@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/infrastructure/bare-metal-runner.js

@@ -0,0 +1,354 @@
+/**
+ * Carrying out a bare-metal plan on the host it was planned for.
+ *
+ * Runs where the service runs — inside the node's own daemon, beside the
+ * container reconciler — so there is no second machine's view of the state
+ * and no shell quoting between the decision and the act. Every command is
+ * an argv array through `execFile`: none of these values is ever spliced
+ * into a shell string, because several of them are credentials and one of
+ * them is a whole config file.
+ *
+ * The observation half is here too, because "is it installed" and "is the
+ * unit active" are questions only the host can answer, and answering them
+ * wrongly is how a reconciler restarts a healthy service.
+ */
+export async function observeBareMetal(spec, host) {
+    const [installed, userExists, dataDirExists, unit, configContent] = await Promise.all([
+        // No `validateCommand` means "assume present": the declaration did not
+        // give a way to check, and guessing "absent" would run an install every
+        // pass.
+        spec.validateCommand ? host.shell(spec.validateCommand, { timeoutMs: 15_000 }).then((r) => r.ok) : Promise.resolve(true),
+        spec.user ? host.run(['id', '-u', spec.user]).then((r) => r.ok) : Promise.resolve(true),
+        spec.dataDir ? host.exists(spec.dataDir) : Promise.resolve(true),
+        observeUnit(spec.systemdUnit, host),
+        spec.configFile ? host.readFile(spec.configFile) : Promise.resolve(null),
+    ]);
+    const unitPath = spec.systemdUnit ? (spec.unitFile ?? `/etc/systemd/system/${spec.systemdUnit}.service`) : null;
+    const unitContent = spec.unitContent !== undefined && unitPath ? await host.readFile(unitPath) : null;
+    const adoption = spec.adopt && spec.dataDir ? await observeAdoption(spec.adopt, spec.dataDir, spec.configFile, host) : undefined;
+    return {
+        installed,
+        userExists,
+        dataDirExists,
+        unitKnown: unit.known,
+        unitActive: unit.active,
+        unitEnabled: unit.enabled,
+        configContent,
+        unitContent,
+        ...(adoption ? { adoption } : {}),
+    };
+}
+/** Both ends of a takeover, whether they share a filesystem, and the unit that ran the chain. */
+async function observeAdoption(adopt, dataDir, configFile, host) {
+    // One entry, not a listing: a chain directory holds thousands.
+    const holds = (path) => host.run(['find', path, '-mindepth', '1', '-maxdepth', '1', '-print', '-quit']).then((r) => r.ok && r.stdout.trim() !== '');
+    const device = (path) => host.run(['stat', '-c', '%d', path]).then((r) => (r.ok ? r.stdout.trim() : null));
+    const config = configFile?.slice(configFile.lastIndexOf('/') + 1);
+    const [sourceHeld, targetHeld, fromDevice, toDevice, configBeside, replaced] = await Promise.all([
+        holds(adopt.from),
+        holds(dataDir),
+        device(adopt.from),
+        // Where the chain would land: the data directory, which may be a mount
+        // of its own, or — not there yet — the directory it goes in.
+        device(dataDir).then((d) => d ?? device(dataDir.slice(0, dataDir.lastIndexOf('/')) || '/')),
+        config ? host.exists(`${adopt.from}/${config}`) : Promise.resolve(false),
+        adopt.replaces ? observeUnit(adopt.replaces, host) : Promise.resolve(null),
+    ]);
+    return { sourceHeld, targetHeld, sameFilesystem: fromDevice !== null && fromDevice === toDevice, configBeside, replaced };
+}
+async function observeUnit(unit, host) {
+    if (!unit)
+        return { known: false, active: false, enabled: false };
+    // One call, three answers. `systemctl show` succeeds for a unit systemd
+    // has never heard of and answers `LoadState=not-found`, which is the
+    // difference between "not installed" and "installed and stopped" — and
+    // `is-active` alone cannot tell them apart.
+    const shown = await host.run(['systemctl', 'show', unit, '-p', 'LoadState', '-p', 'ActiveState', '-p', 'UnitFileState']);
+    const read = (key) => new RegExp(`^${key}=(.*)$`, 'm').exec(shown.stdout)?.[1]?.trim() ?? '';
+    return {
+        known: read('LoadState') === 'loaded',
+        // Up, or on its way: another `start` changes neither. Read as down, a
+        // unit still `activating` — a daemon loading a chain's index — or
+        // mid-`reload` was planned to start again on every pass.
+        active: ['active', 'activating', 'reloading'].includes(read('ActiveState')),
+        // `static` and `enabled-runtime` are both "it will come up"; only
+        // `disabled` and `masked` are not.
+        enabled: ['enabled', 'enabled-runtime', 'static', 'indirect'].includes(read('UnitFileState')),
+    };
+}
+export async function applyBareMetal(actions, host, logger, service) {
+    const applied = [];
+    for (const action of actions) {
+        try {
+            await applyOne(action, host);
+            applied.push(action);
+            logger.info({ service, action: describe(action) }, 'Bare-metal service reconciled');
+        }
+        catch (err) {
+            // Stopped at the first failure, deliberately: these actions are
+            // ordered by dependency — an account before what it owns, a config
+            // before the restart that reads it — so continuing past one runs the
+            // rest against a state they were not planned for.
+            logger.error({ service, action: describe(action), error: err.message }, 'Bare-metal reconcile step failed — stopping before the steps that depend on it');
+            return { applied, failed: { action, error: err.message } };
+        }
+    }
+    return { applied, failed: null };
+}
+async function applyOne(action, host) {
+    switch (action.type) {
+        case 'install': {
+            // The one place a declared string is run as a command line: package
+            // installation is written by an operator as a shell line and has no
+            // faithful argv form.
+            const r = await host.shell(action.command, { timeoutMs: 20 * 60_000 });
+            if (!r.ok)
+                throw new Error(`install failed: ${firstLine(r.stderr || r.stdout)}`);
+            return;
+        }
+        case 'create-user': {
+            // A service account, not a person: no login shell, no home, no
+            // password. `--system` keeps it out of the human uid range.
+            const r = await host.run(['useradd', '--system', '--no-create-home', '--shell', '/usr/sbin/nologin', action.user]);
+            if (!r.ok && !/already exists/i.test(r.stderr)) {
+                throw new Error(`could not create user ${action.user}: ${firstLine(r.stderr)}`);
+            }
+            return;
+        }
+        case 'disable-unit': {
+            const r = await host.run(['systemctl', 'disable', action.unit]);
+            if (!r.ok)
+                throw new Error(`could not disable ${action.unit}: ${firstLine(r.stderr)}`);
+            return;
+        }
+        case 'adopt-data-dir': {
+            // A rename or nothing: across filesystems it fails, rather than start
+            // copying a chain inside a reconcile pass.
+            await host.rename(action.from, action.to);
+            if (action.setAside) {
+                await host.rename(`${action.to}/${action.setAside.file}`, `${action.to}/${action.setAside.as}`);
+            }
+            if (action.owner) {
+                const owned = await host.run(['chown', '-R', `${action.owner}:${action.owner}`, action.to], {
+                    timeoutMs: 5 * 60_000,
+                });
+                if (!owned.ok)
+                    throw new Error(`could not give ${action.to} to ${action.owner}: ${firstLine(owned.stderr)}`);
+            }
+            await closeToOthers(action.to, host);
+            return;
+        }
+        case 'create-data-dir': {
+            const made = await host.run(['mkdir', '-p', action.path]);
+            if (!made.ok)
+                throw new Error(`could not create ${action.path}: ${firstLine(made.stderr)}`);
+            if (action.owner) {
+                const owned = await host.run(['chown', '-R', `${action.owner}:${action.owner}`, action.path]);
+                if (!owned.ok)
+                    throw new Error(`could not give ${action.path} to ${action.owner}: ${firstLine(owned.stderr)}`);
+            }
+            // Not group- or world-readable: a chain directory holds a wallet's
+            // neighbourhood even when it holds no wallet.
+            await closeToOthers(action.path, host);
+            return;
+        }
+        case 'write-config':
+            await host.writeFile(action.path, action.content, { mode: action.mode, owner: action.owner });
+            return;
+        case 'write-unit':
+            // 0644 and root-owned: systemd refuses to read a unit that is group-
+            // or world-writable, and a unit holds no secret — the config it points
+            // at does.
+            await host.writeFile(action.path, action.content, { mode: '0644' });
+            return;
+        case 'daemon-reload': {
+            const r = await host.run(['systemctl', 'daemon-reload']);
+            if (!r.ok)
+                throw new Error(`could not reload systemd: ${firstLine(r.stderr)}`);
+            return;
+        }
+        case 'enable-unit': {
+            const r = await host.run(['systemctl', 'enable', action.unit]);
+            if (!r.ok)
+                throw new Error(`could not enable ${action.unit}: ${firstLine(r.stderr)}`);
+            return;
+        }
+        // Queued, not waited for. A start waits for everything the unit is
+        // ordered after and, for some types, for the daemon to say it is ready;
+        // the test node's bitcoind start was cut at this pass's 120 s with no
+        // reason given (2026-09-23), while systemd went on starting it. Whether
+        // it came up is the next observation's question, and its health check's.
+        case 'start-unit': {
+            const r = await host.run(['systemctl', 'start', '--no-block', action.unit]);
+            if (!r.ok)
+                throw new Error(`could not start ${action.unit}: ${firstLine(r.stderr)}`);
+            return;
+        }
+        case 'restart-unit': {
+            const r = await host.run(['systemctl', 'restart', '--no-block', action.unit]);
+            if (!r.ok)
+                throw new Error(`could not restart ${action.unit}: ${firstLine(r.stderr)}`);
+            return;
+        }
+        default: {
+            // An action this runner cannot perform is a failed step, never a done
+            // one: the reconcile loop counts whatever returns here as applied.
+            const unexpected = action;
+            throw new Error(`unknown bare-metal action: ${JSON.stringify(unexpected)}`);
+        }
+    }
+}
+/** 0750 on a data directory — and a refusal said as one, not a directory left open and called done. */
+async function closeToOthers(path, host) {
+    const r = await host.run(['chmod', '750', path]);
+    if (!r.ok)
+        throw new Error(`could not close ${path} to other accounts: ${firstLine(r.stderr)}`);
+}
+export function describe(action) {
+    switch (action.type) {
+        case 'install': return `install (${firstLine(action.command)})`;
+        case 'write-unit': return `write unit ${action.path}`;
+        case 'daemon-reload': return 'reload systemd';
+        case 'create-user': return `create service account ${action.user}`;
+        case 'disable-unit': return `disable ${action.unit} — ${action.because}`;
+        case 'adopt-data-dir':
+            return (`take over ${action.from} as ${action.to}` +
+                (action.setAside ? `, its ${action.setAside.file} kept as ${action.setAside.as}` : '') +
+                (action.owner ? `, owned by ${action.owner}` : ''));
+        case 'create-data-dir': return `create ${action.path}`;
+        case 'write-config': return `write ${action.path} (${action.mode})`;
+        case 'enable-unit': return `enable ${action.unit}`;
+        case 'start-unit': return `start ${action.unit}`;
+        case 'restart-unit': return `restart ${action.unit} — ${action.because}`;
+        default: {
+            const unexpected = action;
+            return `unknown action ${JSON.stringify(unexpected)}`;
+        }
+    }
+}
+function firstLine(text) {
+    return (text ?? '').split('\n')[0]?.trim() ?? '';
+}
+// =============================================================================
+// The host this daemon is running on
+// =============================================================================
+/**
+ * A command that did not succeed, with words for why.
+ *
+ * `stderr ?? message` kept a killed command's empty stderr — `''` is not
+ * nullish — and every step built on it said «could not start bitcoind: »
+ * and stopped there (the test node, 2026-09-23, at exactly the 120 s the
+ * command was given).
+ */
+function failed(err, timeoutMs) {
+    const e = err;
+    const why = e.killed ? `no answer in ${timeoutMs} ms, stopped` : e.stderr?.trim() || e.message?.trim() || 'failed';
+    return { ok: false, stdout: String(e.stdout ?? ''), stderr: why };
+}
+/**
+ * A `HostRunner` for the machine this process is on.
+ *
+ * `provisionStack` executes on the node, so "the host" is local: no SSH, no
+ * quoting, and no second machine's idea of what is installed.
+ *
+ * Writes are atomic and never pass through a shell. A config file is created
+ * with its final permissions BEFORE anything is written into it — created
+ * 0644 and chmod-ed afterwards leaves a window in which credentials are
+ * world-readable, and a window is all a `while :; do cat` loop needs.
+ */
+export function localHost() {
+    return {
+        async run(argv, options) {
+            const { execFile } = await import('node:child_process');
+            const { promisify } = await import('node:util');
+            const execFileAsync = promisify(execFile);
+            const [command, ...args] = argv;
+            if (!command)
+                return { ok: false, stdout: '', stderr: 'no command' };
+            const timeoutMs = options?.timeoutMs ?? 30_000;
+            try {
+                const { stdout, stderr } = await execFileAsync(command, args, { encoding: 'utf-8', timeout: timeoutMs });
+                return { ok: true, stdout: String(stdout), stderr: String(stderr) };
+            }
+            catch (err) {
+                return failed(err, timeoutMs);
+            }
+        },
+        async shell(command, options) {
+            const { exec } = await import('node:child_process');
+            const { promisify } = await import('node:util');
+            const execAsync = promisify(exec);
+            const timeoutMs = options?.timeoutMs ?? 30_000;
+            try {
+                const { stdout, stderr } = await execAsync(command, { encoding: 'utf-8', timeout: timeoutMs });
+                return { ok: true, stdout: String(stdout), stderr: String(stderr) };
+            }
+            catch (err) {
+                return failed(err, timeoutMs);
+            }
+        },
+        async readFile(path) {
+            const fs = await import('node:fs/promises');
+            try {
+                return await fs.readFile(path, 'utf-8');
+            }
+            catch {
+                return null;
+            }
+        },
+        async writeFile(path, content, options) {
+            const fs = await import('node:fs/promises');
+            const nodePath = await import('node:path');
+            // Every directory this makes is 0755. `mkdir`'s own mode is cut by the
+            // daemon's umask, which nothing sets: under 027 a config's directory
+            // came out 0750 root:root, and the account it was written for could
+            // not reach it. Every level, not the one `mkdir` returns — that is the
+            // topmost it made. A directory that was already there is someone's.
+            const dir = nodePath.dirname(path);
+            const made = await fs.mkdir(dir, { recursive: true });
+            if (made !== undefined) {
+                for (let level = dir;; level = nodePath.dirname(level)) {
+                    await fs.chmod(level, 0o755);
+                    if (level === made || level === nodePath.dirname(level))
+                        break;
+                }
+            }
+            // Same directory as the destination so the rename is atomic — across
+            // filesystems it is a copy, and a copy is not.
+            const staging = `${path}.omnitron-${process.pid}`;
+            const mode = Number.parseInt(options.mode, 8);
+            await fs.writeFile(staging, content, { mode, encoding: 'utf-8' });
+            await fs.chmod(staging, mode);
+            if (options.owner) {
+                const { execFile } = await import('node:child_process');
+                const { promisify } = await import('node:util');
+                try {
+                    await promisify(execFile)('chown', [`${options.owner}:${options.owner}`, staging]);
+                }
+                catch (err) {
+                    // Left as it was written, it is root's, 0640 — a file its own
+                    // account cannot read, reported as written.
+                    await fs.rm(staging, { force: true });
+                    const e = err;
+                    throw new Error(`could not give ${path} to ${options.owner}: ${firstLine(e.stderr?.trim() || e.message || '')}`);
+                }
+            }
+            await fs.rename(staging, path);
+        },
+        async exists(path) {
+            const fs = await import('node:fs/promises');
+            try {
+                await fs.access(path);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+        async rename(from, to) {
+            const fs = await import('node:fs/promises');
+            await fs.rename(from, to);
+        },
+    };
+}
+//# sourceMappingURL=bare-metal-runner.js.map

package/dist/infrastructure/bare-metal-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bare-metal-runner.js","sourceRoot":"","sources":["../../src/infrastructure/bare-metal-runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AA2BH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAAmB,EAAE,IAAgB;IAC1E,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpF,uEAAuE;QACvE,wEAAwE;QACxE,QAAQ;QACR,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACxH,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QACvF,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAChE,WAAW,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;QACnC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KACzE,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,uBAAuB,IAAI,CAAC,WAAW,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtG,MAAM,QAAQ,GACZ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElH,OAAO;QACL,SAAS;QACT,UAAU;QACV,aAAa;QACb,SAAS,EAAE,IAAI,CAAC,KAAK;QACrB,UAAU,EAAE,IAAI,CAAC,MAAM;QACvB,WAAW,EAAE,IAAI,CAAC,OAAO;QACzB,aAAa;QACb,WAAW;QACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,iGAAiG;AACjG,KAAK,UAAU,eAAe,CAC5B,KAA0C,EAC1C,OAAe,EACf,UAA8B,EAC9B,IAAgB;IAEhB,+DAA+D;IAC/D,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9H,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAElE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC/F,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QACjB,KAAK,CAAC,OAAO,CAAC;QACd,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAClB,uEAAuE;QACvE,6DAA6D;QAC7D,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC3F,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC;QACxE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;KAC3E,CAAC,CAAC;IAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,EAAE,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AAC5H,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAwB,EACxB,IAAgB;IAEhB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAElE,wEAAwE;IACxE,qEAAqE;IACrE,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IACzH,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAErG,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ;QACrC,sEAAsE;QACtE,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3E,kEAAkE;QAClE,mCAAmC;QACnC,OAAO,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;KAC9F,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAmC,EACnC,IAAgB,EAChB,MAAe,EACf,OAAe;IAEf,MAAM,OAAO,GAAsB,EAAE,CAAC;IAEtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,gEAAgE;YAChE,mEAAmE;YACnE,qEAAqE;YACrE,kDAAkD;YAClD,MAAM,CAAC,KAAK,CACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EACpE,gFAAgF,CACjF,CAAC;YACF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAuB,EAAE,IAAgB;IAC/D,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS,EAAE,CAAC;YACf,oEAAoE;YACpE,oEAAoE;YACpE,sBAAsB;YACtB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,OAAO;QACT,CAAC;QAED,KAAK,aAAa,EAAE,CAAC;YACnB,+DAA+D;YAC/D,4DAA4D;YAC5D,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACnH,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,OAAO;QACT,CAAC;QAED,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAChE,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QAED,KAAK,gBAAgB,EAAE,CAAC;YACtB,sEAAsE;YACtE,2CAA2C;YAC3C,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC1C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE;oBAC1F,SAAS,EAAE,CAAC,GAAG,MAAM;iBACtB,CAAC,CAAC;gBACH,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YACrC,OAAO;QACT,CAAC;QAED,KAAK,iBAAiB,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5F,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC9F,IAAI,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,mEAAmE;YACnE,8CAA8C;YAC9C,MAAM,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QAED,KAAK,cAAc;YACjB,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9F,OAAO;QAET,KAAK,YAAY;YACf,qEAAqE;YACrE,uEAAuE;YACvE,WAAW;YACX,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO;QAET,KAAK,eAAe,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,KAAK,aAAa,EAAE,CAAC;YACnB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QAED,mEAAmE;QACnE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,yEAAyE;QACzE,KAAK,YAAY,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,KAAK,cAAc,EAAE,CAAC;YACpB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9E,IAAI,CAAC,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvF,OAAO;QACT,CAAC;QACD,SAAS,CAAC;YACR,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;AACH,CAAC;AAED,uGAAuG;AACvG,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,IAAgB;IACzD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,uBAAuB,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAAuB;IAC9C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,SAAS,EAAE,OAAO,YAAY,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QAChE,KAAK,YAAY,EAAE,OAAO,cAAc,MAAM,CAAC,IAAI,EAAE,CAAC;QACtD,KAAK,eAAe,EAAE,OAAO,gBAAgB,CAAC;QAC9C,KAAK,aAAa,EAAE,OAAO,0BAA0B,MAAM,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,cAAc,EAAE,OAAO,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzE,KAAK,gBAAgB;YACnB,OAAO,CACL,aAAa,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,EAAE,EAAE;gBAC1C,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtF,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACnD,CAAC;QACJ,KAAK,iBAAiB,EAAE,OAAO,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC;QACvD,KAAK,cAAc,EAAE,OAAO,SAAS,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC;QACpE,KAAK,aAAa,EAAE,OAAO,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC;QACnD,KAAK,YAAY,EAAE,OAAO,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,KAAK,cAAc,EAAE,OAAO,WAAW,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACzE,SAAS,CAAC;YACR,MAAM,UAAU,GAAU,MAAM,CAAC;YACjC,OAAO,kBAAkB,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,gFAAgF;AAChF,qCAAqC;AACrC,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,MAAM,CAAC,GAAY,EAAE,SAAiB;IAC7C,MAAM,CAAC,GAAG,GAA+E,CAAC;IAC1F,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,gBAAgB,SAAS,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;IACnH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AACpE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS;IACvB,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO;YACrB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC1C,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;YAChC,IAAI,CAAC,OAAO;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;YACrE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACzG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO;YAC1B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACpD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,MAAM,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC1C,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO;YACpC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAE3C,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,uEAAuE;YACvE,oEAAoE;YACpE,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,KAAK,IAAI,KAAK,GAAG,GAAG,GAAI,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACxD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;oBAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,MAAM;gBACjE,CAAC;YACH,CAAC;YAED,qEAAqE;YACrE,+CAA+C;YAC/C,MAAM,OAAO,GAAG,GAAG,IAAI,aAAa,OAAO,CAAC,GAAG,EAAE,CAAC;YAClD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC9C,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YAClE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAE9B,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBACxD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;gBAChD,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;gBACrF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8DAA8D;oBAC9D,4CAA4C;oBAC5C,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBACtC,MAAM,CAAC,GAAG,GAA4C,CAAC;oBACvD,MAAM,IAAI,KAAK,CACb,kBAAkB,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAChG,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACjC,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACtB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/infrastructure/config-payload.d.ts

@@ -0,0 +1,149 @@
+/**
+ * A container's configuration files, carried to the node that will run it.
+ *
+ * A stack's gateway is configured by files — an nginx template, an entrypoint,
+ * Lua modules, a maintenance page — and the resolver mounts them from the
+ * MASTER's filesystem: `${projectRoot}/infra/nginx/...`. That works while the
+ * container runs on the master.
+ *
+ * On a node it cannot. The node has no copy of the project: measured on the
+ * test server, `ls -d /root/sample /opt/sample` finds nothing, and
+ * `sample-test-gateway` came up with an empty `Mounts` array, a null entrypoint,
+ * zero `UPSTREAM_*` variables and the stock `default.conf` baked into the
+ * image. Its onion answered HTTP 200 with `Welcome to OpenResty!` — the
+ * gateway's own page, because the gateway had never been told what to proxy.
+ *
+ * So the files travel with the request that asks for the container. They are
+ * small — the sample gateway's six files are 65 KB — and they are text that
+ * already crosses the wire as part of a config; carrying them is cheaper than
+ * the alternatives (a git checkout on every node, a second image per stack, a
+ * shared filesystem) and has no state to drift.
+ *
+ * The node writes them under its own root and mounts its own copies, so a
+ * container's spec on a node names paths that exist on that node. Nothing
+ * here reaches back to the master at container start.
+ */
+/** One file, as it travels. */
+export interface ConfigFile {
+    /** Path relative to the config directory — `nginx.conf`, `lua/auth_rate.lua`. */
+    path: string;
+    content: string;
+    /** Octal, as a string. Directories are created 0755 regardless. */
+    mode: string;
+}
+/**
+ * The files one service needs, addressed by the service they belong to.
+ *
+ * Keyed by service name rather than by container name: the node computes its
+ * own container names from its own prefix, and a payload keyed on a name the
+ * master chose would be a second opinion about naming — the exact defect the
+ * `project`/`stack` fields on `provisionStack` exist to prevent.
+ */
+export type ConfigPayload = Record<string, ConfigFile[]>;
+/**
+ * Whether a relative path is safe to write under a root.
+ *
+ * A payload arrives over RPC from another daemon, and a path is the one field
+ * that can leave the directory it is supposed to stay in. Absolute paths,
+ * `..` segments and anything resolving above the root are refused rather than
+ * sanitised: a path that needed fixing was not the path the sender meant, and
+ * silently rewriting it turns a mistake into a different file.
+ */
+export declare function isSafeRelativePath(p: string): boolean;
+/**
+ * Octal mode strings this accepts.
+ *
+ * Exactly four octal digits, and the first — the setuid/setgid/sticky digit —
+ * must be `0`. A config file has no business carrying setuid, and a payload
+ * that asks for it is either a mistake or an attempt.
+ *
+ * My first version of this read `!/^0[4267]/`, which tests the second digit —
+ * the OWNER permission — so it rejected every ordinary mode (`0644`, `0755`,
+ * `0600`) and accepted `0111`. It was wrong in both directions at once, and
+ * only running it on real values showed that: the regex looked right, and a
+ * predicate that looks right is the kind that ships.
+ */
+export declare function isSafeMode(mode: string): boolean;
+/**
+ * A fingerprint of a service's files.
+ *
+ * Folded into the container's spec hash by the caller, so a changed template
+ * recreates the container. Without it a corrected nginx.conf reaches the node,
+ * is written to disk, and the container that has the old one mounted keeps
+ * running with it — the same shape as a corrected health check that never
+ * reaches anything already running.
+ */
+export declare function configFilesHash(files: readonly ConfigFile[]): string;
+/** Total bytes of a payload, for the bound the transport needs. */
+export declare function payloadBytes(payload: ConfigPayload): number;
+/**
+ * The most a payload may carry, in bytes.
+ *
+ * Config files are text and few. A directory that grew a build output, a log
+ * or a data file is not a config directory any more, and shipping it through
+ * an RPC call would turn one provisioning request into a transfer nobody
+ * budgeted for. The sample gateway, the largest real one, is 65 KB.
+ */
+export declare const MAX_PAYLOAD_BYTES: number;
+/**
+ * Validate a payload received over RPC.
+ *
+ * Returns the reasons it is not acceptable — empty means it is. Every check is
+ * on the RECEIVING side, because that is the side that has to live with the
+ * answer: a sender that has been tampered with, or is simply older, is exactly
+ * the case where the sender's own validation is not evidence.
+ */
+export declare function validatePayload(payload: unknown): string[];
+/**
+ * Where a node keeps the config files a master sent it.
+ *
+ * Under the daemon's own home, partitioned by project and stack, because two
+ * stacks on one node have two gateways with two different templates and the
+ * only thing distinguishing them is which stack asked. Same reasoning as the
+ * container prefix: without it the second stack overwrites the first's
+ * configuration and reconciles a container towards a spec nobody declared.
+ */
+export declare function nodeConfigRoot(home: string, project: string, stack: string, service: string): string;
+/**
+ * Write one service's files under a root, and report where they landed.
+ *
+ * Validated first, entirely, before anything is written: a payload with one
+ * bad path must not leave half a configuration on disk, because a gateway
+ * that starts with four of its six files is worse than one that does not
+ * start — it serves something, and what it serves is nobody's intention.
+ *
+ * Files this wrote before and are no longer in the payload are removed, so a
+ * Lua module deleted upstream stops being mounted here. A stale file in a
+ * config directory is read by the thing that globs the directory, which is how
+ * a removed rule keeps applying.
+ */
+export declare function writeConfigFiles(root: string, files: readonly ConfigFile[], host: {
+    writeFile(path: string, content: string, options: {
+        mode: string;
+    }): Promise<void>;
+}, remove: (path: string) => Promise<void>, list: (dir: string) => Promise<string[]>): Promise<{
+    root: string;
+    written: string[];
+}>;
+/**
+ * Read a service's config directory into a payload, on the master.
+ *
+ * Walks the directory the resolver would have mounted. Refused paths are
+ * skipped with a reason rather than aborting: a project that happens to have
+ * a `.git` inside its nginx directory should still get a working gateway, and
+ * the operator should be told what was left behind.
+ */
+export declare function readConfigDirectory(dir: string, fs: {
+    readdir(d: string): Promise<Array<{
+        name: string;
+        isDirectory(): boolean;
+    }>>;
+    readFile(p: string): Promise<string>;
+    stat(p: string): Promise<{
+        mode: number;
+    }>;
+}): Promise<{
+    files: ConfigFile[];
+    skipped: string[];
+}>;
+//# sourceMappingURL=config-payload.d.ts.map

package/dist/infrastructure/config-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-payload.d.ts","sourceRoot":"","sources":["../../src/infrastructure/config-payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,+BAA+B;AAC/B,MAAM,WAAW,UAAU;IACzB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAezD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CASrD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAMpE;AAED,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,OAAO,EAAE,aAAa,GAAG,MAAM,CAM3D;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,QAAkB,CAAC;AAEjD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,EAAE,CAgC1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAGpG;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,SAAS,UAAU,EAAE,EAC5B,IAAI,EAAE;IAAE,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,EAC5F,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EACvC,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC,GACvC,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgB9C;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,EAAE,EAAE;IACF,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,IAAI,OAAO,CAAA;KAAE,CAAC,CAAC,CAAC;IAC7E,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC5C,GACA,OAAO,CAAC;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAyBrD"}