      symptom is an authentication failure that looks like a bad config.
+ *      So a generated secret is written to the vault on first use and read
+ *      back forever after — the generation happens once, the resolution
+ *      happens every time.
+ *
+ *   2. LOCAL TO THE NODE. The vault is the daemon's, and the daemon that
+ *      creates the container is the node's. A master that generated these
+ *      would have to transmit them, which puts a password on the wire to
+ *      solve a problem that does not exist: the node is the only party that
+ *      needs it.
+ *
+ * What is NOT here: rotation. Changing a live database's password is a
+ * migration, not a config change, and pretending otherwise by regenerating
+ * on some schedule produces exactly the failure point 1 describes.
+ */
+/** Where a service's credential lives in the vault. */
+export declare function credentialKey(project: string, stack: string, service: string, secret: string): string;
+/**
+ * Secrets that are still whatever the preset shipped.
+ *
+ * Only these are generated. A value an operator wrote is theirs — including
+ * a weak one, because silently replacing a configured password with a
+ * random one produces a service nobody can log into and no message saying
+ * why.
+ */
+export declare function needsGenerating(declared: Record<string, string> | undefined, presetDefaults: Record<string, string>): string[];
+export declare function isCredential(name: string): boolean;
+/**
+ * A password with no encoding surprises in it.
+ *
+ * base64url rather than base64: these values travel through connection
+ * strings, YAML, docker `-e` arguments and shell here-documents, and `+`,
+ * `/` and `=` each mean something to at least one of those. 32 bytes is 256
+ * bits — the length is not the interesting part, the alphabet is.
+ */
+export declare function generateSecret(bytes?: number): string;
+export interface CredentialStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+}
+/**
+ * Fill in a service's credentials, generating what has never been set.
+ *
+ * Returns the secrets the container should be created with. Idempotent: the
+ * second call returns what the first one stored.
+ */
+export declare function resolveServiceCredentials(options: {
+    project: string;
+    stack: string;
+    service: string;
+    presetDefaults: Record<string, string>;
+    declared?: Record<string, string> | undefined;
+    vault: CredentialStore;
+}): Promise<Record<string, string>>;
+/**
+ * A copy of the config with generated credentials filled in.
+ *
+ * Applied to the RAW config, before expansion, because the preset registry
+ * builds each container's environment from these values at expand time — a
+ * secret substituted afterwards would be in the requirement and not in the
+ * container.
+ *
+ * Only the sugar blocks. A service declared the long way, with an explicit
+ * `secrets` map, was configured by someone who was looking at it.
+ */
+export interface CredentialOptions {
+    project: string;
+    stack: string;
+    vault: CredentialStore;
+    /**
+     * Whether this service already holds state initialised with some other
+     * password.
+     *
+     * A Postgres data directory keeps the password it was created with and
+     * ignores `POSTGRES_PASSWORD` thereafter. Generating one for a service
+     * that already has a volume produces an application holding a credential
+     * the database has never heard of — a failure that reads as a bad config
+     * and is fixed by neither side.
+     *
+     * So generation happens at FIRST provision, where the volume and the
+     * vault entry are created together and cannot disagree. A deployment that
+     * predates this keeps what it has, and is told.
+     */
+    hasExistingState?: ((service: string) => Promise<boolean>) | undefined;
+    /** Told when an existing deployment is left on a default credential. */
+    onLeftOnDefault?: ((service: string, field: string) => void) | undefined;
+}
+export declare function withGeneratedCredentials<T extends Record<string, any>>(config: T, options: CredentialOptions): Promise<T>;
+//# sourceMappingURL=service-credentials.d.ts.map

package/dist/infrastructure/service-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-credentials.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,uDAAuD;AACvD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,MAAM,EAAE,CAMV;AAYD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAK,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBlC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1E,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,CAAC,CAAC,CAiCZ"}

package/dist/infrastructure/service-credentials.js

@@ -0,0 +1,141 @@
+/**
+ * Credentials for the services a stack provisions.
+ *
+ * Presets carry defaults — `minioadmin/minioadmin`, `postgres/postgres`,
+ * `omnitron/omnitron` — because a preset has to work before anyone
+ * configures anything, and on a laptop behind loopback that is the right
+ * trade. On a server it is not, and nothing turned it into anything else:
+ * a stack deployed to a public host ran its object store and its database
+ * on the credentials printed in this repository.
+ *
+ * Two things had to be true for generated credentials to be usable, and
+ * both are the whole design here:
+ *
+ *   1. STABLE. A Postgres data directory keeps the password it was
+ *      initialised with. Generating a new one on the next provision
+ *      produces a database that rejects its own application, and the
+ *      symptom is an authentication failure that looks like a bad config.
+ *      So a generated secret is written to the vault on first use and read
+ *      back forever after — the generation happens once, the resolution
+ *      happens every time.
+ *
+ *   2. LOCAL TO THE NODE. The vault is the daemon's, and the daemon that
+ *      creates the container is the node's. A master that generated these
+ *      would have to transmit them, which puts a password on the wire to
+ *      solve a problem that does not exist: the node is the only party that
+ *      needs it.
+ *
+ * What is NOT here: rotation. Changing a live database's password is a
+ * migration, not a config change, and pretending otherwise by regenerating
+ * on some schedule produces exactly the failure point 1 describes.
+ */
+import { randomBytes } from 'node:crypto';
+/** Where a service's credential lives in the vault. */
+export function credentialKey(project, stack, service, secret) {
+    return `infra:${project}:${stack}:${service}:${secret}`;
+}
+/**
+ * Secrets that are still whatever the preset shipped.
+ *
+ * Only these are generated. A value an operator wrote is theirs — including
+ * a weak one, because silently replacing a configured password with a
+ * random one produces a service nobody can log into and no message saying
+ * why.
+ */
+export function needsGenerating(declared, presetDefaults) {
+    return Object.keys(presetDefaults).filter((key) => {
+        const value = declared?.[key];
+        // Unset, or exactly the default the preset ships.
+        return value === undefined || value === presetDefaults[key];
+    });
+}
+/**
+ * Secrets whose names are identity rather than credential.
+ *
+ * A username is not a secret: it appears in connection strings, in logs, in
+ * `psql -U`, and generating one produces a service an operator cannot reach
+ * by hand when something is wrong. Only the values that authenticate are
+ * generated.
+ */
+const IDENTITY_SECRETS = new Set(['user', 'username', 'accessKey']);
+export function isCredential(name) {
+    return !IDENTITY_SECRETS.has(name);
+}
+/**
+ * A password with no encoding surprises in it.
+ *
+ * base64url rather than base64: these values travel through connection
+ * strings, YAML, docker `-e` arguments and shell here-documents, and `+`,
+ * `/` and `=` each mean something to at least one of those. 32 bytes is 256
+ * bits — the length is not the interesting part, the alphabet is.
+ */
+export function generateSecret(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+/**
+ * Fill in a service's credentials, generating what has never been set.
+ *
+ * Returns the secrets the container should be created with. Idempotent: the
+ * second call returns what the first one stored.
+ */
+export async function resolveServiceCredentials(options) {
+    const { project, stack, service, presetDefaults, declared, vault } = options;
+    const resolved = { ...presetDefaults, ...(declared ?? {}) };
+    for (const name of needsGenerating(declared, presetDefaults)) {
+        if (!isCredential(name))
+            continue;
+        const key = credentialKey(project, stack, service, name);
+        const existing = await vault.get(key);
+        if (existing) {
+            resolved[name] = existing;
+            continue;
+        }
+        const generated = generateSecret();
+        await vault.set(key, generated);
+        resolved[name] = generated;
+    }
+    return resolved;
+}
+// =============================================================================
+// Applying this to a stack's infrastructure config
+// =============================================================================
+/** The three sugar blocks that carry credentials, and which field is which. */
+const SUGAR_CREDENTIALS = [
+    { service: 'postgres', field: 'password', defaultValue: 'postgres' },
+    { service: 'minio', field: 'secretKey', defaultValue: 'minioadmin' },
+    // Redis has no default password at all: the preset ships none, and a
+    // redis with no `requirepass` accepts anyone who reaches it. On loopback
+    // that is the documented posture; generating one here would be a second
+    // opinion about a service the preset deliberately leaves open.
+];
+export async function withGeneratedCredentials(config, options) {
+    const next = { ...config };
+    for (const { service, field, defaultValue } of SUGAR_CREDENTIALS) {
+        const block = next[service];
+        if (!block || typeof block !== 'object')
+            continue;
+        const declared = block[field];
+        // A reference into the vault is resolved by the vault, not by us.
+        if (declared !== undefined && typeof declared !== 'string')
+            continue;
+        if (declared !== undefined && declared !== defaultValue)
+            continue;
+        const key = credentialKey(options.project, options.stack, service, field);
+        const existing = await options.vault.get(key);
+        if (existing) {
+            next[service] = { ...block, [field]: existing };
+            continue;
+        }
+        // Nothing in the vault: either this is the first provision, or the
+        // service predates generated credentials. The volume answers which.
+        if (options.hasExistingState && (await options.hasExistingState(service))) {
+            options.onLeftOnDefault?.(service, field);
+            continue;
+        }
+        const secret = generateSecret();
+        await options.vault.set(key, secret);
+        next[service] = { ...block, [field]: secret };
+    }
+    return next;
+}
+//# sourceMappingURL=service-credentials.js.map

package/dist/infrastructure/service-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-credentials.js","sourceRoot":"","sources":["../../src/infrastructure/service-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,OAAe,EACf,MAAc;IAEd,OAAO,SAAS,OAAO,IAAI,KAAK,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA4C,EAC5C,cAAsC;IAEtC,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9B,kDAAkD;QAClD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAK,GAAG,EAAE;IACvC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAO/C;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,QAAQ,GAA2B,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAEpF,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,SAAS;QAElC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG;IACxB,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE;IACpE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,+DAA+D;CACvD,CAAC;AAoCX,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAS,EACT,OAA0B;IAE1B,MAAM,IAAI,GAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAEhD,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,kEAAkE;QAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,YAAY;YAAE,SAAS;QAElE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,IAAS,CAAC;AACnB,CAAC"}

package/dist/infrastructure/service-resolver.d.ts

@@ -12,25 +12,124 @@ import type { InfrastructureConfig, GatewayServiceConfig, ResolvedContainer, ISe
 export declare function setContainerPrefix(project: string, env: string): void;
 /** Get current prefix */
 export declare function getContainerPrefix(): string;
+/**
+ * A named volume two services of one stack mount by the same name:
+ * `source: 'shared:gateway-socket'` is `<prefix>-gateway-socket` wherever it
+ * is declared.
+ *
+ * Every other named volume is its service's — `<prefix>-<service>-<key>`,
+ * whatever its `source` says — so nothing a stack could write gave two
+ * containers one volume. The onion needed exactly that: Tor resolved
+ * `daos-test-gateway` once, at start, and on 2026-09-26 a deploy gave the
+ * gateway's old address to Nominatim; for ~10 minutes the onion served
+ * Nominatim's Apache and nobody could sign in. A unix socket on a volume
+ * both containers mount has no address to go stale.
+ */
+export declare const SHARED_VOLUME_PREFIX = "shared:";
+/**
+ * Where to PUBLISH the gateway, which is not where it listens.
+ *
+ * After preset expansion `ports` holds CONTAINER ports — openresty's
+ * `defaultPorts.http` is 80, because that is what the image listens on — and
+ * a port named in the config becomes a HOST mapping under
+ * `docker.portMappings`. Reading `ports.http` takes the first for the second,
+ * so a stack asking for 8080 gets a gateway published on 80.
+ *
+ * Measured on the dev stand: `omnitron.config.ts` declares
+ * `gateway.ports.http = 8080` and its own comment says ":8080" three times,
+ * while `daos-dev-gateway` published `80/tcp -> 0.0.0.0:80`. The consequence
+ * is quiet rather than loud — a browser arriving on :80 sends
+ * `Origin: http://localhost` with no port, which is not in the gateway's
+ * allow-list, so the portal cannot call the API through it at all. The portal
+ * is reachable on 7080, so nothing complained.
+ *
+ * `resolveServiceRequirement` has read it correctly all along:
+ * `host: docker.portMappings?.[name] ?? containerPort`. Same expression here,
+ * because it is the same question — and a port the preset does not declare
+ * really is a container port, which is why the fallback is not a mistake.
+ */
+export declare function gatewayHostPort(service: {
+    ports?: Record<string, number> | undefined;
+    docker?: {
+        portMappings?: Record<string, number> | undefined;
+    } | undefined;
+} | undefined, legacy: {
+    port?: number | undefined;
+} | undefined): number;
+/**
+ * How one managed container reaches another.
+ *
+ * Every container omnitron provisions joins the stack's named network, and
+ * the network exists so they can address each other by name — the comment on
+ * `networkName` below says exactly that. The gateway did not: it was given
+ * `host.docker.internal` and the HOST-published port, and went out to the
+ * host and back.
+ *
+ * That works on a developer's Mac, where `host.docker.internal` reaches the
+ * host's loopback. It cannot work on a Linux node, where `host-gateway`
+ * resolves to the docker0 bridge address and omnitron publishes every managed
+ * port on `127.0.0.1` — deliberately, so a container is not reachable from
+ * the LAN. Measured on the test node: the gateway sat on 172.19.0.2, redis on
+ * 172.19.0.4 of the same network, and every request the gateway served spent
+ * 200ms on `lua tcp socket connect timed out, upstream: 172.17.0.1:6379`
+ * before failing open. The hardening that bound the ports closed this path,
+ * and the only evidence was a warning nobody was reading.
+ *
+ * The port is the CONTAINER port for the same reason the host is a container
+ * name: a stack whose redis is published on 6380 still listens on 6379
+ * inside. Host and port are one decision and are answered here together,
+ * because answering half of it is how a correct name ends up on the wrong
+ * port.
+ */
+export declare function containerEndpoint(service: string, containerPort: number): {
+    host: string;
+    port: number;
+};
+/** Redis, as a container on the stack network sees it. */
+export declare const REDIS_CONTAINER_PORT = 6379;
+/**
+ * Convention-derived managed network name.
+ *
+ * Every container provisioned by omnitron lives on a named bridge network
+ * (instead of docker's default `bridge`). This is the central piece that
+ * eliminates a whole class of failures we observed in production:
+ *
+ *   - Docker's default `bridge` accumulates **phantom endpoint records**
+ *     after dockerd restarts (host sleep/wake on macOS, dockerd crash).
+ *     Recreating any container by name then fails with
+ *     `endpoint with name X already exists in network bridge` — and
+ *     `docker network disconnect -f bridge X` reports "not found" because
+ *     the endpoint is dangling in dockerd's internal state, not actually
+ *     attached. A named network has no such global pollution; if it gets
+ *     corrupted we can blow it away and rebuild it without touching every
+ *     other container on the host.
+ *   - Inter-service DNS-by-name only works on named networks, so apps that
+ *     need to reach `postgres:5432` from another container can do so
+ *     without leaking host ports.
+ *
+ * Convention `${project}_default` matches what docker-compose creates by
+ * default for `${project}` → seamless coexistence with compose-managed
+ * adjacent infrastructure.
+ */
+export declare function getManagedNetwork(): string;
+/**
+ * Stamp the managed network onto a container spec when it doesn't already
+ * declare one. Centralised so every resolver — preset and built-in alike —
+ * gets the same defaults without each having to remember.
+ */
+export declare function applyManagedDefaults(spec: ResolvedContainer): ResolvedContainer;
 /** Set stack labels for subsequent container creation calls */
 export declare function setStackLabels(project: string, stack: string): void;
 /** Clear stack labels (for internal/global containers) */
 export declare function clearStackLabels(): void;
-/**
- * Resolve an app-declared IServiceRequirement into a ResolvedContainer.
- * Applies networkMode variant selection and stack-level overrides.
- *
- * Returns null if:
- * - No Docker config (external-only service)
- * - Service is disabled by stack override
- * - Stack override provides an external address
- */
-export declare function resolveServiceRequirement(serviceName: string, requirement: IServiceRequirement, override?: IServiceOverride, appName?: string): ResolvedContainer | null;
+export declare function resolveServiceRequirement(serviceName: string, requirement: IServiceRequirement, override?: IServiceOverride, appName?: string, 
+/** Where each service's shipped config directory is on THIS machine — see `shipped-config.ts`. */
+configRoots?: ReadonlyMap<string, string>): ResolvedContainer | null;
 /**
  * Resolve all app-declared infrastructure services into ResolvedContainer[].
  * Respects dependsOn ordering — dependencies come first.
  */
-export declare function resolveAppInfrastructure(infrastructure: Record<string, IServiceRequirement>, overrides?: Record<string, IServiceOverride>, appName?: string): ResolvedContainer[];
+export declare function resolveAppInfrastructure(infrastructure: Record<string, IServiceRequirement>, overrides?: Record<string, IServiceOverride>, appName?: string, configRoots?: ReadonlyMap<string, string>): ResolvedContainer[];
 /**
  * Omnitron's own PostgreSQL container for internal data (logs, metrics,
  * alerts, portal users, deployments, cluster state).
@@ -50,6 +149,28 @@ export declare function resolveOmnitronPg(options?: {
  *
  * Port 9800 (public) → nginx → port 9801 (internal daemon HTTP)
  */
+/**
+ * A digest of every file a container mounts from under `root`.
+ *
+ * `configFilesHash` was written for this — its docblock says it is «folded
+ * into the container's spec hash by the caller, so a changed template
+ * recreates the container» — and had no caller. So a node wrote each new
+ * nginx.conf over the old one and kept serving the old one: the gateway
+ * renders its template once, at start, and a reconcile that compares volume
+ * PATHS saw nothing to do. The test gateway was recreated only when its
+ * static bundle changed, which carried the config along by accident.
+ *
+ * Taken from the volumes themselves rather than a list of file names, so a
+ * mount added later is covered without anyone remembering this function.
+ * Read from disk on the machine that will run the container: on a node that
+ * is the copy just written from the master's payload, on a master the
+ * project's own files. Synchronous, because the resolver is — and small: the
+ * daos gateway's files are 65 KB, read once per provision.
+ *
+ * `undefined` when there is nothing under `root` to read, or it cannot be
+ * read — the spec hash then stays what it was without this.
+ */
+export declare function mountedConfigDigest(root: string, volumes: ResolvedContainer['volumes']): string | undefined;
 /**
  * Resolve API gateway container (OpenResty + Lua).
  *
@@ -60,6 +181,15 @@ export declare function resolveOmnitronPg(options?: {
  * @param redisConfig  Stack's Redis connection info (host, port, password)
  * @param projectRoot  Absolute path to project root (for resolving configDir)
  */
+/**
+ * The gateway's config as the stack declares it: every field `resolveGateway`
+ * reads, the preset's block first and the legacy `infrastructure.gateway`
+ * after. The stack manager used to hand it two of them — `configDir` and
+ * `staticDir` — so `env`, declared on `GatewayServiceConfig` as «passed to the
+ * gateway container», reached nothing, and `volumes`, which carries the
+ * onion's socket, would have reached nothing either.
+ */
+export declare function gatewayConfigOf(presetConfig: Readonly<Record<string, unknown>> | undefined, legacy: Partial<GatewayServiceConfig> | undefined, port: number, redisDb: number): GatewayServiceConfig;
 export declare function resolveGateway(config: GatewayServiceConfig, redisConfig: {
     host: string;
     port: number;
@@ -75,6 +205,8 @@ export declare function resolveOmnitronNginx(options?: {
     internalApiPort?: number;
     image?: string;
     webappDistPath?: string;
+    /** Interface to publish on. Loopback unless the caller says otherwise. */
+    bindHost?: string;
 }): ResolvedContainer;
 /**
  * Resolve an InfrastructureConfig into a list of concrete container specs.
@@ -89,5 +221,52 @@ export declare function resolveOmnitronNginx(options?: {
  * Resolve an InfrastructureConfig into concrete container specs.
  * Uses preset-normalized services map — all services go through resolveServiceRequirement().
  */
-export declare function resolveInfrastructure(_config: InfrastructureConfig, normalizedServices?: Record<string, IServiceRequirement>): ResolvedContainer[];
+export declare function resolveInfrastructure(_config: InfrastructureConfig, normalizedServices?: Record<string, IServiceRequirement>, 
+/**
+ * Stack overrides — `disabled`, `external`, per-service docker changes.
+ *
+ * This did not take them, and `resolveAppInfrastructure` was called
+ * without them, so `serviceOverrides` was honoured for services an
+ * APPLICATION declares and read by nothing for the ones a stack declares.
+ * An operator writing `tiles: { disabled: true }` got tiles.
+ *
+ * Measured on the test server: a stack that disabled the geocoder and the
+ * tile server provisioned both — a geocoding database that can reach tens
+ * of gigabytes, on a host chosen for a payment system.
+ */
+overrides?: Record<string, IServiceOverride>, 
+/**
+ * Where a service's config files live on THIS machine, by service name.
+ *
+ * The gateway is not an ordinary preset container: it needs four bind
+ * mounts, an entrypoint and fifteen upstream variables, and `resolveGateway`
+ * is the only thing that produces them. On a master they come from the
+ * project root; on a node there is no project, so the files are sent over
+ * and written locally, and this names where.
+ *
+ * Without it a node built its gateway through the generic preset path —
+ * whose own `defaultDocker` comment says "Volumes and entrypoint configured
+ * by resolveGateway" — and got bare openresty: an empty `Mounts` array, a
+ * null entrypoint, zero UPSTREAM variables, and an onion serving
+ * `Welcome to OpenResty!`.
+ */
+configRoots?: Map<string, string>, gatewayContext?: {
+    redis: {
+        host: string;
+        port: number;
+        db: number;
+        password?: string;
+    };
+    port?: number;
+    /** Where each service's static content lives on THIS machine. */
+    staticRoots?: Map<string, string>;
+    /**
+     * The static ROOT per service, when the delivery made a
+     * `current-<project>-<stack>` link inside it. Only a NODE sends this: on a
+     * master `staticDir` is a path inside the project (daos declares
+     * `apps/portal/dist`), and mounting ITS parent would put `src/` and
+     * `node_modules` under the web root.
+     */
+    staticLinkRoots?: Map<string, string>;
+}): ResolvedContainer[];
 //# sourceMappingURL=service-resolver.d.ts.map

package/dist/infrastructure/service-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAaD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,GAAG,IAAI,CAmE1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,EAAE,CA0BrB;AAgFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAgEnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,iBAAiB,CAiCpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,iBAAiB,EAAE,CAKrB"}
+{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAgC9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,EAC/I,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,GAChD,MAAM,CAER;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAExG;AAED,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CA8B/E;AASD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AA8ED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM;AAChB,kGAAkG;AAClG,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,iBAAiB,GAAG,IAAI,CA0F1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,iBAAiB,EAAE,CA0BrB;AA8FD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAuB3G;AAED;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EAC3D,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,oBAAoB,CActB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CA+HnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,iBAAiB,CA6CpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;AACxD;;;;;;;;;;;GAWG;AACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C;;;;;;;;;;;;;;GAcG;AACH,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,cAAc,CAAC,EAAE;IACf,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACA,iBAAiB,EAAE,CAyDrB"}