@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/infrastructure/host-ingress-lock.js

@@ -0,0 +1,36 @@
+import { spawn } from 'node:child_process';
+/** Linux kernel lock, released on process death. No stale PID-file deletion race. */
+export const withIngressLock = async (file, body) => {
+    if (process.platform !== 'linux')
+        throw new Error('Host ingress publication requires Linux with util-linux flock');
+    const child = spawn('flock', ['--exclusive', '--timeout', '30', file, 'sh', '-c', 'printf "locked\\n"; cat >/dev/null'], { stdio: ['pipe', 'pipe', 'pipe'] });
+    child.stdin.on('error', () => { });
+    let errorText = '';
+    child.stderr.on('data', (chunk) => { errorText = (errorText + chunk.toString()).slice(-4096); });
+    const ended = new Promise((resolve) => { child.once('close', () => resolve()); child.once('error', () => resolve()); });
+    try {
+        await new Promise((resolve, reject) => {
+            const timer = setTimeout(() => { child.kill(); reject(new Error('Host ingress lock timed out')); }, 35_000);
+            let output = '';
+            child.once('error', (error) => { clearTimeout(timer); reject(error); });
+            child.once('close', () => { clearTimeout(timer); reject(new Error(`Host ingress lock unavailable: ${errorText}`)); });
+            child.stdout.on('data', (chunk) => {
+                output += chunk.toString();
+                if (output === 'locked\n') {
+                    clearTimeout(timer);
+                    resolve();
+                }
+                else if (output.length > 32) {
+                    clearTimeout(timer);
+                    reject(new Error('Unexpected host ingress lock response'));
+                }
+            });
+        });
+        return await body();
+    }
+    finally {
+        child.stdin.end();
+        await ended;
+    }
+};
+//# sourceMappingURL=host-ingress-lock.js.map

package/dist/infrastructure/host-ingress-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-lock.js","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAG3C,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAgB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnH,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,oCAAoC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9J,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClC,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,SAAS,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9H,IAAI,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC5G,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBACxC,MAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC3B,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;oBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAAC,OAAO,EAAE,CAAC;gBAAC,CAAC;qBACzD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;oBAAC,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAAC,CAAC;YACnH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,MAAM,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAClB,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC,CAAC"}

package/dist/infrastructure/host-ingress-runtime.d.ts

@@ -0,0 +1,25 @@
+import type { HostIngressRuntime, HostIngressSettings, HostIngressTakeover, HostIngressTakeoverSnapshot } from './host-ingress-types.js';
+export type IngressExec = (file: string, args: string[]) => Promise<string>;
+export declare const HOST_INGRESS_CONTAINER = "omnitron-host-ingress";
+export declare class DockerHostIngressRuntime implements HostIngressRuntime {
+    private readonly root;
+    private readonly exec;
+    constructor(root: string, exec?: IngressExec);
+    inspectTakeover(settings: HostIngressSettings, descriptor: HostIngressTakeover): Promise<HostIngressTakeoverSnapshot>;
+    quiesceTakeover(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    restoreTakeover(settings: HostIngressSettings, snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    verifyRetiredTakeover(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    private labels;
+    inspect(settings: HostIngressSettings): Promise<{
+        exists: boolean;
+        running: boolean;
+    }>;
+    private common;
+    validate(settings: HostIngressSettings, generation: string): Promise<void>;
+    activate(settings: HostIngressSettings): Promise<void>;
+    private listening;
+    observed(settings: HostIngressSettings): Promise<string | null>;
+    acknowledge(settings: HostIngressSettings, generation: string): Promise<void>;
+    remove(settings: HostIngressSettings): Promise<void>;
+}
+//# sourceMappingURL=host-ingress-runtime.d.ts.map

package/dist/infrastructure/host-ingress-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-runtime.d.ts","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-runtime.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAGzI,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAC5E,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAK9D,qBAAa,wBAAyB,YAAW,kBAAkB;IACrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAU,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAhE,YAA6B,IAAI,EAAE,MAAM,EAAmB,IAAI,GAAE,WAAoH,EAAI;IACpL,eAAe,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,wCAAgF;IAC9J,eAAe,CAAC,QAAQ,EAAE,2BAA2B,iBAAoE;IACzH,eAAe,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,2BAA2B,iBAA8E;IAClK,qBAAqB,CAAC,QAAQ,EAAE,2BAA2B,iBAA0E;IAC3I,OAAO,CAAC,MAAM;IAGR,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAiB3F;IACD,OAAO,CAAC,MAAM;IAGR,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/E;IACK,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAY3D;IACD,OAAO,CAAC,SAAS;IAQjB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAU9D;IACK,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOlF;IACK,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEzD;CACF"}

package/dist/infrastructure/host-ingress-runtime.js

@@ -0,0 +1,114 @@
+import { DockerIngressTakeover } from './host-ingress-takeover.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { createHash } from 'node:crypto';
+import http from 'node:http';
+import net from 'node:net';
+const execute = promisify(execFile);
+export const HOST_INGRESS_CONTAINER = 'omnitron-host-ingress';
+const binary = '/usr/local/openresty/bin/openresty';
+const mount = '/etc/omnitron-ingress';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+export class DockerHostIngressRuntime {
+    root;
+    exec;
+    constructor(root, exec = async (file, args) => (await execute(file, args, { timeout: 120_000, maxBuffer: 1024 * 1024 })).stdout) {
+        this.root = root;
+        this.exec = exec;
+    }
+    async inspectTakeover(settings, descriptor) { return new DockerIngressTakeover(this.exec).inspect(settings, descriptor); }
+    async quiesceTakeover(snapshot) { return new DockerIngressTakeover(this.exec).quiesce(snapshot); }
+    async restoreTakeover(settings, snapshot) { return new DockerIngressTakeover(this.exec).restore(settings, snapshot); }
+    async verifyRetiredTakeover(snapshot) { return new DockerIngressTakeover(this.exec).verifyRetired(snapshot); }
+    labels(settings) {
+        return { 'omnitron.host-ingress': 'true', 'omnitron.host-ingress.owner': hash(this.root), 'omnitron.host-ingress.settings': hash(JSON.stringify(settings)) };
+    }
+    async inspect(settings) {
+        let raw;
+        try {
+            raw = await this.exec('docker', ['inspect', '--type', 'container', HOST_INGRESS_CONTAINER]);
+        }
+        catch (error) {
+            const message = String(error);
+            if (/No such (object|container):/i.test(message))
+                return { exists: false, running: false };
+            throw error;
+        }
+        const rows = JSON.parse(raw);
+        const c = rows[0];
+        if (rows.length !== 1 || !c || Object.entries(this.labels(settings)).some(([k, v]) => c.Config?.Labels?.[k] !== v)
+            || c.Config?.Image !== settings.image || c.HostConfig?.NetworkMode !== 'host'
+            || !c.Mounts?.some((m) => m.Type === 'bind' && m.Source === this.root && m.Destination === mount && m.RW === false)
+            || c.Config?.Labels?.['omnitron.managed'] !== undefined || c.Config?.Labels?.['omnitron.project'] !== undefined || c.Config?.Labels?.['omnitron.stack'] !== undefined
+            || JSON.stringify(c.Config?.Entrypoint) !== JSON.stringify([binary])
+            || JSON.stringify(c.Config?.Cmd) !== JSON.stringify(['-c', `${mount}/current/nginx.conf`, '-g', 'daemon off;'])
+            || c.HostConfig?.ReadonlyRootfs !== true)
+            throw new Error('Refusing foreign or differently configured host ingress container');
+        return { exists: true, running: c.State?.Running === true };
+    }
+    common() {
+        return ['--pull', 'never', '--network', 'host', '--read-only', '--tmpfs', '/tmp:rw,noexec,nosuid,size=64m', '--memory', '256m', '--cpus', '1', '--pids-limit', '64', '--security-opt', 'no-new-privileges', '--mount', `type=bind,source=${this.root},target=${mount},readonly`, '--entrypoint', binary];
+    }
+    async validate(settings, generation) {
+        await this.inspect(settings);
+        await this.exec('docker', ['run', '--rm', ...this.common(), settings.image, '-t', '-c', `${mount}/generations/${generation}/nginx.conf`]);
+    }
+    async activate(settings) {
+        const state = await this.inspect(settings);
+        if (state.running) {
+            await this.exec('docker', ['exec', HOST_INGRESS_CONTAINER, binary, '-c', `${mount}/current/nginx.conf`, '-s', 'reload']);
+            return;
+        }
+        if (state.exists) {
+            await this.exec('docker', ['start', HOST_INGRESS_CONTAINER]);
+            return;
+        }
+        for (const port of [settings.httpPort, settings.httpsPort, settings.controlPort]) {
+            if (await this.listening(port))
+                throw new Error(`Host ingress listener port ${port} is already occupied`);
+        }
+        const labels = Object.entries(this.labels(settings)).flatMap(([k, v]) => ['--label', `${k}=${v}`]);
+        await this.exec('docker', ['run', '-d', '--name', HOST_INGRESS_CONTAINER, '--restart', 'unless-stopped', '--log-opt', 'max-size=10m', '--log-opt', 'max-file=3', ...labels, ...this.common(), settings.image, '-c', `${mount}/current/nginx.conf`, '-g', 'daemon off;']);
+    }
+    listening(port) {
+        return new Promise((resolve, reject) => {
+            const socket = net.connect({ host: '127.0.0.1', port });
+            socket.once('connect', () => { socket.destroy(); resolve(true); });
+            socket.once('error', (error) => { socket.destroy(); if (error.code === 'ECONNREFUSED')
+                resolve(false);
+            else
+                reject(error); });
+            socket.setTimeout(1000, () => { socket.destroy(); reject(new Error(`Listener probe timed out on ${port}`)); });
+        });
+    }
+    observed(settings) {
+        return new Promise((resolve) => {
+            const request = http.get({ host: '127.0.0.1', port: settings.controlPort, path: '/generation', agent: false, headers: { Connection: 'close' }, timeout: 1000 }, (response) => {
+                let body = '';
+                response.setEncoding('utf8');
+                response.on('data', (chunk) => { body += chunk; if (body.length > 128) {
+                    response.destroy();
+                    resolve(null);
+                } });
+                response.on('error', () => resolve(null));
+                response.on('end', () => resolve(response.statusCode === 200 && /^[1-9][0-9]*-[a-f0-9]{16}$/.test(body) ? body : null));
+            });
+            request.on('timeout', () => request.destroy());
+            request.on('error', () => resolve(null));
+        });
+    }
+    async acknowledge(settings, generation) {
+        const deadline = Date.now() + 10_000;
+        do {
+            if ((await this.observed(settings)) === generation)
+                return;
+            await new Promise((resolve) => setTimeout(resolve, 100));
+        } while (Date.now() < deadline);
+        throw new Error(`Host ingress did not acknowledge generation ${generation}`);
+    }
+    async remove(settings) {
+        if ((await this.inspect(settings)).exists)
+            await this.exec('docker', ['rm', '-f', HOST_INGRESS_CONTAINER]);
+    }
+}
+//# sourceMappingURL=host-ingress-runtime.js.map

package/dist/infrastructure/host-ingress-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-runtime.js","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAC9D,MAAM,MAAM,GAAG,oCAAoC,CAAC;AACpD,MAAM,KAAK,GAAG,uBAAuB,CAAC;AACtC,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjF,MAAM,OAAO,wBAAwB;IACN,IAAI;IAA2B,IAAI;IAAhE,YAA6B,IAAY,EAAmB,IAAI,GAAgB,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM;oBAAzJ,IAAI;oBAA2B,IAAI;IAAyH,CAAC;IAC1L,KAAK,CAAC,eAAe,CAAC,QAA6B,EAAE,UAA+B,IAAI,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACpK,KAAK,CAAC,eAAe,CAAC,QAAqC,IAAI,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC/H,KAAK,CAAC,eAAe,CAAC,QAA6B,EAAE,QAAqC,IAAI,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxK,KAAK,CAAC,qBAAqB,CAAC,QAAqC,IAAI,OAAO,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnI,MAAM,CAAC,QAA6B;QAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,6BAA6B,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,gCAAgC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;IAC/J,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAA6B;QACzC,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YAAC,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAAC,CAAC;QACpG,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,8BAA8B,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAC3F,MAAM,KAAK,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;eAC7G,CAAC,CAAC,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,UAAU,EAAE,WAAW,KAAK,MAAM;eAC1E,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,KAAK,IAAI,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC;eACrH,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,kBAAkB,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,gBAAgB,CAAC,KAAK,SAAS;eAClK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;eACjE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,qBAAqB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;eAC5G,CAAC,CAAC,UAAU,EAAE,cAAc,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACjI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;IAC9D,CAAC;IACO,MAAM;QACZ,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,gCAAgC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,oBAAoB,IAAI,CAAC,IAAI,WAAW,KAAK,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;IAC3S,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,QAA6B,EAAE,UAAkB;QAC9D,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,KAAK,gBAAgB,UAAU,aAAa,CAAC,CAAC,CAAC;IAC5I,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,QAA6B;QAC1C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,sBAAsB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,KAAK,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;YACzH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3F,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACjF,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,sBAAsB,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,sBAAsB,EAAE,WAAW,EAAE,gBAAgB,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,qBAAqB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAC3Q,CAAC;IACO,SAAS,CAAC,IAAY;QAC5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,OAAO,CAAC,KAAK,CAAC,CAAC;;gBAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrJ,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,CAAC,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,CAAC,QAA6B;QACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC3K,IAAI,IAAI,GAAG,EAAE,CAAC;gBAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;gBAC5C,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,GAAG,IAAI,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzH,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1C,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1H,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,WAAW,CAAC,QAA6B,EAAE,UAAkB;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,GAAG,CAAC;YACF,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,UAAU;gBAAE,OAAO;YAC3D,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3D,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,UAAU,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,QAA6B;QACxC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAC7G,CAAC;CACF"}

package/dist/infrastructure/host-ingress-takeover.d.ts

@@ -0,0 +1,18 @@
+import type { HostIngressApplication, HostIngressSettings, HostIngressTakeover, HostIngressTakeoverSnapshot } from './host-ingress-types.js';
+type Execute = (file: string, args: string[]) => Promise<string>;
+export declare function normalizeIngressTakeover(value: unknown, app?: HostIngressApplication): HostIngressTakeover;
+export declare function normalizeIngressTakeoverSnapshot(value: unknown): HostIngressTakeoverSnapshot;
+/** Explicit first-publication handoff, never name-only adoption or container deletion. */
+export declare class DockerIngressTakeover {
+    private readonly exec;
+    constructor(exec: Execute);
+    private read;
+    probe(settings: HostIngressSettings, descriptor: HostIngressTakeover): Promise<void>;
+    inspect(settings: HostIngressSettings, descriptor: HostIngressTakeover): Promise<HostIngressTakeoverSnapshot>;
+    private bound;
+    quiesce(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    verifyRetired(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    restore(settings: HostIngressSettings, snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+}
+export {};
+//# sourceMappingURL=host-ingress-takeover.d.ts.map

package/dist/infrastructure/host-ingress-takeover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-takeover.d.ts","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-takeover.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AAE7I,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAKjE,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,sBAAsB,GAAG,mBAAmB,CAe1G;AACD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,OAAO,GAAG,2BAA2B,CAK5F;AAYD,0FAA0F;AAC1F,qBAAa,qBAAqB;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,OAAO,EAAI;YAChC,IAAI;IAMZ,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBzF;IACK,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAMlH;YACa,KAAK;IAKb,OAAO,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlE;IACK,aAAa,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxE;IACK,OAAO,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAcjG;CACF"}

package/dist/infrastructure/host-ingress-takeover.js

@@ -0,0 +1,142 @@
+import https from 'node:https';
+import { createHash, X509Certificate } from 'node:crypto';
+import { ingressDomain, ingressOwner } from './host-ingress-config.js';
+function object(value, keys) {
+    if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some((k) => !keys.includes(k)))
+        throw new Error('Invalid ingress takeover descriptor');
+    return value;
+}
+export function normalizeIngressTakeover(value, app) {
+    const r = object(value, ['containerId', 'containerName', 'expectedLabels', 'probe']);
+    if (typeof r.containerId !== 'string' || !/^[a-f0-9]{64}$/.test(r.containerId) || typeof r.containerName !== 'string' || !/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(r.containerName) || r.containerName === 'omnitron-host-ingress')
+        throw new Error('Takeover requires an exact legacy container ID and name');
+    if (!r.expectedLabels || typeof r.expectedLabels !== 'object' || Array.isArray(r.expectedLabels))
+        throw new Error('Takeover requires exact ownership labels');
+    const labels = {};
+    for (const [key, value] of Object.entries(r.expectedLabels)) {
+        if (!/^[a-zA-Z0-9][a-zA-Z0-9_.-]{0,127}$/.test(key) || typeof value !== 'string' || value.length > 256 || /[\0\r\n]/.test(value))
+            throw new Error('Invalid takeover ownership label');
+        labels[key] = value;
+    }
+    const owner = ingressOwner({ project: labels['omnitron.project'], stack: labels['omnitron.stack'], app: 'legacy-origin' });
+    if (labels['omnitron.managed'] !== 'true' || (app && (owner.project !== app.owner.project || owner.stack !== app.owner.stack)) || 'omnitron.host-ingress' in labels)
+        throw new Error('Legacy origin must belong to the declaring project and stack');
+    const p = object(r.probe, ['domain', 'path', 'status', 'certificateSha256']);
+    const domain = ingressDomain(p.domain);
+    if (app && !app.routes.some((route) => route.domains.includes(domain)))
+        throw new Error('Takeover probe hostname must belong to this application');
+    if (typeof p.path !== 'string' || !/^\/[a-zA-Z0-9_./-]*$/.test(p.path) || p.path.includes('//') || p.path.split('/').some((s) => s === '.' || s === '..') || !Number.isInteger(p.status) || p.status < 200 || p.status > 399 || typeof p.certificateSha256 !== 'string' || !/^[a-f0-9]{64}$/.test(p.certificateSha256))
+        throw new Error('Invalid pinned HTTPS takeover probe');
+    return { containerId: r.containerId, containerName: r.containerName, expectedLabels: Object.fromEntries(Object.entries(labels).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)), probe: { domain, path: p.path, status: p.status, certificateSha256: p.certificateSha256 } };
+}
+export function normalizeIngressTakeoverSnapshot(value) {
+    const r = object(value, ['descriptor', 'restartPolicy', 'image', 'wasRunning']);
+    const p = object(r.restartPolicy, ['name', 'maximumRetryCount']);
+    if (r.wasRunning !== true || typeof r.image !== 'string' || !r.image.length || typeof p.name !== 'string' || !['no', 'always', 'unless-stopped', 'on-failure'].includes(p.name) || !Number.isSafeInteger(p.maximumRetryCount) || p.maximumRetryCount < 0)
+        throw new Error('Invalid legacy origin snapshot');
+    return { descriptor: normalizeIngressTakeover(r.descriptor), restartPolicy: { name: p.name, maximumRetryCount: p.maximumRetryCount }, image: r.image, wasRunning: true };
+}
+function policy(value) {
+    if (!value || !['no', 'always', 'unless-stopped', 'on-failure'].includes(value.Name) || !Number.isSafeInteger(value.MaximumRetryCount) || value.MaximumRetryCount < 0)
+        throw new Error('Unsupported legacy restart policy');
+    return { name: value.Name, maximumRetryCount: value.MaximumRetryCount };
+}
+function same(a, b) { return JSON.stringify(a) === JSON.stringify(b); }
+/** Explicit first-publication handoff, never name-only adoption or container deletion. */
+export class DockerIngressTakeover {
+    exec;
+    constructor(exec) {
+        this.exec = exec;
+    }
+    async read(descriptor) {
+        const rows = JSON.parse(await this.exec('docker', ['inspect', '--type', 'container', descriptor.containerId]));
+        const container = rows[0];
+        if (rows.length !== 1 || !container || container.Id !== descriptor.containerId || container.Name !== `/${descriptor.containerName}` || container.HostConfig?.NetworkMode !== 'host' || container.Config?.Labels?.['omnitron.host-ingress'] !== undefined || Object.entries(descriptor.expectedLabels).some(([key, value]) => container.Config?.Labels?.[key] !== value))
+            throw new Error('Legacy origin identity or ownership changed');
+        return container;
+    }
+    async probe(settings, descriptor) {
+        await new Promise((resolve, reject) => {
+            const finish = (error) => { clearTimeout(timer); if (error)
+                reject(error);
+            else
+                resolve(); };
+            const timer = setTimeout(() => { request.destroy(); finish(new Error('Legacy origin HTTPS probe timed out')); }, 2000);
+            const request = https.get({ host: '127.0.0.1', port: settings.httpsPort, servername: descriptor.probe.domain, path: descriptor.probe.path, headers: { Host: descriptor.probe.domain }, agent: false, timeout: 2000,
+                // Trust is an explicit leaf DER pin and SAN check below, not the system CA store.
+                rejectUnauthorized: false }, (response) => {
+                try {
+                    const raw = response.socket.getPeerCertificate().raw;
+                    if (!raw || createHash('sha256').update(raw).digest('hex') !== descriptor.probe.certificateSha256)
+                        throw new Error('Legacy origin TLS fingerprint mismatch');
+                    const cert = new X509Certificate(raw);
+                    if (!cert.checkHost(descriptor.probe.domain, { subject: 'never', partialWildcards: false, multiLabelWildcards: false, singleLabelSubdomains: false }) || Date.now() < Date.parse(cert.validFrom) || Date.now() >= Date.parse(cert.validTo))
+                        throw new Error('Legacy origin TLS SAN or validity mismatch');
+                    if (response.statusCode !== descriptor.probe.status)
+                        throw new Error(`Legacy origin probe expected ${descriptor.probe.status}, received ${response.statusCode}`);
+                    response.destroy();
+                    finish();
+                }
+                catch (error) {
+                    response.destroy();
+                    finish(error);
+                }
+            });
+            request.once('error', finish);
+            request.once('timeout', () => request.destroy(new Error('Legacy origin HTTPS probe timed out')));
+        });
+    }
+    async inspect(settings, descriptor) {
+        const container = await this.read(descriptor);
+        if (container.State?.Running !== true)
+            throw new Error('Legacy origin must be running before an initial takeover');
+        const restartPolicy = policy(container.HostConfig.RestartPolicy);
+        await this.probe(settings, descriptor);
+        return { descriptor, restartPolicy, image: container.Config.Image, wasRunning: true };
+    }
+    async bound(snapshot) {
+        const container = await this.read(snapshot.descriptor);
+        if (container.Config.Image !== snapshot.image || (!same(policy(container.HostConfig.RestartPolicy), snapshot.restartPolicy) && !same(policy(container.HostConfig.RestartPolicy), { name: 'no', maximumRetryCount: 0 })))
+            throw new Error('Legacy origin configuration changed during takeover');
+        return container;
+    }
+    async quiesce(snapshot) {
+        const container = await this.bound(snapshot);
+        if (container.HostConfig.RestartPolicy.Name !== 'no')
+            await this.exec('docker', ['update', '--restart', 'no', snapshot.descriptor.containerId]);
+        if (container.State.Running)
+            await this.exec('docker', ['stop', '--time', '30', snapshot.descriptor.containerId]);
+        await this.verifyRetired(snapshot);
+    }
+    async verifyRetired(snapshot) {
+        const container = await this.bound(snapshot);
+        if (container.State.Running || container.HostConfig.RestartPolicy.Name !== 'no')
+            throw new Error('Legacy origin has not been safely retired');
+    }
+    async restore(settings, snapshot) {
+        const container = await this.bound(snapshot);
+        if (!same(policy(container.HostConfig.RestartPolicy), snapshot.restartPolicy)) {
+            const value = snapshot.restartPolicy.name === 'on-failure' && snapshot.restartPolicy.maximumRetryCount > 0 ? `on-failure:${snapshot.restartPolicy.maximumRetryCount}` : snapshot.restartPolicy.name;
+            await this.exec('docker', ['update', '--restart', value, snapshot.descriptor.containerId]);
+        }
+        if (!container.State.Running)
+            await this.exec('docker', ['start', snapshot.descriptor.containerId]);
+        const deadline = Date.now() + 10_000;
+        let last;
+        do {
+            try {
+                const current = await this.bound(snapshot);
+                if (!current.State.Running || !same(policy(current.HostConfig.RestartPolicy), snapshot.restartPolicy))
+                    throw new Error('Legacy origin is not restored');
+                await this.probe(settings, snapshot.descriptor);
+                return;
+            }
+            catch (error) {
+                last = error;
+                await new Promise((resolve) => setTimeout(resolve, 100));
+            }
+        } while (Date.now() < deadline);
+        throw new Error(`Legacy origin restore was not observed: ${String(last)}`);
+    }
+}
+//# sourceMappingURL=host-ingress-takeover.js.map

package/dist/infrastructure/host-ingress-takeover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-takeover.js","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-takeover.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAIvE,SAAS,MAAM,CAAmB,KAAc,EAAE,IAAS;IACzD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClL,OAAO,KAAoC,CAAC;AAC9C,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,KAAc,EAAE,GAA4B;IACnF,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC;IACrF,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,aAAa,KAAK,uBAAuB;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAChT,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9J,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtL,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,kBAAkB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAC3H,IAAI,MAAM,CAAC,kBAAkB,CAAC,KAAK,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,uBAAuB,IAAI,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IACrP,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAAC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrH,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACnJ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC,CAAC,MAAiB,GAAG,GAAG,IAAK,CAAC,CAAC,MAAiB,GAAG,GAAG,IAAI,OAAO,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvY,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAgB,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC;AACxR,CAAC;AACD,MAAM,UAAU,gCAAgC,CAAC,KAAc;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC;IAChF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAK,CAAC,CAAC,iBAA4B,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACxT,OAAO,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAA4D,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AAC7O,CAAC;AAMD,SAAS,MAAM,CAAC,KAA+C;IAC7D,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC5N,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAA4D,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;AAClI,CAAC;AACD,SAAS,IAAI,CAAC,CAAU,EAAE,CAAU,IAAa,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG,0FAA0F;AAC1F,MAAM,OAAO,qBAAqB;IACH,IAAI;IAAjC,YAA6B,IAAa;oBAAb,IAAI;IAAY,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,UAA+B;QAChD,MAAM,IAAI,GAAgB,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC5H,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,WAAW,IAAI,SAAS,CAAC,IAAI,KAAK,IAAI,UAAU,CAAC,aAAa,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE,WAAW,KAAK,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,uBAAuB,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACxa,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAA6B,EAAE,UAA+B;QACxE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,MAAM,GAAG,CAAC,KAAe,EAAE,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBAAM,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;YACvG,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI;gBAChN,kFAAkF;gBAClF,kBAAkB,EAAE,KAAK,EAAE,EAAE,CAAC,QAAQ,EAAE,EAAE;gBAC1C,IAAI,CAAC;oBACH,MAAM,GAAG,GAAI,QAAQ,CAAC,MAAoB,CAAC,kBAAkB,EAAE,CAAC,GAAG,CAAC;oBACpE,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,iBAAiB;wBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;oBAC7J,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;oBACtC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;wBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;oBAC1S,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,CAAC,KAAK,CAAC,MAAM;wBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,UAAU,CAAC,KAAK,CAAC,MAAM,cAAc,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;oBACjK,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAAC,MAAM,EAAE,CAAC;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;oBAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAC,CAAC;YACxD,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC,CAAC;QAClI,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,UAA+B;QAC1E,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9C,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACnH,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACvC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxF,CAAC;IACO,KAAK,CAAC,KAAK,CAAC,QAAqC;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAChS,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAAqC;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAChJ,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAClH,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,QAAqC;QACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAChJ,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,QAAqC;QAChF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,YAAY,IAAI,QAAQ,CAAC,aAAa,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,aAAa,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,CAAC;YACpM,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO;YAAE,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;QACpG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,IAAI,IAAa,CAAC;QAClB,GAAG,CAAC;YACF,IAAI,CAAC;gBAAC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,aAAa,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;gBAAC,OAAO;YAAC,CAAC;YACrQ,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAI,GAAG,KAAK,CAAC;gBAAC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;QAC3F,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QAChC,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;CACF"}

package/dist/infrastructure/host-ingress-types.d.ts

@@ -0,0 +1,173 @@
+/** Host-owned ingress has an independent lifetime from every application stack. */
+export interface HostIngressSettings {
+    /** An immutable OpenResty image reference (repository@sha256:...). */
+    image: string;
+    httpPort: number;
+    httpsPort: number;
+    controlPort: number;
+    /** Host-owned source directory. Keys are copied into immutable host snapshots. */
+    certificateRoot: string;
+    proxyPolicy: {
+        mode: 'cloudflare-only';
+        trustedCidrs: string[];
+        allowLoopbackProbes?: boolean;
+    } | {
+        mode: 'direct';
+        trustedCidrs: [];
+    };
+}
+export interface HostIngressOwner {
+    project: string;
+    stack: string;
+    app: string;
+}
+export interface HostIngressUpstream {
+    host: '127.0.0.1' | '::1';
+    port: number;
+}
+export type HostIngressLocation = {
+    path: string;
+    upstream: HostIngressUpstream;
+    stripPrefix: boolean;
+} | {
+    path: string;
+    deny: 403 | 404 | 410;
+};
+export interface HostIngressRoute {
+    domains: string[];
+    /** Request body limit; defaults to 16 MiB, maximum 128 MiB. */
+    maxBodyBytes?: number;
+    tls: {
+        certificate: string;
+        privateKey: string;
+    };
+    locations: HostIngressLocation[];
+}
+export interface HostIngressApplication {
+    owner: HostIngressOwner;
+    /** Every app/container TCP port, including non-HTTP services. */
+    reservedPorts: number[];
+    routes: HostIngressRoute[];
+}
+export interface HostIngressTakeover {
+    containerId: string;
+    containerName: string;
+    expectedLabels: Record<string, string>;
+    probe: {
+        domain: string;
+        path: string;
+        status: number;
+        certificateSha256: string;
+    };
+}
+export interface HostIngressTakeoverSnapshot {
+    descriptor: HostIngressTakeover;
+    restartPolicy: {
+        name: 'no' | 'always' | 'unless-stopped' | 'on-failure';
+        maximumRetryCount: number;
+    };
+    image: string;
+    wasRunning: true;
+}
+export interface HostIngressTakeoverRecord {
+    generation: string;
+    snapshot: HostIngressTakeoverSnapshot;
+    outcome: 'committed' | 'rolled-back';
+}
+export interface HostIngressTakeoverRollback {
+    expectedGeneration: string;
+}
+export interface HostIngressTakeoverRollbackReceipt {
+    rolledBack: true;
+    previousGeneration: string;
+    generation: null;
+    legacyContainerId: string;
+    legacyVerified: true;
+}
+export interface HostIngressApply extends HostIngressApplication {
+    expectedGeneration: string | null;
+    /** Guards the exact content recorded by a prior check/validate receipt. */
+    preparedOwnerRevision?: string;
+    /** Explicit first publication only, never implicit adoption of a listener. */
+    takeover?: HostIngressTakeover;
+}
+export interface HostIngressCheck {
+    valid: true;
+    generation: string | null;
+    owner: HostIngressOwner;
+    reservedPorts: number[];
+    domains: string[];
+    /** This read-only preflight does not replace publication's native nginx -t. */
+    nativeConfigValidated: false;
+    ownerRevision: string;
+}
+export interface HostIngressValidation extends Omit<HostIngressCheck, 'nativeConfigValidated'> {
+    nativeConfigValidated: true;
+    candidateGeneration: string;
+}
+export interface HostIngressOwnerRestore {
+    owner: HostIngressOwner;
+    fromGeneration: string | null;
+    expectedGeneration: string;
+    expectedOwnerRevision: string | null;
+}
+export interface HostIngressRemove {
+    owner: HostIngressOwner;
+    expectedGeneration: string | null;
+}
+export interface StoredIngressRoute extends HostIngressRoute {
+    certificateObject: string;
+}
+export interface StoredIngressApplication extends Omit<HostIngressApplication, 'routes'> {
+    routes: StoredIngressRoute[];
+}
+export interface HostIngressManifest {
+    version: 1;
+    generation: string;
+    sequence: number;
+    applications: StoredIngressApplication[];
+}
+export interface HostIngressStatus {
+    configured: boolean;
+    settings: HostIngressSettings | null;
+    generation: string | null;
+    applications: StoredIngressApplication[];
+    ownerRevisions: Array<{
+        owner: HostIngressOwner;
+        revision: string;
+    }>;
+    takeover: HostIngressTakeoverRecord | null;
+    observedGeneration: string | null;
+    recoveryPending: boolean;
+}
+export interface HostIngressReceipt {
+    generation: string;
+    previousGeneration: string | null;
+    observedGeneration: string;
+    changed: boolean;
+    owner: HostIngressOwner;
+    ownerRevision: string | null;
+    takeover?: {
+        containerId: string;
+        containerName: string;
+        retained: true;
+    };
+}
+export interface HostIngressRuntime {
+    inspectTakeover(settings: HostIngressSettings, descriptor: HostIngressTakeover): Promise<HostIngressTakeoverSnapshot>;
+    quiesceTakeover(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    restoreTakeover(settings: HostIngressSettings, snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    verifyRetiredTakeover(snapshot: HostIngressTakeoverSnapshot): Promise<void>;
+    /** Refuse foreign or differently configured containers; return whether ours exists. */
+    inspect(settings: HostIngressSettings): Promise<{
+        exists: boolean;
+        running: boolean;
+    }>;
+    validate(settings: HostIngressSettings, generation: string): Promise<void>;
+    activate(settings: HostIngressSettings): Promise<void>;
+    acknowledge(settings: HostIngressSettings, generation: string): Promise<void>;
+    observed(settings: HostIngressSettings): Promise<string | null>;
+    /** Used only to undo an initial failed publication; never touches another container. */
+    remove(settings: HostIngressSettings): Promise<void>;
+}
+//# sourceMappingURL=host-ingress-types.d.ts.map

package/dist/infrastructure/host-ingress-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-types.d.ts","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-types.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE;QAAE,IAAI,EAAE,iBAAiB,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,YAAY,EAAE,EAAE,CAAA;KAAE,CAAC;CACxI;AACD,MAAM,WAAW,gBAAgB;IAAG,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AACjF,MAAM,WAAW,mBAAmB;IAAG,IAAI,EAAE,WAAW,GAAG,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;CAAE,CAAC;AAC5C,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,SAAS,EAAE,mBAAmB,EAAE,CAAC;CAClC;AACD,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,gBAAgB,CAAC;IACxB,iEAAiE;IACjE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AACD,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CACpF;AACD,MAAM,WAAW,2BAA2B;IAC1C,UAAU,EAAE,mBAAmB,CAAC;IAChC,aAAa,EAAE;QAAE,IAAI,EAAE,IAAI,GAAG,QAAQ,GAAG,gBAAgB,GAAG,YAAY,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IACtG,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,IAAI,CAAC;CAClB;AACD,MAAM,WAAW,yBAAyB;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,2BAA2B,CAAC;IACtC,OAAO,EAAE,WAAW,GAAG,aAAa,CAAC;CACtC;AACD,MAAM,WAAW,2BAA2B;IAAG,kBAAkB,EAAE,MAAM,CAAA;CAAE;AAC3E,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,IAAI,CAAC;IACjB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,IAAI,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,IAAI,CAAC;CACtB;AACD,MAAM,WAAW,gBAAiB,SAAQ,sBAAsB;IAC9D,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,2EAA2E;IAC3E,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC;AACD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,IAAI,CAAC;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,+EAA+E;IAC/E,qBAAqB,EAAE,KAAK,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;CACvB;AACD,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IAC5F,qBAAqB,EAAE,IAAI,CAAC;IAC5B,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AACD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,gBAAgB,CAAC;IACxB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AACD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,gBAAgB,CAAC;IAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AACjG,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB;IAAG,iBAAiB,EAAE,MAAM,CAAA;CAAE;AAC1F,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,sBAAsB,EAAE,QAAQ,CAAC;IAAG,MAAM,EAAE,kBAAkB,EAAE,CAAA;CAAE;AACzH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,CAAC,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,wBAAwB,EAAE,CAAC;CAC1C;AACD,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,wBAAwB,EAAE,CAAC;IACzC,cAAc,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,gBAAgB,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,QAAQ,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC3C,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe,EAAE,OAAO,CAAC;CAC1B;AACD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,EAAE,gBAAgB,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC;CAC3E;AACD,MAAM,WAAW,kBAAkB;IACjC,eAAe,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,mBAAmB,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IACtH,eAAe,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,eAAe,CAAC,QAAQ,EAAE,mBAAmB,EAAE,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG,qBAAqB,CAAC,QAAQ,EAAE,2BAA2B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5E,uFAAuF;IACvF,OAAO,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACvF,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,WAAW,CAAC,QAAQ,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAChE,wFAAwF;IACxF,MAAM,CAAC,QAAQ,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACtD"}

package/dist/infrastructure/host-ingress-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=host-ingress-types.js.map

package/dist/infrastructure/host-ingress-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress-types.js","sourceRoot":"","sources":["../../src/infrastructure/host-ingress-types.ts"],"names":[],"mappings":""}

package/dist/infrastructure/host-ingress.service.d.ts

@@ -0,0 +1,47 @@
+import { type IngressLock } from './host-ingress-lock.js';
+import type { HostIngressApply, HostIngressCheck, HostIngressReceipt, HostIngressRemove, HostIngressRuntime, HostIngressSettings, HostIngressStatus, HostIngressValidation, HostIngressOwnerRestore, HostIngressTakeoverRollback, HostIngressTakeoverRollbackReceipt, StoredIngressApplication } from './host-ingress-types.js';
+export declare function ingressOwnerRevision(app: StoredIngressApplication): string;
+/** Host-owned state; neither daemon shutdown nor app teardown removes this service. */
+export declare class HostIngressService {
+    private readonly lock;
+    readonly root: string;
+    private readonly runtime;
+    constructor(root?: string, runtime?: HostIngressRuntime, lock?: IngressLock);
+    private file;
+    private locked;
+    private settings;
+    private requiredSettings;
+    configure(value: HostIngressSettings): Promise<{
+        configured: true;
+        settings: HostIngressSettings;
+    }>;
+    private currentGeneration;
+    private generation;
+    private manifest;
+    private verifyCertificates;
+    status(): Promise<HostIngressStatus>;
+    private pointer;
+    private clearJournal;
+    private restore;
+    private takeoverRecord;
+    private recordTakeover;
+    private journal;
+    private restoreJournal;
+    private recoverLocked;
+    recover(): Promise<HostIngressStatus>;
+    private source;
+    private snapshot;
+    private revisionOf;
+    private preparedRevision;
+    private prepare;
+    private publish;
+    /** Read-only admission check. Call under the deployment lease; final apply still requires CAS. */
+    check(input: HostIngressApply): Promise<HostIngressCheck>;
+    /** Writes immutable staging objects, runs native nginx -t, and never publishes or stops a container. */
+    validate(input: HostIngressApply): Promise<HostIngressValidation>;
+    apply(input: HostIngressApply): Promise<HostIngressReceipt>;
+    restoreOwner(input: HostIngressOwnerRestore): Promise<HostIngressReceipt>;
+    rollbackTakeover(input: HostIngressTakeoverRollback): Promise<HostIngressTakeoverRollbackReceipt>;
+    remove(input: HostIngressRemove): Promise<HostIngressReceipt>;
+}
+//# sourceMappingURL=host-ingress.service.d.ts.map