@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/infrastructure/presets/tor.d.ts

@@ -70,5 +70,43 @@ export interface ITorPresetConfig {
      */
     extraTorrc?: string[];
 }
+/**
+ * Inline shell that installs tor (~5s on first run, cached afterward),
+ * generates a hardened torrc from `OMNITRON_TOR_HIDDEN_SERVICES_JSON`,
+ * and execs the daemon as the `tor` user.
+ *
+ * Why inline rather than a custom Dockerfile: keeps the preset hermetic.
+ * No image build step, no separate registry, no image-tag drift.
+ */
+/**
+ * Client-authorization keys, written where tor reads them — or the container
+ * stops.
+ *
+ * Each key goes to `<HiddenServiceDir>/authorized_clients/`, which tor reads
+ * at startup, and a key that does not arrive is a restriction that silently
+ * does not exist: the onion answers everyone. This was
+ *
+ *     apk add --no-cache jq >/dev/null 2>&1 || true
+ *     printf '%s' "$JSON" | jq -c '.[]' | while IFS= read -r f; do … done
+ *
+ * under `set -eu` and no `pipefail`. A jq that was not there (the `|| true`
+ * swallowed the failed install) or JSON it could not read failed IN FRONT of
+ * the pipe; the loop read nothing and ended 0, the pipeline's status was the
+ * loop's, `set -e` saw success — and `exec tor` started the service with no
+ * key in place. Fail-open, on the one setting whose whole purpose is to close.
+ *
+ * Now nothing here is in a pipeline whose failure could hide (the loop reads
+ * a here-document, in this shell), jq is required rather than hoped for, and
+ * the keys are counted: fewer written than configured stops the container.
+ * An onion that is down is better than one that was meant for a few and
+ * answers everyone. `-e` where a null must fail — a key's path or content —
+ * and not on the list itself: `jq -e '.[]'` answers an empty one with exit 4,
+ * which would stop, without a sentence, an onion restricted to nobody.
+ *
+ * Exported so the court can run exactly this text. It needs `set -eu -o
+ * pipefail` in effect, which ENTRYPOINT_SHELL sets; busybox `sh` in
+ * alpine:3.21 honours `pipefail` (measured: `false | cat` → 1).
+ */
+export declare const CLIENT_AUTH_SHELL = "# Client-authorization keys, when the service uses them.\nif [ -n \"${OMNITRON_TOR_CLIENT_AUTH_JSON:-}\" ]; then\n  command -v jq >/dev/null 2>&1 || apk add --no-cache jq >/dev/null 2>&1 || apk add jq >/dev/null 2>&1 || true\n  if ! command -v jq >/dev/null 2>&1; then\n    echo 'tor: client authorization is configured and there is no jq to write its keys; not starting an onion service without them' >&2\n    exit 1\n  fi\n  expected=$(printf '%s' \"$OMNITRON_TOR_CLIENT_AUTH_JSON\" | jq -e 'length')\n  entries=$(printf '%s' \"$OMNITRON_TOR_CLIENT_AUTH_JSON\" | jq -c '.[]')\n  written=0\n  while IFS= read -r f; do\n    [ -n \"$f\" ] || continue\n    path=$(printf '%s' \"$f\" | jq -er .path)\n    mkdir -p \"$(dirname \"$path\")\"\n    printf '%s' \"$f\" | jq -er .content > \"$path\"\n    chmod 600 \"$path\"\n    written=$((written + 1))\n  done <<CLIENT_AUTH_KEYS\n$entries\nCLIENT_AUTH_KEYS\n  if [ \"$written\" -ne \"$expected\" ]; then\n    echo \"tor: wrote $written of $expected client-authorization keys; not starting an onion service without them\" >&2\n    exit 1\n  fi\nfi\n";
 export declare const torPreset: IServicePreset;
 //# sourceMappingURL=tor.d.ts.map

package/dist/infrastructure/presets/tor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tor.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,cAAc,EAAE,uBAAuB,EAAE,CAAC;IAC1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAwFD,eAAO,MAAM,SAAS,EAAE,cAyCvB,CAAC"}
+{"version":3,"file":"tor.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,+CAA+C;AAC/C,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,cAAc,EAAE,uBAAuB,EAAE,CAAC;IAC1C;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,iBAAiB,wkCAyB7B,CAAC;AAiCF,eAAO,MAAM,SAAS,EAAE,cA0CvB,CAAC"}

package/dist/infrastructure/presets/tor.js

@@ -58,87 +58,95 @@
  * Why inline rather than a custom Dockerfile: keeps the preset hermetic.
  * No image build step, no separate registry, no image-tag drift.
  */
+/**
+ * Client-authorization keys, written where tor reads them — or the container
+ * stops.
+ *
+ * Each key goes to `<HiddenServiceDir>/authorized_clients/`, which tor reads
+ * at startup, and a key that does not arrive is a restriction that silently
+ * does not exist: the onion answers everyone. This was
+ *
+ *     apk add --no-cache jq >/dev/null 2>&1 || true
+ *     printf '%s' "$JSON" | jq -c '.[]' | while IFS= read -r f; do … done
+ *
+ * under `set -eu` and no `pipefail`. A jq that was not there (the `|| true`
+ * swallowed the failed install) or JSON it could not read failed IN FRONT of
+ * the pipe; the loop read nothing and ended 0, the pipeline's status was the
+ * loop's, `set -e` saw success — and `exec tor` started the service with no
+ * key in place. Fail-open, on the one setting whose whole purpose is to close.
+ *
+ * Now nothing here is in a pipeline whose failure could hide (the loop reads
+ * a here-document, in this shell), jq is required rather than hoped for, and
+ * the keys are counted: fewer written than configured stops the container.
+ * An onion that is down is better than one that was meant for a few and
+ * answers everyone. `-e` where a null must fail — a key's path or content —
+ * and not on the list itself: `jq -e '.[]'` answers an empty one with exit 4,
+ * which would stop, without a sentence, an onion restricted to nobody.
+ *
+ * Exported so the court can run exactly this text. It needs `set -eu -o
+ * pipefail` in effect, which ENTRYPOINT_SHELL sets; busybox `sh` in
+ * alpine:3.21 honours `pipefail` (measured: `false | cat` → 1).
+ */
+export const CLIENT_AUTH_SHELL = `# Client-authorization keys, when the service uses them.
+if [ -n "\${OMNITRON_TOR_CLIENT_AUTH_JSON:-}" ]; then
+  command -v jq >/dev/null 2>&1 || apk add --no-cache jq >/dev/null 2>&1 || apk add jq >/dev/null 2>&1 || true
+  if ! command -v jq >/dev/null 2>&1; then
+    echo 'tor: client authorization is configured and there is no jq to write its keys; not starting an onion service without them' >&2
+    exit 1
+  fi
+  expected=$(printf '%s' "$OMNITRON_TOR_CLIENT_AUTH_JSON" | jq -e 'length')
+  entries=$(printf '%s' "$OMNITRON_TOR_CLIENT_AUTH_JSON" | jq -c '.[]')
+  written=0
+  while IFS= read -r f; do
+    [ -n "$f" ] || continue
+    path=$(printf '%s' "$f" | jq -er .path)
+    mkdir -p "$(dirname "$path")"
+    printf '%s' "$f" | jq -er .content > "$path"
+    chmod 600 "$path"
+    written=$((written + 1))
+  done <<CLIENT_AUTH_KEYS
+$entries
+CLIENT_AUTH_KEYS
+  if [ "$written" -ne "$expected" ]; then
+    echo "tor: wrote $written of $expected client-authorization keys; not starting an onion service without them" >&2
+    exit 1
+  fi
+fi
+`;
 const ENTRYPOINT_SHELL = `set -eu
+# A pipeline's status is its LAST command's. Without this, a command that
+# failed in front of a pipe was invisible to \`set -e\` — see CLIENT_AUTH_SHELL.
+set -o pipefail
 
-# Install tor + jq. The Alpine tor package automatically creates a
-# 'tor' system user (uid 100, gid 101). Idempotent across restarts.
-apk add --no-cache tor jq >/dev/null 2>&1 || apk add tor jq >/dev/null 2>&1
+# Tor, from the distribution. The version this pins to is measured, not
+# assumed: \`docker run --rm alpine:3.21 sh -c 'apk add tor && tor --version'\`
+# answers 0.4.9.12, against 0.4.9.11 on 3.20. Onion-service anonymity
+# improves with the release — 0.4.7 added the layer-2/3 guards that blunt
+# guard discovery, 0.4.8 the PoW defences this config turns on — so the base
+# image is part of the security posture and not a detail.
+apk add --no-cache tor >/dev/null 2>&1 || apk add tor >/dev/null 2>&1
 
-# Build torrc from the env-passed JSON config.
-TORRC=/etc/tor/torrc
 mkdir -p /etc/tor /var/lib/tor
-cat > "$TORRC" <<'TORRC_EOF'
-# ============================================================
-# Hidden-service-only Tor configuration (omnitron preset)
-# ============================================================
-# Process identity — tor drops privileges to this user after binding.
-User tor
-
-# Lockdown: no client/relay/exit functionality, only HSes.
-SocksPort 0
-ClientOnly 0
-ORPort 0
-DirPort 0
-ExitRelay 0
-ExitPolicy reject *:*
-ExitPolicy reject6 *:*
-BridgeRelay 0
-
-# Operational hardening
-DataDirectory /var/lib/tor
-RunAsDaemon 0
-HardwareAccel 1
-DisableDebuggerAttachment 1
-SafeLogging 1
-LogTimeGranularity 1000
-Log notice stdout
-
-# IPv4 only by default — IPv6 onion service traffic still works
-ClientUseIPv6 0
-ClientPreferIPv6ORPort 0
 
-# Avoid filesystem races on shared volumes
-AvoidDiskWrites 1
-TORRC_EOF
-
-# Append per-hidden-service stanzas. Each gets:
-#   - HiddenServiceVersion 3 (Ed25519, 56-char .onion)
-#   - HiddenServiceEnableIntroDoSDefense (DoS mitigation at intro layer)
-#   - HiddenServicePoWDefensesEnabled    (PoW puzzles for clients)
-echo "$OMNITRON_TOR_HIDDEN_SERVICES_JSON" | jq -c '.[]' | while IFS= read -r svc; do
-  name=$(printf '%s' "$svc" | jq -r .name)
-  vport=$(printf '%s' "$svc" | jq -r .virtualPort)
-  target=$(printf '%s' "$svc" | jq -r .target)
-  {
-    echo
-    echo "# --- Hidden service: $name ---"
-    echo "HiddenServiceDir /var/lib/tor/$name"
-    echo "HiddenServiceVersion 3"
-    echo "HiddenServiceEnableIntroDoSDefense 1"
-    echo "HiddenServicePoWDefensesEnabled 1"
-    echo "HiddenServicePort $vport $target"
-  } >> "$TORRC"
-done
-
-# Append any user-provided raw torrc lines.
-if [ -n "\${OMNITRON_TOR_EXTRA_TORRC:-}" ]; then
-  printf '\\n# --- User-provided torrc additions ---\\n%s\\n' "$OMNITRON_TOR_EXTRA_TORRC" >> "$TORRC"
-fi
+# The torrc arrives finished. Nothing here assembles it, so there is no
+# quoting in the path between what omnitron decided and what tor reads.
+printf '%s\\n' "$OMNITRON_TORRC" > /etc/tor/torrc
 
-# Hidden service directories must be owned by the tor user with mode 0700,
-# otherwise tor refuses to start. Re-apply on every boot in case the volume
-# was created externally with different permissions.
+${CLIENT_AUTH_SHELL}
+# Key material must be tor's and nobody else's; tor refuses to start on a
+# directory it does not own at 0700, which is the check working.
 chown -R tor:tor /var/lib/tor 2>/dev/null || true
 chmod 700 /var/lib/tor
 
-# Run tor as root and let it drop privileges via the 'User tor' directive.
-# This avoids needing su-exec/gosu, which aren't in alpine by default.
-exec tor -f "$TORRC"
+# Run as root and let tor drop to the \`User tor\` in the config: Alpine has
+# neither su-exec nor gosu by default, and adding one to drop privileges a
+# second time buys nothing.
+exec tor -f /etc/tor/torrc
 `;
 export const torPreset = {
     name: 'tor',
     type: 'gateway',
-    defaultImage: 'alpine:3.20',
+    defaultImage: 'alpine:3.21',
     // No host-side ports: hidden services are reachable only via the Tor
     // network. Exposing 9050 etc. would defeat the entire point.
     defaultPorts: {},
@@ -163,7 +171,8 @@ export const torPreset = {
         // server, omnitron-nginx published port) on every platform.
         extraHosts: ['host.docker.internal:host-gateway'],
         environment: {
-            // Default torrc has tor user; keep umask tight on key files.
+            // Key files are created by tor itself; a tight umask is what keeps
+            // them 0600 rather than whatever the image's default would give.
             UMASK: '077',
         },
     },

package/dist/infrastructure/presets/tor.js.map

@@ -1 +1 @@
-{"version":3,"file":"tor.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4ExB,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,qEAAqE;IACrE,6DAA6D;IAC7D,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,EAAE,SAAS;QACf,MAAM,EACJ,sFAAsF;QACxF,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,MAAM;KACpB;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;SAC7C;QACD,sEAAsE;QACtE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,WAAW,EAAE;YACX,6DAA6D;YAC7D,KAAK,EAAE,KAAK;SACb;KACF;IAED,oBAAoB;QAClB,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}
+{"version":3,"file":"tor.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/tor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAyBH;;;;;;;GAOG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyBhC,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,iBAAiB;;;;;;;;;;CAUlB,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAmB;IACvC,IAAI,EAAE,KAAK;IACX,IAAI,EAAE,SAAS;IACf,YAAY,EAAE,aAAa;IAC3B,qEAAqE;IACrE,6DAA6D;IAC7D,YAAY,EAAE,EAAE;IAChB,cAAc,EAAE,EAAE;IAElB,kBAAkB,EAAE;QAClB,uEAAuE;QACvE,uEAAuE;QACvE,qCAAqC;QACrC,IAAI,EAAE,SAAS;QACf,MAAM,EACJ,sFAAsF;QACxF,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,MAAM;KACpB;IAED,aAAa,EAAE;QACb,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,CAAC;QACvC,OAAO,EAAE;YACP,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE;SAC7C;QACD,sEAAsE;QACtE,4DAA4D;QAC5D,UAAU,EAAE,CAAC,mCAAmC,CAAC;QACjD,WAAW,EAAE;YACX,mEAAmE;YACnE,iEAAiE;YACjE,KAAK,EAAE,KAAK;SACb;KACF;IAED,oBAAoB;QAClB,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,EAAE,CAAC;IACZ,CAAC;CACF,CAAC"}

package/dist/infrastructure/presets/torrc.d.ts

@@ -0,0 +1,54 @@
+/**
+ * The torrc an onion service runs on, and why each line is in it.
+ *
+ * Built here rather than by shell inside the container. The previous version
+ * assembled it with `cat`, `jq` and a `while read` loop at runtime, which
+ * meant the one file that decides whether a service is anonymous could not
+ * be read without starting a container, and could not be tested at all. A
+ * hardening option that is silently dropped by a quoting mistake looks
+ * exactly like one that was never asked for.
+ *
+ * Everything here is a real Tor option, checked against `tor --version`
+ * 0.4.9.12 — the newest in Alpine 3.21, measured rather than assumed.
+ *
+ * The threat this is written against: an adversary who wants to learn which
+ * host runs the service, or to make it stop. Not an adversary who has the
+ * host — that one has the keys, and no torrc helps.
+ */
+export interface TorHiddenService {
+    /** Directory name under /var/lib/tor, and the name `omnitron tor` prints. */
+    name: string;
+    /** Port clients reach on the .onion address. */
+    virtualPort: number;
+    /** `host:port` tor forwards plaintext to. */
+    target: string;
+    /**
+     * Public keys allowed to reach this service, as `<name>:descriptor:x25519:<base32>`.
+     *
+     * v3 client authorization, and the strongest privacy control an onion
+     * service has: without a listed key a client cannot decrypt the
+     * descriptor, so the service is not merely closed to them — it is
+     * undiscoverable. The cost is that every legitimate client needs the
+     * matching private key installed, so it is off unless asked for.
+     */
+    authorizedClients?: string[] | undefined;
+}
+export interface TorrcInputs {
+    services: readonly TorHiddenService[];
+    /** Appended verbatim, last, so an operator can always have the final word. */
+    extra?: readonly string[] | undefined;
+}
+export declare function renderTorrc(inputs: TorrcInputs): string;
+/**
+ * The `.auth` files that make client authorization real.
+ *
+ * Returned separately from the torrc because they are not torrc lines: tor
+ * reads them from `<HiddenServiceDir>/authorized_clients/`, and a key that
+ * never reaches that directory is a restriction that silently does not
+ * exist.
+ */
+export declare function authorizedClientFiles(services: readonly TorHiddenService[]): Array<{
+    path: string;
+    content: string;
+}>;
+//# sourceMappingURL=torrc.d.ts.map

package/dist/infrastructure/presets/torrc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"torrc.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/torrc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,WAAW,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAC;IACtC,8EAA8E;IAC9E,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACvC;AAkBD,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,CAmIvD;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAa1C"}

package/dist/infrastructure/presets/torrc.js

@@ -0,0 +1,153 @@
+/**
+ * The torrc an onion service runs on, and why each line is in it.
+ *
+ * Built here rather than by shell inside the container. The previous version
+ * assembled it with `cat`, `jq` and a `while read` loop at runtime, which
+ * meant the one file that decides whether a service is anonymous could not
+ * be read without starting a container, and could not be tested at all. A
+ * hardening option that is silently dropped by a quoting mistake looks
+ * exactly like one that was never asked for.
+ *
+ * Everything here is a real Tor option, checked against `tor --version`
+ * 0.4.9.12 — the newest in Alpine 3.21, measured rather than assumed.
+ *
+ * The threat this is written against: an adversary who wants to learn which
+ * host runs the service, or to make it stop. Not an adversary who has the
+ * host — that one has the keys, and no torrc helps.
+ */
+/**
+ * Per-service defence tuning.
+ *
+ * The introduction point is where an onion service is cheapest to attack:
+ * anyone can ask it to relay an introduction, and the service pays to
+ * answer. These are the two mechanisms Tor gives for that, and neither is
+ * on by default.
+ */
+const INTRO_DOS_RATE_PER_SEC = 25;
+const INTRO_DOS_BURST_PER_SEC = 200;
+/** PoW: how fast the service dequeues client requests, and the burst it tolerates. */
+const POW_QUEUE_RATE = 250;
+const POW_QUEUE_BURST = 2500;
+/** A single client's streams on one rendezvous circuit. */
+const MAX_STREAMS_PER_CIRCUIT = 128;
+export function renderTorrc(inputs) {
+    const lines = [
+        '# =====================================================================',
+        '# Onion-service-only Tor, generated by omnitron. Do not edit in place —',
+        '# the container rewrites this file on every start.',
+        '# =====================================================================',
+        '',
+        '# Identity. Tor drops privileges to this account after binding.',
+        'User tor',
+        '',
+        '# --- This process is not a relay, not a proxy, and not a client ------',
+        '#',
+        '# A SOCKS port would make the host an open proxy on its docker network;',
+        '# an ORPort would make it a relay, which publishes its address in the',
+        '# consensus — the one fact an onion service exists to withhold.',
+        'SocksPort 0',
+        'ORPort 0',
+        'DirPort 0',
+        'ControlPort 0',
+        'ClientOnly 1',
+        'ExitRelay 0',
+        'ExitPolicy reject *:*',
+        'ExitPolicy reject6 *:*',
+        'BridgeRelay 0',
+        'PublishServerDescriptor 0',
+        '',
+        '# --- Anonymity ------------------------------------------------------',
+        '#',
+        '# Single-hop mode trades the service\'s anonymity for latency. It is off',
+        '# by default and named here so that turning it on is a visible edit and',
+        '# not an omission.',
+        'HiddenServiceSingleHopMode 0',
+        'HiddenServiceNonAnonymousMode 0',
+        '',
+        '# Guard discovery is the attack that finds the host behind an onion',
+        '# service: watch which relays it builds circuits through, narrow the',
+        '# set, then attack what is left. Tor 0.4.7+ keeps layer-2 and layer-3',
+        '# guards for onion services automatically (vanguards-lite) — this',
+        '# states the entry layer it rests on.',
+        'UseEntryGuards 1',
+        'NumEntryGuards 1',
+        'EnforceDistinctSubnets 1',
+        '',
+        '# Padding hides the shape of traffic from whoever can see the link to',
+        '# the guard. The reduced variants exist for battery-powered clients and',
+        '# cost anonymity; a server has no reason to take that trade.',
+        'ConnectionPadding 1',
+        'ReducedConnectionPadding 0',
+        'CircuitPadding 1',
+        'ReducedCircuitPadding 0',
+        '',
+        '# IPv4 only. A host reachable both ways is two chances to be correlated,',
+        '# and onion traffic needs neither.',
+        'ClientUseIPv4 1',
+        'ClientUseIPv6 0',
+        'ClientPreferIPv6ORPort 0',
+        '',
+        '# --- What is written down -------------------------------------------',
+        '#',
+        '# SafeLogging scrubs addresses from the log. `notice` is the highest',
+        '# level that never logs a circuit or a stream: `info` and `debug` do,',
+        '# and a debug log from an onion service is a deanonymisation waiting to',
+        '# be read by whoever gets the file.',
+        'SafeLogging 1',
+        'Log notice stdout',
+        'LogTimeGranularity 1000',
+        'LogMessageDomains 0',
+        '',
+        '# Nothing about this service belongs on disk beyond its keys.',
+        'DataDirectory /var/lib/tor',
+        'DataDirectoryGroupReadable 0',
+        'AvoidDiskWrites 1',
+        'RunAsDaemon 0',
+        '',
+        '# --- Process hardening ----------------------------------------------',
+        '#',
+        '# NoExec stops tor executing anything at all, which removes the class',
+        '# of bug where a malformed input becomes a command. DisableDebugger-',
+        '# Attachment keeps another process on the host from reading the keys',
+        '# out of memory.',
+        'NoExec 1',
+        'DisableDebuggerAttachment 1',
+        'HardwareAccel 1',
+        '',
+    ];
+    for (const service of inputs.services) {
+        lines.push(`# --- Hidden service: ${service.name} ---`, `HiddenServiceDir /var/lib/tor/${service.name}`, 
+        // v3 only. v2 was removed from Tor, and its addresses were 80-bit
+        // truncated hashes — brute-forceable to a lookalike.
+        'HiddenServiceVersion 3', `HiddenServicePort ${service.virtualPort} ${service.target}`, '', '# The introduction point is where this service is cheapest to attack:', '# anyone may ask it to relay an introduction, and the service pays to', '# answer. Neither defence is on by default.', 'HiddenServiceEnableIntroDoSDefense 1', `HiddenServiceEnableIntroDoSRatePerSec ${INTRO_DOS_RATE_PER_SEC}`, `HiddenServiceEnableIntroDoSBurstPerSec ${INTRO_DOS_BURST_PER_SEC}`, 'HiddenServicePoWDefensesEnabled 1', `HiddenServicePoWQueueRate ${POW_QUEUE_RATE}`, `HiddenServicePoWQueueBurst ${POW_QUEUE_BURST}`, '', '# One client must not be able to hold the service open indefinitely.', `HiddenServiceMaxStreams ${MAX_STREAMS_PER_CIRCUIT}`, 'HiddenServiceMaxStreamsCloseCircuit 1', '', '# The key directory is this service. Group-readable means any process', '# in the container s group can copy the identity.', 'HiddenServiceDirGroupReadable 0');
+        if (service.authorizedClients && service.authorizedClients.length > 0) {
+            lines.push('', `# ${service.authorizedClients.length} authorized client(s): without one of`, '# these keys a client cannot decrypt the descriptor, so the service', '# is not merely closed to them — it is undiscoverable.');
+        }
+        lines.push('');
+    }
+    if (inputs.extra && inputs.extra.length > 0) {
+        lines.push('# --- Operator additions ---', ...inputs.extra, '');
+    }
+    return lines.join('\n');
+}
+/**
+ * The `.auth` files that make client authorization real.
+ *
+ * Returned separately from the torrc because they are not torrc lines: tor
+ * reads them from `<HiddenServiceDir>/authorized_clients/`, and a key that
+ * never reaches that directory is a restriction that silently does not
+ * exist.
+ */
+export function authorizedClientFiles(services) {
+    const files = [];
+    for (const service of services) {
+        for (const [index, key] of (service.authorizedClients ?? []).entries()) {
+            files.push({
+                path: `/var/lib/tor/${service.name}/authorized_clients/client-${index + 1}.auth`,
+                content: `${key}\n`,
+            });
+        }
+    }
+    return files;
+}
+//# sourceMappingURL=torrc.js.map

package/dist/infrastructure/presets/torrc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"torrc.js","sourceRoot":"","sources":["../../../src/infrastructure/presets/torrc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA2BH;;;;;;;GAOG;AACH,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,sFAAsF;AACtF,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,2DAA2D;AAC3D,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAEpC,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAa;QACtB,yEAAyE;QACzE,yEAAyE;QACzE,oDAAoD;QACpD,yEAAyE;QACzE,EAAE;QACF,iEAAiE;QACjE,UAAU;QACV,EAAE;QACF,yEAAyE;QACzE,GAAG;QACH,yEAAyE;QACzE,uEAAuE;QACvE,iEAAiE;QACjE,aAAa;QACb,UAAU;QACV,WAAW;QACX,eAAe;QACf,cAAc;QACd,aAAa;QACb,uBAAuB;QACvB,wBAAwB;QACxB,eAAe;QACf,2BAA2B;QAC3B,EAAE;QACF,wEAAwE;QACxE,GAAG;QACH,0EAA0E;QAC1E,yEAAyE;QACzE,oBAAoB;QACpB,8BAA8B;QAC9B,iCAAiC;QACjC,EAAE;QACF,qEAAqE;QACrE,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,uCAAuC;QACvC,kBAAkB;QAClB,kBAAkB;QAClB,0BAA0B;QAC1B,EAAE;QACF,uEAAuE;QACvE,yEAAyE;QACzE,8DAA8D;QAC9D,qBAAqB;QACrB,4BAA4B;QAC5B,kBAAkB;QAClB,yBAAyB;QACzB,EAAE;QACF,0EAA0E;QAC1E,oCAAoC;QACpC,iBAAiB;QACjB,iBAAiB;QACjB,0BAA0B;QAC1B,EAAE;QACF,wEAAwE;QACxE,GAAG;QACH,sEAAsE;QACtE,uEAAuE;QACvE,yEAAyE;QACzE,qCAAqC;QACrC,eAAe;QACf,mBAAmB;QACnB,yBAAyB;QACzB,qBAAqB;QACrB,EAAE;QACF,+DAA+D;QAC/D,4BAA4B;QAC5B,8BAA8B;QAC9B,mBAAmB;QACnB,eAAe;QACf,EAAE;QACF,wEAAwE;QACxE,GAAG;QACH,uEAAuE;QACvE,sEAAsE;QACtE,sEAAsE;QACtE,kBAAkB;QAClB,UAAU;QACV,6BAA6B;QAC7B,iBAAiB;QACjB,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,KAAK,CAAC,IAAI,CACR,yBAAyB,OAAO,CAAC,IAAI,MAAM,EAC3C,iCAAiC,OAAO,CAAC,IAAI,EAAE;QAC/C,kEAAkE;QAClE,qDAAqD;QACrD,wBAAwB,EACxB,qBAAqB,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,EAC5D,EAAE,EACF,uEAAuE,EACvE,uEAAuE,EACvE,6CAA6C,EAC7C,sCAAsC,EACtC,yCAAyC,sBAAsB,EAAE,EACjE,0CAA0C,uBAAuB,EAAE,EACnE,mCAAmC,EACnC,6BAA6B,cAAc,EAAE,EAC7C,8BAA8B,eAAe,EAAE,EAC/C,EAAE,EACF,sEAAsE,EACtE,2BAA2B,uBAAuB,EAAE,EACpD,uCAAuC,EACvC,EAAE,EACF,uEAAuE,EACvE,mDAAmD,EACnD,iCAAiC,CAClC,CAAC;QAEF,IAAI,OAAO,CAAC,iBAAiB,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtE,KAAK,CAAC,IAAI,CACR,EAAE,EACF,KAAK,OAAO,CAAC,iBAAiB,CAAC,MAAM,uCAAuC,EAC5E,qEAAqE,EACrE,wDAAwD,CACzD,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqC;IAErC,MAAM,KAAK,GAA6C,EAAE,CAAC;IAE3D,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACvE,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,gBAAgB,OAAO,CAAC,IAAI,8BAA8B,KAAK,GAAG,CAAC,OAAO;gBAChF,OAAO,EAAE,GAAG,GAAG,IAAI;aACpB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/infrastructure/presets/types.d.ts

@@ -31,6 +31,23 @@ export interface IServicePreset {
     defaultDocker: Partial<IDockerServiceConfig>;
     /** Default credentials (e.g., { user: 'postgres', password: 'postgres' }) */
     defaultSecrets: Record<string, string>;
+    /**
+     * Build the container command from the user's `config` block.
+     *
+     * Without this the command is whatever `defaultDocker.command` hardcodes,
+     * and the tuning options the service config declares reach nothing. That
+     * was the state of things: `PostgresServiceConfig.config` documented six
+     * settings with defaults, the postgres preset hardcoded `max_connections`
+     * and `shared_buffers` into its command, and an operator who raised
+     * `sharedBuffers` to 4GB in omnitron.stacks.json got 256MB and no word
+     * about it. `config.config` was carried as far as `_presetConfig` and
+     * handed only to `postProvision`, which reads `databases` and nothing
+     * else.
+     *
+     * Falls back to `defaultDocker.command` when a preset does not implement
+     * it, and is overridden entirely by an explicit `docker.command`.
+     */
+    buildCommand?: (userConfig: Record<string, unknown>) => string[];
     /**
      * Post-provision hook — runs after the container is healthy.
      * Used for setup like CREATE DATABASE, creating S3 buckets, etc.

package/dist/infrastructure/presets/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAC;AAMrB;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IAEnF,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,yCAAyC;IACzC,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,0EAA0E;IAC1E,aAAa,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvC;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxF;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qDAAqD;IACrD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6BAA6B;IAC7B,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IAEf,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAE7C,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvC,mCAAmC;IACnC,SAAS,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE7C,sBAAsB;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/infrastructure/presets/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,cAAc,EACd,SAAS,EACV,MAAM,aAAa,CAAC;AAMrB;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;IAEb,uBAAuB;IACvB,IAAI,EAAE,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,CAAC;IAEnF,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAC;IAErB,8EAA8E;IAC9E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAErC,yCAAyC;IACzC,kBAAkB,EAAE,mBAAmB,CAAC;IAExC,0EAA0E;IAC1E,aAAa,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEvC;;;;;;;;;;;;;;;OAeG;IACH,YAAY,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;IAEjE;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9D;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxF;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACpC,+CAA+C;IAC/C,aAAa,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,8DAA8D;IAC9D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qDAAqD;IACrD,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD,6BAA6B;IAC7B,MAAM,EAAE,OAAO,CAAC;CACjB;AAMD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,oBAAoB;IACnC,gEAAgE;IAChE,MAAM,EAAE,MAAM,CAAC;IAEf,oCAAoC;IACpC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,6BAA6B;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE/B,mCAAmC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAE7C,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEjC,qCAAqC;IACrC,MAAM,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEvC,mCAAmC;IACnC,SAAS,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE7C,sBAAsB;IACtB,SAAS,CAAC,EAAE,cAAc,CAAC;CAC5B"}

package/dist/infrastructure/provisioning-outcome.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Whether provisioning actually provisioned anything.
+ *
+ * `provision()` set `state.ready = true` and logged "Infrastructure
+ * provisioned and healthy" as the last two statements of its `try`,
+ * unconditionally. Every service reconciles inside a `Promise.all` whose
+ * per-service `catch` records `status: 'exited'` and continues, so a run in
+ * which every container failed ended exactly like a run in which all of them
+ * came up.
+ *
+ * `omnitron infra up` then printed
+ *
+ *     Infrastructure ready:
+ *
+ * as a heading, before looking at anything, and listed whatever
+ * `state.services` happened to hold. An empty object printed the heading and
+ * nothing else — and an empty enumeration of problems reads as "no
+ * problems". Observed three times in one shift on a host under memory
+ * pressure, with `sample-dev-postgres` and `sample-dev-redis` absent from
+ * `docker ps -a` entirely at the moment it said so.
+ *
+ * The cost is separate from the cause. A control plane that reports health
+ * when the database is gone sends whoever reads it to look at their own
+ * change: one colleague reverted a correct fix after reading
+ * `Module "TitanRedisModule" failed to initialize`, because the line above it
+ * said the infrastructure was fine. The full error said
+ * `Redis client "default" connection timed out`.
+ *
+ * Three states have to be distinguishable, and two of them looked identical
+ * because both produced an empty list of complaints:
+ *
+ *   - declared, present, running;
+ *   - declared, present, not running — an error to show;
+ *   - declared and MISSING — nothing even tried, which is the one that
+ *     looks like success.
+ */
+import type { ContainerState, ContainerStatus } from './types.js';
+export interface ServiceOutcome {
+    name: string;
+    image: string | undefined;
+    status: ContainerStatus | 'missing';
+    error: string | undefined;
+}
+export interface ProvisioningOutcome {
+    /** True only when everything declared is present and running. */
+    ready: boolean;
+    /** Nothing was declared — not the same as everything being fine. */
+    empty: boolean;
+    running: ServiceOutcome[];
+    /** Present and not running, or running and reporting unhealthy. */
+    failed: ServiceOutcome[];
+    /** Declared, and absent from the state entirely. */
+    missing: ServiceOutcome[];
+}
+export declare function summariseProvisioning(desired: readonly {
+    name: string;
+    image?: string | undefined;
+}[], services: Readonly<Record<string, ContainerState>>): ProvisioningOutcome;
+/** One line saying what happened, for a log that has to be readable alone. */
+export declare function describeProvisioning(outcome: ProvisioningOutcome): string;
+/** What the node did about services that are not containers (`reconcileHostServices`). */
+export interface HostServicesOutcome {
+    settled: readonly string[];
+    /** Refused by the plan, or failed while it was carried out. */
+    failed: ReadonlyArray<{
+        name: string;
+        status: string;
+        error: string | null;
+    }>;
+}
+/**
+ * The node's verdict on everything it was asked to bring up.
+ *
+ * Readiness counted the containers and the host services' REFUSALS, and not a
+ * host service that failed while its plan was carried out. Measured on the
+ * test node, 2026-09-23: bitcoind's start failed — `could not start bitcoind: `
+ * — and the node answered `ready: true` with «Infrastructure provisioned and
+ * healthy (5 services)», the failure sitting in `failed` beside it; the master
+ * logged that sentence and the deployment reported `6/6 apps online`.
+ */
+export declare function provisioningVerdict(outcome: ProvisioningOutcome, hosted: HostServicesOutcome): {
+    ready: boolean;
+    detail: string;
+};
+//# sourceMappingURL=provisioning-outcome.d.ts.map

package/dist/infrastructure/provisioning-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-outcome.d.ts","sourceRoot":"","sources":["../../src/infrastructure/provisioning-outcome.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC;IACpC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,oEAAoE;IACpE,KAAK,EAAE,OAAO,CAAC;IACf,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,mEAAmE;IACnE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,oDAAoD;IACpD,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAcD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,EAAE,EAChE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GACjD,mBAAmB,CA+CrB;AAED,8EAA8E;AAC9E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,MAAM,CAQzE;AAED,0FAA0F;AAC1F,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,MAAM,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC/E;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,mBAAmB,EAC5B,MAAM,EAAE,mBAAmB,GAC1B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAKpC"}