@omnitron-dev/omnitron 0.3.0 → 0.3.1

package/dist/services/host-upgrade.js

@@ -0,0 +1,352 @@
+/** Controlled host upgrades. App deployments pin an installed bundle and never call this lifecycle. */
+import { shellEscape } from '../shared/shell-escape.js';
+export const HOST_UPGRADE_CONTRACT = 'omnitron.host-upgrade.json';
+function fail(reason) { throw new Error(`Host upgrade preflight: ${reason}`); }
+function strings(value) { return Array.isArray(value) && value.every(v => typeof v === 'string' && v.length > 0); }
+/** The native control-plane runtime contract currently binds the default daemon endpoint. */
+export function assertControlledDaemonPort(port) {
+    if (port !== undefined && port !== 9700)
+        throw new Error('Controlled host operations currently require daemon port 9700');
+}
+export function assertServingBundle(bundle, status) {
+    if (!status || status.build?.commit !== bundle.commit || status.build?.dirty !== false ||
+        typeof status.version !== 'string' || status.version.split('+')[0] !== bundle.version.split('+')[0] ||
+        !Number.isSafeInteger(status.pid) || status.pid <= 0 || !Array.isArray(status.apps)) {
+        fail(`serving daemon does not match installed bundle ${bundle.root}`);
+    }
+}
+/** Refuse configurations whose existing boot policy would start something previously offline. */
+export function planHostUpgrade(previous, candidate, inventory) {
+    for (const bundle of [previous, candidate]) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(bundle.version) || bundle.version.includes('..') ||
+            !bundle.root?.startsWith('/') || !bundle.root.endsWith(`/versions/${bundle.version}`) || !/^[a-f0-9]{40}$/.test(bundle.commit))
+            fail('invalid recorded bundle identity');
+    }
+    assertServingBundle(previous, inventory.status);
+    if (!inventory.runtime || !['fork', 'systemd'].includes(inventory.runtime.kind) || !inventory.runtime.cwd?.startsWith('/'))
+        fail('missing supported runtime snapshot');
+    if (!Array.isArray(inventory.projects) || !Array.isArray(inventory.stacks) || !Array.isArray(inventory.contracts))
+        fail('incomplete project inventory');
+    const all = new Map();
+    const contracts = new Map();
+    const seenProjects = new Set();
+    for (const project of inventory.projects) {
+        if (!project.name || seenProjects.has(project.name) || !strings(project.enabledStacks) || !project.path?.startsWith('/'))
+            fail('invalid or duplicate project');
+        seenProjects.add(project.name);
+        const group = inventory.stacks.filter(s => s.project === project.name);
+        if (group.length !== 1 || group[0].path !== project.path)
+            fail(`missing stack inventory for ${project.name}`);
+        const declarations = inventory.contracts.filter(c => c.project === project.name);
+        const localApps = group[0].stacks.filter(s => s.type === 'local').flatMap(s => s.apps);
+        if (localApps.length && (declarations.length !== 1 || declarations[0].schema !== 1 || !Array.isArray(declarations[0].apps)))
+            fail(`${project.name} needs ${HOST_UPGRADE_CONTRACT} schema 1`);
+        const seenStacks = new Set();
+        for (const stack of group[0].stacks) {
+            if (seenStacks.has(stack.name))
+                fail(`duplicate stack ${project.name}/${stack.name}`);
+            seenStacks.add(stack.name);
+            const enabled = project.enabledStacks.includes(stack.name);
+            if (stack.type !== 'local') {
+                if (enabled)
+                    fail(`enabled ${stack.type} stack ${project.name}/${stack.name} cannot be restored locally`);
+                continue;
+            }
+            for (const app of stack.apps) {
+                if (!app.handleKey.startsWith(`${project.name}/${stack.name}/`) || all.has(app.handleKey))
+                    fail('invalid or duplicate qualified app identity');
+                if (!['online', 'stopped', 'errored', 'crashed'].includes(app.status))
+                    fail(`unstable app ${app.handleKey}: ${app.status}`);
+                const online = app.status === 'online';
+                if (online !== enabled)
+                    fail(`${app.handleKey}: boot policy would change its online/offline state; partial enabled stacks are unsupported`);
+                all.set(app.handleKey, online);
+            }
+        }
+        if (project.enabledStacks.some(s => !seenStacks.has(s)))
+            fail(`unknown enabled stack in ${project.name}`);
+        for (const app of declarations[0]?.apps ?? []) {
+            if (!app || typeof app.name !== 'string' || !app.name.startsWith(`${project.name}/`) || contracts.has(app.name) ||
+                !app.cwd?.startsWith('/') || !app.version || !app.binding)
+                fail('invalid or duplicate app contract');
+            if (app.binding.kind === 'hook') {
+                const b = app.binding;
+                if (b.bundleRoot !== previous.root || !/^[A-Z_][A-Z0-9_]*$/.test(b.bundleEnv) ||
+                    ['PATH', 'HOME', 'NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'SHELL'].includes(b.bundleEnv) ||
+                    !strings(b.rebind) || !b.rebind.length || !strings(b.verify) || !b.verify.length)
+                    fail(`unsupported or stale rebind contract for ${app.name}`);
+            }
+            else if (app.binding.kind !== 'independent')
+                fail(`unsupported binding for ${app.name}`);
+            contracts.set(app.name, app);
+        }
+    }
+    if (inventory.stacks.length !== seenProjects.size || inventory.contracts.some(c => !seenProjects.has(c.project)))
+        fail('unmatched project inventory');
+    const seenHandles = new Set();
+    for (const app of inventory.status.apps) {
+        if (seenHandles.has(app.name) || !all.has(app.name) || !['online', 'stopped', 'errored', 'crashed'].includes(app.status) ||
+            all.get(app.name) !== (app.status === 'online'))
+            fail(`unregistered, duplicate or inconsistent handle ${app.name}`);
+        seenHandles.add(app.name);
+    }
+    for (const [name, online] of all) {
+        if (!contracts.has(name))
+            fail(`missing explicit binding contract for ${name}`);
+        if (online && (!strings(contracts.get(name).health) || !contracts.get(name).health.length))
+            fail(`missing operational health command for ${name}`);
+        if (online && !seenHandles.has(name))
+            fail(`online stack app ${name} is absent from daemon`);
+    }
+    if ([...contracts.keys()].some(name => !all.has(name)))
+        fail('contract names an app absent from local stacks');
+    return { previous, candidate, inventory, apps: [...contracts.values()],
+        online: [...all].filter(([, online]) => online).map(([name]) => name).sort(),
+        offline: [...all].filter(([, online]) => !online).map(([name]) => name).sort() };
+}
+export function verifyRestoredInventory(plan, bundle, status) {
+    assertServingBundle(bundle, status);
+    const online = status.apps.filter(a => a.status === 'online').map(a => a.name).sort();
+    if (JSON.stringify(online) !== JSON.stringify(plan.online) || new Set(status.apps.map(a => a.name)).size !== status.apps.length ||
+        status.apps.some(a => ![...plan.online, ...plan.offline].includes(a.name) || ['starting', 'stopping'].includes(a.status))) {
+        throw new Error('Restored daemon does not have exactly the previously online apps');
+    }
+}
+/** Save intent before mutation; rollback only the framework and dependency bindings, never app releases/data. */
+export async function executeHostUpgrade(plan, id, actions) {
+    const receipt = { schema: 1, id, plan, phase: 'prepared', outcome: 'running', events: [] };
+    const record = async (phase, error) => {
+        receipt.phase = phase;
+        receipt.events.push({ at: new Date().toISOString(), phase, ...(error ? { error: String(error) } : {}) });
+        await actions.save(receipt);
+    };
+    await record('prepared'); // If this fails there must be no mutation.
+    try {
+        await record('stopping');
+        await actions.stop(plan.previous);
+        await record('activating');
+        await actions.activate(plan.candidate);
+        await record('rebinding');
+        for (const app of plan.apps)
+            await actions.rebind(app, plan.candidate);
+        await record('starting');
+        await actions.start(plan.candidate);
+        await record('verifying');
+        await actions.verify(plan.candidate);
+        receipt.outcome = 'upgraded';
+        await record('verified');
+    }
+    catch (error) {
+        // A failed terminal write may have left either the old or the new bytes.
+        // Rollback intent must always be discoverable as unfinished after a crash.
+        receipt.outcome = 'running';
+        // Record loss must not prevent recovery. All failed writes remain in the returned receipt.
+        try {
+            await record('rollback', error);
+        }
+        catch (writeError) {
+            receipt.events.push({ at: new Date().toISOString(), phase: 'receipt-write-failed', error: String(writeError) });
+        }
+        return recoverHostUpgrade(receipt, actions);
+    }
+    try {
+        await actions.prune([plan.previous.root, plan.candidate.root]);
+        await record('retained');
+    }
+    catch (error) {
+        try {
+            await record('retention-failed', error);
+        }
+        catch { /* verified upgrade remains successful */ }
+    }
+    return receipt;
+}
+/** Idempotent recovery of an interrupted operation, including a controller lost between phase writes. */
+export async function recoverHostUpgrade(receipt, actions) {
+    const record = async (phase, error) => {
+        receipt.phase = phase;
+        receipt.events.push({ at: new Date().toISOString(), phase, ...(error ? { error: String(error) } : {}) });
+        await actions.save(receipt);
+    };
+    try {
+        receipt.outcome = 'running';
+        await record('recovering');
+        await actions.stop(receipt.plan.candidate);
+        await actions.activate(receipt.plan.previous);
+        for (const app of receipt.plan.apps)
+            await actions.rebind(app, receipt.plan.previous);
+        await actions.start(receipt.plan.previous);
+        await actions.verify(receipt.plan.previous);
+        receipt.outcome = 'rolled-back';
+        await record('rolled-back');
+    }
+    catch (error) {
+        receipt.outcome = 'recovery-required';
+        try {
+            await record('recovery-required', error);
+        }
+        catch { /* original durable intent remains */ }
+    }
+    return receipt;
+}
+export function appHealthCommand(app, bundle) {
+    if (!app.health?.length)
+        throw new Error(`No operational health command for ${app.name}`);
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const cwd=${JSON.stringify(app.cwd)};
+    if(fs.realpathSync(cwd)!==cwd) throw Error('Release cwd changed or is not immutable');
+    const argv=${JSON.stringify(app.health)};
+    execFileSync(argv[0],argv.slice(1),{cwd,env:{...process.env,...${JSON.stringify(app.binding.kind === 'hook' ? { [app.binding.bundleEnv]: bundle.root } : {})}},stdio:'inherit',timeout:300000});`);
+}
+export function pendingReceiptsCommand(prefix, id) {
+    if (id !== undefined && !/^[A-Za-z0-9_-]+$/.test(id))
+        throw new Error('Invalid host upgrade receipt ID');
+    return remoteNode(`${fsPrelude}
+    const dir=${JSON.stringify(`${prefix}/upgrade-receipts`)};
+    const ids=${id === undefined ? "fs.existsSync(dir)?fs.readdirSync(dir).filter(n=>n.endsWith('.json')):[]" : JSON.stringify([`${id}.json`])};
+    const records=ids.map(name=>JSON.parse(fs.readFileSync(path.join(dir,name),'utf8')));
+    if(records.some(r=>r.schema!==1 || !r.plan || !Array.isArray(r.events))) throw Error('Invalid host upgrade receipt');
+    console.log(JSON.stringify(records.filter(r=>['running','recovery-required'].includes(r.outcome))));`);
+}
+/** Every program argument is quoted as data; declared hooks run without shell interpolation. */
+export function remoteNode(source) { return `node --input-type=module -e ${shellEscape(source)}`; }
+const fsPrelude = `import fs from 'node:fs'; import path from 'node:path'; import { pathToFileURL } from 'node:url';`;
+export function bundleProbeCommand(prefix, version) {
+    return remoteNode(`${fsPrelude}
+    const prefix=fs.realpathSync(${JSON.stringify(prefix)});
+    if(prefix!==${JSON.stringify(prefix)}) throw Error('Installation prefix must be canonical');
+    const root=fs.realpathSync(path.join(prefix,${JSON.stringify(version ? `versions/${version}` : 'current')}));
+    if(path.dirname(root)!==path.join(prefix,'versions')) throw Error('Bundle is not an immutable installed version');
+    const meta=JSON.parse(fs.readFileSync(path.join(root,'BUNDLE.json'),'utf8'));
+    const stamp=JSON.parse(fs.readFileSync(path.join(root,'dist/BUILD.json'),'utf8'));
+    const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
+    if(meta.dirty!==false || stamp.dirty!==false || !/^[a-f0-9]{40}$/.test(meta.commit) || stamp.commit!==meta.commit ||
+       meta.version!==path.basename(root) || pkg.version!==meta.version) throw Error('Inconsistent bundle metadata');
+    fs.accessSync(path.join(root,'dist/cli/omnitron.js'),fs.constants.X_OK);
+    console.log(JSON.stringify({root,version:meta.version,commit:meta.commit}));`);
+}
+export function inventoryCommand(bundle, full) {
+    return remoteNode(`${fsPrelude}
+    const {createDaemonClient}=await import(pathToFileURL(${JSON.stringify(`${bundle.root}/dist/daemon/daemon-client.js`)}).href);
+    const client=createDaemonClient();
+    try {
+      const status=await client.status();
+      ${full ? `const service=await client.service('OmnitronProject');
+      const projects=await service.listProjects(); const stacks=[]; const contracts=[];
+      for(const project of projects){
+        stacks.push({project:project.name,path:project.path,stacks:await service.listStacks({project:project.name})});
+        const file=path.join(project.path,${JSON.stringify(HOST_UPGRADE_CONTRACT)});
+        if(fs.existsSync(file)) contracts.push({...JSON.parse(fs.readFileSync(file,'utf8')),project:project.name});
+      }
+      console.log(JSON.stringify({status,projects,stacks,contracts}));` : 'console.log(JSON.stringify(status));'}
+    } finally { await client.disconnect(); }`);
+}
+export function hookCommand(app, bundle, operation) {
+    if (app.binding.kind === 'independent')
+        return 'true';
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const cwd=${JSON.stringify(app.cwd)};
+    if(fs.realpathSync(cwd)!==cwd) throw Error('Release cwd changed or is not immutable');
+    const argv=${JSON.stringify(app.binding[operation])};
+    execFileSync(argv[0],argv.slice(1),{cwd,env:{...process.env,[${JSON.stringify(app.binding.bundleEnv)}]:${JSON.stringify(bundle.root)}},stdio:'inherit',timeout:300000});`);
+}
+export function receiptCommand(prefix, receipt) {
+    return remoteNode(`${fsPrelude}
+    const dir=${JSON.stringify(`${prefix}/upgrade-receipts`)}; fs.mkdirSync(dir,{recursive:true,mode:0o700});
+    const file=path.join(dir,${JSON.stringify(`${receipt.id}.json`)}); const temporary=file+'.part';
+    const fd=fs.openSync(temporary,'w',0o600);
+    try { fs.writeFileSync(fd,${JSON.stringify(JSON.stringify(receipt, null, 2) + '\n')}); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.renameSync(temporary,file); const directory=fs.openSync(dir,'r'); try{fs.fsyncSync(directory)}finally{fs.closeSync(directory)};`);
+}
+export function contractPreflightCommand(apps) {
+    return remoteNode(`${fsPrelude}
+    for(const app of ${JSON.stringify(apps)}){
+      if(fs.realpathSync(app.cwd)!==app.cwd || !fs.statSync(app.cwd).isDirectory()) throw Error('Release cwd is not immutable: '+app.name);
+      for(const argv of [...(app.binding.kind==='hook'?[app.binding.rebind,app.binding.verify]:[]),...(app.health?[app.health]:[])]) {
+        const executable=argv[0];
+        const candidates=executable.includes('/') ? [path.resolve(app.cwd,executable)] : (process.env.PATH||'').split(':').filter(Boolean).map(p=>path.join(p,executable));
+        if(!candidates.some(p=>{try{fs.accessSync(p,fs.constants.X_OK);return fs.statSync(p).isFile()}catch{return false}})) throw Error('Missing hook executable: '+executable);
+      }
+    }`);
+}
+/** Only the declared dependency binding changes; release paths, versions, and app data stay intact. */
+export function updateContractBindingsCommand(plan, bundle) {
+    return remoteNode(`${fsPrelude}
+    for(const project of ${JSON.stringify(plan.inventory.projects)}) {
+      const file=path.join(project.path,${JSON.stringify(HOST_UPGRADE_CONTRACT)});
+      if(!fs.existsSync(file)) continue;
+      const document=JSON.parse(fs.readFileSync(file,'utf8'));
+      const expected=${JSON.stringify(plan.apps)}.filter(a=>a.name.startsWith(project.name+'/'));
+      if(document.schema!==1 || !Array.isArray(document.apps) || document.apps.length!==expected.length) throw Error('App contract changed during upgrade');
+      for(const app of document.apps) {
+        const original=expected.find(a=>a.name===app.name);
+        const normalized=JSON.parse(JSON.stringify(app));
+        if(normalized.binding.kind==='hook') normalized.binding.bundleRoot=${JSON.stringify(plan.previous.root)};
+        if(JSON.stringify(normalized)!==JSON.stringify(original)) throw Error('App release contract changed during upgrade: '+app.name);
+        if(app.binding.kind==='hook') app.binding.bundleRoot=${JSON.stringify(bundle.root)};
+      }
+      const temporary=file+'.upgrade-part'; const fd=fs.openSync(temporary,'w',0o600);
+      try {fs.writeFileSync(fd,JSON.stringify(document,null,2));fs.fsyncSync(fd)}finally{fs.closeSync(fd)}
+      fs.renameSync(temporary,file);
+    }`);
+}
+/** Linux process identity + supervisor state. Other platforms and custom/drop-in units fail closed. */
+export function runtimeProbeCommand(bundle, pid) {
+    return remoteNode(`${fsPrelude} import os from 'node:os'; import {execFileSync} from 'node:child_process';
+    if(process.platform!=='linux') throw Error('Controlled host upgrade currently requires Linux runtime inspection');
+    const root=${JSON.stringify(bundle.root)}; const pid=${JSON.stringify(pid)};
+    const argv=fs.readFileSync('/proc/'+pid+'/cmdline','utf8').split('\\0').filter(Boolean);
+    const entry=argv.find(a=>a.endsWith('/dist/daemon/daemon-entry.js'));
+    if(!entry || fs.realpathSync(entry)!==root+'/dist/daemon/daemon-entry.js') throw Error('Serving daemon entry does not bind installed bundle');
+    const cwd=fs.realpathSync('/proc/'+pid+'/cwd');
+    const candidates=[{scope:'system',file:'/etc/systemd/system/omnitron-daemon.service'},{scope:'user',file:path.join(os.homedir(),'.config/systemd/user/omnitron-daemon.service')}].filter(c=>fs.existsSync(c.file));
+    if(candidates.length>1) throw Error('Multiple supervisor scopes are unsupported');
+    if(!candidates.length) { console.log(JSON.stringify({kind:'fork',cwd})); }
+    else {
+      const unit=candidates[0]; const args=unit.scope==='user'?['--user']:[];
+      const output=execFileSync('systemctl',[...args,'show','omnitron-daemon.service','--property=MainPID,ActiveState,UnitFileState,FragmentPath,DropInPaths'],{encoding:'utf8'});
+      const properties=Object.fromEntries(output.trim().split('\\n').map(l=>[l.slice(0,l.indexOf('=')),l.slice(l.indexOf('=')+1)]));
+      if(properties.MainPID!==String(pid) || properties.ActiveState!=='active' || properties.FragmentPath!==unit.file || properties.DropInPaths || !['enabled','disabled'].includes(properties.UnitFileState)) throw Error('Supervisor does not own the serving daemon, or has unsupported overrides');
+      const contents=fs.readFileSync(unit.file,'utf8');
+      const lines=contents.split('\\n'); const exec=lines.filter(l=>l.startsWith('ExecStart=')); const wd=lines.filter(l=>l.startsWith('WorkingDirectory='));
+      const aliases=[root,path.dirname(path.dirname(root))+'/current'];
+      if(exec.length!==1 || wd.length!==1 || !aliases.some(p=>exec[0].includes(p+'/dist/daemon/daemon-entry.js')) || !aliases.some(p=>wd[0]==='WorkingDirectory='+p)) throw Error('Unsupported supervisor framework binding');
+      const operatorCwd=lines.filter(l=>/^Environment="?OMNITRON_CWD=/.test(l));
+      if(operatorCwd.length!==1 || !aliases.some(p=>operatorCwd[0]==='Environment=OMNITRON_CWD='+p || operatorCwd[0]==='Environment="OMNITRON_CWD='+p+'"')) throw Error('Unsupported supervisor operator cwd');
+      if(lines.some(l=>!l.startsWith('ExecStart=')&&!l.startsWith('WorkingDirectory=')&&!/^Environment="?OMNITRON_CWD=/.test(l)&&l.includes(root))) throw Error('Additional static framework paths in service need an explicit migration');
+      console.log(JSON.stringify({kind:'systemd',cwd,...unit,contents,enabled:properties.UnitFileState==='enabled'}));
+    }`);
+}
+export function runtimeStopCommand(runtime, bundle) {
+    if (runtime.kind === 'fork')
+        return `${shellEscape(`${bundle.root}/dist/cli/omnitron.js`)} down`;
+    return `systemctl ${runtime.scope === 'user' ? '--user ' : ''}stop omnitron-daemon.service`;
+}
+export function runtimeStartCommand(runtime, previous, bundle, allowedCurrentRoots = [previous.root, bundle.root]) {
+    if (runtime.kind === 'fork')
+        return `cd ${shellEscape(runtime.cwd === previous.root ? bundle.root : runtime.cwd)} && ${shellEscape(`${bundle.root}/dist/cli/omnitron.js`)} up --no-infra`;
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const original=${JSON.stringify(runtime.contents)};
+    const render=root=>original.split('\\n').map(l=>(l.startsWith('ExecStart=')||l.startsWith('WorkingDirectory=')||/^Environment="?OMNITRON_CWD=/.test(l))?l.split(${JSON.stringify(previous.root)}).join(root):l).join('\\n');
+    const content=render(${JSON.stringify(bundle.root)});
+    const file=${JSON.stringify(runtime.file)};
+    if(!${JSON.stringify(allowedCurrentRoots)}.map(render).includes(fs.readFileSync(file,'utf8'))) throw Error('Supervisor unit changed outside the captured host operation');
+    const mode=fs.statSync(file).mode & 0o777;
+    const temporary=file+'.upgrade-part'; const fd=fs.openSync(temporary,'w',mode);
+    try{fs.writeFileSync(fd,content);fs.fsyncSync(fd)}finally{fs.closeSync(fd)} fs.renameSync(temporary,file);
+    const scope=${JSON.stringify(runtime.scope === 'user' ? ['--user'] : [])};
+    execFileSync('systemctl',[...scope,'daemon-reload'],{stdio:'inherit'});
+    execFileSync('systemctl',[...scope,${JSON.stringify(runtime.enabled ? 'enable' : 'disable')},'omnitron-daemon.service'],{stdio:'inherit'});
+    execFileSync('systemctl',[...scope,'start','omnitron-daemon.service'],{stdio:'inherit'});`);
+}
+/** A successful CLI exit is insufficient: prove its native PID owner is no longer alive before rebinding. */
+export function stoppedDaemonCommand(bundle) {
+    return remoteNode(`${fsPrelude}
+    const base=${JSON.stringify(bundle.root)};
+    const {PidManager}=await import(pathToFileURL(base+'/dist/daemon/pid-manager.js').href);
+    const {DEFAULT_DAEMON_CONFIG}=await import(pathToFileURL(base+'/dist/config/defaults.js').href);
+    const {expandPath}=await import(pathToFileURL(base+'/dist/shared/paths.js').href);
+    const pid=new PidManager(expandPath(DEFAULT_DAEMON_CONFIG.pidFile)).getPid();
+    if(pid && PidManager.isProcessAlive(pid)) throw Error('Daemon still owns a live PID after stop; refusing to change bindings');`);
+}
+//# sourceMappingURL=host-upgrade.js.map

package/dist/services/host-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-upgrade.js","sourceRoot":"","sources":["../../src/services/host-upgrade.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAuClE,SAAS,IAAI,CAAC,MAAc,IAAW,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,KAAc,IAAuB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/I,6FAA6F;AAC7F,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AAC5H,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,MAA+B;IAC1F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,KAAK,KAAK;QAClF,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,kDAAkD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,QAAyB,EAAE,SAA0B,EAAE,SAAwB;IAC7G,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtF,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC/K,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACvK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC/J,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,IAAI,CAAC,+BAA+B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/G,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,UAAU,qBAAqB,WAAW,CAAC,CAAC;QAC/L,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO;oBAAE,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,UAAU,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBAC1G,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBAC/I,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5H,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;gBACvC,IAAI,MAAM,KAAK,OAAO;oBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,6FAA6F,CAAC,CAAC;gBAC5I,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,4BAA4B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC3G,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACzG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;gBACtB,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBACzE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1F,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,4CAA4C,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrJ,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;gBAAE,IAAI,CAAC,2BAA2B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3F,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtJ,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACpH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;YAAE,IAAI,CAAC,kDAAkD,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;QACtJ,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,oBAAoB,IAAI,wBAAwB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC/G,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAC5E,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAqB,EAAE,MAAuB,EAAE,MAA+B;IACrH,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;QAC3H,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAaD,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAqB,EAAE,EAAU,EAAE,OAA2B;IACrG,MAAM,OAAO,GAAuB,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/G,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,EAAE;QACtD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,2CAA2C;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;QAC5B,2FAA2F;QAC3F,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAChL,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACjG,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IAAC,CAAC;IACtH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA2B,EAAE,OAA2B;IAC/F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,EAAE;QACtD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;QAC5B,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;QAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,GAAG,mBAAmB,CAAC;QACtC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,MAAuB;IAC/E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;;iBAEtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;qEAC0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACvM,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,EAAW;IAChE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzG,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,mBAAmB,CAAC;gBAC5C,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;;;yGAGrC,CAAC,CAAC;AAC3G,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,MAAc,IAAY,OAAO,+BAA+B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACnH,MAAM,SAAS,GAAG,mGAAmG,CAAC;AACtH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAgB;IACjE,OAAO,UAAU,CAAC,GAAG,SAAS;mCACG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;kBACvC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;kDACU,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;;;;;;;;iFAQ5B,CAAC,CAAC;AACnF,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,MAAuB,EAAE,IAAa;IACrE,OAAO,UAAU,CAAC,GAAG,SAAS;4DAC4B,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,+BAA+B,CAAC;;;;QAIjH,IAAI,CAAC,CAAC,CAAC;;;;4CAI6B,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;uEAGV,CAAC,CAAC,CAAC,sCAAsC;6CACnE,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,GAAuB,EAAE,MAAuB,EAAE,SAA8B;IAC1G,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IACtD,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;;iBAEtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;mEACY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;AAC/K,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAA2B;IACxE,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,mBAAmB,CAAC;+BAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,EAAE,OAAO,CAAC;;gCAEnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;uIACgD,CAAC,CAAC;AACzI,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,IAA0B;IACjE,OAAO,UAAU,CAAC,GAAG,SAAS;uBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;MAOrC,CAAC,CAAC;AACR,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,6BAA6B,CAAC,IAAqB,EAAE,MAAuB;IAC1F,OAAO,UAAU,CAAC,GAAG,SAAS;2BACL,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;0CACxB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;uBAGxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;6EAK6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;+DAEhD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;MAKpF,CAAC,CAAC;AACR,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,GAAW;IACtE,OAAO,UAAU,CAAC,GAAG,SAAS;;iBAEf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;MAqBxE,CAAC,CAAC;AACR,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,MAAuB;IAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,WAAW,CAAC,GAAG,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC;IACjG,OAAO,aAAa,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC;AAC9F,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAAoB,EAAE,QAAyB,EAAE,MAAuB,EAAE,mBAAmB,GAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;IACxK,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,WAAW,CAAC,GAAG,MAAM,CAAC,IAAI,uBAAuB,CAAC,gBAAgB,CAAC;IAC1L,OAAO,UAAU,CAAC,GAAG,SAAS;qBACX,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;sKACiH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;2BACxK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;iBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;UACnC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;;;;kBAI3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;;yCAEnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;8FACD,CAAC,CAAC;AAChG,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO,UAAU,CAAC,GAAG,SAAS;iBACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;mIAKuF,CAAC,CAAC;AACrI,CAAC"}

package/dist/services/infrastructure.rpc-service.d.ts

@@ -4,6 +4,8 @@
  * Netron RPC endpoints for infrastructure container management
  * (Docker-based PostgreSQL, Redis, MinIO, etc.).
  */
+import { HostIngressService } from '../infrastructure/host-ingress.service.js';
+import type { HostIngressApply, HostIngressRemove, HostIngressSettings, HostIngressOwnerRestore, HostIngressTakeoverRollback } from '../infrastructure/host-ingress-types.js';
 import type { InfrastructureService } from '../infrastructure/infrastructure.service.js';
 import type { InfrastructureConfig, IServiceRequirement } from '../infrastructure/types.js';
 import type { InfrastructureState, ContainerState } from '../infrastructure/types.js';
@@ -52,6 +54,7 @@ export declare class InfrastructureRpcService implements IOmnitronInfraService {
      * partial payload a `warn`.
      */
     private readonly logger?;
+    private readonly hostIngress;
     constructor(getInfra: () => InfrastructureService | null, 
     /**
      * How this daemon builds and adopts an infrastructure it is asked for.
@@ -98,7 +101,19 @@ export declare class InfrastructureRpcService implements IOmnitronInfraService {
         error(obj: object, msg?: string, ...args: any[]): void;
         warn?(obj: object, msg?: string, ...args: any[]): void;
         info?(obj: object, msg?: string, ...args: any[]): void;
-    } | undefined);
+    } | undefined, hostIngress?: HostIngressService);
+    configureHostIngress(data: HostIngressSettings): Promise<{
+        configured: true;
+        settings: HostIngressSettings;
+    }>;
+    getHostIngress(): Promise<import("../infrastructure/host-ingress-types.js").HostIngressStatus>;
+    checkHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressCheck>;
+    validateHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressValidation>;
+    restoreHostIngressOwner(data: HostIngressOwnerRestore): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    rollbackHostIngressTakeover(data: HostIngressTakeoverRollback): Promise<import("../infrastructure/host-ingress-types.js").HostIngressTakeoverRollbackReceipt>;
+    applyHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    removeHostIngress(data: HostIngressRemove): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    recoverHostIngress(): Promise<import("../infrastructure/host-ingress-types.js").HostIngressStatus>;
     /**
      * Bring up the infrastructure a stack needs, here, on this node.
      *

package/dist/services/infrastructure.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infrastructure.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/infrastructure.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAK5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAUvE,qBACa,wBAAyB,YAAW,qBAAqB;IAElE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAhD1B,YACmB,QAAQ,EAAE,MAAM,qBAAqB,GAAG,IAAI;IAC7D;;;;;;;;;;OAUG;IACc,SAAS,CAAC,GAAE,CAC3B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC7C,QAAQ,EAAE,OAAO,uCAAuC,EAAE,cAAc,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,KAC7E,qBAAqB,aAAA;IAC1B;;;;;;;;;;;;OAYG;IACc,QAAQ,CAAC,GAAE,MAAM,OAAO,0CAA0C,EAAE,eAAe,GAAG,SAAS,aAAA;IAChH;;;;;;;;OAQG;IACH;;;;;OAKG;IACc,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KACxD,GAAG,SAAS,EACX;IAEJ;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAOG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,oBAAoB,CAAC;QAC7B;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;QAC3D;;;;;;;;;;WAUG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;QAC9F;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE,OAAO,qCAAqC,EAAE,aAAa,GAAG,SAAS,CAAC;QACtF;;;;;;;WAOG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACjD;;;;;;;;;;WAUG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KACtD,GAAG,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAOD;IAED,2EAA2E;YAC7D,iBAAiB;IA2K/B;;;;;;OAMG;IACL;;;;;;SAMK;IACL;;;;;;;;;SASK;YACW,iBAAiB;YAuBjB,iBAAiB;YAmDjB,qBAAqB;IA6DnC;;;;;;OAMG;IAEG,mBAAmB,CACvB,IAAI,EAAE,OAAO,sCAAsC,EAAE,qBAAqB,GACzE,OAAO,CAAC,OAAO,sCAAsC,EAAE,cAAc,CAAC,CAUxE;IAGK,QAAQ,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGpD;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEG,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAEG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAI1F;IAgBD;;OAEG;YACW,aAAa;IAarB,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI1E;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3F;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3E;IAGK,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAMvF;CACF"}
+{"version":3,"file":"infrastructure.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/infrastructure.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AAI9K,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAK5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAUvE,qBACa,wBAAyB,YAAW,qBAAqB;IAElE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IArD9B,YACmB,QAAQ,EAAE,MAAM,qBAAqB,GAAG,IAAI;IAC7D;;;;;;;;;;OAUG;IACc,SAAS,CAAC,GAAE,CAC3B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC7C,QAAQ,EAAE,OAAO,uCAAuC,EAAE,cAAc,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,KAC7E,qBAAqB,aAAA;IAC1B;;;;;;;;;;;;OAYG;IACc,QAAQ,CAAC,GAAE,MAAM,OAAO,0CAA0C,EAAE,eAAe,GAAG,SAAS,aAAA;IAChH;;;;;;;;OAQG;IACH;;;;;OAKG;IACc,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KACxD,GAAG,SAAS,EACI,WAAW,GAAE,kBAA6C,EACzE;IAGE,oBAAoB,CAAC,IAAI,EAAE,mBAAmB;;;OAA8C;IAG5F,cAAc,iFAAwC;IAGtD,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,+EAA0C;IAGjF,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,oFAA6C;IAGvF,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,iFAAiD;IAGtG,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,iGAAqD;IAGlH,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,iFAA0C;IAGjF,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,iFAA2C;IAGpF,kBAAkB,iFAAyC;IAEjE;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAOG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,oBAAoB,CAAC;QAC7B;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;QAC3D;;;;;;;;;;WAUG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;QAC9F;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE,OAAO,qCAAqC,EAAE,aAAa,GAAG,SAAS,CAAC;QACtF;;;;;;;WAOG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACjD;;;;;;;;;;WAUG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KACtD,GAAG,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CASD;IAED,2EAA2E;YAC7D,iBAAiB;IAqK/B;;;;;;OAMG;IACL;;;;;;SAMK;IACL;;;;;;;;;SASK;YACW,iBAAiB;YAuBjB,iBAAiB;YAmDjB,qBAAqB;IA6DnC;;;;;;OAMG;IAEG,mBAAmB,CACvB,IAAI,EAAE,OAAO,sCAAsC,EAAE,qBAAqB,GACzE,OAAO,CAAC,OAAO,sCAAsC,EAAE,cAAc,CAAC,CAUxE;IAGK,QAAQ,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGpD;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEG,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAEG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAI1F;IAgBD;;OAEG;YACW,aAAa;IAarB,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI1E;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3F;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3E;IAGK,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAMvF;CACF"}

package/dist/services/infrastructure.rpc-service.js

@@ -13,13 +13,14 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import { HostIngressService } from '../infrastructure/host-ingress.service.js';
 import { Service, Public } from '@omnitron-dev/titan/decorators';
 import { Errors } from '@omnitron-dev/titan/errors';
 import { VIEWER_ROLES, OPERATOR_ROLES, CONTROL_PLANE_ROLES, CONTROL_PLANE_READ_ROLES } from '../shared/roles.js';
 import { summariseProvisioning, provisioningVerdict } from '../infrastructure/provisioning-outcome.js';
 import { withGeneratedCredentials } from '../infrastructure/service-credentials.js';
 import { duringPhase } from '../project/deploy-phases.js';
-import { containerEndpoint, REDIS_CONTAINER_PORT } from '../infrastructure/service-resolver.js';
+import { containerEndpoint, REDIS_CONTAINER_PORT, withInfrastructureScope } from '../infrastructure/service-resolver.js';
 import { gatewayRedisDb } from '../infrastructure/gateway-redis-db.js';
 import { startContainer, stopContainer, removeContainer, getContainerLogs, listManagedContainers, } from '../infrastructure/container-runtime.js';
 let InfrastructureRpcService = class InfrastructureRpcService {
@@ -27,6 +28,7 @@ let InfrastructureRpcService = class InfrastructureRpcService {
     hostInfra;
     getVault;
     logger;
+    hostIngress;
     constructor(getInfra, 
     /**
      * How this daemon builds and adopts an infrastructure it is asked for.
@@ -69,12 +71,22 @@ let InfrastructureRpcService = class InfrastructureRpcService {
      * credential; writing a node's config files is worth an `info` and a
      * partial payload a `warn`.
      */
-    logger) {
+    logger, hostIngress = new HostIngressService()) {
         this.getInfra = getInfra;
         this.hostInfra = hostInfra;
         this.getVault = getVault;
         this.logger = logger;
+        this.hostIngress = hostIngress;
     }
+    async configureHostIngress(data) { return this.hostIngress.configure(data); }
+    async getHostIngress() { return this.hostIngress.status(); }
+    async checkHostIngress(data) { return this.hostIngress.check(data); }
+    async validateHostIngress(data) { return this.hostIngress.validate(data); }
+    async restoreHostIngressOwner(data) { return this.hostIngress.restoreOwner(data); }
+    async rollbackHostIngressTakeover(data) { return this.hostIngress.rollbackTakeover(data); }
+    async applyHostIngress(data) { return this.hostIngress.apply(data); }
+    async removeHostIngress(data) { return this.hostIngress.remove(data); }
+    async recoverHostIngress() { return this.hostIngress.recover(); }
     /**
      * Bring up the infrastructure a stack needs, here, on this node.
      *
@@ -108,7 +120,7 @@ let InfrastructureRpcService = class InfrastructureRpcService {
         // Named while it runs, so a stall on this node says what it was doing.
         // Test node, 2026-09-22: it went quiet for ten seconds around the end of a
         // provision and nothing here could name it — `monitoring/event-loop-watch.ts`.
-        return duringPhase(`provisioning ${data?.project ?? 'omnitron'}/${data?.stack ?? 'default'} for the master`, () => this.provisionStackNow(data));
+        return withInfrastructureScope(data?.project, data?.stack, () => duringPhase(`provisioning ${data?.project ?? 'omnitron'}/${data?.stack ?? 'default'} for the master`, () => this.provisionStackNow(data)));
     }
     /** `provisionStack`'s work. Not an RPC method: it carries no `@Public`. */
     async provisionStackNow(data) {
@@ -131,11 +143,6 @@ let InfrastructureRpcService = class InfrastructureRpcService {
         // Measured: a node asked to provision `postgres, redis, minio` answered
         // "Infrastructure: nothing is declared, so nothing was provisioned" —
         // which was true of what it had been given and false of what was asked.
-        if (data.project && data.stack) {
-            const { setContainerPrefix, setStackLabels } = await import('../infrastructure/service-resolver.js');
-            setContainerPrefix(data.project, data.stack);
-            setStackLabels(data.project, data.stack);
-        }
         const { normalizeInfraConfig } = await import('../infrastructure/config-normalizer.js');
         const { createDefaultRegistry } = await import('../infrastructure/presets/index.js');
         // One registry, used to expand the config AND to run the post-provision
@@ -233,7 +240,7 @@ let InfrastructureRpcService = class InfrastructureRpcService {
             service.setConfigRoots(configRoots, staticRoots, {
                 host: endpoint.host,
                 port: endpoint.port,
-                // Not `(redis.db ?? 0) + 1`: on daos/test that is 1, storage's
+                // Not `(redis.db ?? 0) + 1`: on sample/test that is 1, storage's
                 // database, while main wrote the lock to 5 — see gateway-redis-db.ts.
                 db: gatewayRedisDb(redisCfg?.databases),
                 ...(redisCfg?.password ? { password: redisCfg.password } : {}),
@@ -514,6 +521,60 @@ let InfrastructureRpcService = class InfrastructureRpcService {
         return { logs: await getContainerLogs(data.name, tail) };
     }
 };
+__decorate([
+    Public({ auth: { roles: ['admin', 'service_role'] } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "configureHostIngress", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_READ_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "getHostIngress", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "checkHostIngress", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "validateHostIngress", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "restoreHostIngressOwner", null);
+__decorate([
+    Public({ auth: { roles: ['admin', 'service_role'] } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "rollbackHostIngressTakeover", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "applyHostIngress", null);
+__decorate([
+    Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "removeHostIngress", null);
+__decorate([
+    Public({ auth: { roles: ['admin', 'service_role'] } }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], InfrastructureRpcService.prototype, "recoverHostIngress", null);
 __decorate([
     Public({ auth: { roles: CONTROL_PLANE_ROLES } }),
     __metadata("design:type", Function),
@@ -570,7 +631,7 @@ __decorate([
 ], InfrastructureRpcService.prototype, "getContainerLogs", null);
 InfrastructureRpcService = __decorate([
     Service({ name: 'OmnitronInfra' }),
-    __metadata("design:paramtypes", [Function, Function, Function, Object])
+    __metadata("design:paramtypes", [Function, Function, Function, Object, HostIngressService])
 ], InfrastructureRpcService);
 export { InfrastructureRpcService };
 //# sourceMappingURL=infrastructure.rpc-service.js.map