@omnitron-dev/omnitron 0.3.0 → 0.3.1

package/dist/infrastructure/host-ingress.service.js

@@ -0,0 +1,514 @@
+import path from 'node:path';
+import os from 'node:os';
+import { constants } from 'node:fs';
+import * as fs from 'node:fs/promises';
+import { createHash, createPrivateKey, randomUUID, X509Certificate } from 'node:crypto';
+import { checkIngressConflicts, ingressOwner, ingressOwnerKey, normalizeIngressApplication, normalizeIngressSettings, renderHostIngress } from './host-ingress-config.js';
+import { normalizeIngressTakeover, normalizeIngressTakeoverSnapshot } from './host-ingress-takeover.js';
+import { DockerHostIngressRuntime } from './host-ingress-runtime.js';
+import { withIngressLock } from './host-ingress-lock.js';
+const digest = (value) => createHash('sha256').update(value).digest('hex');
+const generationPattern = /^[1-9][0-9]*-[a-f0-9]{16}$/;
+export function ingressOwnerRevision(app) { return digest(JSON.stringify(app)); }
+async function exists(file) { try {
+    await fs.lstat(file);
+    return true;
+}
+catch (e) {
+    if (e.code === 'ENOENT')
+        return false;
+    throw e;
+} }
+async function syncDirectory(directory) { const fd = await fs.open(directory, 'r'); try {
+    await fd.sync();
+}
+finally {
+    await fd.close();
+} }
+async function durableFile(file, contents) {
+    const temp = `${file}.${randomUUID()}.tmp`;
+    const fd = await fs.open(temp, 'wx', 0o600);
+    try {
+        await fd.writeFile(contents);
+        await fd.sync();
+    }
+    finally {
+        await fd.close();
+    }
+    try {
+        await fs.rename(temp, file);
+        await syncDirectory(path.dirname(file));
+    }
+    finally {
+        await fs.rm(temp, { force: true });
+    }
+}
+/** Host-owned state; neither daemon shutdown nor app teardown removes this service. */
+export class HostIngressService {
+    lock;
+    root;
+    runtime;
+    constructor(root = path.join(os.homedir(), '.omnitron', 'host-ingress'), runtime, lock = withIngressLock) {
+        this.lock = lock;
+        this.root = path.resolve(root);
+        if (/[\0\r\n,]/.test(this.root))
+            throw new Error('Invalid host ingress state root');
+        this.runtime = runtime ?? new DockerHostIngressRuntime(this.root);
+    }
+    file(name) { return path.join(this.root, name); }
+    async locked(body) {
+        const created = await fs.mkdir(this.root, { recursive: true, mode: 0o700 });
+        // Persist newly created directory entries too, before any transaction can stop an origin.
+        if (created) {
+            for (let directory = this.root;; directory = path.dirname(directory)) {
+                await syncDirectory(path.dirname(directory));
+                if (directory === created)
+                    break;
+            }
+        }
+        return this.lock(this.file('publication.lock'), body);
+    }
+    async settings() {
+        try {
+            return normalizeIngressSettings(JSON.parse(await fs.readFile(this.file('settings.json'), 'utf8')));
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw e;
+        }
+    }
+    async requiredSettings() { const settings = await this.settings(); if (!settings)
+        throw new Error('Host ingress is not configured'); return settings; }
+    async configure(value) {
+        const settings = normalizeIngressSettings(value);
+        return this.locked(async () => {
+            const previous = await this.settings();
+            if (previous && JSON.stringify(previous) !== JSON.stringify(settings))
+                throw new Error('Host ingress settings are immutable; migrate or upgrade the host explicitly');
+            if (!previous)
+                await durableFile(this.file('settings.json'), JSON.stringify(settings, null, 2) + '\n');
+            return { configured: true, settings };
+        });
+    }
+    async currentGeneration() {
+        let link;
+        try {
+            link = await fs.readlink(this.file('current'));
+        }
+        catch (e) {
+            if (e.code === 'ENOENT')
+                return null;
+            throw new Error(`Invalid host ingress current pointer: ${String(e)}`);
+        }
+        if (!/^generations\/[1-9][0-9]*-[a-f0-9]{16}$/.test(link))
+            throw new Error('Invalid host ingress current pointer');
+        return path.posix.basename(link);
+    }
+    generation(settings, sequence, applications) {
+        return `${sequence}-${digest(JSON.stringify({ settings, sequence, applications })).slice(0, 16)}`;
+    }
+    async manifest(settings, generation) {
+        if (!generationPattern.test(generation))
+            throw new Error('Invalid ingress generation');
+        const raw = JSON.parse(await fs.readFile(this.file(`generations/${generation}/manifest.json`), 'utf8'));
+        if (raw.version !== 1 || raw.generation !== generation || !Number.isSafeInteger(raw.sequence) || raw.sequence < 1 || !Array.isArray(raw.applications)
+            || Object.keys(raw).sort().join(',') !== 'applications,generation,sequence,version')
+            throw new Error('Invalid ingress manifest');
+        const applications = raw.applications.map((app) => {
+            if (!Array.isArray(app.routes))
+                throw new Error('Invalid ingress routes');
+            const normalized = normalizeIngressApplication({ ...app, routes: app.routes.map(({ certificateObject: _object, ...route }) => route) });
+            const routes = normalized.routes.map((route) => {
+                const original = app.routes.find((r) => JSON.stringify(r.domains) === JSON.stringify(route.domains));
+                if (!original || !/^[a-f0-9]{64}$/.test(original.certificateObject))
+                    throw new Error('Invalid certificate snapshot');
+                return { ...route, certificateObject: original.certificateObject };
+            });
+            return { ...normalized, routes };
+        });
+        applications.sort((a, b) => ingressOwnerKey(a.owner).localeCompare(ingressOwnerKey(b.owner)));
+        checkIngressConflicts(settings, applications);
+        if (this.generation(settings, raw.sequence, applications) !== generation || JSON.stringify(applications) !== JSON.stringify(raw.applications))
+            throw new Error('Ingress manifest content hash mismatch');
+        const manifest = { version: 1, generation, sequence: raw.sequence, applications };
+        if ((await fs.readFile(this.file(`generations/${generation}/nginx.conf`), 'utf8')) !== renderHostIngress(settings, manifest))
+            throw new Error('Ingress configuration content mismatch');
+        await this.verifyCertificates(manifest);
+        return manifest;
+    }
+    async verifyCertificates(manifest) {
+        const seen = new Set();
+        for (const app of manifest.applications)
+            for (const route of app.routes) {
+                const object = route.certificateObject;
+                if (seen.has(object))
+                    continue;
+                seen.add(object);
+                const certificate = await this.source(this.file('certificates'), `${object}/certificate.pem`);
+                const key = await this.source(this.file('certificates'), `${object}/private-key.pem`);
+                if (createHash('sha256').update(certificate).update('\0').update(key).digest('hex') !== object)
+                    throw new Error('TLS snapshot content hash mismatch');
+            }
+    }
+    async status() {
+        const settings = await this.settings();
+        const generation = await this.currentGeneration();
+        if (!settings && generation)
+            throw new Error('Ingress settings missing for existing generation');
+        const manifest = settings && generation ? await this.manifest(settings, generation) : null;
+        return { configured: !!settings, settings, generation, applications: manifest?.applications ?? [], ownerRevisions: (manifest?.applications ?? []).map((app) => ({ owner: app.owner, revision: ingressOwnerRevision(app) })), takeover: await this.takeoverRecord(), observedGeneration: settings ? await this.runtime.observed(settings) : null, recoveryPending: await exists(this.file('pending.json')) };
+    }
+    async pointer(generation) {
+        if (generation === null) {
+            await fs.rm(this.file('current'), { force: true });
+            await syncDirectory(this.root);
+            return;
+        }
+        if (!generationPattern.test(generation))
+            throw new Error('Invalid ingress pointer target');
+        const temp = this.file(`current.${randomUUID()}.tmp`);
+        await fs.symlink(`generations/${generation}`, temp);
+        try {
+            await fs.rename(temp, this.file('current'));
+            await syncDirectory(this.root);
+        }
+        finally {
+            await fs.rm(temp, { force: true });
+        }
+    }
+    async clearJournal() { await fs.rm(this.file('pending.json')); await syncDirectory(this.root); }
+    async restore(settings, generation) {
+        if (generation) {
+            await this.manifest(settings, generation);
+            await this.runtime.validate(settings, generation);
+        }
+        await this.pointer(generation);
+        if (generation) {
+            await this.runtime.activate(settings);
+            await this.runtime.acknowledge(settings, generation);
+        }
+        else
+            await this.runtime.remove(settings);
+    }
+    async takeoverRecord() {
+        if (!(await exists(this.file('takeover.json'))))
+            return null;
+        const raw = JSON.parse(await fs.readFile(this.file('takeover.json'), 'utf8'));
+        if (!generationPattern.test(raw.generation) || !['committed', 'rolled-back'].includes(raw.outcome) || Object.keys(raw).sort().join(',') !== 'generation,outcome,snapshot')
+            throw new Error('Invalid takeover receipt');
+        const snapshot = normalizeIngressTakeoverSnapshot(raw.snapshot);
+        if (JSON.stringify(snapshot) !== JSON.stringify(raw.snapshot))
+            throw new Error('Invalid takeover snapshot');
+        return { generation: raw.generation, snapshot, outcome: raw.outcome };
+    }
+    async recordTakeover(journal, outcome) {
+        if (journal.takeover)
+            await durableFile(this.file('takeover.json'), JSON.stringify({ generation: journal.candidate, snapshot: journal.takeover, outcome }) + '\n');
+    }
+    journal(value, settings) {
+        const journal = value;
+        const keys = journal?.takeover ? 'candidate,phase,previous,settingsHash,takeover,version' : 'candidate,phase,previous,settingsHash,version';
+        if (!journal || journal.version !== 1 || !['prepared', 'acknowledged', 'rollback-prepared'].includes(journal.phase) || !generationPattern.test(journal.candidate)
+            || (journal.previous !== null && !generationPattern.test(journal.previous)) || journal.settingsHash !== digest(JSON.stringify(settings)) || Object.keys(journal).sort().join(',') !== keys)
+            throw new Error('Invalid host ingress recovery journal');
+        if (journal.takeover) {
+            if (journal.previous !== null || JSON.stringify(normalizeIngressTakeoverSnapshot(journal.takeover)) !== JSON.stringify(journal.takeover))
+                throw new Error('Invalid initial takeover journal');
+        }
+        else if (journal.phase === 'rollback-prepared')
+            throw new Error('Rollback journal requires an initial takeover');
+        return journal;
+    }
+    async restoreJournal(settings, journal) {
+        await this.restore(settings, journal.previous);
+        if (journal.takeover)
+            await this.runtime.restoreTakeover(settings, journal.takeover);
+        await this.recordTakeover(journal, 'rolled-back');
+    }
+    async recoverLocked(settings) {
+        if (!(await exists(this.file('pending.json'))))
+            return;
+        const journal = this.journal(JSON.parse(await fs.readFile(this.file('pending.json'), 'utf8')), settings);
+        const current = await this.currentGeneration();
+        if (current !== journal.previous && current !== journal.candidate)
+            throw new Error('Host ingress recovery found an unrelated generation');
+        if (journal.phase === 'acknowledged') {
+            if (current !== journal.candidate)
+                throw new Error('Acknowledged ingress generation pointer changed');
+            await this.manifest(settings, journal.candidate);
+            await this.runtime.inspect(settings);
+            if (journal.takeover)
+                await this.runtime.verifyRetiredTakeover(journal.takeover);
+            await this.runtime.activate(settings);
+            await this.runtime.acknowledge(settings, journal.candidate);
+            await this.recordTakeover(journal, 'committed');
+        }
+        else
+            await this.restoreJournal(settings, journal);
+        await this.clearJournal();
+    }
+    async recover() {
+        return this.locked(async () => { const settings = await this.requiredSettings(); await this.recoverLocked(settings); return this.status(); });
+    }
+    async source(root, relative) {
+        const realRoot = await fs.realpath(root);
+        const realFile = await fs.realpath(path.join(realRoot, relative));
+        if (!realFile.startsWith(realRoot + path.sep))
+            throw new Error('TLS source escapes certificate root');
+        const fd = await fs.open(realFile, constants.O_RDONLY | constants.O_NOFOLLOW);
+        try {
+            const stat = await fd.stat();
+            if (!stat.isFile() || stat.size > 1024 * 1024)
+                throw new Error('TLS source must be a regular file under 1 MiB');
+            return await fd.readFile();
+        }
+        finally {
+            await fd.close();
+        }
+    }
+    async snapshot(settings, value, persist = true) {
+        const routes = [];
+        for (const route of value.routes) {
+            const certificate = await this.source(settings.certificateRoot, route.tls.certificate), key = await this.source(settings.certificateRoot, route.tls.privateKey);
+            const x509 = new X509Certificate(certificate);
+            if (Date.now() < Date.parse(x509.validFrom) || Date.now() >= Date.parse(x509.validTo))
+                throw new Error('Ingress TLS certificate is not currently valid');
+            for (const domain of route.domains)
+                if (!x509.checkHost(domain, { subject: 'never', partialWildcards: false, multiLabelWildcards: false, singleLabelSubdomains: false }))
+                    throw new Error(`TLS certificate SAN does not cover ${domain}`);
+            if (!x509.checkPrivateKey(createPrivateKey(key)))
+                throw new Error('Ingress TLS certificate and private key do not match');
+            const object = createHash('sha256').update(certificate).update('\0').update(key).digest('hex');
+            if (!persist) {
+                routes.push({ ...route, certificateObject: object });
+                continue;
+            }
+            const directory = this.file(`certificates/${object}`);
+            await fs.mkdir(this.file('certificates'), { recursive: true, mode: 0o700 });
+            if (!(await exists(directory))) {
+                const temp = this.file(`certificates/.${randomUUID()}.tmp`);
+                await fs.mkdir(temp, { mode: 0o700 });
+                await durableFile(path.join(temp, 'certificate.pem'), certificate);
+                await durableFile(path.join(temp, 'private-key.pem'), key);
+                await fs.rename(temp, directory);
+                await syncDirectory(this.file('certificates'));
+            }
+            else if (!(await fs.readFile(path.join(directory, 'certificate.pem'))).equals(certificate) || !(await fs.readFile(path.join(directory, 'private-key.pem'))).equals(key))
+                throw new Error('TLS snapshot content mismatch');
+            routes.push({ ...route, certificateObject: object });
+        }
+        return { ...value, routes };
+    }
+    revisionOf(applications, owner) {
+        const app = applications.find((candidate) => ingressOwnerKey(candidate.owner) === ingressOwnerKey(owner));
+        return app ? ingressOwnerRevision(app) : null;
+    }
+    preparedRevision(input, app) {
+        if (input.preparedOwnerRevision !== undefined && (!/^[a-f0-9]{64}$/.test(input.preparedOwnerRevision) || input.preparedOwnerRevision !== ingressOwnerRevision(app)))
+            throw new Error('Prepared ingress owner revision changed');
+    }
+    async prepare(settings, previous, applications) {
+        applications.sort((a, b) => ingressOwnerKey(a.owner).localeCompare(ingressOwnerKey(b.owner)));
+        checkIngressConflicts(settings, applications);
+        if (previous && JSON.stringify(previous.applications) === JSON.stringify(applications)) {
+            await this.verifyCertificates(previous);
+            await this.runtime.validate(settings, previous.generation);
+            return previous;
+        }
+        const sequence = (previous?.sequence ?? 0) + 1;
+        if (!Number.isSafeInteger(sequence))
+            throw new Error('Ingress sequence exhausted');
+        const generation = this.generation(settings, sequence, applications);
+        const manifest = { version: 1, generation, sequence, applications };
+        const directory = this.file(`generations/${generation}`);
+        await fs.mkdir(this.file('generations'), { recursive: true, mode: 0o700 });
+        if (await exists(directory))
+            await this.manifest(settings, generation);
+        else {
+            const temp = this.file(`generations/.${randomUUID()}.tmp`);
+            await fs.mkdir(temp, { mode: 0o700 });
+            await durableFile(path.join(temp, 'manifest.json'), JSON.stringify(manifest) + '\n');
+            await durableFile(path.join(temp, 'nginx.conf'), renderHostIngress(settings, manifest));
+            await fs.rename(temp, directory);
+            await syncDirectory(this.file('generations'));
+        }
+        await this.verifyCertificates(manifest);
+        await this.runtime.validate(settings, generation);
+        return manifest;
+    }
+    async publish(settings, previous, owner, applications, takeover) {
+        applications.sort((a, b) => ingressOwnerKey(a.owner).localeCompare(ingressOwnerKey(b.owner)));
+        checkIngressConflicts(settings, applications);
+        const ownerRevision = this.revisionOf(applications, owner);
+        if (takeover && previous)
+            throw new Error('Legacy takeover is allowed only for initial host publication');
+        if (previous && JSON.stringify(applications) === JSON.stringify(previous.applications)) {
+            const running = await this.runtime.inspect(settings);
+            if (!running.running || await this.runtime.observed(settings) !== previous.generation)
+                await this.runtime.activate(settings);
+            await this.runtime.acknowledge(settings, previous.generation);
+            return { generation: previous.generation, previousGeneration: previous.generation, observedGeneration: previous.generation, changed: false, owner, ownerRevision };
+        }
+        const manifest = await this.prepare(settings, previous, applications);
+        const generation = manifest.generation;
+        const snapshot = takeover ? await this.runtime.inspectTakeover(settings, takeover) : undefined;
+        const journal = { version: 1, previous: previous?.generation ?? null, candidate: generation, phase: 'prepared', settingsHash: digest(JSON.stringify(settings)), ...(snapshot ? { takeover: snapshot } : {}) };
+        await durableFile(this.file('pending.json'), JSON.stringify(journal) + '\n');
+        try {
+            if (snapshot)
+                await this.runtime.quiesceTakeover(snapshot);
+            await this.pointer(generation);
+            await this.runtime.activate(settings);
+            await this.runtime.acknowledge(settings, generation);
+            await durableFile(this.file('pending.json'), JSON.stringify({ ...journal, phase: 'acknowledged' }) + '\n');
+        }
+        catch (failure) {
+            try {
+                await this.restoreJournal(settings, journal);
+                await this.clearJournal();
+            }
+            catch (rollback) {
+                throw new Error(`Host ingress publication failed (${String(failure)}); rollback needs recovery (${String(rollback)})`);
+            }
+            throw new Error(`Host ingress publication failed; previous generation restored: ${String(failure)}`);
+        }
+        await this.recordTakeover(journal, 'committed');
+        await this.clearJournal();
+        return { generation, previousGeneration: previous?.generation ?? null, observedGeneration: generation, changed: true, owner, ownerRevision, ...(snapshot ? { takeover: { containerId: snapshot.descriptor.containerId, containerName: snapshot.descriptor.containerName, retained: true } } : {}) };
+    }
+    /** Read-only admission check. Call under the deployment lease; final apply still requires CAS. */
+    async check(input) {
+        const normalized = normalizeIngressApplication(input);
+        const settings = await this.requiredSettings();
+        if (await exists(this.file('pending.json')))
+            throw new Error('Host ingress recovery is required before preflight');
+        const generation = await this.currentGeneration();
+        if (input.expectedGeneration !== generation)
+            throw new Error(`Host ingress generation conflict: expected ${String(input.expectedGeneration)}, current ${String(generation)}`);
+        const previous = generation ? await this.manifest(settings, generation) : null;
+        const others = (previous?.applications ?? []).filter((app) => ingressOwnerKey(app.owner) !== ingressOwnerKey(normalized.owner));
+        checkIngressConflicts(settings, [...others, normalized]);
+        const app = await this.snapshot(settings, normalized, false);
+        this.preparedRevision(input, app);
+        if (input.takeover) {
+            if (generation !== null)
+                throw new Error('Legacy takeover is allowed only for initial host publication');
+            await this.runtime.inspectTakeover(settings, normalizeIngressTakeover(input.takeover, normalized));
+        }
+        if (await this.currentGeneration() !== generation || await exists(this.file('pending.json')))
+            throw new Error('Host ingress generation conflict during preflight');
+        return { valid: true, generation, owner: normalized.owner, reservedPorts: normalized.reservedPorts, domains: normalized.routes.flatMap((route) => route.domains), nativeConfigValidated: false, ownerRevision: ingressOwnerRevision(app) };
+    }
+    /** Writes immutable staging objects, runs native nginx -t, and never publishes or stops a container. */
+    async validate(input) {
+        const normalized = normalizeIngressApplication(input);
+        return this.locked(async () => {
+            const settings = await this.requiredSettings();
+            if (await exists(this.file('pending.json')))
+                throw new Error('Host ingress recovery is required before validation');
+            const generation = await this.currentGeneration();
+            if (input.expectedGeneration !== generation)
+                throw new Error(`Host ingress generation conflict: expected ${String(input.expectedGeneration)}, current ${String(generation)}`);
+            const previous = generation ? await this.manifest(settings, generation) : null;
+            const others = (previous?.applications ?? []).filter((app) => ingressOwnerKey(app.owner) !== ingressOwnerKey(normalized.owner));
+            checkIngressConflicts(settings, [...others, normalized]);
+            const app = await this.snapshot(settings, normalized);
+            this.preparedRevision(input, app);
+            const manifest = await this.prepare(settings, previous, [...others, app]);
+            if (input.takeover) {
+                if (generation !== null)
+                    throw new Error('Legacy takeover is allowed only for initial host publication');
+                await this.runtime.inspectTakeover(settings, normalizeIngressTakeover(input.takeover, normalized));
+            }
+            return { valid: true, generation, candidateGeneration: manifest.generation, owner: app.owner, reservedPorts: app.reservedPorts, domains: app.routes.flatMap((route) => route.domains), ownerRevision: ingressOwnerRevision(app), nativeConfigValidated: true };
+        });
+    }
+    async apply(input) {
+        const normalized = normalizeIngressApplication(input);
+        return this.locked(async () => {
+            const settings = await this.requiredSettings();
+            await this.recoverLocked(settings);
+            const generation = await this.currentGeneration();
+            if (input.expectedGeneration !== generation)
+                throw new Error(`Host ingress generation conflict: expected ${String(input.expectedGeneration)}, current ${String(generation)}`);
+            const previous = generation ? await this.manifest(settings, generation) : null;
+            const others = (previous?.applications ?? []).filter((app) => ingressOwnerKey(app.owner) !== ingressOwnerKey(normalized.owner));
+            checkIngressConflicts(settings, [...others, normalized]);
+            const app = await this.snapshot(settings, normalized);
+            this.preparedRevision(input, app);
+            const takeover = input.takeover ? normalizeIngressTakeover(input.takeover, normalized) : undefined;
+            return this.publish(settings, previous, app.owner, [...others, app], takeover);
+        });
+    }
+    async restoreOwner(input) {
+        if (!input || Object.keys(input).some((key) => !['owner', 'fromGeneration', 'expectedGeneration', 'expectedOwnerRevision'].includes(key)) || (input.fromGeneration !== null && !generationPattern.test(input.fromGeneration)) || (input.expectedOwnerRevision !== null && !/^[a-f0-9]{64}$/.test(input.expectedOwnerRevision)))
+            throw new Error('Invalid owner restoration');
+        const owner = ingressOwner(input.owner);
+        return this.locked(async () => {
+            const settings = await this.requiredSettings();
+            await this.recoverLocked(settings);
+            const generation = await this.currentGeneration();
+            if (input.expectedGeneration !== generation)
+                throw new Error(`Host ingress generation conflict: expected ${String(input.expectedGeneration)}, current ${String(generation)}`);
+            if (!generation)
+                throw new Error('No host ingress generation exists');
+            const current = await this.manifest(settings, generation);
+            if (this.revisionOf(current.applications, owner) !== input.expectedOwnerRevision)
+                throw new Error('Ingress owner revision conflict; another publication changed this owner');
+            const old = input.fromGeneration ? await this.manifest(settings, input.fromGeneration) : null;
+            const priorOwner = old?.applications.find((app) => ingressOwnerKey(app.owner) === ingressOwnerKey(owner));
+            const others = current.applications.filter((app) => ingressOwnerKey(app.owner) !== ingressOwnerKey(owner));
+            return this.publish(settings, current, owner, priorOwner ? [...others, priorOwner] : others);
+        });
+    }
+    async rollbackTakeover(input) {
+        if (!input || Object.keys(input).join(',') !== 'expectedGeneration' || !generationPattern.test(input.expectedGeneration))
+            throw new Error('Invalid initial takeover rollback');
+        return this.locked(async () => {
+            const settings = await this.requiredSettings();
+            await this.recoverLocked(settings);
+            const generation = await this.currentGeneration();
+            const record = await this.takeoverRecord();
+            if (!record || record.generation !== input.expectedGeneration)
+                throw new Error('No matching initial takeover receipt');
+            if (generation === null && record.outcome === 'rolled-back') {
+                await this.runtime.restoreTakeover(settings, record.snapshot);
+                return { rolledBack: true, previousGeneration: record.generation, generation: null, legacyContainerId: record.snapshot.descriptor.containerId, legacyVerified: true };
+            }
+            if (generation !== input.expectedGeneration || record.outcome !== 'committed')
+                throw new Error('Host ingress advanced after initial takeover; rollback refused');
+            const manifest = await this.manifest(settings, generation);
+            if (manifest.sequence !== 1 || manifest.applications.length !== 1)
+                throw new Error('Initial takeover rollback cannot remove other tenants');
+            await this.runtime.verifyRetiredTakeover(record.snapshot);
+            const journal = { version: 1, previous: null, candidate: generation, phase: 'rollback-prepared', settingsHash: digest(JSON.stringify(settings)), takeover: record.snapshot };
+            await durableFile(this.file('pending.json'), JSON.stringify(journal) + '\n');
+            try {
+                await this.restoreJournal(settings, journal);
+                await this.clearJournal();
+            }
+            catch (error) {
+                throw new Error(`Initial takeover rollback needs recovery: ${String(error)}`);
+            }
+            return { rolledBack: true, previousGeneration: generation, generation: null, legacyContainerId: record.snapshot.descriptor.containerId, legacyVerified: true };
+        });
+    }
+    async remove(input) {
+        if (!input || Object.keys(input).some((k) => !['owner', 'expectedGeneration'].includes(k)))
+            throw new Error('Invalid ingress removal');
+        const owner = ingressOwner(input.owner);
+        return this.locked(async () => {
+            const settings = await this.requiredSettings();
+            await this.recoverLocked(settings);
+            const generation = await this.currentGeneration();
+            if (input.expectedGeneration !== generation)
+                throw new Error(`Host ingress generation conflict: expected ${String(input.expectedGeneration)}, current ${String(generation)}`);
+            if (!generation)
+                throw new Error('No host ingress generation exists');
+            const previous = await this.manifest(settings, generation);
+            return this.publish(settings, previous, owner, previous.applications.filter((app) => ingressOwnerKey(app.owner) !== ingressOwnerKey(owner)));
+        });
+    }
+}
+//# sourceMappingURL=host-ingress.service.js.map

package/dist/infrastructure/host-ingress.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-ingress.service.js","sourceRoot":"","sources":["../../src/infrastructure/host-ingress.service.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC1K,OAAO,EAAE,wBAAwB,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,eAAe,EAAoB,MAAM,wBAAwB,CAAC;AAG3E,MAAM,MAAM,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AAEvD,MAAM,UAAU,oBAAoB,CAAC,GAA6B,IAAY,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AACnH,KAAK,UAAU,MAAM,CAAC,IAAY,IAAsB,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,OAAO,IAAI,CAAC;AAAC,CAAC;AAAC,OAAO,CAAC,EAAE,CAAC;IAAC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAAC,MAAM,CAAC,CAAC;AAAC,CAAC,CAAC,CAAC;AAC7L,KAAK,UAAU,aAAa,CAAC,SAAiB,IAAmB,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAAC,CAAC;QAAS,CAAC;IAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;AAAC,CAAC,CAAC,CAAC;AACnK,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,QAAyB;IAChE,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACxF,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACpF,IAAI,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/H,CAAC;AAED,uFAAuF;AACvF,MAAM,OAAO,kBAAkB;IAG2F,IAAI;IAFnH,IAAI,CAAS;IACL,OAAO,CAAqB;IAC7C,YAAY,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,cAAc,CAAC,EAAE,OAA4B,EAAmB,IAAI,GAAgB,eAAe;oBAAnC,IAAI;QAC1H,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,GAAG,OAAO,IAAI,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpE,CAAC;IACO,IAAI,CAAC,IAAY,IAAY,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IACjE,KAAK,CAAC,MAAM,CAAI,IAAsB;QAC5C,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,0FAA0F;QAC1F,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,GAAI,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBACtE,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;gBAC7C,IAAI,SAAS,KAAK,OAAO;oBAAE,MAAM;YACnC,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IACO,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC;YAAC,OAAO,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAC3G,OAAO,CAAC,EAAE,CAAC;YAAC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAAC,MAAM,CAAC,CAAC;QAAC,CAAC;IACzF,CAAC;IACO,KAAK,CAAC,gBAAgB,KAAmC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC;IAC7L,KAAK,CAAC,SAAS,CAAC,KAA0B;QACxC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;YACtK,IAAI,CAAC,QAAQ;gBAAE,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YACvG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IACO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7M,IAAI,CAAC,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IACO,UAAU,CAAC,QAA6B,EAAE,QAAgB,EAAE,YAAwC;QAC1G,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACpG,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,QAA6B,EAAE,UAAkB;QACtE,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,UAAU,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxG,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;eAChJ,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,0CAA0C;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnI,MAAM,YAAY,GAA+B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAQ,EAAE,EAAE;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YAC1E,MAAM,UAAU,GAAG,2BAA2B,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,KAAK,EAAO,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7I,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1G,IAAI,CAAC,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;gBACrH,OAAO,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,QAAQ,CAAC,iBAA2B,EAAE,CAAC;YAC/E,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9F,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC9C,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACzM,MAAM,QAAQ,GAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;QACvG,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,UAAU,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxL,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QACxC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACO,KAAK,CAAC,kBAAkB,CAAC,QAA6B;QAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,YAAY;YAAE,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBACxE,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,CAAC;gBAAC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,SAAS;gBAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACzF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC;gBAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC;gBACtF,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;oBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACxJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,MAAM;QACV,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC1F,IAAI,CAAC,QAAQ,IAAI,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3F,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,cAAc,EAAE,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC,cAAc,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;IAC9Y,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,UAAyB;QAC7C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxH,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,UAAU,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,EAAE,CAAC,OAAO,CAAC,eAAe,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC;YAAC,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;IACtI,CAAC;IACO,KAAK,CAAC,YAAY,KAAoB,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/G,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,UAAyB;QAC5E,IAAI,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;QACjH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,UAAU,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAC,CAAC;;YAC3G,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACO,KAAK,CAAC,cAAc;QAC1B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,6BAA6B;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACvN,MAAM,QAAQ,GAAG,gCAAgC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5G,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;IACxE,CAAC;IACO,KAAK,CAAC,cAAc,CAAC,OAAgB,EAAE,OAA6C;QAC1F,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACrK,CAAC;IACO,OAAO,CAAC,KAAc,EAAE,QAA6B;QAC3D,MAAM,OAAO,GAAG,KAAgB,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,+CAA+C,CAAC;QAC5I,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;eAC5J,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACvP,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,gCAAgC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QAChM,CAAC;aAAM,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnH,OAAO,OAAO,CAAC;IACjB,CAAC;IACO,KAAK,CAAC,cAAc,CAAC,QAA6B,EAAE,OAAgB;QAC1E,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpD,CAAC;IACO,KAAK,CAAC,aAAa,CAAC,QAA6B;QACvD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YAAE,OAAO;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,OAAO,CAAC,QAAQ,IAAI,OAAO,KAAK,OAAO,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QAC1I,IAAI,OAAO,CAAC,KAAK,KAAK,cAAc,EAAE,CAAC;YACrC,IAAI,OAAO,KAAK,OAAO,CAAC,SAAS;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACtG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvF,IAAI,OAAO,CAAC,QAAQ;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACjF,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YACnG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;;YAAM,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,GAAG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAChJ,CAAC;IACO,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QACjD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC5G,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACtG,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC9E,IAAI,CAAC;YAAC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAAC,OAAO,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC;QAAC,CAAC;gBAC1K,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;IAC/B,CAAC;IACO,KAAK,CAAC,QAAQ,CAAC,QAA6B,EAAE,KAAqD,EAAE,OAAO,GAAG,IAAI;QACzH,MAAM,MAAM,GAAG,EAAE,CAAC;QAClB,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAChK,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACzJ,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO;gBAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,EAAE,CAAC,CAAC;YAC1O,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YAC1H,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/F,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACjF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;YACtD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,UAAU,EAAE,MAAM,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,WAAW,CAAC,CAAC;gBAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC/H,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;YACnF,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAC5N,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IACO,UAAU,CAAC,YAAwC,EAAE,KAAuB;QAClF,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,OAAO,GAAG,CAAC,CAAC,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;IACO,gBAAgB,CAAC,KAAuB,EAAE,GAA6B;QAC7E,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,qBAAqB,KAAK,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAClO,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,QAAoC,EAAE,YAAwC;QACjI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7I,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAAC,OAAO,QAAQ,CAAC;QACvH,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACnI,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAwB,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;QACzF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,UAAU,EAAE,CAAC,CAAC;QAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrI,IAAI,MAAM,MAAM,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;aAClE,CAAC;YACJ,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,UAAU,EAAE,MAAM,CAAC,CAAC;YAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,EAAE,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC9K,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAC,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAAC,OAAO,QAAQ,CAAC;IAC9G,CAAC;IACO,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,QAAoC,EAAE,KAAuB,EAAE,YAAwC,EAAE,QAA8B;QAC1L,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,qBAAqB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QAC7I,MAAM,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,QAAQ,IAAI,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAC1G,IAAI,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,UAAU;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC7H,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC9D,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,QAAQ,CAAC,UAAU,EAAE,kBAAkB,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QACrK,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QAAC,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QAC9G,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,OAAO,GAAY,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACvN,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7E,IAAI,CAAC;YACH,IAAI,QAAQ;gBAAE,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC5H,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QAC7G,CAAC;QAAC,OAAO,OAAO,EAAE,CAAC;YACjB,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,CAAC;YAChF,OAAO,QAAQ,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,oCAAoC,MAAM,CAAC,OAAO,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAAC,CAAC;YAC5I,MAAM,IAAI,KAAK,CAAC,kEAAkE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAa,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/S,CAAC;IACD,kGAAkG;IAClG,KAAK,CAAC,KAAK,CAAC,KAAuB;QACjC,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtG,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACnH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9K,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAChI,qBAAqB,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAChG,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,UAAU,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YACzG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,MAAM,IAAI,CAAC,iBAAiB,EAAE,KAAK,UAAU,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnK,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,aAAa,EAAE,UAAU,CAAC,aAAa,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;IAC7O,CAAC;IACD,wGAAwG;IACxG,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC/C,IAAI,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACpH,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAClD,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9K,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/E,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAChI,qBAAqB,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YAC1E,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBACnB,IAAI,UAAU,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;gBACzG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;YACrG,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,EAAE,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;QACjQ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,KAAuB;QACjC,MAAM,UAAU,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAAC,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACjO,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/E,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAChI,qBAAqB,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACzF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;QACjF,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,YAAY,CAAC,KAA8B;QAC/C,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,uBAAuB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC7W,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtI,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9K,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACtE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,KAAK,CAAC,qBAAqB;gBAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;YAC7K,MAAM,GAAG,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9F,MAAM,UAAU,GAAG,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1G,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3G,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/F,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,gBAAgB,CAAC,KAAkC;QACvD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,oBAAoB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC/K,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnF,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,kBAAkB;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YACvH,IAAI,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,aAAa,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC9D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YACxK,CAAC;YACD,IAAI,UAAU,KAAK,KAAK,CAAC,kBAAkB,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;YACjK,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3D,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC5I,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAY,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;YACtL,MAAM,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;YAC7E,IAAI,CAAC;gBAAC,MAAM,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;gBAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,CAAC;YAChF,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAChG,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;QACjK,CAAC,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACvI,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAAC,MAAM,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YAAC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACtI,IAAI,KAAK,CAAC,kBAAkB,KAAK,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,aAAa,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9K,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC/I,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/infrastructure/infrastructure.service.d.ts

@@ -44,13 +44,13 @@ export declare function restartBackoffMs(failures: number): number;
  * Measured: `omnitron-pg`, created before published ports were bound to
  * loopback, survived on 0.0.0.0:5480 through the fix that reached all eleven
  * other managed containers, and still answered `nc -vz <lan-address> 5480`
- * from another machine months later, while `daos-dev-postgres` beside it in
+ * from another machine months later, while `sample-dev-postgres` beside it in
  * `docker ps` was correctly on 127.0.0.1.
  *
  * `reconcileName` is the subtlety. The control-plane database is ONE
  * container per host — it owns port 5480 — but each daemon resolves a name
- * carrying its own project prefix, so a daemon on the `daos/dev` stack
- * computes `daos-dev-pg` while the container that exists is `omnitron-pg`.
+ * carrying its own project prefix, so a daemon on the `sample/dev` stack
+ * computes `sample-dev-pg` while the container that exists is `omnitron-pg`.
  * Reconciling the running container against a spec under the OTHER name
  * creates a second one and collides on the port; the first version of this
  * did exactly that and corrected nothing. The name to reconcile is therefore
@@ -180,6 +180,16 @@ export declare class InfrastructureService {
         name: string;
         image?: string | undefined;
     }>;
+    /**
+     * Transfer monitoring ownership to a freshly resolved declaration. This never
+     * provisions containers: retained specs must match; additions must already be
+     * running with exact native ownership and spec labels. Freeze and drain all
+     * earlier monitor/reconcile work before acknowledging a handoff.
+     */
+    refreshOwnershipFrom(candidate: InfrastructureService): Promise<{
+        released: string[];
+        adopted: string[];
+    }>;
     /**
      * Services whose socket is new since this reconcile began.
      *
@@ -188,8 +198,10 @@ export declare class InfrastructureService {
      */
     getRestartedServices(): string[];
     /**
-     * Stop all managed infrastructure containers.
+     * Release process-owned monitoring resources without changing infrastructure.
      */
+    dispose(): void;
+    /** Explicit infrastructure removal; process disposal alone preserves containers. */
     teardown(): Promise<void>;
     /**
      * Get current infrastructure state.
@@ -244,6 +256,9 @@ export declare class InfrastructureService {
      * own restart-policy in the mix) occasional duplicate containers.
      */
     private readonly reconciling;
+    private readonly reconcileTasks;
+    private readonly activeSweeps;
+    private ownershipFrozen;
     /**
      * Where this node keeps each service's config files, once a master sent them.
      *
@@ -315,11 +330,12 @@ export declare class InfrastructureService {
      *
      * `provision()` asked `needsControlPlaneDatabase`; the health sweep and the
      * teardown asked only `usingGlobalOmnitronPg`. So on a node the sweep found
-     * `<prefix>-pg` «not running» every 30 s and created it: daos/test got one on
+     * `<prefix>-pg` «not running» every 30 s and created it: sample/test got one on
      * 2026-09-20, and again on 2026-09-25 forty seconds after it was removed —
      * on the default credentials, for a database nothing reads.
      */
     private controlPlaneContainers;
     private healthSweep;
+    private healthSweepOwned;
 }
 //# sourceMappingURL=infrastructure.service.d.ts.map