@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/project/node-app-config.js

@@ -0,0 +1,134 @@
+/**
+ * What a node runs, written for the node.
+ *
+ * A node's daemon starts apps it knows about, and it learns them the way any
+ * omnitron does: from a project directory with an `omnitron.config` in it.
+ * Remote deployment never gave it one. Artifacts landed at
+ * `/opt/omnitron/artifacts/<project>/<app>/<version>/` and the daemon's own
+ * log said `No projects registered`, so `omnitron restart main` answered
+ * `Failed: Unknown app: main` and the fleet showed six apps deployed and none
+ * running.
+ *
+ * This renders the master's app definitions into a config the node can read,
+ * with every path rewritten to where that app actually is on THAT machine.
+ *
+ * `.mjs` rather than `.ts`: the loader accepts `.ts`, `.js` and `.mjs`, and a
+ * node should not need a TypeScript loader to know what to start. It is
+ * generated, not edited, so the format costs nothing in readability that a
+ * header cannot repay.
+ */
+/**
+ * The stack a node runs its deployed apps under.
+ *
+ * One name, used by the renderer and by whoever starts them, so the two
+ * cannot drift into naming different stacks — which reads as
+ * `Stack 'x' not found` and sends the reader to the config rather than to the
+ * two places that disagree.
+ */
+export const NODE_STACK = 'deployed';
+/**
+ * Fields that describe a developer's machine and mean nothing on a node.
+ *
+ * `watch` is the load-bearing one: it names a source directory to rebuild
+ * from, and a node has no sources. Left in, the node's file watcher would
+ * follow a path that does not exist — or, worse, one that does and belongs to
+ * something else.
+ */
+const DROPPED = new Set(['watch', 'cwd', 'script']);
+/**
+ * The app definitions a node should be given.
+ *
+ * An app with no artifact on the node is omitted rather than written with a
+ * path that is not there: a config naming six apps where four are installed
+ * produces two that fail at startup for a reason the operator has to work
+ * out, and the node already knows how to say "this app is not deployed here"
+ * by not listing it.
+ */
+export function selectNodeApps(input) {
+    const versions = new Map(input.artifacts.map((a) => [a.app, a.version]));
+    const present = new Set(versions.keys());
+    const out = [];
+    for (const app of input.apps) {
+        const version = versions.get(app.name);
+        if (!version)
+            continue;
+        const entry = {};
+        for (const [key, value] of Object.entries(app)) {
+            if (DROPPED.has(key) || value === undefined)
+                continue;
+            entry[key] = value;
+        }
+        // The artifact's compiled entry point. `bootstrap.js`, because the
+        // artifact is `pnpm deploy` output: `dist/` beside a real `node_modules`,
+        // both under the version directory the deployer created.
+        entry['bootstrap'] = `${input.artifactRoot}/${input.project}/${app.name}/${version}/dist/bootstrap.js`;
+        entry['cwd'] = `${input.artifactRoot}/${input.project}/${app.name}/${version}`;
+        // The addresses and credentials this app connects with, merged OVER its
+        // declared env: the master resolved them against what it actually
+        // provisioned on this node, and a value the app's own definition carries
+        // was written without knowing which machine it would land on.
+        const resolved = input.appEnv?.[app.name];
+        if (resolved && Object.keys(resolved).length > 0) {
+            entry['env'] = { ...(app.env ?? {}), ...resolved };
+        }
+        // A dependency the node does not have would block this app forever: the
+        // supervisor waits for something that is never going to start. Keeping
+        // only the dependencies that are present turns "never starts" into
+        // "starts in an order that may be wrong", which is recoverable and
+        // visible.
+        if (Array.isArray(app.dependsOn)) {
+            const kept = app.dependsOn.filter((d) => present.has(d));
+            if (kept.length > 0)
+                entry['dependsOn'] = kept;
+            else
+                delete entry['dependsOn'];
+        }
+        out.push(entry);
+    }
+    return out;
+}
+/**
+ * Render the config file itself.
+ *
+ * A header saying where it came from, because the next person to read it will
+ * be looking at a file nobody wrote by hand, on a machine with no repository,
+ * and "who generates this" is the first thing they need.
+ */
+export function renderNodeAppConfig(input) {
+    const apps = selectNodeApps(input);
+    return [
+        '// Generated by omnitron. Do not edit — the master rewrites this file on',
+        '// every deployment, and a change made here is lost at the next one.',
+        '//',
+        `// Project: ${input.project}`,
+        `// Apps:    ${apps.map((a) => a['name']).join(', ') || '(none deployed)'}`,
+        '//',
+        '// Paths point into this node\'s artifact directory. They are absolute',
+        '// because a node has no project to resolve them against.',
+        '//',
+        '// CONTAINS CREDENTIALS. Each app carries the generated passwords it',
+        '// connects with, so this file is written 0600 and owned by the daemon',
+        '// user.',
+        '',
+        `export default ${JSON.stringify({
+            name: input.project,
+            apps,
+            // A stack, because `startStack` is how a project's apps are started
+            // and it refuses a name it cannot find: `Stack 'x' not found in
+            // project 'sample'`. Registering the project alone left the node with
+            // six definitions it had read and no instruction to run any of them —
+            // `omnitron status` answered `appsTotal: 0` while
+            // `/opt/omnitron/projects/sample/omnitron.config.mjs` listed all six.
+            //
+            // `local`, because from the node's point of view that is what these
+            // are: it supervises them itself. The stack that sent them is remote
+            // from the master's side and this machine's own from here.
+            stacks: {
+                [NODE_STACK]: { type: 'local', apps: apps.map((a) => a['name']) },
+            },
+            ...(input.alertSink && { monitoring: { alertSink: input.alertSink } }),
+        }, null, 2)};`,
+        '',
+    ].join('\n');
+}
+//# sourceMappingURL=node-app-config.js.map

package/dist/project/node-app-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-app-config.js","sourceRoot":"","sources":["../../src/project/node-app-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,UAAU,CAAC;AAyDrC;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAsB;IACnD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAmC,EAAE,CAAC;IAE/C,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO;YAAE,SAAS;QAEvB,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YACtD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;QAED,mEAAmE;QACnE,0EAA0E;QAC1E,yDAAyD;QACzD,KAAK,CAAC,WAAW,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,oBAAoB,CAAC;QACvG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;QAE/E,wEAAwE;QACxE,kEAAkE;QAClE,yEAAyE;QACzE,8DAA8D;QAC9D,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAE,GAAG,CAAC,GAA0C,IAAI,EAAE,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7F,CAAC;QAED,wEAAwE;QACxE,uEAAuE;QACvE,mEAAmE;QACnE,mEAAmE;QACnE,WAAW;QACX,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,KAAK,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;;gBAC1C,OAAO,KAAK,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAED,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAsB;IACxD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO;QACL,0EAA0E;QAC1E,sEAAsE;QACtE,IAAI;QACJ,eAAe,KAAK,CAAC,OAAO,EAAE;QAC9B,eAAe,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,EAAE;QAC3E,IAAI;QACJ,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI;QACJ,sEAAsE;QACtE,wEAAwE;QACxE,UAAU;QACV,EAAE;QACF,kBAAkB,IAAI,CAAC,SAAS,CAC9B;YACE,IAAI,EAAE,KAAK,CAAC,OAAO;YACnB,IAAI;YAEJ,oEAAoE;YACpE,gEAAgE;YAChE,sEAAsE;YACtE,sEAAsE;YACtE,kDAAkD;YAClD,sEAAsE;YACtE,EAAE;YACF,oEAAoE;YACpE,qEAAqE;YACrE,2DAA2D;YAC3D,MAAM,EAAE;gBACN,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAW,CAAC,EAAE;aAC5E;YACD,GAAG,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,UAAU,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;SACvE,EACD,IAAI,EACJ,CAAC,CACF,GAAG;QACJ,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/project/node-app-health.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Reading a node's answer about one app.
+ *
+ * `omnitron status --json` on a node answers with the apps that node runs,
+ * and a node names an app the way every omnitron does: qualified by the
+ * project and stack it belongs to. A deployment asks about `main`; the node
+ * answers `sample/deployed/main`.
+ *
+ * Compared as equal strings, those never match, so a deployment that had
+ * just put six apps on a node and started all six reported six failures:
+ *
+ *     Artifact installed, but the app is not running on the node
+ *     — the node is running 6 app(s) and none of them is 'main'
+ *
+ * measured against a node that answered `appsTotal: 6, appsOnline: 6` with
+ * every port listening. A verification that cannot pass is the same defect as
+ * one that cannot fail, one sign flipped: the first time it says "failed"
+ * about a healthy deployment is the last time anybody reads it.
+ *
+ * Extracted from the deployer so the assertion about this reading runs
+ * against the reading itself. The test that pinned it held its own copy of
+ * the logic, which agreed with the original and would have gone on agreeing
+ * with it after the original was wrong.
+ */
+/** What a node says about itself and what it runs. */
+export interface NodeStatus {
+    readonly version?: string | undefined;
+    readonly pid?: number | undefined;
+    readonly uptime?: number | undefined;
+    readonly role?: 'master' | 'slave' | undefined;
+    readonly apps: ReadonlyArray<{
+        name?: string | undefined;
+        status?: string | undefined;
+    }>;
+}
+/**
+ * Read `omnitron status --json` from a node.
+ *
+ * The answer is an envelope — `{ok, data: {...}}` — and everything worth
+ * knowing is inside `data`. Two readers in this codebase have reached past
+ * it for the top level and found nothing there:
+ *
+ *   - the deployment's health check read `parsed.apps`, so no app could ever
+ *     be recognised as running;
+ *   - the fleet's daemon check reads `info.pid`, so a node whose daemon has
+ *     been up for days, answering this very command, is listed `○ offline`
+ *     in the console and in `omnitron node list`.
+ *
+ * Measured on the test node while its daemon reported `appsOnline: 6`:
+ *
+ *     {"ok":true,"data":{"version":"0.2.0+local…","pid":426053,"uptime":216097,…}}
+ *
+ * Only `data` is read. A top-level `apps` or `pid` is not a node's answer in
+ * any version that has ever shipped, and accepting one would make any JSON
+ * object with the right field names read as a healthy daemon.
+ *
+ * `null` means the answer was not JSON at all — `omnitron: command not
+ * found` is a node without omnitron, which is not the same state as a node
+ * whose daemon is stopped.
+ */
+export declare function readNodeStatus(raw: string): NodeStatus | null;
+export interface NodeHealth {
+    readonly online: boolean;
+    /** Why, in the words the operator will read in the log. */
+    readonly detail: string;
+}
+/** What a node calls an app that was deployed to it. */
+export declare function nodeAppName(project: string, app: string): string;
+/**
+ * Whether the node says this app is online.
+ *
+ * `project` is required rather than optional: every caller has it, and an
+ * optional one would be omitted exactly where the qualified name matters.
+ */
+export declare function readNodeHealth(raw: string, appName: string, project: string): NodeHealth;
+//# sourceMappingURL=node-app-health.d.ts.map

package/dist/project/node-app-health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-app-health.d.ts","sourceRoot":"","sources":["../../src/project/node-app-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,OAAO,GAAG,SAAS,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAsB7D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wDAAwD;AACxD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAKD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,UAAU,CAoCxF"}

package/dist/project/node-app-health.js

@@ -0,0 +1,119 @@
+/**
+ * Reading a node's answer about one app.
+ *
+ * `omnitron status --json` on a node answers with the apps that node runs,
+ * and a node names an app the way every omnitron does: qualified by the
+ * project and stack it belongs to. A deployment asks about `main`; the node
+ * answers `sample/deployed/main`.
+ *
+ * Compared as equal strings, those never match, so a deployment that had
+ * just put six apps on a node and started all six reported six failures:
+ *
+ *     Artifact installed, but the app is not running on the node
+ *     — the node is running 6 app(s) and none of them is 'main'
+ *
+ * measured against a node that answered `appsTotal: 6, appsOnline: 6` with
+ * every port listening. A verification that cannot pass is the same defect as
+ * one that cannot fail, one sign flipped: the first time it says "failed"
+ * about a healthy deployment is the last time anybody reads it.
+ *
+ * Extracted from the deployer so the assertion about this reading runs
+ * against the reading itself. The test that pinned it held its own copy of
+ * the logic, which agreed with the original and would have gone on agreeing
+ * with it after the original was wrong.
+ */
+import { NODE_STACK } from './node-app-config.js';
+/**
+ * Read `omnitron status --json` from a node.
+ *
+ * The answer is an envelope — `{ok, data: {...}}` — and everything worth
+ * knowing is inside `data`. Two readers in this codebase have reached past
+ * it for the top level and found nothing there:
+ *
+ *   - the deployment's health check read `parsed.apps`, so no app could ever
+ *     be recognised as running;
+ *   - the fleet's daemon check reads `info.pid`, so a node whose daemon has
+ *     been up for days, answering this very command, is listed `○ offline`
+ *     in the console and in `omnitron node list`.
+ *
+ * Measured on the test node while its daemon reported `appsOnline: 6`:
+ *
+ *     {"ok":true,"data":{"version":"0.2.0+local…","pid":426053,"uptime":216097,…}}
+ *
+ * Only `data` is read. A top-level `apps` or `pid` is not a node's answer in
+ * any version that has ever shipped, and accepting one would make any JSON
+ * object with the right field names read as a healthy daemon.
+ *
+ * `null` means the answer was not JSON at all — `omnitron: command not
+ * found` is a node without omnitron, which is not the same state as a node
+ * whose daemon is stopped.
+ */
+export function readNodeStatus(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const data = parsed['data'];
+    const body = (data && typeof data === 'object' ? data : {});
+    const role = body['role'];
+    return {
+        version: typeof body['version'] === 'string' ? body['version'] : undefined,
+        pid: typeof body['pid'] === 'number' ? body['pid'] : undefined,
+        uptime: typeof body['uptime'] === 'number' ? body['uptime'] : undefined,
+        role: role === 'master' || role === 'slave' ? role : undefined,
+        apps: Array.isArray(body['apps'])
+            ? body['apps']
+            : [],
+    };
+}
+/** What a node calls an app that was deployed to it. */
+export function nodeAppName(project, app) {
+    return `${project}/${NODE_STACK}/${app}`;
+}
+/** How many names to print before the rest become a count. */
+const NAMES_SHOWN = 6;
+/**
+ * Whether the node says this app is online.
+ *
+ * `project` is required rather than optional: every caller has it, and an
+ * optional one would be omitted exactly where the qualified name matters.
+ */
+export function readNodeHealth(raw, appName, project) {
+    const status = readNodeStatus(raw);
+    if (!status) {
+        // A node that answers something other than JSON is a node whose CLI is
+        // not the one this expects — worth saying, not worth guessing about. Its
+        // length, not its text: the answer arrives through the data channel,
+        // unmasked, and this detail is written to the log. What the node SAID
+        // about it is its stderr, which the caller adds — masked, because words
+        // are.
+        return { online: false, detail: `the node's status was not JSON (${raw.trim().length} characters)` };
+    }
+    const apps = status.apps;
+    const qualified = nodeAppName(project, appName);
+    // The qualified name first, because it is the one a node answers with, and
+    // the bare name after it, because a node that was given a bare definition
+    // answers bare. Nothing else: an app of the same name under another
+    // project is another app, and reporting it as this one is precisely the
+    // false pass this file exists to prevent.
+    const app = apps.find((a) => a.name === qualified) ?? apps.find((a) => a.name === appName);
+    if (!app) {
+        const names = apps.map((a) => a.name ?? '(unnamed)');
+        const shown = names.slice(0, NAMES_SHOWN).join(', ');
+        const rest = names.length > NAMES_SHOWN ? `, and ${names.length - NAMES_SHOWN} more` : '';
+        return {
+            online: false,
+            detail: `the node is running ${apps.length} app(s) and none of them is '${qualified}'` +
+                (names.length > 0 ? ` — it is running ${shown}${rest}` : ''),
+        };
+    }
+    return app.status === 'online'
+        ? { online: true, detail: 'online' }
+        : { online: false, detail: `the node reports it as '${app.status ?? 'unknown'}'` };
+}
+//# sourceMappingURL=node-app-health.js.map

package/dist/project/node-app-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-app-health.js","sourceRoot":"","sources":["../../src/project/node-app-health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAWlD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEvD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAA4B,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAE1B,OAAO;QACL,OAAO,EAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QAC1E,GAAG,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;QAC9D,MAAM,EAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC,CAAE,IAAI,CAAC,MAAM,CAA+C;YAC7D,CAAC,CAAC,EAAE;KACP,CAAC;AACJ,CAAC;AAQD,wDAAwD;AACxD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,GAAW;IACtD,OAAO,GAAG,OAAO,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AAC3C,CAAC;AAED,8DAA8D;AAC9D,MAAM,WAAW,GAAG,CAAC,CAAC;AAEtB;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,OAAe,EAAE,OAAe;IAC1E,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,sEAAsE;QACtE,wEAAwE;QACxE,OAAO;QACP,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,cAAc,EAAE,CAAC;IACvG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAEhD,2EAA2E;IAC3E,0EAA0E;IAC1E,oEAAoE;IACpE,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;IAC3F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EACJ,uBAAuB,IAAI,CAAC,MAAM,gCAAgC,SAAS,GAAG;gBAC9E,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,oBAAoB,KAAK,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;IACJ,CAAC;IAED,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;QAC5B,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QACpC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,GAAG,CAAC,MAAM,IAAI,SAAS,GAAG,EAAE,CAAC;AACvF,CAAC"}

package/dist/project/operator-account.d.ts

@@ -0,0 +1,293 @@
+/**
+ * An operator account on a stack's node — the transport's pure half.
+ *
+ * A stand needs a named account with the platform's highest role that
+ * somebody can sign in with, and a fresh one has only the seed's: on
+ * sample/test, `admin` from a migration, whose password is in the project's
+ * repository and whose role is not the highest. The project knows how to make
+ * an account properly (`scripts/operator-account.mjs`: a captcha from the
+ * stand, its answer from the stack's redis, the application's own signup
+ * hashing the password, the role through its postgres). What it cannot do
+ * from a laptop is reach the node's containers. The master can — SSH with the
+ * node's own credentials, under the node's deploy lease, the transport the
+ * on-node attestation already uses.
+ *
+ * The password is generated ON the node and comes back SEALED — RSA-OAEP to a
+ * key this daemon makes for the one run and never writes down (`sealingKey`)
+ * — and is opened only to go into the vault. `omnitron secret get <key>`
+ * reads it, in the operator's own terminal.
+ *
+ * Sealed because the transport rewrites what looks like a secret. Every
+ * stdout the SSH layer returns passes through its masker, and
+ * `"password":"…"` comes back as `"password": [REDACTED]` — measured on
+ * sample/test, 2026-09-23: the first account made this way was made, the tool
+ * said so with exit 0, and the line carrying its password arrived as a line
+ * that was no longer JSON. It was refused, rightly — a masker that had kept
+ * the JSON valid would have put the string `[REDACTED]` in the vault — and
+ * the account stayed on the stand with a password nobody could ever read.
+ * A sealed password is nothing a masker recognises, and nothing any log that
+ * kept the line could use.
+ *
+ * Even so, a make's stdout is never quoted here: an answer this side cannot
+ * read is described by its shape, not its content.
+ */
+/** The project's tool, relative to its root. */
+export declare const OPERATOR_ACCOUNT_TOOL = "scripts/operator-account.mjs";
+/**
+ * The project's tool for what the probes left on a stand. Without flags it
+ * is a census — SELECTs and nothing else; its removal modes are not asked for
+ * from here.
+ */
+export declare const PROBE_LEFTOVERS_TOOL = "scripts/probe-leftovers.mjs";
+/** Where the password is kept when the operator names no key. */
+export declare function accountVaultKey(project: string, stack: string, username: string): string;
+/**
+ * A key for one run: its public half goes to the tool as `--seal-to`, its
+ * private half stays in this process and opens the one value sealed to it.
+ * Generated asynchronously — a 3072-bit key takes long enough to notice on
+ * the daemon's event loop.
+ */
+export interface SealingKey {
+    /** Base64 SPKI DER — what `--seal-to` takes. Public. */
+    readonly spki: string;
+    open(sealed: string): string;
+}
+export declare function sealingKey(): Promise<SealingKey>;
+/** The command the tool runs as on the node, the stand's containers named as they are there. */
+export declare function toolCommand(remoteDir: string, containerPrefix: string, flags: readonly string[], tool?: string, projectName?: string): string;
+/**
+ * The make. `--role` and `--display-name` only when the operator gave them:
+ * which roles exist, and which one is the default, are the project's to say.
+ * `--seal-to` always.
+ */
+export declare function operatorAccountCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+    username: string;
+    role?: string | undefined;
+    displayName?: string | undefined;
+    sealTo: string;
+}): string;
+/** What the stand holds under a name — read, never a secret. */
+export declare function operatorAccountShowCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+    username: string;
+}): string;
+/** What the stand holds in aggregate — counts, never a value. */
+export declare function operatorCensusCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+}): string;
+/**
+ * What this door asks the leftovers tool for: its census, a rehearsal of the
+ * removal — each database's transaction measured and rolled back — or the
+ * removal itself. The removal is asked for only as the owner gave it on
+ * 2026-09-25, after a census and a rehearsal: without `--accept-losses`, so the
+ * tool refuses to COMMIT anything that would take a row of somebody who stays.
+ * That flag is never passed from here.
+ */
+export type LeftoversMode = 'census' | 'rehearse' | 'apply';
+/** The tool on the node in one of this door's modes; `also` names accounts no template matches, after the census. */
+export declare function probeLeftoversCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+    mode: LeftoversMode;
+    also?: readonly string[] | undefined;
+}): string;
+/** What the probes left on the stand, counted and named — the tool without a flag, which is its census. */
+export declare function probeLeftoversCensusCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+}): string;
+/** The row with this name AND this id, or nothing. */
+export declare function operatorAccountRemoveCommand(input: {
+    remoteDir: string;
+    containerPrefix: string;
+    projectName?: string;
+    username: string;
+    id: string;
+}): string;
+export interface MadeAccount {
+    readonly username: string;
+    readonly password: string;
+    readonly id: string;
+    readonly role: string;
+}
+/** What a run of the make means. */
+export type AccountRun = {
+    readonly made: true;
+    readonly account: MadeAccount;
+} | {
+    readonly made: false;
+    readonly because: string;
+    /**
+     * The account may exist on the stand: the run's outcome is not known
+     * (the transport failed, or the tool said something this side cannot
+     * read). The caller asks the stand (`--show`) before it says anything
+     * more.
+     */
+    readonly uncertain: boolean;
+};
+/**
+ * What stdout looked like, without what it said: how many lines, and of the
+ * last whether it is JSON. A make's stdout is never quoted — see the head of
+ * this file.
+ */
+export declare function describeStdout(stdout: string): string;
+/** The census of what the probes left, as the tool reports it: its answer object, and its own words. */
+export interface LeftoversCensus {
+    /** `{"probeLeftovers": …}` — the tool's shape, passed on as it is. */
+    readonly report: Readonly<Record<string, unknown>>;
+    /** What the tool said on stderr, line by line — the census a person reads. */
+    readonly lines: readonly string[];
+}
+/**
+ * A run of `probe-leftovers.mjs`, read. Only a report in the mode that was
+ * asked for is an answer: anything else means the tool did something this
+ * run never asked of it, and that is refused rather than shown as counts.
+ */
+export declare function readLeftoversRun(run: {
+    stdout: string;
+    stderr: string;
+    code: number;
+}, asked?: LeftoversMode): {
+    readonly ok: true;
+    readonly census: LeftoversCensus;
+} | {
+    readonly ok: false;
+    readonly because: string;
+};
+/**
+ * A run of the make, read as the tool defines it.
+ *
+ *   0 — made: the answer line is `{"operatorAccount": {username, id, role,
+ *       sealed}}`, and `sealed` opens with this run's key.
+ *   1 — refused, with the reason on stderr (the name is taken, the stand
+ *       would not sign it up, the role did not stick).
+ *   2 — the tool refused its arguments — among them a tool too old to know
+ *       `--seal-to`, which refuses before it makes anything.
+ *
+ * Anything else is the transport — a signal, ssh's own 255 — and says
+ * nothing about whether the account was made. A `password` on the line is
+ * never read: through this transport it is `[REDACTED]` at best.
+ */
+export declare function readAccountRun(run: {
+    stdout: string;
+    stderr: string;
+    code: number;
+}, username: string, open: (sealed: string) => string): AccountRun;
+/** An account as the stand holds it — no secret in it. */
+export interface StandAccount {
+    readonly username: string;
+    readonly id: string;
+    readonly role: string;
+    readonly status: string | null;
+    readonly createdAt: string | null;
+    /** `null`: nobody has signed in with it. */
+    readonly lastActiveAt: string | null;
+}
+/**
+ * A run of `--show`. Its stdout carries no secret, so an answer this side
+ * cannot read is quoted — the one place here that does.
+ */
+export declare function readShowRun(run: {
+    stdout: string;
+    stderr: string;
+    code: number;
+}): {
+    readonly ok: true;
+    readonly account: StandAccount | null;
+} | {
+    readonly ok: false;
+    readonly because: string;
+};
+/** The stand's accounts, counted — the tool's `--census`. */
+export interface StandCensus {
+    readonly users: number;
+    readonly byRole: Readonly<Record<string, number>>;
+    readonly byStatus: Readonly<Record<string, number>>;
+    readonly mfa: {
+        readonly totpEnabled: number;
+        /** `enc:v1:` — sealed under the root MFA keys are derived from; a new root cannot open them. */
+        readonly totpSecretEncrypted: number;
+        readonly totpSecretPlain: number;
+        readonly backupCodes: number;
+    };
+    readonly seededAdmin: {
+        readonly present: boolean;
+        /** The row's status, or `deleted` when it was soft-deleted. */
+        readonly status: string | null;
+        readonly role: string | null;
+        /** Whether it still opens with the password its seed published; `null` when the stand cannot check. */
+        readonly publishedPassword: boolean | null;
+    };
+    /**
+     * Every account above «user» that is not deleted. Absent from a tool that
+     * predates it — the project's own, taken from its HEAD — and said so.
+     */
+    readonly privileged?: {
+        readonly accounts: number;
+        /** `YYYY-MM-DD` (UTC) → how many were made that day. */
+        readonly byCreatedDay: Readonly<Record<string, number>>;
+        /** How many open with a password the repository publishes; `null` when the stand cannot check. */
+        readonly openWithPublishedPassword: number | null;
+        /** How many were ever signed into, as far as the stand's sign-in log and sessions keep. */
+        readonly signedIn: number;
+    };
+    /** What rotating the stand's JWT_SECRET would take away besides sessions. */
+    readonly keyedOnJwtSecret?: {
+        /** Pickup codes a buyer holds that a new key could not find, by method. */
+        readonly pickupCodesLive: Readonly<Record<string, number>>;
+    };
+    /**
+     * Counts the project's tool names by the question each answers — printed as
+     * they come, so the next question is the tool's to add and needs nothing here.
+     */
+    readonly counts?: Readonly<Record<string, number>>;
+}
+/**
+ * A run of `--census`. Its stdout carries counts only, so an answer this side
+ * cannot read is quoted, as `--show`'s is.
+ */
+export declare function readCensusRun(run: {
+    stdout: string;
+    stderr: string;
+    code: number;
+}): {
+    readonly ok: true;
+    readonly census: StandCensus;
+} | {
+    readonly ok: false;
+    readonly because: string;
+};
+/** A run of `--remove`: removed, or why not. */
+export declare function readRemoveRun(run: {
+    stdout: string;
+    stderr: string;
+    code: number;
+}, username: string, id: string): {
+    readonly removed: true;
+} | {
+    readonly removed: false;
+    readonly because: string;
+};
+/**
+ * The project's `scripts/` at its HEAD commit, in a directory of its own.
+ *
+ * The commit, not the working tree: what runs on a stand with the power to
+ * hand out its highest role is code somebody committed, and the answer names
+ * which. Refused when that commit has no tool.
+ */
+export declare function stageOperatorTool(projectPath: string, 
+/** The tool the run needs — refused when the commit has none. */
+tool?: string): Promise<{
+    dir: string;
+    commit: string;
+}>;
+//# sourceMappingURL=operator-account.d.ts.map

package/dist/project/operator-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-account.d.ts","sourceRoot":"","sources":["../../src/project/operator-account.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAcH,gDAAgD;AAChD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,gCAAgC,CAAC;AAElE,iEAAiE;AACjE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExF;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC9B;AAED,wBAAsB,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,CAUtD;AAED,gGAAgG;AAChG,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,IAAI,GAAE,MAA8B,EACpC,WAAW,CAAC,EAAE,MAAM,GACnB,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAOT;AAED,gEAAgE;AAChE,wBAAgB,0BAA0B,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEhJ;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAEzH;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;AAE5D,qHAAqH;AACrH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAC3C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CACtC,GAAG,MAAM,CAIT;AAED,2GAA2G;AAC3G,wBAAgB,2BAA2B,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAE/H;AAED,sDAAsD;AACtD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,MAAM,CAET;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,oCAAoC;AACpC,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GACtD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B,CAAC;AA2BN;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAYrD;AAED,wGAAwG;AACxG,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACrD,KAAK,GAAE,aAAwB,GAC9B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAW5G;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACrD,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,GAC/B,UAAU,CA0CZ;AAED,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,4CAA4C;IAC5C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CA+BjH;AAED,6DAA6D;AAC7D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,GAAG,EAAE;QACZ,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,gGAAgG;QAChG,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;QACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;QACjC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE;QACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1B,+DAA+D;QAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;QAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,uGAAuG;QACvG,QAAQ,CAAC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;KAC5C,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,wDAAwD;QACxD,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,kGAAkG;QAClG,QAAQ,CAAC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;QAClD,2FAA2F;QAC3F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAC1B,2EAA2E;QAC3E,QAAQ,CAAC,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAC5D,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACpD;AAMD;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAoExG;AAED,gDAAgD;AAChD,wBAAgB,aAAa,CAC3B,GAAG,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EACrD,QAAQ,EAAE,MAAM,EAChB,EAAE,EAAE,MAAM,GACT;IAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CASpF;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM;AACnB,iEAAiE;AACjE,IAAI,GAAE,MAA8B,GACnC,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAuB1C"}