@omnitron-dev/omnitron 0.2.0 → 0.3.0

package/dist/infrastructure/service-credentials.js

@@ -0,0 +1,141 @@
+/**
+ * Credentials for the services a stack provisions.
+ *
+ * Presets carry defaults — `minioadmin/minioadmin`, `postgres/postgres`,
+ * `omnitron/omnitron` — because a preset has to work before anyone
+ * configures anything, and on a laptop behind loopback that is the right
+ * trade. On a server it is not, and nothing turned it into anything else:
+ * a stack deployed to a public host ran its object store and its database
+ * on the credentials printed in this repository.
+ *
+ * Two things had to be true for generated credentials to be usable, and
+ * both are the whole design here:
+ *
+ *   1. STABLE. A Postgres data directory keeps the password it was
+ *      initialised with. Generating a new one on the next provision
+ *      produces a database that rejects its own application, and the
+ *      symptom is an authentication failure that looks like a bad config.
+ *      So a generated secret is written to the vault on first use and read
+ *      back forever after — the generation happens once, the resolution
+ *      happens every time.
+ *
+ *   2. LOCAL TO THE NODE. The vault is the daemon's, and the daemon that
+ *      creates the container is the node's. A master that generated these
+ *      would have to transmit them, which puts a password on the wire to
+ *      solve a problem that does not exist: the node is the only party that
+ *      needs it.
+ *
+ * What is NOT here: rotation. Changing a live database's password is a
+ * migration, not a config change, and pretending otherwise by regenerating
+ * on some schedule produces exactly the failure point 1 describes.
+ */
+import { randomBytes } from 'node:crypto';
+/** Where a service's credential lives in the vault. */
+export function credentialKey(project, stack, service, secret) {
+    return `infra:${project}:${stack}:${service}:${secret}`;
+}
+/**
+ * Secrets that are still whatever the preset shipped.
+ *
+ * Only these are generated. A value an operator wrote is theirs — including
+ * a weak one, because silently replacing a configured password with a
+ * random one produces a service nobody can log into and no message saying
+ * why.
+ */
+export function needsGenerating(declared, presetDefaults) {
+    return Object.keys(presetDefaults).filter((key) => {
+        const value = declared?.[key];
+        // Unset, or exactly the default the preset ships.
+        return value === undefined || value === presetDefaults[key];
+    });
+}
+/**
+ * Secrets whose names are identity rather than credential.
+ *
+ * A username is not a secret: it appears in connection strings, in logs, in
+ * `psql -U`, and generating one produces a service an operator cannot reach
+ * by hand when something is wrong. Only the values that authenticate are
+ * generated.
+ */
+const IDENTITY_SECRETS = new Set(['user', 'username', 'accessKey']);
+export function isCredential(name) {
+    return !IDENTITY_SECRETS.has(name);
+}
+/**
+ * A password with no encoding surprises in it.
+ *
+ * base64url rather than base64: these values travel through connection
+ * strings, YAML, docker `-e` arguments and shell here-documents, and `+`,
+ * `/` and `=` each mean something to at least one of those. 32 bytes is 256
+ * bits — the length is not the interesting part, the alphabet is.
+ */
+export function generateSecret(bytes = 32) {
+    return randomBytes(bytes).toString('base64url');
+}
+/**
+ * Fill in a service's credentials, generating what has never been set.
+ *
+ * Returns the secrets the container should be created with. Idempotent: the
+ * second call returns what the first one stored.
+ */
+export async function resolveServiceCredentials(options) {
+    const { project, stack, service, presetDefaults, declared, vault } = options;
+    const resolved = { ...presetDefaults, ...(declared ?? {}) };
+    for (const name of needsGenerating(declared, presetDefaults)) {
+        if (!isCredential(name))
+            continue;
+        const key = credentialKey(project, stack, service, name);
+        const existing = await vault.get(key);
+        if (existing) {
+            resolved[name] = existing;
+            continue;
+        }
+        const generated = generateSecret();
+        await vault.set(key, generated);
+        resolved[name] = generated;
+    }
+    return resolved;
+}
+// =============================================================================
+// Applying this to a stack's infrastructure config
+// =============================================================================
+/** The three sugar blocks that carry credentials, and which field is which. */
+const SUGAR_CREDENTIALS = [
+    { service: 'postgres', field: 'password', defaultValue: 'postgres' },
+    { service: 'minio', field: 'secretKey', defaultValue: 'minioadmin' },
+    // Redis has no default password at all: the preset ships none, and a
+    // redis with no `requirepass` accepts anyone who reaches it. On loopback
+    // that is the documented posture; generating one here would be a second
+    // opinion about a service the preset deliberately leaves open.
+];
+export async function withGeneratedCredentials(config, options) {
+    const next = { ...config };
+    for (const { service, field, defaultValue } of SUGAR_CREDENTIALS) {
+        const block = next[service];
+        if (!block || typeof block !== 'object')
+            continue;
+        const declared = block[field];
+        // A reference into the vault is resolved by the vault, not by us.
+        if (declared !== undefined && typeof declared !== 'string')
+            continue;
+        if (declared !== undefined && declared !== defaultValue)
+            continue;
+        const key = credentialKey(options.project, options.stack, service, field);
+        const existing = await options.vault.get(key);
+        if (existing) {
+            next[service] = { ...block, [field]: existing };
+            continue;
+        }
+        // Nothing in the vault: either this is the first provision, or the
+        // service predates generated credentials. The volume answers which.
+        if (options.hasExistingState && (await options.hasExistingState(service))) {
+            options.onLeftOnDefault?.(service, field);
+            continue;
+        }
+        const secret = generateSecret();
+        await options.vault.set(key, secret);
+        next[service] = { ...block, [field]: secret };
+    }
+    return next;
+}
+//# sourceMappingURL=service-credentials.js.map

package/dist/infrastructure/service-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-credentials.js","sourceRoot":"","sources":["../../src/infrastructure/service-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,uDAAuD;AACvD,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,KAAa,EACb,OAAe,EACf,MAAc;IAEd,OAAO,SAAS,OAAO,IAAI,KAAK,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA4C,EAC5C,cAAsC;IAEtC,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;QAC9B,kDAAkD;QAClD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;AAEpE,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,KAAK,GAAG,EAAE;IACvC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAO/C;IACC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IAC7E,MAAM,QAAQ,GAA2B,EAAE,GAAG,cAAc,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;IAEpF,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;QAC7D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,SAAS;QAElC,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,mDAAmD;AACnD,gFAAgF;AAEhF,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG;IACxB,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE;IACpE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE;IACpE,qEAAqE;IACrE,yEAAyE;IACzE,wEAAwE;IACxE,+DAA+D;CACvD,CAAC;AAoCX,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAS,EACT,OAA0B;IAE1B,MAAM,IAAI,GAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAEhD,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAElD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAC9B,kEAAkE;QAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,SAAS;QACrE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,YAAY;YAAE,SAAS;QAElE,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAE9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QAED,mEAAmE;QACnE,oEAAoE;QACpE,IAAI,OAAO,CAAC,gBAAgB,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC1E,OAAO,CAAC,eAAe,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;QAChC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,IAAS,CAAC;AACnB,CAAC"}

package/dist/infrastructure/service-resolver.d.ts

@@ -12,6 +12,81 @@ import type { InfrastructureConfig, GatewayServiceConfig, ResolvedContainer, ISe
 export declare function setContainerPrefix(project: string, env: string): void;
 /** Get current prefix */
 export declare function getContainerPrefix(): string;
+/**
+ * A named volume two services of one stack mount by the same name:
+ * `source: 'shared:gateway-socket'` is `<prefix>-gateway-socket` wherever it
+ * is declared.
+ *
+ * Every other named volume is its service's — `<prefix>-<service>-<key>`,
+ * whatever its `source` says — so nothing a stack could write gave two
+ * containers one volume. The onion needed exactly that: Tor resolved
+ * `daos-test-gateway` once, at start, and on 2026-09-26 a deploy gave the
+ * gateway's old address to Nominatim; for ~10 minutes the onion served
+ * Nominatim's Apache and nobody could sign in. A unix socket on a volume
+ * both containers mount has no address to go stale.
+ */
+export declare const SHARED_VOLUME_PREFIX = "shared:";
+/**
+ * Where to PUBLISH the gateway, which is not where it listens.
+ *
+ * After preset expansion `ports` holds CONTAINER ports — openresty's
+ * `defaultPorts.http` is 80, because that is what the image listens on — and
+ * a port named in the config becomes a HOST mapping under
+ * `docker.portMappings`. Reading `ports.http` takes the first for the second,
+ * so a stack asking for 8080 gets a gateway published on 80.
+ *
+ * Measured on the dev stand: `omnitron.config.ts` declares
+ * `gateway.ports.http = 8080` and its own comment says ":8080" three times,
+ * while `daos-dev-gateway` published `80/tcp -> 0.0.0.0:80`. The consequence
+ * is quiet rather than loud — a browser arriving on :80 sends
+ * `Origin: http://localhost` with no port, which is not in the gateway's
+ * allow-list, so the portal cannot call the API through it at all. The portal
+ * is reachable on 7080, so nothing complained.
+ *
+ * `resolveServiceRequirement` has read it correctly all along:
+ * `host: docker.portMappings?.[name] ?? containerPort`. Same expression here,
+ * because it is the same question — and a port the preset does not declare
+ * really is a container port, which is why the fallback is not a mistake.
+ */
+export declare function gatewayHostPort(service: {
+    ports?: Record<string, number> | undefined;
+    docker?: {
+        portMappings?: Record<string, number> | undefined;
+    } | undefined;
+} | undefined, legacy: {
+    port?: number | undefined;
+} | undefined): number;
+/**
+ * How one managed container reaches another.
+ *
+ * Every container omnitron provisions joins the stack's named network, and
+ * the network exists so they can address each other by name — the comment on
+ * `networkName` below says exactly that. The gateway did not: it was given
+ * `host.docker.internal` and the HOST-published port, and went out to the
+ * host and back.
+ *
+ * That works on a developer's Mac, where `host.docker.internal` reaches the
+ * host's loopback. It cannot work on a Linux node, where `host-gateway`
+ * resolves to the docker0 bridge address and omnitron publishes every managed
+ * port on `127.0.0.1` — deliberately, so a container is not reachable from
+ * the LAN. Measured on the test node: the gateway sat on 172.19.0.2, redis on
+ * 172.19.0.4 of the same network, and every request the gateway served spent
+ * 200ms on `lua tcp socket connect timed out, upstream: 172.17.0.1:6379`
+ * before failing open. The hardening that bound the ports closed this path,
+ * and the only evidence was a warning nobody was reading.
+ *
+ * The port is the CONTAINER port for the same reason the host is a container
+ * name: a stack whose redis is published on 6380 still listens on 6379
+ * inside. Host and port are one decision and are answered here together,
+ * because answering half of it is how a correct name ends up on the wrong
+ * port.
+ */
+export declare function containerEndpoint(service: string, containerPort: number): {
+    host: string;
+    port: number;
+};
+/** Redis, as a container on the stack network sees it. */
+export declare const REDIS_CONTAINER_PORT = 6379;
 /**
  * Convention-derived managed network name.
  *
@@ -47,21 +122,14 @@ export declare function applyManagedDefaults(spec: ResolvedContainer): ResolvedC
 export declare function setStackLabels(project: string, stack: string): void;
 /** Clear stack labels (for internal/global containers) */
 export declare function clearStackLabels(): void;
-/**
- * Resolve an app-declared IServiceRequirement into a ResolvedContainer.
- * Applies networkMode variant selection and stack-level overrides.
- *
- * Returns null if:
- * - No Docker config (external-only service)
- * - Service is disabled by stack override
- * - Stack override provides an external address
- */
-export declare function resolveServiceRequirement(serviceName: string, requirement: IServiceRequirement, override?: IServiceOverride, appName?: string): ResolvedContainer | null;
+export declare function resolveServiceRequirement(serviceName: string, requirement: IServiceRequirement, override?: IServiceOverride, appName?: string, 
+/** Where each service's shipped config directory is on THIS machine — see `shipped-config.ts`. */
+configRoots?: ReadonlyMap<string, string>): ResolvedContainer | null;
 /**
  * Resolve all app-declared infrastructure services into ResolvedContainer[].
  * Respects dependsOn ordering — dependencies come first.
  */
-export declare function resolveAppInfrastructure(infrastructure: Record<string, IServiceRequirement>, overrides?: Record<string, IServiceOverride>, appName?: string): ResolvedContainer[];
+export declare function resolveAppInfrastructure(infrastructure: Record<string, IServiceRequirement>, overrides?: Record<string, IServiceOverride>, appName?: string, configRoots?: ReadonlyMap<string, string>): ResolvedContainer[];
 /**
  * Omnitron's own PostgreSQL container for internal data (logs, metrics,
  * alerts, portal users, deployments, cluster state).
@@ -81,6 +149,28 @@ export declare function resolveOmnitronPg(options?: {
  *
  * Port 9800 (public) → nginx → port 9801 (internal daemon HTTP)
  */
+/**
+ * A digest of every file a container mounts from under `root`.
+ *
+ * `configFilesHash` was written for this — its docblock says it is «folded
+ * into the container's spec hash by the caller, so a changed template
+ * recreates the container» — and had no caller. So a node wrote each new
+ * nginx.conf over the old one and kept serving the old one: the gateway
+ * renders its template once, at start, and a reconcile that compares volume
+ * PATHS saw nothing to do. The test gateway was recreated only when its
+ * static bundle changed, which carried the config along by accident.
+ *
+ * Taken from the volumes themselves rather than a list of file names, so a
+ * mount added later is covered without anyone remembering this function.
+ * Read from disk on the machine that will run the container: on a node that
+ * is the copy just written from the master's payload, on a master the
+ * project's own files. Synchronous, because the resolver is — and small: the
+ * daos gateway's files are 65 KB, read once per provision.
+ *
+ * `undefined` when there is nothing under `root` to read, or it cannot be
+ * read — the spec hash then stays what it was without this.
+ */
+export declare function mountedConfigDigest(root: string, volumes: ResolvedContainer['volumes']): string | undefined;
 /**
  * Resolve API gateway container (OpenResty + Lua).
  *
@@ -91,6 +181,15 @@ export declare function resolveOmnitronPg(options?: {
  * @param redisConfig  Stack's Redis connection info (host, port, password)
  * @param projectRoot  Absolute path to project root (for resolving configDir)
  */
+/**
+ * The gateway's config as the stack declares it: every field `resolveGateway`
+ * reads, the preset's block first and the legacy `infrastructure.gateway`
+ * after. The stack manager used to hand it two of them — `configDir` and
+ * `staticDir` — so `env`, declared on `GatewayServiceConfig` as «passed to the
+ * gateway container», reached nothing, and `volumes`, which carries the
+ * onion's socket, would have reached nothing either.
+ */
+export declare function gatewayConfigOf(presetConfig: Readonly<Record<string, unknown>> | undefined, legacy: Partial<GatewayServiceConfig> | undefined, port: number, redisDb: number): GatewayServiceConfig;
 export declare function resolveGateway(config: GatewayServiceConfig, redisConfig: {
     host: string;
     port: number;
@@ -106,6 +205,8 @@ export declare function resolveOmnitronNginx(options?: {
     internalApiPort?: number;
     image?: string;
     webappDistPath?: string;
+    /** Interface to publish on. Loopback unless the caller says otherwise. */
+    bindHost?: string;
 }): ResolvedContainer;
 /**
  * Resolve an InfrastructureConfig into a list of concrete container specs.
@@ -120,5 +221,52 @@ export declare function resolveOmnitronNginx(options?: {
  * Resolve an InfrastructureConfig into concrete container specs.
  * Uses preset-normalized services map — all services go through resolveServiceRequirement().
  */
-export declare function resolveInfrastructure(_config: InfrastructureConfig, normalizedServices?: Record<string, IServiceRequirement>): ResolvedContainer[];
+export declare function resolveInfrastructure(_config: InfrastructureConfig, normalizedServices?: Record<string, IServiceRequirement>, 
+/**
+ * Stack overrides — `disabled`, `external`, per-service docker changes.
+ *
+ * This did not take them, and `resolveAppInfrastructure` was called
+ * without them, so `serviceOverrides` was honoured for services an
+ * APPLICATION declares and read by nothing for the ones a stack declares.
+ * An operator writing `tiles: { disabled: true }` got tiles.
+ *
+ * Measured on the test server: a stack that disabled the geocoder and the
+ * tile server provisioned both — a geocoding database that can reach tens
+ * of gigabytes, on a host chosen for a payment system.
+ */
+overrides?: Record<string, IServiceOverride>, 
+/**
+ * Where a service's config files live on THIS machine, by service name.
+ *
+ * The gateway is not an ordinary preset container: it needs four bind
+ * mounts, an entrypoint and fifteen upstream variables, and `resolveGateway`
+ * is the only thing that produces them. On a master they come from the
+ * project root; on a node there is no project, so the files are sent over
+ * and written locally, and this names where.
+ *
+ * Without it a node built its gateway through the generic preset path —
+ * whose own `defaultDocker` comment says "Volumes and entrypoint configured
+ * by resolveGateway" — and got bare openresty: an empty `Mounts` array, a
+ * null entrypoint, zero UPSTREAM variables, and an onion serving
+ * `Welcome to OpenResty!`.
+ */
+configRoots?: Map<string, string>, gatewayContext?: {
+    redis: {
+        host: string;
+        port: number;
+        db: number;
+        password?: string;
+    };
+    port?: number;
+    /** Where each service's static content lives on THIS machine. */
+    staticRoots?: Map<string, string>;
+    /**
+     * The static ROOT per service, when the delivery made a
+     * `current-<project>-<stack>` link inside it. Only a NODE sends this: on a
+     * master `staticDir` is a path inside the project (daos declares
+     * `apps/portal/dist`), and mounting ITS parent would put `src/` and
+     * `node_modules` under the web root.
+     */
+    staticLinkRoots?: Map<string, string>;
+}): ResolvedContainer[];
 //# sourceMappingURL=service-resolver.d.ts.map

package/dist/infrastructure/service-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAMD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAG/E;AASD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAWD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,GAAG,IAAI,CAyE1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,GACf,iBAAiB,EAAE,CA0BrB;AAiFD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CAgEnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GAAG,iBAAiB,CAwCpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GACvD,iBAAiB,EAAE,CAKrB"}
+{"version":3,"file":"service-resolver.d.ts","sourceRoot":"","sources":["../../src/infrastructure/service-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EAEnB,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AAepB,iEAAiE;AACjE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAErE;AAED,yBAAyB;AACzB,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAgC9C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,EAC/I,MAAM,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAAG,SAAS,GAChD,MAAM,CAER;AAMD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAExG;AAED,0DAA0D;AAC1D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAEzC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CA8B/E;AASD,+DAA+D;AAC/D,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOnE;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AA8ED,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,mBAAmB,EAChC,QAAQ,CAAC,EAAE,gBAAgB,EAC3B,OAAO,CAAC,EAAE,MAAM;AAChB,kGAAkG;AAClG,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,iBAAiB,GAAG,IAAI,CA0F1B;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CACtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EACnD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAC5C,OAAO,CAAC,EAAE,MAAM,EAChB,WAAW,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GACxC,iBAAiB,EAAE,CA0BrB;AA8FD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,iBAAiB,CAuCpB;AAMD;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,CAAC,SAAS,CAAC,GAAG,MAAM,GAAG,SAAS,CAuB3G;AAED;;;;;;;;;GASG;AACH;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAC7B,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,EAC3D,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,GAAG,SAAS,EACjD,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,oBAAoB,CActB;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,oBAAoB,EAC5B,WAAW,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,EAC1E,WAAW,EAAE,MAAM,GAClB,iBAAiB,CA+HnB;AAMD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,iBAAiB,CA6CpB;AAMD;;;;;;;;GAQG;AACH;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,oBAAoB,EAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;AACxD;;;;;;;;;;;GAWG;AACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC;AAC5C;;;;;;;;;;;;;;GAcG;AACH,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EACjC,cAAc,CAAC,EAAE;IACf,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iEAAiE;IACjE,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACA,iBAAiB,EAAE,CAyDrB"}