@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/infrastructure/provisioning-outcome.js

@@ -0,0 +1,122 @@
+/**
+ * Whether provisioning actually provisioned anything.
+ *
+ * `provision()` set `state.ready = true` and logged "Infrastructure
+ * provisioned and healthy" as the last two statements of its `try`,
+ * unconditionally. Every service reconciles inside a `Promise.all` whose
+ * per-service `catch` records `status: 'exited'` and continues, so a run in
+ * which every container failed ended exactly like a run in which all of them
+ * came up.
+ *
+ * `omnitron infra up` then printed
+ *
+ *     Infrastructure ready:
+ *
+ * as a heading, before looking at anything, and listed whatever
+ * `state.services` happened to hold. An empty object printed the heading and
+ * nothing else — and an empty enumeration of problems reads as "no
+ * problems". Observed three times in one shift on a host under memory
+ * pressure, with `daos-dev-postgres` and `daos-dev-redis` absent from
+ * `docker ps -a` entirely at the moment it said so.
+ *
+ * The cost is separate from the cause. A control plane that reports health
+ * when the database is gone sends whoever reads it to look at their own
+ * change: one colleague reverted a correct fix after reading
+ * `Module "TitanRedisModule" failed to initialize`, because the line above it
+ * said the infrastructure was fine. The full error said
+ * `Redis client "default" connection timed out`.
+ *
+ * Three states have to be distinguishable, and two of them looked identical
+ * because both produced an empty list of complaints:
+ *
+ *   - declared, present, running;
+ *   - declared, present, not running — an error to show;
+ *   - declared and MISSING — nothing even tried, which is the one that
+ *     looks like success.
+ */
+/**
+ * A container that is running is not necessarily working.
+ *
+ * Docker's own health probe is the only thing here that has looked inside,
+ * so `unhealthy` outranks `running`. `starting` does not: a container in its
+ * first probe window is not yet a failure, and calling it one would make
+ * every provisioning run fail for the seconds before the first check.
+ */
+function isUp(state) {
+    return state.status === 'running' && state.health !== 'unhealthy';
+}
+export function summariseProvisioning(desired, services) {
+    const running = [];
+    const failed = [];
+    const missing = [];
+    const seen = new Set();
+    for (const want of desired) {
+        seen.add(want.name);
+        const state = services[want.name];
+        if (!state) {
+            // The state that reads as success. Nothing tried, so nothing failed,
+            // so there is nothing in any list of problems.
+            missing.push({ name: want.name, image: want.image, status: 'missing', error: undefined });
+            continue;
+        }
+        (isUp(state) ? running : failed).push({
+            name: state.name,
+            image: state.image,
+            status: state.status,
+            error: state.error ?? (state.health === 'unhealthy' ? 'container reports unhealthy' : undefined),
+        });
+    }
+    // Services provisioned outside the declared set — omnitron's own Postgres
+    // is one — count against readiness when they are down. They were left out
+    // of this decision entirely, and a master with no control-plane database
+    // is not a healthy master.
+    for (const [name, state] of Object.entries(services)) {
+        if (seen.has(name))
+            continue;
+        (isUp(state) ? running : failed).push({
+            name: state.name ?? name,
+            image: state.image,
+            status: state.status,
+            error: state.error ?? (state.health === 'unhealthy' ? 'container reports unhealthy' : undefined),
+        });
+    }
+    const empty = desired.length === 0 && Object.keys(services).length === 0;
+    return {
+        ready: !empty && failed.length === 0 && missing.length === 0,
+        empty,
+        running,
+        failed,
+        missing,
+    };
+}
+/** One line saying what happened, for a log that has to be readable alone. */
+export function describeProvisioning(outcome) {
+    if (outcome.empty)
+        return 'Infrastructure: nothing is declared, so nothing was provisioned';
+    if (outcome.ready)
+        return `Infrastructure provisioned and healthy (${outcome.running.length} services)`;
+    const parts = [];
+    if (outcome.missing.length > 0)
+        parts.push(`${outcome.missing.length} missing (${outcome.missing.map((s) => s.name).join(', ')})`);
+    if (outcome.failed.length > 0)
+        parts.push(`${outcome.failed.length} not running (${outcome.failed.map((s) => s.name).join(', ')})`);
+    return `Infrastructure is NOT ready — ${parts.join('; ')}`;
+}
+/**
+ * The node's verdict on everything it was asked to bring up.
+ *
+ * Readiness counted the containers and the host services' REFUSALS, and not a
+ * host service that failed while its plan was carried out. Measured on the
+ * test node, 2026-09-23: bitcoind's start failed — `could not start bitcoind: `
+ * — and the node answered `ready: true` with «Infrastructure provisioned and
+ * healthy (5 services)», the failure sitting in `failed` beside it; the master
+ * logged that sentence and the deployment reported `6/6 apps online`.
+ */
+export function provisioningVerdict(outcome, hosted) {
+    if (hosted.failed.length === 0)
+        return { ready: outcome.ready, detail: describeProvisioning(outcome) };
+    const notUp = hosted.failed.map((f) => `${f.name} ${f.status}: ${f.error?.replace(/:\s*$/, '').trim() || 'no reason given'}`);
+    const containers = outcome.ready || outcome.empty ? '' : `${describeProvisioning(outcome)}; `;
+    return { ready: false, detail: `${containers}host services NOT up — ${notUp.join('; ')}` };
+}
+//# sourceMappingURL=provisioning-outcome.js.map

package/dist/infrastructure/provisioning-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-outcome.js","sourceRoot":"","sources":["../../src/infrastructure/provisioning-outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAuBH;;;;;;;GAOG;AACH,SAAS,IAAI,CAAC,KAAqB;IACjC,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAgE,EAChE,QAAkD;IAElD,MAAM,OAAO,GAAqB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,MAAM,OAAO,GAAqB,EAAE,CAAC;IAErC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1F,SAAS;QACX,CAAC;QACD,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;SACjG,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,2BAA2B;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAC7B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;SACjG,CAAC,CAAC;IACL,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAEzE,OAAO;QACL,KAAK,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAC5D,KAAK;QACL,OAAO;QACP,MAAM;QACN,OAAO;KACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,oBAAoB,CAAC,OAA4B;IAC/D,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,iEAAiE,CAAC;IAC5F,IAAI,OAAO,CAAC,KAAK;QAAE,OAAO,2CAA2C,OAAO,CAAC,OAAO,CAAC,MAAM,YAAY,CAAC;IAExG,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnI,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,iBAAiB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpI,OAAO,iCAAiC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC7D,CAAC;AASD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAA4B,EAC5B,MAA2B;IAE3B,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;IACvG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAC9H,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9F,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,UAAU,0BAA0B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AAC7F,CAAC"}

package/dist/infrastructure/server-registry.d.ts

@@ -2,15 +2,42 @@
  * ServerRegistry — Persistent registry for remote daemon servers
  *
  * Phase 5 implementation. Stores at ~/.omnitron/servers.json
+ *
+ * Read by `omnitron remote`, `omnitron fleet` and `omnitron deploy`. Note
+ * that this is NOT the registry the console's Nodes page and `omnitron node`
+ * use — those live in the SQLite `nodes` table via `NodeManagerService`. Two
+ * registries for "a remote machine" is a real gap, not a subtlety: a host
+ * added in the console is invisible to `omnitron deploy`, and one added with
+ * `omnitron remote add` never appears in the fleet view.
  */
 import type { ServerInfoDto } from '../shared/dto/services.js';
 export declare class ServerRegistry {
     private readonly registryFile;
     constructor();
+    /**
+     * Every registered server.
+     *
+     * A missing file means no servers have been registered; a file that cannot
+     * be read or parsed means something is wrong, and the two must not give the
+     * same answer. They did: one `catch` returned `[]` for both, so a truncated
+     * or half-written `servers.json` read as an empty fleet — and `deploy.ts`
+     * resolves its targets from this list, so a deploy to a corrupt registry
+     * targeted nothing and reported success.
+     *
+     * @throws when the file exists and cannot be read as a server list.
+     */
     list(): ServerInfoDto[];
     add(server: ServerInfoDto): void;
     remove(alias: string): boolean;
     get(alias: string): ServerInfoDto | undefined;
+    /**
+     * Write the list.
+     *
+     * Through a temporary file and a rename, which is atomic within a
+     * filesystem: a crash or a full disk part-way through leaves the previous
+     * registry intact rather than a truncated one. Writing in place meant every
+     * save had a window in which the file was neither the old list nor the new.
+     */
     private save;
 }
 //# sourceMappingURL=server-registry.d.ts.map

package/dist/infrastructure/server-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server-registry.d.ts","sourceRoot":"","sources":["../../src/infrastructure/server-registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;;IAMtC,IAAI,IAAI,aAAa,EAAE;IASvB,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAMhC,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAQ9B,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAI7C,OAAO,CAAC,IAAI;CAKb"}
+{"version":3,"file":"server-registry.d.ts","sourceRoot":"","sources":["../../src/infrastructure/server-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IAEtC,cAEC;IAED;;;;;;;;;;;OAWG;IACH,IAAI,IAAI,aAAa,EAAE,CAuBtB;IAED,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAI/B;IAED,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAM7B;IAED,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAE5C;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI;CAYb"}

package/dist/infrastructure/server-registry.js

@@ -2,6 +2,13 @@
  * ServerRegistry — Persistent registry for remote daemon servers
  *
  * Phase 5 implementation. Stores at ~/.omnitron/servers.json
+ *
+ * Read by `omnitron remote`, `omnitron fleet` and `omnitron deploy`. Note
+ * that this is NOT the registry the console's Nodes page and `omnitron node`
+ * use — those live in the SQLite `nodes` table via `NodeManagerService`. Two
+ * registries for "a remote machine" is a real gap, not a subtlety: a host
+ * added in the console is invisible to `omnitron deploy`, and one added with
+ * `omnitron remote add` never appears in the fleet view.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -11,14 +18,43 @@ export class ServerRegistry {
     constructor() {
         this.registryFile = path.join(OMNITRON_HOME, 'servers.json');
     }
+    /**
+     * Every registered server.
+     *
+     * A missing file means no servers have been registered; a file that cannot
+     * be read or parsed means something is wrong, and the two must not give the
+     * same answer. They did: one `catch` returned `[]` for both, so a truncated
+     * or half-written `servers.json` read as an empty fleet — and `deploy.ts`
+     * resolves its targets from this list, so a deploy to a corrupt registry
+     * targeted nothing and reported success.
+     *
+     * @throws when the file exists and cannot be read as a server list.
+     */
     list() {
+        let data;
+        try {
+            data = fs.readFileSync(this.registryFile, 'utf-8');
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return [];
+            throw new Error(`Cannot read the server registry at ${this.registryFile}: ${err.message}`, {
+                cause: err,
+            });
+        }
+        let parsed;
         try {
-            const data = fs.readFileSync(this.registryFile, 'utf-8');
-            return JSON.parse(data);
+            parsed = JSON.parse(data);
         }
-        catch {
-            return [];
+        catch (err) {
+            throw new Error(`The server registry at ${this.registryFile} is not valid JSON: ${err.message}`, {
+                cause: err,
+            });
         }
+        if (!Array.isArray(parsed)) {
+            throw new Error(`The server registry at ${this.registryFile} does not contain a list of servers.`);
+        }
+        return parsed;
     }
     add(server) {
         const servers = this.list().filter((s) => s.alias !== server.alias);
@@ -36,10 +72,29 @@ export class ServerRegistry {
     get(alias) {
         return this.list().find((s) => s.alias === alias);
     }
+    /**
+     * Write the list.
+     *
+     * Through a temporary file and a rename, which is atomic within a
+     * filesystem: a crash or a full disk part-way through leaves the previous
+     * registry intact rather than a truncated one. Writing in place meant every
+     * save had a window in which the file was neither the old list nor the new.
+     */
     save(servers) {
         const dir = path.dirname(this.registryFile);
         fs.mkdirSync(dir, { recursive: true });
-        fs.writeFileSync(this.registryFile, JSON.stringify(servers, null, 2), 'utf-8');
+        const tmp = `${this.registryFile}.${process.pid}.tmp`;
+        try {
+            fs.writeFileSync(tmp, JSON.stringify(servers, null, 2), { encoding: 'utf-8', mode: 0o600 });
+            fs.renameSync(tmp, this.registryFile);
+        }
+        catch (err) {
+            try {
+                fs.unlinkSync(tmp);
+            }
+            catch { /* nothing to clean up */ }
+            throw err;
+        }
     }
 }
 //# sourceMappingURL=server-registry.js.map

package/dist/infrastructure/server-registry.js.map

@@ -1 +1 @@
-{"version":3,"file":"server-registry.js","sourceRoot":"","sources":["../../src/infrastructure/server-registry.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,OAAO,cAAc;IACR,YAAY,CAAS;IAEtC;QACE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACpD,CAAC;IAEO,IAAI,CAAC,OAAwB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;CACF"}
+{"version":3,"file":"server-registry.js","sourceRoot":"","sources":["../../src/infrastructure/server-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAGtD,MAAM,OAAO,cAAc;IACR,YAAY,CAAS;IAEtC;QACE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,IAAI;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,YAAY,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE;gBACpG,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,YAAY,uBAAwB,GAAa,CAAC,OAAO,EAAE,EAAE;gBAC1G,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,YAAY,sCAAsC,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,MAAyB,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;OAOG;IACK,IAAI,CAAC,OAAwB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACtD,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;YAC/D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF"}

package/dist/infrastructure/service-binding.d.ts

@@ -0,0 +1,60 @@
+/**
+ * How a stack runs a service an application declares: where, on which
+ * network, on which ports, with which credentials.
+ *
+ * Three readers answered this each for itself — the node's container
+ * resolver, its bare-metal planner, and the master's resolver of the
+ * applications' environment — and their answers had drifted apart on the
+ * one service where being wrong costs money. Measured against the test
+ * stack, which runs Bitcoin on mainnet (2026-09-23):
+ *
+ *   - nothing chose between a declaration's `docker` and `bareMetal` blocks:
+ *     a node given the service would make the container AND plan the unit;
+ *   - the bare-metal templates took their credentials from the
+ *     application's declaration — `omni_regtest` / `omni_regtest_dev_password`,
+ *     in git — whatever network the stack ran;
+ *   - the applications' environment for a service provisioned on the node
+ *     read the same declaration: the regtest port and the regtest password,
+ *     beside `BITCOIN_NETWORK=mainnet`.
+ *
+ * One answer now, and one rule for credentials: an application's own
+ * `secrets` belong to the network it declares — a laptop's. A stack that
+ * runs another network gives its own (`serviceOverrides.<name>.secrets`,
+ * vault references), and a credential it does not give is missing, not
+ * borrowed from the laptop.
+ */
+import type { IServiceOverride, IServiceRequirement, SecretRef } from './types.js';
+export type Provisioning = 'external' | 'docker' | 'bareMetal' | 'disabled' | 'none';
+export interface ServiceBinding {
+    /**
+     * `none` is a service with nothing to provision it by: no docker block,
+     * no bare-metal block, and no address to reach it at.
+     */
+    provisioning: Provisioning;
+    networkMode: string | undefined;
+    /** False when the stack runs another network than the declaration names. */
+    declaredNetwork: boolean;
+    ports: Record<string, number>;
+    /** References until the master resolves them; values after. */
+    secrets: Record<string, string | SecretRef>;
+    /** Where an `external` service is. */
+    host?: string | undefined;
+}
+/** What of a declaration the binding reads. */
+type Requirement = {
+    networkMode?: string | undefined;
+    secrets?: IServiceRequirement['secrets'] | undefined;
+    ports?: Record<string, number> | undefined;
+    docker?: unknown;
+    bareMetal?: unknown;
+};
+export declare function bindService(requirement: Requirement, override?: IServiceOverride | undefined): ServiceBinding;
+/**
+ * The credentials that are values. A reference still standing — the master
+ * did not resolve it, or the vault did not hold it — is left out, so a
+ * template needing it reports it unfilled rather than writing
+ * `[object Object]` into a config file.
+ */
+export declare function secretValues(binding: Pick<ServiceBinding, 'secrets'>): Record<string, string>;
+export {};
+//# sourceMappingURL=service-binding.d.ts.map

package/dist/infrastructure/service-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-binding.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,MAAM,YAAY,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,UAAU,GAAG,MAAM,CAAC;AAErF,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,+CAA+C;AAC/C,KAAK,WAAW,GAAG;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC3C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEF,wBAAgB,WAAW,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,EAAE,gBAAgB,GAAG,SAAS,GAAG,cAAc,CAoC7G;AAyBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7F"}

package/dist/infrastructure/service-binding.js

@@ -0,0 +1,90 @@
+/**
+ * How a stack runs a service an application declares: where, on which
+ * network, on which ports, with which credentials.
+ *
+ * Three readers answered this each for itself — the node's container
+ * resolver, its bare-metal planner, and the master's resolver of the
+ * applications' environment — and their answers had drifted apart on the
+ * one service where being wrong costs money. Measured against the test
+ * stack, which runs Bitcoin on mainnet (2026-09-23):
+ *
+ *   - nothing chose between a declaration's `docker` and `bareMetal` blocks:
+ *     a node given the service would make the container AND plan the unit;
+ *   - the bare-metal templates took their credentials from the
+ *     application's declaration — `omni_regtest` / `omni_regtest_dev_password`,
+ *     in git — whatever network the stack ran;
+ *   - the applications' environment for a service provisioned on the node
+ *     read the same declaration: the regtest port and the regtest password,
+ *     beside `BITCOIN_NETWORK=mainnet`.
+ *
+ * One answer now, and one rule for credentials: an application's own
+ * `secrets` belong to the network it declares — a laptop's. A stack that
+ * runs another network gives its own (`serviceOverrides.<name>.secrets`,
+ * vault references), and a credential it does not give is missing, not
+ * borrowed from the laptop.
+ */
+export function bindService(requirement, override) {
+    const networkMode = override?.networkMode ?? requirement.networkMode;
+    const declaredNetwork = networkMode === requirement.networkMode;
+    // The declaration's credentials serve the network it declares, and no other.
+    const own = declaredNetwork ? (requirement.secrets ?? {}) : {};
+    if (override?.disabled) {
+        return { provisioning: 'disabled', networkMode, declaredNetwork, ports: {}, secrets: {} };
+    }
+    if (override?.external) {
+        return {
+            provisioning: 'external',
+            networkMode,
+            declaredNetwork,
+            host: override.external.host,
+            ports: { ...override.external.ports },
+            secrets: { ...own, ...(override.external.secrets ?? {}) },
+        };
+    }
+    const provisioning = override?.provisioning ?? (requirement.docker ? 'docker' : requirement.bareMetal ? 'bareMetal' : 'none');
+    return {
+        provisioning,
+        networkMode,
+        declaredNetwork,
+        // The declaration's, the network's, the stack's.
+        ports: {
+            ...(requirement.ports ?? {}),
+            ...networkPorts(requirement, provisioning, networkMode),
+            ...(override?.ports ?? {}),
+        },
+        secrets: { ...own, ...(override?.secrets ?? {}) },
+    };
+}
+/**
+ * The ports a network's variant of the provisioning block names —
+ * `docker.variants.mainnet.ports`, `bareMetal.variants.mainnet.ports`.
+ *
+ * paysys declares Bitcoin's per network (testnet 18332/18333, mainnet
+ * 8332/8333) and monerod's for mainnet (18081/18080) in its docker variants,
+ * and nothing read them (2026-09-23): a stack running Bitcoin on mainnet in
+ * a container would have published, addressed and health-checked regtest's
+ * 18443 while the daemon listened on 8332, and a stack running it on the
+ * node had to repeat 8332 in its own override.
+ */
+function networkPorts(requirement, provisioning, networkMode) {
+    const block = provisioning === 'docker' ? requirement.docker : provisioning === 'bareMetal' ? requirement.bareMetal : undefined;
+    if (!networkMode || !block || typeof block !== 'object')
+        return {};
+    const variants = block.variants;
+    return { ...(variants?.[networkMode]?.ports ?? {}) };
+}
+/**
+ * The credentials that are values. A reference still standing — the master
+ * did not resolve it, or the vault did not hold it — is left out, so a
+ * template needing it reports it unfilled rather than writing
+ * `[object Object]` into a config file.
+ */
+export function secretValues(binding) {
+    const values = {};
+    for (const [key, value] of Object.entries(binding.secrets)) {
+        if (typeof value === 'string')
+            values[key] = value;
+    }
+    return values;
+}
+//# sourceMappingURL=service-binding.js.map

package/dist/infrastructure/service-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-binding.js","sourceRoot":"","sources":["../../src/infrastructure/service-binding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AA+BH,MAAM,UAAU,WAAW,CAAC,WAAwB,EAAE,QAAuC;IAC3F,MAAM,WAAW,GAAG,QAAQ,EAAE,WAAW,IAAI,WAAW,CAAC,WAAW,CAAC;IACrE,MAAM,eAAe,GAAG,WAAW,KAAK,WAAW,CAAC,WAAW,CAAC;IAChE,6EAA6E;IAC7E,MAAM,GAAG,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACvB,OAAO;YACL,YAAY,EAAE,UAAU;YACxB,WAAW;YACX,eAAe;YACf,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;YAC5B,KAAK,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE;YACrC,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE;SAC1D,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAChB,QAAQ,EAAE,YAAY,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAE3G,OAAO;QACL,YAAY;QACZ,WAAW;QACX,eAAe;QACf,iDAAiD;QACjD,KAAK,EAAE;YACL,GAAG,CAAC,WAAW,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5B,GAAG,YAAY,CAAC,WAAW,EAAE,YAAY,EAAE,WAAW,CAAC;YACvD,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;SAC3B;QACD,OAAO,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,YAAY,CACnB,WAAwB,EACxB,YAA0B,EAC1B,WAA+B;IAE/B,MAAM,KAAK,GACT,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpH,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,QAAQ,GAAI,KAAuF,CAAC,QAAQ,CAAC;IACnH,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;AACvD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAwC;IACnE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/infrastructure/service-credentials.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Credentials for the services a stack provisions.
+ *
+ * Presets carry defaults — `minioadmin/minioadmin`, `postgres/postgres`,
+ * `omnitron/omnitron` — because a preset has to work before anyone
+ * configures anything, and on a laptop behind loopback that is the right
+ * trade. On a server it is not, and nothing turned it into anything else:
+ * a stack deployed to a public host ran its object store and its database
+ * on the credentials printed in this repository.
+ *
+ * Two things had to be true for generated credentials to be usable, and
+ * both are the whole design here:
+ *
+ *   1. STABLE. A Postgres data directory keeps the password it was
+ *      initialised with. Generating a new one on the next provision
+ *      produces a database that rejects its own application, and the
+ *      symptom is an authentication failure that looks like a bad config.
+ *      So a generated secret is written to the vault on first use and read
+ *      back forever after — the generation happens once, the resolution
+ *      happens every time.
+ *
+ *   2. LOCAL TO THE NODE. The vault is the daemon's, and the daemon that
+ *      creates the container is the node's. A master that generated these
+ *      would have to transmit them, which puts a password on the wire to
+ *      solve a problem that does not exist: the node is the only party that
+ *      needs it.
+ *
+ * What is NOT here: rotation. Changing a live database's password is a
+ * migration, not a config change, and pretending otherwise by regenerating
+ * on some schedule produces exactly the failure point 1 describes.
+ */
+/** Where a service's credential lives in the vault. */
+export declare function credentialKey(project: string, stack: string, service: string, secret: string): string;
+/**
+ * Secrets that are still whatever the preset shipped.
+ *
+ * Only these are generated. A value an operator wrote is theirs — including
+ * a weak one, because silently replacing a configured password with a
+ * random one produces a service nobody can log into and no message saying
+ * why.
+ */
+export declare function needsGenerating(declared: Record<string, string> | undefined, presetDefaults: Record<string, string>): string[];
+export declare function isCredential(name: string): boolean;
+/**
+ * A password with no encoding surprises in it.
+ *
+ * base64url rather than base64: these values travel through connection
+ * strings, YAML, docker `-e` arguments and shell here-documents, and `+`,
+ * `/` and `=` each mean something to at least one of those. 32 bytes is 256
+ * bits — the length is not the interesting part, the alphabet is.
+ */
+export declare function generateSecret(bytes?: number): string;
+export interface CredentialStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+}
+/**
+ * Fill in a service's credentials, generating what has never been set.
+ *
+ * Returns the secrets the container should be created with. Idempotent: the
+ * second call returns what the first one stored.
+ */
+export declare function resolveServiceCredentials(options: {
+    project: string;
+    stack: string;
+    service: string;
+    presetDefaults: Record<string, string>;
+    declared?: Record<string, string> | undefined;
+    vault: CredentialStore;
+}): Promise<Record<string, string>>;
+/**
+ * A copy of the config with generated credentials filled in.
+ *
+ * Applied to the RAW config, before expansion, because the preset registry
+ * builds each container's environment from these values at expand time — a
+ * secret substituted afterwards would be in the requirement and not in the
+ * container.
+ *
+ * Only the sugar blocks. A service declared the long way, with an explicit
+ * `secrets` map, was configured by someone who was looking at it.
+ */
+export interface CredentialOptions {
+    project: string;
+    stack: string;
+    vault: CredentialStore;
+    /**
+     * Whether this service already holds state initialised with some other
+     * password.
+     *
+     * A Postgres data directory keeps the password it was created with and
+     * ignores `POSTGRES_PASSWORD` thereafter. Generating one for a service
+     * that already has a volume produces an application holding a credential
+     * the database has never heard of — a failure that reads as a bad config
+     * and is fixed by neither side.
+     *
+     * So generation happens at FIRST provision, where the volume and the
+     * vault entry are created together and cannot disagree. A deployment that
+     * predates this keeps what it has, and is told.
+     */
+    hasExistingState?: ((service: string) => Promise<boolean>) | undefined;
+    /** Told when an existing deployment is left on a default credential. */
+    onLeftOnDefault?: ((service: string, field: string) => void) | undefined;
+}
+export declare function withGeneratedCredentials<T extends Record<string, any>>(config: T, options: CredentialOptions): Promise<T>;
+//# sourceMappingURL=service-credentials.d.ts.map

package/dist/infrastructure/service-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-credentials.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAIH,uDAAuD;AACvD,wBAAgB,aAAa,CAC3B,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,MAAM,CAER;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC5C,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACrC,MAAM,EAAE,CAMV;AAYD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAK,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChD;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,KAAK,EAAE,eAAe,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAoBlC;AAgBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,eAAe,CAAC;IACvB;;;;;;;;;;;;;OAaG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IACvE,wEAAwE;IACxE,eAAe,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED,wBAAsB,wBAAwB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1E,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,CAAC,CAAC,CAiCZ"}