@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/infrastructure/phantom-endpoint-janitor.d.ts

@@ -54,6 +54,26 @@ export declare class PhantomEndpointJanitor {
     /** Run a single sweep across every managed network. Public for tests + ops triggers. */
     sweepAll(): Promise<number>;
     private sweepNetwork;
+    /**
+     * Decide whether a container exists, is definitively gone, or cannot be
+     * determined right now.
+     *
+     * This distinction is the whole point of the module's safety. The
+     * original code asked `docker inspect` and treated ANY non-zero exit as
+     * "gone" — so a 10s timeout (trivially reachable when the host disk is
+     * full and dockerd crawls), a spawn failure, or an unreachable daemon
+     * all read as "phantom". On 2026-09-04 that fired nine times in six
+     * minutes against RUNNING containers: the janitor force-disconnected
+     * acme-dev-pg, -redis, -postgres, -minio, -tor, -tiles, -nominatim and
+     * both monero containers from the managed network, which drops their
+     * host port publication until the container is recreated. The container
+     * IDs in those log lines matched the live containers exactly — they were
+     * never phantoms.
+     *
+     * `disconnect --force` is destructive and unrecoverable without a
+     * recreate, so 'unknown' must never be treated as 'absent'.
+     */
+    private containerVerdict;
     /**
      * Run `docker <args>` and return stdout/stderr/exit-code. Never throws —
      * a missing docker binary or a hung daemon shouldn't crash the daemon.

package/dist/infrastructure/phantom-endpoint-janitor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"phantom-endpoint-janitor.d.ts","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAEjE,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxD;AAED,qBAAa,sBAAsB;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAS;gBAEI,IAAI,EAAE,6BAA6B;IAEhE,KAAK,IAAI,IAAI;IAeb,IAAI,IAAI,IAAI;IAMZ,wFAAwF;IAClF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC;YAuBnB,YAAY;IAsC1B;;;;;;;;OAQG;IACH,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;CAqB9F"}
+{"version":3,"file":"phantom-endpoint-janitor.d.ts","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AAEjE,MAAM,WAAW,6BAA6B;IAC5C,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iCAAiC;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACxD;AAED,qBAAa,sBAAsB;IAIrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IAEzB,YAA6B,IAAI,EAAE,6BAA6B,EAAI;IAEpE,KAAK,IAAI,IAAI,CAaZ;IAED,IAAI,IAAI,IAAI,CAIX;IAED,wFAAwF;IAClF,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAqBhC;YAEa,YAAY;IAsE1B;;;;;;;;;;;;;;;;;;OAkBG;YACW,gBAAgB;IAS9B;;;;;;;;OAQG;IACH,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAoB5F;CACF"}

package/dist/infrastructure/phantom-endpoint-janitor.js

@@ -92,14 +92,35 @@ export class PhantomEndpointJanitor {
         catch {
             return 0;
         }
-        const endpoints = networks[0]?.Containers ?? {};
+        const endpoints = Object.entries(networks[0]?.Containers ?? {});
+        if (endpoints.length === 0)
+            return 0;
+        // One authoritative listing instead of an inspect per endpoint: it is
+        // a single docker round-trip (this loop used to make N), and it gives
+        // the sweep a positive fact — "these containers exist" — to reason
+        // from. If the listing itself fails we know nothing about anything, so
+        // the only safe move is to skip the sweep entirely and retry next tick.
+        const listing = await this.runDocker(['ps', '-aq', '--no-trunc']);
+        if (!listing.ok) {
+            this.opts.logger.warn({ network, stderr: listing.stderr }, 'phantom-endpoint janitor: could not list containers — skipping sweep (nothing disconnected)');
+            return 0;
+        }
+        const liveContainerIds = new Set(listing.stdout
+            .split('\n')
+            .map((line) => line.trim())
+            .filter(Boolean));
         let cleaned = 0;
-        for (const [containerId, info] of Object.entries(endpoints)) {
-            // Check whether the container still exists. `docker inspect`
-            // returns exit code 1 with "No such object" when it doesn't.
-            const exists = await this.runDocker(['inspect', '--type=container', '--format', '{{.Id}}', containerId]);
-            if (exists.ok)
+        for (const [containerId, info] of endpoints) {
+            if (liveContainerIds.has(containerId))
                 continue;
+            // Absent from the listing is not yet proof: the container may have
+            // been created between the listing and now. Confirm per-endpoint,
+            // and require docker to SAY the object is gone.
+            const verdict = await this.containerVerdict(containerId);
+            if (verdict !== 'absent') {
+                this.opts.logger.warn({ network, containerId, name: info?.Name, verdict }, 'phantom-endpoint janitor: could not confirm container is gone — leaving endpoint alone');
+                continue;
+            }
             // Phantom — force-disconnect.
             const disconnect = await this.runDocker(['network', 'disconnect', network, containerId, '--force']);
             if (disconnect.ok) {
@@ -112,6 +133,35 @@ export class PhantomEndpointJanitor {
         }
         return cleaned;
     }
+    /**
+     * Decide whether a container exists, is definitively gone, or cannot be
+     * determined right now.
+     *
+     * This distinction is the whole point of the module's safety. The
+     * original code asked `docker inspect` and treated ANY non-zero exit as
+     * "gone" — so a 10s timeout (trivially reachable when the host disk is
+     * full and dockerd crawls), a spawn failure, or an unreachable daemon
+     * all read as "phantom". On 2026-09-04 that fired nine times in six
+     * minutes against RUNNING containers: the janitor force-disconnected
+     * acme-dev-pg, -redis, -postgres, -minio, -tor, -tiles, -nominatim and
+     * both monero containers from the managed network, which drops their
+     * host port publication until the container is recreated. The container
+     * IDs in those log lines matched the live containers exactly — they were
+     * never phantoms.
+     *
+     * `disconnect --force` is destructive and unrecoverable without a
+     * recreate, so 'unknown' must never be treated as 'absent'.
+     */
+    async containerVerdict(containerId) {
+        const result = await this.runDocker(['inspect', '--type=container', '--format', '{{.Id}}', containerId]);
+        if (result.ok)
+            return 'exists';
+        // Docker answered, and its answer was "there is no such object".
+        if (/no such (object|container)/i.test(result.stderr))
+            return 'absent';
+        // Timeout, spawn error, daemon unreachable, permission problem, …
+        return 'unknown';
+    }
     /**
      * Run `docker <args>` and return stdout/stderr/exit-code. Never throws —
      * a missing docker binary or a hung daemon shouldn't crash the daemon.

package/dist/infrastructure/phantom-endpoint-janitor.js.map

@@ -1 +1 @@
-{"version":3,"file":"phantom-endpoint-janitor.js","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkB3C,MAAM,OAAO,sBAAsB;IAIJ;IAHrB,KAAK,GAA0B,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;IAAG,CAAC;IAEpE,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;oBAC7C,YAAY,IAAI,OAAO,CAAC;oBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EACrB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,6DAA6D;YAC7D,yBAAyB;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,QAAQ,GAA8D,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAoB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;QAChD,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5D,6DAA6D;YAC7D,6DAA6D;YAC7D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;YACzG,IAAI,MAAM,CAAC,EAAE;gBAAE,SAAS;YACxB,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;YACpG,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC1C,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EACnD,gFAAgF,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;OAQG;IACO,SAAS,CAAC,IAAc;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAAC,CAAC;YAC1E,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"phantom-endpoint-janitor.js","sourceRoot":"","sources":["../../src/infrastructure/phantom-endpoint-janitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAkB3C,MAAM,OAAO,sBAAsB;IAIJ,IAAI;IAHzB,KAAK,GAA0B,IAAI,CAAC;IACpC,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAA6B,IAAmC;oBAAnC,IAAI;IAAkC,CAAC;IAEpE,KAAK;QACH,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8CAA8C,CAAC,CAAC;YAClF,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,UAAU,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,EAC5C,0CAA0C,CAC3C,CAAC;IACJ,CAAC;IAED,IAAI;QACF,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO;QACxB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,wFAAwF;IACxF,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC;YACH,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;oBAC7C,YAAY,IAAI,OAAO,CAAC;oBACxB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,EACrB,iEAAiE,CAClE,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACxB,CAAC;QACD,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,OAAe;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,6DAA6D;YAC7D,yBAAyB;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QACD,IAAI,QAAQ,GAA8D,EAAE,CAAC;QAC7E,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAoB,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAErC,sEAAsE;QACtE,sEAAsE;QACtE,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EACnC,6FAA6F,CAC9F,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAC9B,OAAO,CAAC,MAAM;aACX,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;QAEF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC;YAC5C,IAAI,gBAAgB,CAAC,GAAG,CAAC,WAAW,CAAC;gBAAE,SAAS;YAEhD,mEAAmE;YACnE,kEAAkE;YAClE,gDAAgD;YAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACzD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EACnD,wFAAwF,CACzF,CAAC;gBACF,SAAS;YACX,CAAC;YAED,8BAA8B;YAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;YACpG,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;gBAClB,OAAO,EAAE,CAAC;gBACV,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAC1C,gEAAgE,CACjE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CACnB,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EACnD,gFAAgF,CACjF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACK,KAAK,CAAC,gBAAgB,CAAC,WAAmB;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;QACzG,IAAI,MAAM,CAAC,EAAE;YAAE,OAAO,QAAQ,CAAC;QAC/B,iEAAiE;QACjE,IAAI,6BAA6B,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,QAAQ,CAAC;QACvE,kEAAkE;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACO,SAAS,CAAC,IAAc;QAChC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC9B,IAAI,CAAC;oBAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC9C,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,sBAAsB,EAAE,CAAC,CAAC;YAC1E,CAAC,EAAE,MAAM,CAAC,CAAC;YACX,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACrB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,0BAA0B,EAAE,CAAC,CAAC;YAC9E,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACzB,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/infrastructure/presets/gateway-openresty.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-openresty.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,sBAAsB,EAAE,cAwBpC,CAAC"}
+{"version":3,"file":"gateway-openresty.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,sBAAsB,EAAE,cAkDpC,CAAC"}

package/dist/infrastructure/presets/gateway-openresty.js

@@ -9,11 +9,37 @@ export const gatewayOpenrestyPreset = {
     name: 'openresty',
     type: 'gateway',
     defaultImage: 'openresty/openresty:alpine',
-    defaultPorts: { http: 8080 },
+    // 80 — the port nginx listens on inside this image. It is a fact about
+    // the image, not something a stack config can change; a config naming
+    // `http` is saying where to PUBLISH it. Declared as 8080 here, the
+    // container published 8080→8080 while the server was on 80, and every
+    // connection was refused.
+    defaultPorts: { http: 80 },
     defaultSecrets: {},
+    /**
+     * Accepting connections, not serving a particular path.
+     *
+     * This asked for `/nginx-health`, an endpoint a reverse proxy's config may
+     * or may not define — and the config is the operator's, mounted from their
+     * repository. The one omnitron was pointed at has no such location, so the
+     * check could never pass: measured on the test node, a gateway reporting
+     * unhealthy for hours while serving an onion address that answered HTTP
+     * 200 through the Tor network.
+     *
+     * A preset must not assert the contents of a config it does not own. What
+     * it can assert is that the server it started is up and accepting
+     * connections on the port it declares — which is the whole of what this
+     * preset is responsible for. Whether a given route answers is the
+     * operator's config, and a health check that fails on their routing is a
+     * report about the wrong thing.
+     *
+     * `resolveGateway` reached the same conclusion for the same image and
+     * checked the nginx pid file. This checks the socket, which is one step
+     * stronger: a master process can be alive with no listener.
+     */
     defaultHealthCheck: {
-        type: 'http',
-        target: '/nginx-health',
+        type: 'command',
+        target: 'nc -z 127.0.0.1 80 || exit 1',
         interval: '10s',
         timeout: '5s',
         retries: 3,

package/dist/infrastructure/presets/gateway-openresty.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-openresty.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,4BAA4B;IAC1C,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;IACb,yEAAyE;KAC1E;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,6BAA6B;SAC3C,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"gateway-openresty.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/gateway-openresty.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,sBAAsB,GAAmB;IACpD,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,4BAA4B;IAC1C,uEAAuE;IACvE,sEAAsE;IACtE,mEAAmE;IACnE,sEAAsE;IACtE,0BAA0B;IAC1B,YAAY,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;IAC1B,cAAc,EAAE,EAAE;IAElB;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,8BAA8B;QACtC,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;IACb,yEAAyE;KAC1E;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,6BAA6B;SAC3C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/minio.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,WAAW,EAAE,cAuDzB,CAAC"}
+{"version":3,"file":"minio.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,WAAW,EAAE,cA0FzB,CAAC"}

package/dist/infrastructure/presets/minio.js

@@ -8,7 +8,23 @@
 export const minioPreset = {
     name: 'minio',
     type: 'storage',
-    defaultImage: 'minio/minio',
+    /**
+     * quay.io, and pinned.
+     *
+     * `minio/minio` on Docker Hub answers `pull access denied ... repository
+     * does not exist or may require 'docker login'` — for `:latest` and for an
+     * exact RELEASE tag alike. The image is still in the local cache of every
+     * machine that pulled it before the change, which is why nothing noticed:
+     * the development host runs it happily and a NEW node cannot get it at
+     * all. Measured provisioning the test server, where MinIO was the one
+     * service of three that did not come up.
+     *
+     * Pinned rather than `:latest`, because an unpinned tag is how this
+     * arrived: a config that names no version cannot be reasoned about after
+     * the registry changes under it, and "it worked yesterday" stops being
+     * evidence of anything.
+     */
+    defaultImage: 'quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z',
     defaultPorts: { api: 9000, console: 9001 },
     defaultSecrets: { accessKey: 'minioadmin', secretKey: 'minioadmin' },
     defaultHealthCheck: {
@@ -41,11 +57,28 @@ export const minioPreset = {
                     'http://localhost:9000', accessKey, secretKey,
                 ]);
                 await ctx.execInContainer(['mc', 'mb', '--ignore-existing', `local/${bucket}`]);
-                await ctx.execInContainer(['mc', 'anonymous', 'set', 'public', `local/${bucket}`]);
-                ctx.logger.info({ bucket }, 'Created MinIO bucket');
             }
             catch (err) {
                 ctx.logger.warn({ bucket, error: err.message }, 'Failed to create bucket');
+                continue;
+            }
+            // No anonymous access — `none`, set on every provisioning, so a bucket
+            // an earlier omnitron made `public` is closed on the next one.
+            //
+            // `public` was set here on every bucket: anonymous read AND write, to
+            // anything that could reach :9000 — every container on the stack's
+            // network — past the storage service's moderation, metadata scrubbing
+            // and safe delivery. Nothing reads MinIO anonymously: the storage
+            // service signs every request with the credentials above, the gateway
+            // has no route to MinIO, and the port is published on loopback
+            // (`portArg`). Measured on daos, 2026-09-23, before ad creatives made
+            // "whose bytes are these" a question with money on it.
+            try {
+                await ctx.execInContainer(['mc', 'anonymous', 'set', 'none', `local/${bucket}`]);
+                ctx.logger.info({ bucket, anonymous: 'none' }, 'MinIO bucket ready — no anonymous access');
+            }
+            catch (err) {
+                ctx.logger.error({ bucket, error: err.message }, 'Could not close anonymous access to this MinIO bucket — it keeps whatever policy it had, which an earlier omnitron set to public');
             }
         }
     },

package/dist/infrastructure/presets/minio.js.map

@@ -1 +1 @@
-{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,cAAc,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IAEpE,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC1D,WAAW,EAAE;YACX,eAAe,EAAE,qBAAqB;YACtC,mBAAmB,EAAE,qBAAqB;SAC3C;QACD,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO;QAE7B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC;oBACxB,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;oBAC7B,uBAAuB,EAAE,SAAS,EAAE,SAAS;iBAC9C,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBAChF,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBACnF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC;YACtD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,4BAA4B;YACzC,aAAa,EAAE,qBAAqB;YACpC,aAAa,EAAE,qBAAqB;SACrC,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"minio.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/minio.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,SAAS;IACf;;;;;;;;;;;;;;;OAeG;IACH,YAAY,EAAE,kDAAkD;IAChE,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;IAC1C,cAAc,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE;IAEpE,kBAAkB,EAAE;QAClB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC;KACX;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,mBAAmB,EAAE,OAAO,CAAC;QAC1D,WAAW,EAAE;YACX,eAAe,EAAE,qBAAqB;YACtC,mBAAmB,EAAE,qBAAqB;SAC3C;QACD,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,SAAS,CAAyB,CAAC;QAClE,IAAI,CAAC,OAAO,EAAE,MAAM;YAAE,OAAO;QAE7B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAC3D,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAE3D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC;oBACxB,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO;oBAC7B,uBAAuB,EAAE,SAAS,EAAE,SAAS;iBAC9C,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,yBAAyB,CAAC,CAAC;gBACtF,SAAS;YACX,CAAC;YACD,uEAAuE;YACvE,+DAA+D;YAC/D,EAAE;YACF,sEAAsE;YACtE,mEAAmE;YACnE,sEAAsE;YACtE,kEAAkE;YAClE,sEAAsE;YACtE,+DAA+D;YAC/D,sEAAsE;YACtE,uDAAuD;YACvD,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;gBACjF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,0CAA0C,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACzC,kIAAkI,CACnI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB;QAClB,OAAO;YACL,WAAW,EAAE,4BAA4B;YACzC,aAAa,EAAE,qBAAqB;YACpC,aAAa,EAAE,qBAAqB;SACrC,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cAiF5B,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAyB,MAAM,YAAY,CAAC;AAExE,eAAO,MAAM,cAAc,EAAE,cA4H5B,CAAC"}

package/dist/infrastructure/presets/postgres.js

@@ -23,14 +23,43 @@ export const postgresPreset = {
         timeout: '5s',
         retries: 30,
     },
+    buildCommand(userConfig) {
+        const cfg = (userConfig['config'] ?? {});
+        const command = ['postgres'];
+        const set = (key, value) => {
+            if (value === undefined || value === null || value === '')
+                return;
+            command.push('-c', `${key}=${value}`);
+        };
+        set('max_connections', cfg.maxConnections ?? 200);
+        set('shared_buffers', cfg.sharedBuffers ?? '256MB');
+        // Optional with no default: unset means "let postgres decide", which is
+        // a better answer than a number picked without knowing the machine.
+        set('effective_cache_size', cfg.effectiveCacheSize);
+        set('work_mem', cfg.workMem);
+        set('maintenance_work_mem', cfg.maintenanceWorkMem);
+        set('log_statement', 'none');
+        // -1 disables slow-query logging, and is a value an operator may mean —
+        // so `?? 1000` rather than a truthiness test, which would treat 0 and -1
+        // as absent and silently restore the default.
+        set('log_min_duration_statement', cfg.logMinDurationStatement ?? 1000);
+        // Safety: kill leaked connections from crashed/restarted processes.
+        // Not configurable — these protect the daemon from its own clients.
+        set('idle_in_transaction_session_timeout', 60000);
+        set('tcp_keepalives_idle', 60);
+        set('tcp_keepalives_interval', 10);
+        set('tcp_keepalives_count', 3);
+        return command;
+    },
     defaultDocker: {
+        // Mirrors `buildCommand({})`. Kept because `defaultDocker` is the
+        // fallback for any path that does not run the builder.
         command: [
             'postgres',
             '-c', 'max_connections=200',
             '-c', 'shared_buffers=256MB',
             '-c', 'log_statement=none',
             '-c', 'log_min_duration_statement=1000',
-            // Safety: kill leaked connections from crashed/restarted processes
             '-c', 'idle_in_transaction_session_timeout=60000',
             '-c', 'tcp_keepalives_idle=60',
             '-c', 'tcp_keepalives_interval=10',
@@ -49,7 +78,7 @@ export const postgresPreset = {
         const user = ctx.secrets['user'] ?? 'postgres';
         const maxRetries = 5;
         const retryDelay = 2000;
-        for (const dbName of Object.keys(databases)) {
+        for (const [dbName, dbConfig] of Object.entries(databases)) {
             let created = false;
             for (let attempt = 0; attempt < maxRetries && !created; attempt++) {
                 try {
@@ -75,6 +104,8 @@ export const postgresPreset = {
                     }
                 }
             }
+            if (created)
+                await createExtensions(ctx, user, dbName, dbConfig?.extensions ?? []);
         }
     },
     generateEnvTemplates(_userConfig) {
@@ -83,4 +114,40 @@ export const postgresPreset = {
         };
     },
 };
+/**
+ * Create the extensions a database declared, inside that database.
+ *
+ * `omnitronConfig.database.extensions` was declared in the type and in the
+ * zod schema and read by nothing: the resolver took `dialect` and `pool` and
+ * dropped the rest. An app asking for postgis got a plain container and
+ * failed on its first spatial query with `$libdir/postgis-3: No such file` —
+ * a message about a shared library, three layers away from the setting that
+ * was ignored. The workaround was to override the image by hand in the stack
+ * config, which is why the gap survived: it looked like an image problem.
+ *
+ * A missing extension is reported here, at provisioning time, naming the
+ * extension and the fact that the image has to carry it. Failing to create
+ * one does not abort the rest — the other databases and the other extensions
+ * are still worth having, and the app's own startup will fail loudly enough
+ * if it truly cannot run without it.
+ */
+async function createExtensions(ctx, user, dbName, extensions) {
+    for (const ext of extensions) {
+        // Extension names come from a config file, not from a request, but they
+        // are interpolated into SQL — so keep them to what an identifier can be.
+        if (!/^[a-zA-Z][a-zA-Z0-9_-]*$/.test(ext)) {
+            ctx.logger.warn({ database: dbName, extension: ext }, 'Skipped extension: not a valid identifier');
+            continue;
+        }
+        try {
+            await ctx.execInContainer([
+                'psql', '-U', user, '-d', dbName, '-c', `CREATE EXTENSION IF NOT EXISTS "${ext}"`,
+            ]);
+            ctx.logger.info({ database: dbName, extension: ext }, 'Ensured PostgreSQL extension');
+        }
+        catch (err) {
+            ctx.logger.error({ database: dbName, extension: ext, error: err.message }, `Could not create extension "${ext}" — the image must ship it (postgres:17-alpine has the contrib set, not postgis; use an image override for those)`);
+        }
+    }
+}
 //# sourceMappingURL=postgres.js.map

package/dist/infrastructure/presets/postgres.js.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,6FAA6F;QACrG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,aAAa,EAAE;QACb,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,mEAAmE;YACnE,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAAwC,CAAC;QACrF,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"postgres.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/postgres.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,cAAc,GAAmB;IAC5C,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,UAAU;IAChB,YAAY,EAAE,oBAAoB;IAClC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE;IAE1D,kBAAkB,EAAE;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,+DAA+D;QAC/D,8CAA8C;QAC9C,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,6FAA6F;QACrG,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,YAAY,CAAC,UAAmC;QAC9C,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAOtC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,KAAkC,EAAQ,EAAE;YACpE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;gBAAE,OAAO;YAClE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC;QAEF,GAAG,CAAC,iBAAiB,EAAE,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,CAAC;QAClD,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC,aAAa,IAAI,OAAO,CAAC,CAAC;QACpD,wEAAwE;QACxE,oEAAoE;QACpE,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACpD,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC7B,wEAAwE;QACxE,yEAAyE;QACzE,8CAA8C;QAC9C,GAAG,CAAC,4BAA4B,EAAE,GAAG,CAAC,uBAAuB,IAAI,IAAI,CAAC,CAAC;QACvE,oEAAoE;QACpE,oEAAoE;QACpE,GAAG,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAClD,GAAG,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,yBAAyB,EAAE,EAAE,CAAC,CAAC;QACnC,GAAG,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC;QAE/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,aAAa,EAAE;QACb,kEAAkE;QAClE,uDAAuD;QACvD,OAAO,EAAE;YACP,UAAU;YACV,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,sBAAsB;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,IAAI,EAAE,iCAAiC;YACvC,IAAI,EAAE,2CAA2C;YACjD,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,wBAAwB;SAC/B;QACD,WAAW,EAAE,EAAE;QACf,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,MAAM,EAAE,EAAE,EAAE;SACzD;QACD,OAAO,EAAE,MAAM;KAChB;IAED,KAAK,CAAC,aAAa,CAAC,GAA0B;QAC5C,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,WAAW,CAE/B,CAAC;QACd,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;QAC/C,MAAM,UAAU,GAAG,CAAC,CAAC;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC;QAExB,KAAK,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,UAAU,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC;gBAClE,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC;wBACvC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM;wBAC1B,4CAA4C,MAAM,GAAG;qBACtD,CAAC,CAAC;oBACH,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;wBACnB,MAAM,GAAG,CAAC,eAAe,CAAC;4BACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,MAAM,GAAG;yBACxD,CAAC,CAAC;wBACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,6BAA6B,CAAC,CAAC;oBACvE,CAAC;oBACD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,OAAO,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;wBAC7B,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;wBAC9F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;oBACtD,CAAC;yBAAM,CAAC;wBACN,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,2BAA2B,CAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;YACH,CAAC;YAED,IAAI,OAAO;gBAAE,MAAM,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,oBAAoB,CAAC,WAAoC;QACvD,OAAO;YACL,YAAY,EAAE,+EAA+E;SAC9F,CAAC;IACJ,CAAC;CACF,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAA0B,EAC1B,IAAY,EACZ,MAAc,EACd,UAAoB;IAEpB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,wEAAwE;QACxE,yEAAyE;QACzE,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,2CAA2C,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,eAAe,CAAC;gBACxB,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,GAAG,GAAG;aAClF,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACnE,+BAA+B,GAAG,mHAAmH,CACtJ,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/infrastructure/presets/redis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cAiCzB,CAAC"}
+{"version":3,"file":"redis.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,WAAW,EAAE,cAmDzB,CAAC"}

package/dist/infrastructure/presets/redis.js

@@ -23,7 +23,20 @@ export const redisPreset = {
         timeout: '3s',
         retries: 30,
     },
+    buildCommand(userConfig) {
+        const cfg = (userConfig['config'] ?? {});
+        const command = ['redis-server'];
+        command.push('--appendonly', cfg.appendonly === false ? 'no' : 'yes');
+        command.push('--maxmemory-policy', cfg.maxmemoryPolicy ?? 'allkeys-lru');
+        // No default. An eviction policy without a memory ceiling never evicts,
+        // so `maxmemory` was the one setting here that mattered — and it was the
+        // one the preset never passed at all, whatever the config said.
+        if (cfg.maxmemory)
+            command.push('--maxmemory', cfg.maxmemory);
+        return command;
+    },
     defaultDocker: {
+        // Mirrors `buildCommand({})`.
         command: ['redis-server', '--appendonly', 'yes', '--maxmemory-policy', 'allkeys-lru'],
         volumes: {
             data: { target: '/data', source: '' },

package/dist/infrastructure/presets/redis.js.map

@@ -1 +1 @@
-{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,8DAA8D;QAC9D,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}
+{"version":3,"file":"redis.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/redis.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,CAAC,MAAM,WAAW,GAAmB;IACzC,IAAI,EAAE,OAAO;IACb,IAAI,EAAE,OAAO;IACb,YAAY,EAAE,gBAAgB;IAC9B,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IAC5B,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,8DAA8D;QAC9D,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,uCAAuC;QAC/C,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;KACZ;IAED,YAAY,CAAC,UAAmC;QAC9C,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,CAItC,CAAC;QAEF,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,CAAC,eAAe,IAAI,aAAa,CAAC,CAAC;QACzE,wEAAwE;QACxE,yEAAyE;QACzE,gEAAgE;QAChE,IAAI,GAAG,CAAC,SAAS;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9D,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,aAAa,EAAE;QACb,8BAA8B;QAC9B,OAAO,EAAE,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,oBAAoB,EAAE,aAAa,CAAC;QACrF,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;SACtC;KACF;IAED,oBAAoB;QAClB,OAAO;YACL,SAAS,EAAE,gCAAgC;SAC5C,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAE7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAItC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,IAAI,IAAI,MAAM,EAAE;IAIhB;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB;CA6E/E"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,mBAAmB,EAAwB,MAAM,aAAa,CAAC;AAG7E,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqC;IAE7D,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI,CAErC;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAE5C;IAED,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzB;IAED,IAAI,IAAI,MAAM,EAAE,CAEf;IAED;;;OAGG;IACH,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,mBAAmB,CAoJ7E;CACF"}

package/dist/infrastructure/presets/registry.js

@@ -4,6 +4,7 @@
  * Ships with built-in presets for common infrastructure.
  * Projects can register custom presets for specialized services.
  */
+import { renderTorrc, authorizedClientFiles } from './torrc.js';
 export class PresetRegistry {
     presets = new Map();
     register(preset) {
@@ -35,8 +36,41 @@ export class PresetRegistry {
                 mergedSecrets[k] = typeof v === 'string' ? v : v.secret;
             }
         }
-        // Merge ports
-        const mergedPorts = { ...preset.defaultPorts, ...config.ports };
+        // A preset's port is the CONTAINER's; a configured port is the host's.
+        //
+        // These were merged as one, so writing `ports: { http: 8080 }` for the
+        // openresty gateway declared that its nginx listens on 8080. It listens
+        // on 80 — that is a fact about the image, not something a config can
+        // change — so the container published 8080→8080 while the server was on
+        // 80, and every connection to it was refused. Measured on the gateway,
+        // where the health check reported unhealthy for a container that was
+        // serving an onion address correctly through a different path.
+        //
+        // The same distinction is right for the others and was accidentally
+        // harmless there: nobody changes the port Postgres listens on by editing
+        // a stack config, they change the one it is published at. `9000` for
+        // MinIO means "reach it at 9000", not "rebuild MinIO to listen
+        // elsewhere".
+        //
+        // So: the container port comes from the preset, and anything the config
+        // names becomes a host mapping — unless the preset never declared that
+        // port, in which case the config is describing a container port the
+        // preset does not know about, and it is one.
+        const containerPorts = { ...preset.defaultPorts };
+        const hostMappings = { ...config.docker?.portMappings };
+        for (const [name, port] of Object.entries(config.ports ?? {})) {
+            if (preset.defaultPorts[name] !== undefined) {
+                // The preset knows this port: the config is naming where to publish
+                // it. An explicit `portMappings` entry still wins — it says the same
+                // thing more precisely.
+                if (hostMappings[name] === undefined)
+                    hostMappings[name] = port;
+            }
+            else {
+                containerPorts[name] = port;
+            }
+        }
+        const mergedPorts = containerPorts;
         // Build Docker config: inject resolved secrets into environment
         const dockerEnv = { ...preset.defaultDocker.environment };
         // For postgres: POSTGRES_USER, POSTGRES_PASSWORD
@@ -51,31 +85,66 @@ export class PresetRegistry {
             dockerEnv['MINIO_ROOT_PASSWORD'] = mergedSecrets['secretKey'] ?? 'minioadmin';
         }
         else if (preset.name === 'tor') {
-            // Tor preset reads its hidden-service map from a single JSON env var —
-            // simpler than parametrising arbitrary numbers of HiddenServiceDir/Port
-            // pairs through individual variables. The torrc generator (see
-            // tor.ts ENTRYPOINT_SHELL) iterates over this list with `jq`.
+            // The finished torrc, rendered here.
+            //
+            // It used to travel as a JSON list that a `jq` loop inside the
+            // container turned into torrc stanzas. That put the one file which
+            // decides whether a service is anonymous behind a shell script nobody
+            // could read without starting a container and nothing could test — and
+            // a hardening line dropped by a quoting mistake looks exactly like one
+            // that was never written.
             const torCfg = (config.config ?? {});
-            const hsArr = Array.isArray(torCfg.hiddenServices) ? torCfg.hiddenServices : [];
-            dockerEnv['OMNITRON_TOR_HIDDEN_SERVICES_JSON'] = JSON.stringify(hsArr);
-            if (Array.isArray(torCfg.extraTorrc) && torCfg.extraTorrc.length > 0) {
-                dockerEnv['OMNITRON_TOR_EXTRA_TORRC'] = torCfg.extraTorrc.join('\n');
+            const services = Array.isArray(torCfg.hiddenServices) ? torCfg.hiddenServices : [];
+            dockerEnv['OMNITRON_TORRC'] = renderTorrc({ services, extra: torCfg.extraTorrc });
+            // Client-authorization keys go to files tor reads out of each service
+            // directory, not into the torrc. A key that never reaches
+            // `authorized_clients/` is a restriction that silently does not exist.
+            const authFiles = authorizedClientFiles(services);
+            if (authFiles.length > 0) {
+                dockerEnv['OMNITRON_TOR_CLIENT_AUTH_JSON'] = JSON.stringify(authFiles);
             }
         }
         if (config.docker?.environment) {
             Object.assign(dockerEnv, config.docker.environment);
         }
-        // Merge Docker config
+        // Merge Docker config. The command comes from the preset's own builder
+        // when it has one, so the `config` block actually reaches the container;
+        // an explicit `docker.command` still wins, because a caller who spelled
+        // out the command means it.
+        const built = preset.buildCommand?.(config.config ?? {});
         const docker = {
             image: config.image ?? preset.defaultImage,
             ...preset.defaultDocker,
+            ...(built ? { command: built } : {}),
             ...config.docker,
+            // By key: a stack that adds a mount keeps the preset's. Spread whole,
+            // `docker.volumes` replaced them — the Tor preset's `/var/lib/tor`, its
+            // onion keys and so its address, would have gone the moment a stack
+            // gave Tor the gateway's socket to reach.
+            ...(preset.defaultDocker.volumes || config.docker?.volumes
+                ? { volumes: { ...preset.defaultDocker.volumes, ...config.docker?.volumes } }
+                : {}),
             environment: dockerEnv,
+            // Where each port is published, after the config's ports were read as
+            // host mappings rather than container ones.
+            ...(Object.keys(hostMappings).length > 0 ? { portMappings: hostMappings } : {}),
         };
         // Build health check — customize user secret (e.g., pg_isready -U <user>)
         let healthCheck = preset.defaultHealthCheck;
         if (preset.name === 'postgres' && mergedSecrets['user']) {
-            healthCheck = { ...healthCheck, target: `pg_isready -U ${mergedSecrets['user']}` };
+            // Parametrise the user, keep the check. This used to replace the whole
+            // target with `pg_isready -U <user>` — the exact check the preset
+            // spends a paragraph explaining is not good enough, because it returns
+            // 0 the moment the postmaster accepts connections, while WAL replay or
+            // extension creation may still be running. So configuring a user
+            // silently downgraded the health check to the one the preset warns
+            // against, and only for the deployments that configure a user.
+            const user = mergedSecrets['user'];
+            healthCheck = {
+                ...healthCheck,
+                type: 'command',
+                target: `sh -c "psql -U ${user} -d postgres -h /var/run/postgresql -tAc \\"SELECT 1\\" | grep -q 1"`,
+            };
         }
         if (preset.name === 'redis' && mergedSecrets['password']) {
             healthCheck = { ...healthCheck, type: 'command', target: `redis-cli -a ${mergedSecrets['password']} ping` };

package/dist/infrastructure/presets/registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,cAAc;QACd,MAAM,WAAW,GAAG,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;QAEhE,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,uEAAuE;YACvE,wEAAwE;YACxE,+DAA+D;YAC/D,8DAA8D;YAC9D,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAA0D,CAAC;YAC9F,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,SAAS,CAAC,mCAAmC,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrE,SAAS,CAAC,0BAA0B,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,sBAAsB;QACtB,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,MAAM,CAAC,MAAM;YAChB,WAAW,EAAE,SAAS;SACvB,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,iBAAiB,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,WAAW,EAAE,qBAAqB,EAAyB,MAAM,YAAY,CAAC;AAEvF,MAAM,OAAO,cAAc;IACR,OAAO,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE7D,QAAQ,CAAC,MAAsB;QAC7B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,WAAmB,EAAE,MAA4B;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,MAAM,kBAAkB,WAAW,KAAK;gBAC1E,sBAAsB,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/C,CAAC;QACJ,CAAC;QAED,kDAAkD;QAClD,MAAM,aAAa,GAA2B,EAAE,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBACpD,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,EAAE;QACF,uEAAuE;QACvE,wEAAwE;QACxE,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,qEAAqE;QACrE,+DAA+D;QAC/D,EAAE;QACF,oEAAoE;QACpE,yEAAyE;QACzE,qEAAqE;QACrE,+DAA+D;QAC/D,cAAc;QACd,EAAE;QACF,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,6CAA6C;QAC7C,MAAM,cAAc,GAA2B,EAAE,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,YAAY,GAA2B,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC;QAEhF,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9D,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,oEAAoE;gBACpE,qEAAqE;gBACrE,wBAAwB;gBACxB,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,SAAS;oBAAE,YAAY,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YAC9B,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,cAAc,CAAC;QAEnC,gEAAgE;QAChE,MAAM,SAAS,GAA2B,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,CAAC;QAClF,iDAAiD;QACjD,kDAAkD;QAClD,8EAA8E;QAC9E,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC/B,SAAS,CAAC,eAAe,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC;YACjE,SAAS,CAAC,mBAAmB,CAAC,GAAG,aAAa,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC;QAC3E,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YACnC,SAAS,CAAC,iBAAiB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;YAC1E,SAAS,CAAC,qBAAqB,CAAC,GAAG,aAAa,CAAC,WAAW,CAAC,IAAI,YAAY,CAAC;QAChF,CAAC;aAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,qCAAqC;YACrC,EAAE;YACF,+DAA+D;YAC/D,mEAAmE;YACnE,sEAAsE;YACtE,uEAAuE;YACvE,uEAAuE;YACvE,0BAA0B;YAC1B,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAGlC,CAAC;YACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,SAAS,CAAC,gBAAgB,CAAC,GAAG,WAAW,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YAElF,sEAAsE;YACtE,0DAA0D;YAC1D,uEAAuE;YACvE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;YAClD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzB,SAAS,CAAC,+BAA+B,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;YACzE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;YAC/B,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACtD,CAAC;QAED,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,4BAA4B;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,MAAM,GAAyB;YACnC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,YAAY;YAC1C,GAAG,MAAM,CAAC,aAAa;YACvB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpC,GAAG,MAAM,CAAC,MAAM;YAChB,sEAAsE;YACtE,wEAAwE;YACxE,oEAAoE;YACpE,0CAA0C;YAC1C,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO;gBACxD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;gBAC7E,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,SAAS;YACtB,sEAAsE;YACtE,4CAA4C;YAC5C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChF,CAAC;QAEF,0EAA0E;QAC1E,IAAI,WAAW,GAAG,MAAM,CAAC,kBAAkB,CAAC;QAC5C,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,uEAAuE;YACvE,kEAAkE;YAClE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;YACjE,mEAAmE;YACnE,+DAA+D;YAC/D,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACnC,WAAW,GAAG;gBACZ,GAAG,WAAW;gBACd,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,kBAAkB,IAAI,sEAAsE;aACrG,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,WAAW,GAAG,EAAE,GAAG,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,aAAa,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9G,CAAC;QAED,MAAM,MAAM,GAAwB;YAClC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK,EAAE,WAAW;YAClB,GAAG,EAAE,MAAM,CAAC,oBAAoB,EAAE,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,IAAI,EAAE;YAC7D,WAAW;YACX,OAAO,EAAE,aAAa;YACtB,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}