@omnitron-dev/omnitron 0.3.0 → 0.3.2

package/dist/services/host-upgrade.js

@@ -0,0 +1,503 @@
+/** Controlled host upgrades. App deployments pin an installed bundle and never call this lifecycle. */
+import path from 'node:path';
+import { shellEscape } from '../shared/shell-escape.js';
+export const HOST_UPGRADE_CONTRACT = 'omnitron.host-upgrade.json';
+export function assertResidentApplicationRuntime(value) {
+    if (!value || typeof value.root !== 'string' || !path.isAbsolute(value.root) ||
+        typeof value.executable !== 'string' || !path.isAbsolute(value.executable) || !/^[a-f0-9]{40}$/.test(value.commit) ||
+        value.execution?.mode !== 'resident' || value.execution.protocol !== 1 ||
+        typeof value.execution.ownerId !== 'string' || !/^[a-zA-Z0-9-]{1,128}$/.test(value.execution.ownerId) || !Number.isSafeInteger(value.execution.pid) || value.execution.pid < 1 ||
+        !Number.isSafeInteger(value.execution.epoch) || value.execution.epoch < 1)
+        throw Error('Verified application deployment requires an authenticated independent execution owner (protocol 1). Prepare an owner transition and rollback before installing this release; no SDK rebinding or dependency installation will be attempted.');
+}
+function fail(reason) { throw new Error(`Host upgrade preflight: ${reason}`); }
+function strings(value) { return Array.isArray(value) && value.every(v => typeof v === 'string' && v.length > 0); }
+/** The native control-plane runtime contract currently binds the default daemon endpoint. */
+export function assertControlledDaemonPort(port) {
+    if (port !== undefined && port !== 9700)
+        throw new Error('Controlled host operations currently require daemon port 9700');
+}
+export function assertServingBundle(bundle, status) {
+    if (!status || status.build?.commit !== bundle.commit || status.build?.dirty !== false ||
+        typeof status.version !== 'string' || status.version.split('+')[0] !== bundle.version.split('+')[0] ||
+        !Number.isSafeInteger(status.pid) || status.pid <= 0 || !Array.isArray(status.apps)) {
+        fail(`serving daemon does not match installed bundle ${bundle.root}`);
+    }
+}
+/** Refuse configurations whose existing boot policy would start something previously offline. */
+export function planHostUpgrade(previous, candidate, inventory) {
+    for (const bundle of [previous, candidate]) {
+        if (!/^[A-Za-z0-9][A-Za-z0-9._+-]*$/.test(bundle.version) || bundle.version.includes('..') ||
+            !bundle.root?.startsWith('/') || !bundle.root.endsWith(`/versions/${bundle.version}`) || !/^[a-f0-9]{40}$/.test(bundle.commit))
+            fail('invalid recorded bundle identity');
+    }
+    assertServingBundle(previous, inventory.status);
+    if (inventory.runtime?.kind === 'managed')
+        fail('Independent owner detected. Use backend upgrade with a sealed runtime on this node; coupled host upgrades cannot stop or rebind its applications.');
+    if (!inventory.runtime || !['fork', 'systemd'].includes(inventory.runtime.kind) || !inventory.runtime.cwd?.startsWith('/'))
+        fail('missing supported runtime snapshot');
+    if (!Array.isArray(inventory.projects) || !Array.isArray(inventory.stacks) || !Array.isArray(inventory.contracts))
+        fail('incomplete project inventory');
+    const all = new Map();
+    const contracts = new Map();
+    const seenProjects = new Set();
+    for (const project of inventory.projects) {
+        if (!project.name || seenProjects.has(project.name) || !strings(project.enabledStacks) || !project.path?.startsWith('/'))
+            fail('invalid or duplicate project');
+        seenProjects.add(project.name);
+        const group = inventory.stacks.filter(s => s.project === project.name);
+        if (group.length !== 1 || group[0].path !== project.path)
+            fail(`missing stack inventory for ${project.name}`);
+        const declarations = inventory.contracts.filter(c => c.project === project.name);
+        const localApps = group[0].stacks.filter(s => s.type === 'local').flatMap(s => s.apps);
+        if (localApps.length && (declarations.length !== 1 || declarations[0].schema !== 1 || !Array.isArray(declarations[0].apps)))
+            fail(`${project.name} needs ${HOST_UPGRADE_CONTRACT} schema 1`);
+        const seenStacks = new Set();
+        for (const stack of group[0].stacks) {
+            if (seenStacks.has(stack.name))
+                fail(`duplicate stack ${project.name}/${stack.name}`);
+            seenStacks.add(stack.name);
+            const enabled = project.enabledStacks.includes(stack.name);
+            if (stack.type !== 'local') {
+                if (enabled)
+                    fail(`enabled ${stack.type} stack ${project.name}/${stack.name} cannot be restored locally`);
+                continue;
+            }
+            for (const app of stack.apps) {
+                if (!app.handleKey.startsWith(`${project.name}/${stack.name}/`) || all.has(app.handleKey))
+                    fail('invalid or duplicate qualified app identity');
+                if (!['online', 'stopped', 'errored', 'crashed'].includes(app.status))
+                    fail(`unstable app ${app.handleKey}: ${app.status}`);
+                const online = app.status === 'online';
+                if (online !== enabled)
+                    fail(`${app.handleKey}: boot policy would change its online/offline state; partial enabled stacks are unsupported`);
+                all.set(app.handleKey, online);
+            }
+        }
+        if (project.enabledStacks.some(s => !seenStacks.has(s)))
+            fail(`unknown enabled stack in ${project.name}`);
+        for (const app of declarations[0]?.apps ?? []) {
+            if (!app || typeof app.name !== 'string' || !app.name.startsWith(`${project.name}/`) || contracts.has(app.name) ||
+                !app.cwd?.startsWith('/') || !app.version || !app.binding)
+                fail('invalid or duplicate app contract');
+            if (app.binding.kind === 'hook') {
+                const b = app.binding;
+                if (b.bundleRoot !== previous.root || !/^[A-Z_][A-Z0-9_]*$/.test(b.bundleEnv) ||
+                    ['PATH', 'HOME', 'NODE_OPTIONS', 'NODE_PATH', 'LD_PRELOAD', 'SHELL'].includes(b.bundleEnv) ||
+                    !strings(b.rebind) || !b.rebind.length || !strings(b.verify) || !b.verify.length)
+                    fail(`unsupported or stale rebind contract for ${app.name}`);
+            }
+            else if (app.binding.kind !== 'independent')
+                fail(`unsupported binding for ${app.name}`);
+            contracts.set(app.name, app);
+        }
+    }
+    if (inventory.stacks.length !== seenProjects.size || inventory.contracts.some(c => !seenProjects.has(c.project)))
+        fail('unmatched project inventory');
+    const seenHandles = new Set();
+    for (const app of inventory.status.apps) {
+        if (seenHandles.has(app.name) || !all.has(app.name) || !['online', 'stopped', 'errored', 'crashed'].includes(app.status) ||
+            all.get(app.name) !== (app.status === 'online'))
+            fail(`unregistered, duplicate or inconsistent handle ${app.name}`);
+        seenHandles.add(app.name);
+    }
+    for (const [name, online] of all) {
+        if (!contracts.has(name))
+            fail(`missing explicit binding contract for ${name}`);
+        if (online && (!strings(contracts.get(name).health) || !contracts.get(name).health.length))
+            fail(`missing operational health command for ${name}`);
+        if (online && !seenHandles.has(name))
+            fail(`online stack app ${name} is absent from daemon`);
+    }
+    if ([...contracts.keys()].some(name => !all.has(name)))
+        fail('contract names an app absent from local stacks');
+    return { previous, candidate, inventory, apps: [...contracts.values()],
+        online: [...all].filter(([, online]) => online).map(([name]) => name).sort(),
+        offline: [...all].filter(([, online]) => !online).map(([name]) => name).sort() };
+}
+export function verifyRestoredInventory(plan, bundle, status) {
+    assertServingBundle(bundle, status);
+    const online = status.apps.filter(a => a.status === 'online').map(a => a.name).sort();
+    if (JSON.stringify(online) !== JSON.stringify(plan.online) || new Set(status.apps.map(a => a.name)).size !== status.apps.length ||
+        status.apps.some(a => ![...plan.online, ...plan.offline].includes(a.name) || ['starting', 'stopping'].includes(a.status))) {
+        throw new Error('Restored daemon does not have exactly the previously online apps');
+    }
+}
+/** Save intent before mutation; rollback only the framework and dependency bindings, never app releases/data. */
+export async function executeHostUpgrade(plan, id, actions) {
+    const receipt = { schema: 1, id, plan, phase: 'prepared', outcome: 'running', events: [] };
+    const record = async (phase, error) => {
+        receipt.phase = phase;
+        receipt.events.push({ at: new Date().toISOString(), phase, ...(error ? { error: String(error) } : {}) });
+        await actions.save(receipt);
+    };
+    await record('prepared'); // If this fails there must be no mutation.
+    try {
+        await record('stopping');
+        await actions.stop(plan.previous);
+        await record('activating');
+        await actions.activate(plan.candidate);
+        await record('rebinding');
+        for (const app of plan.apps)
+            await actions.rebind(app, plan.candidate);
+        await record('starting');
+        await actions.start(plan.candidate);
+        await record('verifying');
+        await actions.verify(plan.candidate);
+        receipt.outcome = 'upgraded';
+        await record('verified');
+    }
+    catch (error) {
+        // A failed terminal write may have left either the old or the new bytes.
+        // Rollback intent must always be discoverable as unfinished after a crash.
+        receipt.outcome = 'running';
+        // Record loss must not prevent recovery. All failed writes remain in the returned receipt.
+        try {
+            await record('rollback', error);
+        }
+        catch (writeError) {
+            receipt.events.push({ at: new Date().toISOString(), phase: 'receipt-write-failed', error: String(writeError) });
+        }
+        return recoverHostUpgrade(receipt, actions);
+    }
+    try {
+        await actions.prune([plan.previous.root, plan.candidate.root]);
+        await record('retained');
+    }
+    catch (error) {
+        try {
+            await record('retention-failed', error);
+        }
+        catch { /* verified upgrade remains successful */ }
+    }
+    return receipt;
+}
+/** Idempotent recovery of an interrupted operation, including a controller lost between phase writes. */
+export async function recoverHostUpgrade(receipt, actions) {
+    const record = async (phase, error) => {
+        receipt.phase = phase;
+        receipt.events.push({ at: new Date().toISOString(), phase, ...(error ? { error: String(error) } : {}) });
+        await actions.save(receipt);
+    };
+    try {
+        receipt.outcome = 'running';
+        await record('recovering');
+        await actions.stop(receipt.plan.candidate);
+        await actions.activate(receipt.plan.previous);
+        for (const app of receipt.plan.apps)
+            await actions.rebind(app, receipt.plan.previous);
+        await actions.start(receipt.plan.previous);
+        await actions.verify(receipt.plan.previous);
+        receipt.outcome = 'rolled-back';
+        await record('rolled-back');
+    }
+    catch (error) {
+        receipt.outcome = 'recovery-required';
+        try {
+            await record('recovery-required', error);
+        }
+        catch { /* original durable intent remains */ }
+    }
+    return receipt;
+}
+export function appHealthCommand(app, bundle) {
+    if (!app.health?.length)
+        throw new Error(`No operational health command for ${app.name}`);
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const cwd=${JSON.stringify(app.cwd)};
+    if(fs.realpathSync(cwd)!==cwd) throw Error('Release cwd changed or is not immutable');
+    const argv=${JSON.stringify(app.health)};
+    execFileSync(argv[0],argv.slice(1),{cwd,env:{...process.env,...${JSON.stringify(app.binding.kind === 'hook' ? { [app.binding.bundleEnv]: bundle.root } : {})}},stdio:'inherit',timeout:300000});`);
+}
+export function pendingReceiptsCommand(prefix, id) {
+    if (id !== undefined && !/^[A-Za-z0-9_-]+$/.test(id))
+        throw new Error('Invalid host upgrade receipt ID');
+    return remoteNode(`${fsPrelude}
+    const dir=${JSON.stringify(`${prefix}/upgrade-receipts`)};
+    const ids=${id === undefined ? "fs.existsSync(dir)?fs.readdirSync(dir).filter(n=>n.endsWith('.json')):[]" : JSON.stringify([`${id}.json`])};
+    const records=ids.map(name=>JSON.parse(fs.readFileSync(path.join(dir,name),'utf8')));
+    if(records.some(r=>r.schema!==1 || !r.plan || !Array.isArray(r.events))) throw Error('Invalid host upgrade receipt');
+    console.log(JSON.stringify(records.filter(r=>['running','recovery-required'].includes(r.outcome))));`);
+}
+/** Every program argument is quoted as data; declared hooks run without shell interpolation. */
+export function remoteNode(source) { return `node --input-type=module -e ${shellEscape(source)}`; }
+const fsPrelude = `import fs from 'node:fs'; import path from 'node:path'; import { pathToFileURL } from 'node:url';`;
+export function bundleProbeCommand(prefix, version) {
+    return remoteNode(`${fsPrelude}
+    const prefix=fs.realpathSync(${JSON.stringify(prefix)});
+    if(prefix!==${JSON.stringify(prefix)}) throw Error('Installation prefix must be canonical');
+    const root=fs.realpathSync(path.join(prefix,${JSON.stringify(version ? `versions/${version}` : 'current')}));
+    if(path.dirname(root)!==path.join(prefix,'versions')) throw Error('Bundle is not an immutable installed version');
+    const meta=JSON.parse(fs.readFileSync(path.join(root,'BUNDLE.json'),'utf8'));
+    const stamp=JSON.parse(fs.readFileSync(path.join(root,'dist/BUILD.json'),'utf8'));
+    const pkg=JSON.parse(fs.readFileSync(path.join(root,'package.json'),'utf8'));
+    if(meta.dirty!==false || stamp.dirty!==false || !/^[a-f0-9]{40}$/.test(meta.commit) || stamp.commit!==meta.commit ||
+       meta.version!==path.basename(root) || pkg.version!==meta.version) throw Error('Inconsistent bundle metadata');
+    fs.accessSync(path.join(root,'dist/cli/omnitron.js'),fs.constants.X_OK);
+    console.log(JSON.stringify({root,version:meta.version,commit:meta.commit}));`);
+}
+export function inventoryCommand(bundle, full) {
+    return remoteNode(`${fsPrelude}
+    const {createDaemonClient}=await import(pathToFileURL(${JSON.stringify(`${bundle.root}/dist/daemon/daemon-client.js`)}).href);
+    const client=createDaemonClient();
+    try {
+      const status=await client.status();
+      ${full ? `const service=await client.service('OmnitronProject');
+      const {loadEcosystemConfig}=await import(pathToFileURL(${JSON.stringify(`${bundle.root}/dist/config/loader.js`)}).href);
+      const projects=await service.listProjects(); const stacks=[]; const contracts=[]; const launches=[];
+      for(const project of projects){
+        const live=await service.listStacks({project:project.name});
+        stacks.push({project:project.name,path:project.path,stacks:live});
+        const file=path.join(project.path,${JSON.stringify(HOST_UPGRADE_CONTRACT)});
+        const contract=fs.existsSync(file)?JSON.parse(fs.readFileSync(file,'utf8')):null;
+        if(contract) contracts.push({...contract,project:project.name});
+        // The daemon's cached inventory is insufficient: prove that disk can boot it again.
+        const config=await loadEcosystemConfig(project.path);
+        const userFile=path.join(project.path,'omnitron.stacks.json');
+        const declared={...(fs.existsSync(userFile)?JSON.parse(fs.readFileSync(userFile,'utf8')):{}),...config.stacks};
+        const boot=[];
+        for(const [stackName,stack] of Object.entries(declared)){
+          if(stack.type!=='local') continue;
+          for(const app of config.apps.filter(a=>a.enabled!==false && (!stack.apps || stack.apps==='all' || stack.apps.includes(a.name)))){
+            const name=project.name+'/'+stackName+'/'+app.name; boot.push(name);
+            const binding=contract?.apps?.find(a=>a.name===name);
+            if(!binding || path.resolve(project.path,app.cwd||'.')!==binding.cwd) throw Error('Boot release differs from upgrade contract: '+name);
+            launches.push({name,bootstrap:app.bootstrap?path.resolve(project.path,app.cwd ?? '.',app.bootstrap):null});
+          }
+        }
+        const expected=live.filter(s=>s.type==='local').flatMap(s=>s.apps.map(a=>a.handleKey)).sort();
+        if(JSON.stringify(boot.sort())!==JSON.stringify(expected)) throw Error('Boot configuration differs from serving app inventory: '+project.name);
+      }
+      console.log(JSON.stringify({status,projects,stacks,contracts,launches}));` : 'console.log(JSON.stringify(status));'}
+    } finally { await client.disconnect(); }`);
+}
+export function hookCommand(app, bundle, operation) {
+    if (app.binding.kind === 'independent')
+        return 'true';
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const cwd=${JSON.stringify(app.cwd)};
+    if(fs.realpathSync(cwd)!==cwd) throw Error('Release cwd changed or is not immutable');
+    const argv=${JSON.stringify(app.binding[operation])};
+    execFileSync(argv[0],argv.slice(1),{cwd,env:{...process.env,[${JSON.stringify(app.binding.bundleEnv)}]:${JSON.stringify(bundle.root)}},stdio:'inherit',timeout:300000});`);
+}
+export function receiptCommand(prefix, receipt) {
+    return remoteNode(`${fsPrelude}
+    const dir=${JSON.stringify(`${prefix}/upgrade-receipts`)}; fs.mkdirSync(dir,{recursive:true,mode:0o700});
+    const file=path.join(dir,${JSON.stringify(`${receipt.id}.json`)}); const temporary=file+'.part';
+    const fd=fs.openSync(temporary,'w',0o600);
+    try { fs.writeFileSync(fd,${JSON.stringify(JSON.stringify(receipt, null, 2) + '\n')}); fs.fsyncSync(fd); } finally { fs.closeSync(fd); }
+    fs.renameSync(temporary,file); const directory=fs.openSync(dir,'r'); try{fs.fsyncSync(directory)}finally{fs.closeSync(directory)};`);
+}
+export function contractPreflightCommand(apps) {
+    return remoteNode(`${fsPrelude}
+    for(const app of ${JSON.stringify(apps)}){
+      if(fs.realpathSync(app.cwd)!==app.cwd || !fs.statSync(app.cwd).isDirectory()) throw Error('Release cwd is not immutable: '+app.name);
+      for(const argv of [...(app.binding.kind==='hook'?[app.binding.rebind,app.binding.verify]:[]),...(app.health?[app.health]:[])]) {
+        const executable=argv[0];
+        const candidates=executable.includes('/') ? [path.resolve(app.cwd,executable)] : (process.env.PATH||'').split(':').filter(Boolean).map(p=>path.join(p,executable));
+        if(!candidates.some(p=>{try{fs.accessSync(p,fs.constants.X_OK);return fs.statSync(p).isFile()}catch{return false}})) throw Error('Missing hook executable: '+executable);
+      }
+    }`);
+}
+export const HOST_BOOTSTRAP_PREFLIGHT_TIMEOUT_MS = 120_000;
+/**
+ * Exercise the candidate's fresh reader before stopping anything. Dependency
+ * hooks remain separate: definitions still see the serving application's bindings.
+ * procRoot permits inspection of a mounted procfs (and isolated process fixtures).
+ * Environment bytes stay on the host, outside inventory and recovery receipts.
+ */
+export function bootstrapPreflightCommand(plan, procRoot = '/proc') {
+    const runtime = plan.inventory.runtime;
+    const launches = plan.inventory.launches;
+    if (!Array.isArray(launches) || new Set(launches.map(a => a.name)).size !== launches.length ||
+        JSON.stringify(launches.map(a => a.name).sort()) !== JSON.stringify([...plan.online, ...plan.offline].sort()) ||
+        launches.some(a => a.bootstrap !== null && (typeof a.bootstrap !== 'string' || !a.bootstrap.startsWith('/')))) {
+        fail('missing or inconsistent bootstrap launch inventory');
+    }
+    if (!runtime.executable?.startsWith('/') || !Array.isArray(runtime.execArgv) ||
+        runtime.execArgv.some(a => typeof a !== 'string' || /^(--inspect|--debug|--watch|--eval|--print|--input-type|-e$|-p$)/.test(a))) {
+        fail('missing or unsupported captured Node arguments for bootstrap preflight');
+    }
+    const online = launches.filter(a => plan.online.includes(a.name));
+    const cwd = runtime.cwd === plan.previous.root ? plan.candidate.root : runtime.cwd;
+    const execArgv = runtime.execArgv.map(a => a.replaceAll(plan.previous.root, plan.candidate.root));
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const proc=path.join(${JSON.stringify(procRoot)},String(${plan.inventory.status.pid}));
+    const argv=fs.readFileSync(proc+'/cmdline','utf8').split('\\0').filter(Boolean);
+    if(fs.realpathSync(proc+'/exe')!==${JSON.stringify(runtime.executable)} ||
+       fs.realpathSync(proc+'/cwd')!==${JSON.stringify(runtime.cwd)} ||
+       fs.realpathSync(argv[${runtime.execArgv.length + 1}])!==${JSON.stringify(plan.previous.root + '/dist/daemon/daemon-entry.js')} ||
+       JSON.stringify(argv.slice(1,${runtime.execArgv.length + 1}))!==${JSON.stringify(JSON.stringify(runtime.execArgv))}) throw Error('Serving process changed before bootstrap preflight');
+    const env=Object.fromEntries(fs.readFileSync(proc+'/environ','utf8').split('\\0').filter(v=>v.includes('=')).map(v=>[v.slice(0,v.indexOf('=')),v.slice(v.indexOf('=')+1)]));
+    // procfs retains startup IPC descriptors that Node consumes during boot.
+    // They belong to the serving daemon's parent, never to an execFile child.
+    delete env.NODE_CHANNEL_FD; delete env.NODE_CHANNEL_SERIALIZATION_MODE; delete env.NODE_UNIQUE_ID;
+    if(/--(?:inspect|debug|watch)/.test(env.NODE_OPTIONS||'')) throw Error('Unsupported debugging/watch NODE_OPTIONS for bootstrap preflight');
+    if(env.OMNITRON_CWD===${JSON.stringify(plan.previous.root)}) env.OMNITRON_CWD=${JSON.stringify(plan.candidate.root)};
+    const deadline=Date.now()+${HOST_BOOTSTRAP_PREFLIGHT_TIMEOUT_MS},checked=[],seen=new Set();
+    for(const app of ${JSON.stringify(online)}){
+      if(app.bootstrap===null || seen.has(app.bootstrap)) continue;
+      const remaining=deadline-Date.now();if(remaining<1000) throw Error('Bootstrap preflight exceeded its total deadline');
+      const timeout=Math.min(30000,remaining);
+      const script='process.chdir('+JSON.stringify(${JSON.stringify(cwd)})+');' +
+        'const {loadBootstrapConfig}=await import('+JSON.stringify(pathToFileURL(${JSON.stringify(plan.candidate.root + '/dist/orchestrator/bootstrap-loader.js')}).href)+');' +
+        'await loadBootstrapConfig('+JSON.stringify(app.bootstrap)+',{freshModuleGraph:{timeoutMs:'+Math.max(1, timeout-500)+'}});';
+      try {execFileSync(${JSON.stringify(runtime.executable)},[...${JSON.stringify(execArgv)},'--input-type=module','--eval',script],
+        {cwd:${JSON.stringify(plan.candidate.root)},env,timeout,maxBuffer:256*1024,stdio:['ignore','ignore','pipe']});}
+      catch(error){throw Error('Candidate bootstrap preflight failed for '+app.name+' (exit '+error.status+', signal '+error.signal+', code '+error.code+'): '+(error.stderr?.toString().slice(-4000)||error.message));}
+      seen.add(app.bootstrap);checked.push(app.name);
+    }
+    console.log(JSON.stringify({checked,classic:${online.filter(a => a.bootstrap === null).length},total:${online.length}}));`);
+}
+/** Only the declared dependency binding changes; release paths, versions, and app data stay intact. */
+export function updateContractBindingsCommand(plan, bundle) {
+    return remoteNode(`${fsPrelude}
+    for(const project of ${JSON.stringify(plan.inventory.projects)}) {
+      const file=path.join(project.path,${JSON.stringify(HOST_UPGRADE_CONTRACT)});
+      if(!fs.existsSync(file)) continue;
+      const document=JSON.parse(fs.readFileSync(file,'utf8'));
+      const expected=${JSON.stringify(plan.apps)}.filter(a=>a.name.startsWith(project.name+'/'));
+      if(document.schema!==1 || !Array.isArray(document.apps) || document.apps.length!==expected.length) throw Error('App contract changed during upgrade');
+      for(const app of document.apps) {
+        const original=expected.find(a=>a.name===app.name);
+        const normalized=JSON.parse(JSON.stringify(app));
+        if(normalized.binding.kind==='hook') normalized.binding.bundleRoot=${JSON.stringify(plan.previous.root)};
+        if(JSON.stringify(normalized)!==JSON.stringify(original)) throw Error('App release contract changed during upgrade: '+app.name);
+        if(app.binding.kind==='hook') app.binding.bundleRoot=${JSON.stringify(bundle.root)};
+      }
+      const temporary=file+'.upgrade-part'; const fd=fs.openSync(temporary,'w',0o600);
+      try {fs.writeFileSync(fd,JSON.stringify(document,null,2));fs.fsyncSync(fd)}finally{fs.closeSync(fd)}
+      fs.renameSync(temporary,file);
+    }`);
+}
+/** Linux process identity + supervisor state. Other platforms and custom/drop-in units fail closed. */
+export function runtimeProbeCommand(bundle, pid) {
+    if (!Number.isSafeInteger(pid) || pid < 1)
+        throw new Error('A live daemon PID is required for runtime inspection');
+    const probe = `${fsPrelude} import os from 'node:os'; import {execFileSync} from 'node:child_process';
+    if(process.platform!=='linux') throw Error('Controlled host upgrade currently requires Linux runtime inspection');
+    const root=${JSON.stringify(bundle.root)}; const pid=${JSON.stringify(pid)};
+    const argv=fs.readFileSync('/proc/'+pid+'/cmdline','utf8').split('\\0').filter(Boolean);
+    const entry=argv.find(a=>a.endsWith('/dist/daemon/daemon-entry.js'));
+    if(!entry) throw Error('Serving daemon has no recognized entry');
+    const cwd=fs.realpathSync('/proc/'+pid+'/cwd');
+    const executable=fs.realpathSync('/proc/'+pid+'/exe');
+    fs.accessSync(executable,fs.constants.X_OK);
+    const execArgv=argv.slice(1,argv.indexOf(entry));
+    if(fs.realpathSync(entry)!==root+'/dist/daemon/daemon-entry.js') {
+      const {readManagedRuntime,managedJobPid,verifyManagedIsolation}=await import(pathToFileURL(root+'/dist/daemon/managed-runtime.js').href);
+      const {RuntimeInstallation}=await import(pathToFileURL(root+'/dist/daemon/runtime-installation.js').href);
+      const config=await readManagedRuntime();
+      if(!config) throw Error('Serving daemon entry does not bind installed bundle or an independent owner');
+      const installation=await RuntimeInstallation.open(config.instanceHome,{existing:true});
+      if(!installation) throw Error('Managed runtime registry is missing');
+      try {
+        const selection=installation.selection();
+        if(!selection || installation.activation()) throw Error('Managed backend selection is not settled');
+        const artifact=await installation.artifact(selection.current);
+        if(fs.realpathSync(entry)!==artifact.entry || executable!==artifact.execPath || artifact.build.commit!==${JSON.stringify(bundle.commit)}) throw Error('Serving process does not match its selected sealed backend');
+        const ownerPid=await managedJobPid(config,'owner'),guardianPid=await managedJobPid(config,'backend');
+        await verifyManagedIsolation(config,ownerPid,guardianPid,pid);
+        const stat=fs.readFileSync('/proc/'+pid+'/stat','utf8');
+        if(Number(stat.slice(stat.lastIndexOf(')')+2).split(' ')[1])!==guardianPid) throw Error('Serving backend is not a child of its native guardian');
+        const ownerRoot=path.join(config.instanceHome,'runtime','releases',config.owner.artifact);
+        const ownerExecutable=fs.realpathSync('/proc/'+ownerPid+'/exe');
+        if(ownerExecutable!==path.join(fs.realpathSync(ownerRoot),'node')) throw Error('Execution owner does not use its registered Node executable');
+        const ownerPackage=path.join(fs.realpathSync(ownerRoot),'packages/0');
+        const stamp=JSON.parse(fs.readFileSync(path.join(ownerPackage,'dist/BUILD.json'),'utf8'));
+        if(!/^[a-f0-9]{40}$/.test(stamp.commit) || stamp.dirty!==false) throw Error('Execution owner has no clean framework identity');
+        console.log(JSON.stringify({kind:'managed',cwd,executable,execArgv,scope:config.scope,ownerPid,guardianPid,artifact:selection.current,
+          applicationRuntime:{root:ownerPackage,executable:ownerExecutable,commit:stamp.commit}}));
+      } finally { await installation.close(); }
+    } else {
+    const candidates=[{scope:'system',file:'/etc/systemd/system/omnitron-daemon.service'},{scope:'user',file:path.join(os.homedir(),'.config/systemd/user/omnitron-daemon.service')}].filter(c=>fs.existsSync(c.file));
+    if(candidates.length>1) throw Error('Multiple supervisor scopes are unsupported');
+    if(!candidates.length) { console.log(JSON.stringify({kind:'fork',cwd,executable,execArgv})); }
+    else {
+      const unit=candidates[0]; const args=unit.scope==='user'?['--user']:[];
+      const output=execFileSync('systemctl',[...args,'show','omnitron-daemon.service','--property=MainPID,ActiveState,UnitFileState,FragmentPath,DropInPaths'],{encoding:'utf8'});
+      const properties=Object.fromEntries(output.trim().split('\\n').map(l=>[l.slice(0,l.indexOf('=')),l.slice(l.indexOf('=')+1)]));
+      if(properties.MainPID!==String(pid) || properties.ActiveState!=='active' || properties.FragmentPath!==unit.file || properties.DropInPaths || !['enabled','disabled'].includes(properties.UnitFileState)) throw Error('Supervisor does not own the serving daemon, or has unsupported overrides');
+      const contents=fs.readFileSync(unit.file,'utf8');
+      const lines=contents.split('\\n'); const exec=lines.filter(l=>l.startsWith('ExecStart=')); const wd=lines.filter(l=>l.startsWith('WorkingDirectory='));
+      const aliases=[root,path.dirname(path.dirname(root))+'/current'];
+      if(exec.length!==1 || wd.length!==1 || !aliases.some(p=>exec[0].includes(p+'/dist/daemon/daemon-entry.js')) || !aliases.some(p=>wd[0]==='WorkingDirectory='+p)) throw Error('Unsupported supervisor framework binding');
+      const operatorCwd=lines.filter(l=>/^Environment="?OMNITRON_CWD=/.test(l));
+      if(operatorCwd.length!==1 || !aliases.some(p=>operatorCwd[0]==='Environment=OMNITRON_CWD='+p || operatorCwd[0]==='Environment="OMNITRON_CWD='+p+'"')) throw Error('Unsupported supervisor operator cwd');
+      if(lines.some(l=>!l.startsWith('ExecStart=')&&!l.startsWith('WorkingDirectory=')&&!/^Environment="?OMNITRON_CWD=/.test(l)&&l.includes(root))) throw Error('Additional static framework paths in service need an explicit migration');
+      console.log(JSON.stringify({kind:'systemd',cwd,executable,execArgv,...unit,contents,enabled:properties.UnitFileState==='enabled'}));
+    } }`;
+    // SSH's default Node may have a different native-module ABI. Read the
+    // selected SQLite registry with the executable of the actual serving process.
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    if(process.platform!=='linux') throw Error('Controlled host upgrade currently requires Linux runtime inspection');
+    const executable=fs.realpathSync('/proc/'+${pid}+'/exe');
+    process.stdout.write(execFileSync(executable,['--input-type=module','--eval',${JSON.stringify(probe)}],
+      {encoding:'utf8',timeout:60000,maxBuffer:1024*1024}));`);
+}
+export function runtimeStopCommand(runtime, bundle) {
+    if (runtime.kind === 'managed')
+        throw new Error('Use backend upgrade for an independently supervised runtime');
+    if (runtime.kind === 'fork')
+        return `${runtime.executable ? shellEscape(runtime.executable) + ' ' : ''}${shellEscape(`${bundle.root}/dist/cli/omnitron.js`)} down`;
+    return `systemctl ${runtime.scope === 'user' ? '--user ' : ''}stop omnitron-daemon.service`;
+}
+export function runtimeStartCommand(runtime, previous, bundle, allowedCurrentRoots = [previous.root, bundle.root]) {
+    if (runtime.kind === 'managed')
+        throw new Error('Use backend upgrade for an independently supervised runtime');
+    if (runtime.kind === 'fork') {
+        if (runtime.executable && !runtime.executable.startsWith('/'))
+            throw new Error('Captured Node executable must be absolute');
+        const executable = runtime.executable ? shellEscape(runtime.executable) + ' ' : '';
+        // Keep the serving Node runtime for the daemon and its child processes, without modifying global links.
+        const env = runtime.executable ? `PATH=${shellEscape(runtime.executable.slice(0, runtime.executable.lastIndexOf('/')))}:"$PATH" ` : '';
+        return `cd ${shellEscape(runtime.cwd === previous.root ? bundle.root : runtime.cwd)} && ${env}${executable}${shellEscape(`${bundle.root}/dist/cli/omnitron.js`)} up --no-infra`;
+    }
+    return remoteNode(`${fsPrelude} import {execFileSync} from 'node:child_process';
+    const original=${JSON.stringify(runtime.contents)};
+    const render=root=>original.split('\\n').map(l=>(l.startsWith('ExecStart=')||l.startsWith('WorkingDirectory=')||/^Environment="?OMNITRON_CWD=/.test(l))?l.split(${JSON.stringify(previous.root)}).join(root):l).join('\\n');
+    const content=render(${JSON.stringify(bundle.root)});
+    const file=${JSON.stringify(runtime.file)};
+    const originalStat=fs.lstatSync(file);
+    if(!originalStat.isFile()) throw Error('Supervisor unit must be a regular file');
+    const current=fs.readFileSync(file,'utf8');
+    if(!${JSON.stringify(allowedCurrentRoots)}.map(render).includes(current)) throw Error('Supervisor unit changed outside the captured host operation');
+    const temporary=file+'.upgrade-part'; const fd=fs.openSync(temporary,'wx',0o600);
+    try {
+      try {
+        fs.writeFileSync(fd,content);
+        const created=fs.fstatSync(fd);
+        if(created.uid!==originalStat.uid||created.gid!==originalStat.gid)fs.fchownSync(fd,originalStat.uid,originalStat.gid);
+        fs.fchmodSync(fd,originalStat.mode & 0o777);fs.fsyncSync(fd);
+      } finally {fs.closeSync(fd)}
+      const now=fs.lstatSync(file);
+      if(!now.isFile()||now.dev!==originalStat.dev||now.ino!==originalStat.ino||now.mode!==originalStat.mode||now.uid!==originalStat.uid||now.gid!==originalStat.gid||fs.readFileSync(file,'utf8')!==current)
+        throw Error('Supervisor unit changed while preparing replacement');
+      fs.renameSync(temporary,file);
+      const directory=fs.openSync(path.dirname(file),'r');try{fs.fsyncSync(directory)}finally{fs.closeSync(directory)}
+    } finally {if(fs.existsSync(temporary))fs.unlinkSync(temporary)}
+    const scope=${JSON.stringify(runtime.scope === 'user' ? ['--user'] : [])};
+    execFileSync('systemctl',[...scope,'daemon-reload'],{stdio:'inherit'});
+    execFileSync('systemctl',[...scope,${JSON.stringify(runtime.enabled ? 'enable' : 'disable')},'omnitron-daemon.service'],{stdio:'inherit'});
+    execFileSync('systemctl',[...scope,'start','omnitron-daemon.service'],{stdio:'inherit'});`);
+}
+/** A successful CLI exit is insufficient: prove its native PID owner is no longer alive before rebinding. */
+export function stoppedDaemonCommand(bundle) {
+    return remoteNode(`${fsPrelude}
+    const base=${JSON.stringify(bundle.root)};
+    const {PidManager}=await import(pathToFileURL(base+'/dist/daemon/pid-manager.js').href);
+    const {DEFAULT_DAEMON_CONFIG}=await import(pathToFileURL(base+'/dist/config/defaults.js').href);
+    const {expandPath}=await import(pathToFileURL(base+'/dist/shared/paths.js').href);
+    const pid=new PidManager(expandPath(DEFAULT_DAEMON_CONFIG.pidFile)).getPid();
+    if(pid && PidManager.isProcessAlive(pid)) throw Error('Daemon still owns a live PID after stop; refusing to change bindings');`);
+}
+/** A build commit identifies code, while this observation binds the live process and grant. */
+export function assertSameApplicationRuntime(expected, actual) {
+    assertResidentApplicationRuntime(expected);
+    assertResidentApplicationRuntime(actual);
+    if (expected.root !== actual.root || expected.executable !== actual.executable || expected.commit !== actual.commit ||
+        expected.execution.ownerId !== actual.execution.ownerId || expected.execution.pid !== actual.execution.pid ||
+        expected.execution.epoch !== actual.execution.epoch)
+        throw Error('Execution owner or controller grant changed during application delivery; inspect the settled owner and retry before starting this release');
+}
+//# sourceMappingURL=host-upgrade.js.map

package/dist/services/host-upgrade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host-upgrade.js","sourceRoot":"","sources":["../../src/services/host-upgrade.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAGxD,MAAM,CAAC,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AASlE,MAAM,UAAU,gCAAgC,CAAC,KAAqC;IACpF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QACxE,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAClH,KAAK,CAAC,SAAS,EAAE,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,SAAS,CAAC,QAAQ,KAAK,CAAC;QACtE,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;QAC9K,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC;QAC3E,MAAM,KAAK,CAAC,6OAA6O,CAAC,CAAC;AAC/P,CAAC;AA6CD,SAAS,IAAI,CAAC,MAAc,IAAW,MAAM,IAAI,KAAK,CAAC,2BAA2B,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC9F,SAAS,OAAO,CAAC,KAAc,IAAuB,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/I,6FAA6F;AAC7F,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;AAC5H,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,MAA+B;IAC1F,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,KAAK,KAAK;QAClF,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACnG,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,kDAAkD,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,eAAe,CAAC,QAAyB,EAAE,SAA0B,EAAE,SAAwB;IAC7G,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QAC3C,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;YACtF,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC/K,CAAC;IACD,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS;QAAE,IAAI,CAAC,mJAAmJ,CAAC,CAAC;IACrM,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC;QAAE,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACvK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC;QAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;IACxJ,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmB,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IACxD,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC/J,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,IAAI,CAAC,+BAA+B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/G,MAAM,YAAY,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACjF,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACxF,IAAI,SAAS,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,CAAC,CAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;YAAE,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,UAAU,qBAAqB,WAAW,CAAC,CAAC;QAC/L,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,mBAAmB,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACtF,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC3B,IAAI,OAAO;oBAAE,IAAI,CAAC,WAAW,KAAK,CAAC,IAAI,UAAU,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBAC1G,SAAS;YACX,CAAC;YACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC7B,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;oBAAE,IAAI,CAAC,6CAA6C,CAAC,CAAC;gBAC/I,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;oBAAE,IAAI,CAAC,gBAAgB,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5H,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;gBACvC,IAAI,MAAM,KAAK,OAAO;oBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,SAAS,6FAA6F,CAAC,CAAC;gBAC5I,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,4BAA4B,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC3G,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACzG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAChC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC;gBACtB,IAAI,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;oBACzE,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;oBAC1F,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;oBAAE,IAAI,CAAC,4CAA4C,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACrJ,CAAC;iBAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;gBAAE,IAAI,CAAC,2BAA2B,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3F,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACtJ,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACxC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;YACpH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC;YAAE,IAAI,CAAC,kDAAkD,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxH,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,MAAO,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;QACtJ,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,oBAAoB,IAAI,wBAAwB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAC/G,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC;QACpE,MAAM,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;QAC5E,OAAO,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,IAAqB,EAAE,MAAuB,EAAE,MAA+B;IACrH,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;QAC3H,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAaD,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAqB,EAAE,EAAU,EAAE,OAA2B;IACrG,MAAM,OAAO,GAAuB,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/G,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,EAAE;QACtD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,2CAA2C;IACrE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChE,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,yEAAyE;QACzE,2EAA2E;QAC3E,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;QAC5B,2FAA2F;QAC3F,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAChL,OAAO,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC;QAAC,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;IAAC,CAAC;IACjG,OAAO,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yCAAyC,CAAC,CAAC;IAAC,CAAC;IACtH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAA2B,EAAE,OAA2B;IAC/F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,KAAe,EAAE,EAAE;QACtD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC,CAAC;IACF,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;QAC5B,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QAC3B,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtF,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC5C,OAAO,CAAC,OAAO,GAAG,aAAa,CAAC;QAAC,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,OAAO,GAAG,mBAAmB,CAAC;QACtC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAuB,EAAE,MAAuB;IAC/E,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1F,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;;iBAEtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;qEAC0B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC;AACvM,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAE,EAAW;IAChE,IAAI,EAAE,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzG,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,mBAAmB,CAAC;gBAC5C,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,0EAA0E,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;;;yGAGrC,CAAC,CAAC;AAC3G,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,UAAU,CAAC,MAAc,IAAY,OAAO,+BAA+B,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;AACnH,MAAM,SAAS,GAAG,mGAAmG,CAAC;AACtH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,OAAgB;IACjE,OAAO,UAAU,CAAC,GAAG,SAAS;mCACG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;kBACvC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;kDACU,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;;;;;;;;iFAQ5B,CAAC,CAAC;AACnF,CAAC;AACD,MAAM,UAAU,gBAAgB,CAAC,MAAuB,EAAE,IAAa;IACrE,OAAO,UAAU,CAAC,GAAG,SAAS;4DAC4B,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,+BAA+B,CAAC;;;;QAIjH,IAAI,CAAC,CAAC,CAAC;+DACgD,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,wBAAwB,CAAC;;;;;4CAKzE,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;;;;;;;;;;;;;;;;;;gFAoBD,CAAC,CAAC,CAAC,sCAAsC;6CAC5E,CAAC,CAAC;AAC/C,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,GAAuB,EAAE,MAAuB,EAAE,SAA8B;IAC1G,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,aAAa;QAAE,OAAO,MAAM,CAAC;IACtD,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;;iBAEtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;mEACY,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;AAC/K,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,OAA2B;IACxE,OAAO,UAAU,CAAC,GAAG,SAAS;gBAChB,IAAI,CAAC,SAAS,CAAC,GAAG,MAAM,mBAAmB,CAAC;+BAC7B,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,EAAE,OAAO,CAAC;;gCAEnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;uIACgD,CAAC,CAAC;AACzI,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,IAA0B;IACjE,OAAO,UAAU,CAAC,GAAG,SAAS;uBACT,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;;;;MAOrC,CAAC,CAAC;AACR,CAAC;AAED,MAAM,CAAC,MAAM,mCAAmC,GAAG,OAAO,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAqB,EAAE,QAAQ,GAAG,OAAO;IACjF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;QACvF,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7G,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAClH,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,kEAAkE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpI,IAAI,CAAC,wEAAwE,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;IACnF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,GAAG,SAAS;2BACL,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG;;wCAE/C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;wCAClC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;8BACrC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,8BAA8B,CAAC;qCAC/F,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;;;;;;4BAM5F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gCACvF,mCAAmC;uBAC5C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;;;;qDAIQ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;mFACW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,wCAAwC,CAAC;;0BAEvI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;eAC7E,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;;;;kDAIA,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,MAAM,UAAU,MAAM,CAAC,MAAM,MAAM,CAAC,CAAC;AAChI,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,6BAA6B,CAAC,IAAqB,EAAE,MAAuB;IAC1F,OAAO,UAAU,CAAC,GAAG,SAAS;2BACL,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;0CACxB,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC;;;uBAGxD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;6EAK6B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;;+DAEhD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;MAKpF,CAAC,CAAC;AACR,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,GAAW;IACtE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACnH,MAAM,KAAK,GAAG,GAAG,SAAS;;iBAEX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;kHAmBoC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QA+BvI,CAAC;IACP,sEAAsE;IACtE,8EAA8E;IAC9E,OAAO,UAAU,CAAC,GAAG,SAAS;;gDAEgB,GAAG;mFACgC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;6DAC3C,CAAC,CAAC;AAC/D,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,OAAoB,EAAE,MAAuB;IAC9E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,MAAM,CAAC,IAAI,uBAAuB,CAAC,OAAO,CAAC;IACnK,OAAO,aAAa,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,8BAA8B,CAAC;AAC9F,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAAoB,EAAE,QAAyB,EAAE,MAAuB,EAAE,mBAAmB,GAAa,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;IACxK,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC5H,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,wGAAwG;QACxG,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,OAAO,MAAM,WAAW,CAAC,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG,MAAM,CAAC,IAAI,uBAAuB,CAAC,gBAAgB,CAAC;IAClL,CAAC;IACD,OAAO,UAAU,CAAC,GAAG,SAAS;qBACX,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;sKACiH,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;2BACxK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;iBACrC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;;;;UAInC,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC;;;;;;;;;;;;;;;kBAe3B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;;yCAEnC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;8FACD,CAAC,CAAC;AAChG,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,OAAO,UAAU,CAAC,GAAG,SAAS;iBACf,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC;;;;;mIAKuF,CAAC,CAAC;AACrI,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,4BAA4B,CAAC,QAA4B,EAAE,MAAsC;IAC/G,gCAAgC,CAAC,QAAQ,CAAC,CAAC;IAC3C,gCAAgC,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAC/G,QAAQ,CAAC,SAAU,CAAC,OAAO,KAAK,MAAM,CAAC,SAAU,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAU,CAAC,GAAG,KAAK,MAAM,CAAC,SAAU,CAAC,GAAG;QAC9G,QAAQ,CAAC,SAAU,CAAC,KAAK,KAAK,MAAM,CAAC,SAAU,CAAC,KAAK;QACvD,MAAM,KAAK,CAAC,2IAA2I,CAAC,CAAC;AAC7J,CAAC"}

package/dist/services/infrastructure.rpc-service.d.ts

@@ -4,6 +4,9 @@
  * Netron RPC endpoints for infrastructure container management
  * (Docker-based PostgreSQL, Redis, MinIO, etc.).
  */
+import { type StackExecutionScope } from '../shared/dto/stack-execution.js';
+import { HostIngressService } from '../infrastructure/host-ingress.service.js';
+import type { HostIngressApply, HostIngressRemove, HostIngressSettings, HostIngressOwnerRestore, HostIngressTakeoverRollback } from '../infrastructure/host-ingress-types.js';
 import type { InfrastructureService } from '../infrastructure/infrastructure.service.js';
 import type { InfrastructureConfig, IServiceRequirement } from '../infrastructure/types.js';
 import type { InfrastructureState, ContainerState } from '../infrastructure/types.js';
@@ -52,6 +55,13 @@ export declare class InfrastructureRpcService implements IOmnitronInfraService {
      * partial payload a `warn`.
      */
     private readonly logger?;
+    private readonly hostIngress;
+    private readonly getStackObservations;
+    private readonly activeMutations;
+    private stackOperationGate?;
+    setStackOperationGate(gate: (scope?: StackExecutionScope) => void): void;
+    drainStackProvisioning(scope: StackExecutionScope): Promise<void>;
+    private trackMutation;
     constructor(getInfra: () => InfrastructureService | null, 
     /**
      * How this daemon builds and adopts an infrastructure it is asked for.
@@ -98,7 +108,19 @@ export declare class InfrastructureRpcService implements IOmnitronInfraService {
         error(obj: object, msg?: string, ...args: any[]): void;
         warn?(obj: object, msg?: string, ...args: any[]): void;
         info?(obj: object, msg?: string, ...args: any[]): void;
-    } | undefined);
+    } | undefined, hostIngress?: HostIngressService, getStackObservations?: () => ContainerState[]);
+    configureHostIngress(data: HostIngressSettings): Promise<{
+        configured: true;
+        settings: HostIngressSettings;
+    }>;
+    getHostIngress(): Promise<import("../infrastructure/host-ingress-types.js").HostIngressStatus>;
+    checkHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressCheck>;
+    validateHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressValidation>;
+    restoreHostIngressOwner(data: HostIngressOwnerRestore): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    rollbackHostIngressTakeover(data: HostIngressTakeoverRollback): Promise<import("../infrastructure/host-ingress-types.js").HostIngressTakeoverRollbackReceipt>;
+    applyHostIngress(data: HostIngressApply): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    removeHostIngress(data: HostIngressRemove): Promise<import("../infrastructure/host-ingress-types.js").HostIngressReceipt>;
+    recoverHostIngress(): Promise<import("../infrastructure/host-ingress-types.js").HostIngressStatus>;
     /**
      * Bring up the infrastructure a stack needs, here, on this node.
      *
@@ -286,7 +308,7 @@ export declare class InfrastructureRpcService implements IOmnitronInfraService {
     /**
      * @throws when the container is not one this daemon manages.
      */
-    private assertManaged;
+    private managedContainer;
     startContainer(data: {
         name: string;
     }): Promise<{

package/dist/services/infrastructure.rpc-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infrastructure.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/infrastructure.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAK5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAUvE,qBACa,wBAAyB,YAAW,qBAAqB;IAElE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAhD1B,YACmB,QAAQ,EAAE,MAAM,qBAAqB,GAAG,IAAI;IAC7D;;;;;;;;;;OAUG;IACc,SAAS,CAAC,GAAE,CAC3B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC7C,QAAQ,EAAE,OAAO,uCAAuC,EAAE,cAAc,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,KAC7E,qBAAqB,aAAA;IAC1B;;;;;;;;;;;;OAYG;IACc,QAAQ,CAAC,GAAE,MAAM,OAAO,0CAA0C,EAAE,eAAe,GAAG,SAAS,aAAA;IAChH;;;;;;;;OAQG;IACH;;;;;OAKG;IACc,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KACxD,GAAG,SAAS,EACX;IAEJ;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAOG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,oBAAoB,CAAC;QAC7B;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;QAC3D;;;;;;;;;;WAUG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;QAC9F;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE,OAAO,qCAAqC,EAAE,aAAa,GAAG,SAAS,CAAC;QACtF;;;;;;;WAOG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACjD;;;;;;;;;;WAUG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KACtD,GAAG,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAOD;IAED,2EAA2E;YAC7D,iBAAiB;IA2K/B;;;;;;OAMG;IACL;;;;;;SAMK;IACL;;;;;;;;;SASK;YACW,iBAAiB;YAuBjB,iBAAiB;YAmDjB,qBAAqB;IA6DnC;;;;;;OAMG;IAEG,mBAAmB,CACvB,IAAI,EAAE,OAAO,sCAAsC,EAAE,qBAAqB,GACzE,OAAO,CAAC,OAAO,sCAAsC,EAAE,cAAc,CAAC,CAUxE;IAGK,QAAQ,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGpD;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEG,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAEhD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAEG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAI1F;IAgBD;;OAEG;YACW,aAAa;IAarB,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI1E;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3F;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAI3E;IAGK,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAMvF;CACF"}
+{"version":3,"file":"infrastructure.rpc-service.d.ts","sourceRoot":"","sources":["../../src/services/infrastructure.rpc-service.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAqB,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2CAA2C,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,yCAAyC,CAAC;AAI9K,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6CAA6C,CAAC;AACzF,OAAO,KAAK,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAK5F,OAAO,KAAK,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACtF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA0BvE,qBACa,wBAAyB,YAAW,qBAAqB;IAmClE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB;;;;;;;;;;OAUG;IACH,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;IAM3B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAC1B;;;;;;;;OAQG;IACH;;;;;OAKG;IACH,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAKxB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IAvFvC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAwD;IACxF,OAAO,CAAC,kBAAkB,CAAC,CAAwC;IAEnE,qBAAqB,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,mBAAmB,KAAK,IAAI,GAAG,IAAI,CAEvE;IAEK,sBAAsB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAEtE;IAED,OAAO,CAAC,aAAa;IAsBrB,YACmB,QAAQ,EAAE,MAAM,qBAAqB,GAAG,IAAI;IAC7D;;;;;;;;;;OAUG;IACc,SAAS,CAAC,GAAE,CAC3B,MAAM,EAAE,oBAAoB,EAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,EAC7C,QAAQ,EAAE,OAAO,uCAAuC,EAAE,cAAc,EACxE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,KAC7E,qBAAqB,aAAA;IAC1B;;;;;;;;;;;;OAYG;IACc,QAAQ,CAAC,GAAE,MAAM,OAAO,0CAA0C,EAAE,eAAe,GAAG,SAAS,aAAA;IAChH;;;;;;;;OAQG;IACH;;;;;OAKG;IACc,MAAM,CAAC,EAAE;QACxB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;KACxD,GAAG,SAAS,EACI,WAAW,GAAE,kBAA6C,EAC1D,oBAAoB,GAAE,MAAM,cAAc,EAAa,EACtE;IAGE,oBAAoB,CAAC,IAAI,EAAE,mBAAmB;;;OAAmF;IAGjI,cAAc,iFAAwC;IAGtD,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,+EAA0C;IAGjF,mBAAmB,CAAC,IAAI,EAAE,gBAAgB,oFAAmF;IAG7H,uBAAuB,CAAC,IAAI,EAAE,uBAAuB,iFAAuF;IAG5I,2BAA2B,CAAC,IAAI,EAAE,2BAA2B,iGAA0F;IAGvJ,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,iFAAgF;IAGvH,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,iFAAiF;IAG1H,kBAAkB,iFAA8E;IAEtG;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IAOG,cAAc,CAAC,IAAI,EAAE;QACzB,MAAM,EAAE,oBAAoB,CAAC;QAC7B;;;;;;;;WAQG;QACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,GAAG,SAAS,CAAC;QAC3D;;;;;;;;;;WAUG;QACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7B,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;QAC3B;;;;WAIG;QACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,4BAA4B,EAAE,gBAAgB,CAAC,GAAG,SAAS,CAAC;QAC9F;;;;;;;;;;;WAWG;QACH,WAAW,CAAC,EAAE,OAAO,qCAAqC,EAAE,aAAa,GAAG,SAAS,CAAC;QACtF;;;;;;;WAOG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;QACjD;;;;;;;;;;WAUG;QACH,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;KACtD,GAAG,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CASD;IAED,2EAA2E;YAC7D,iBAAiB;IAoK/B;;;;;;OAMG;IACL;;;;;;SAMK;IACL;;;;;;;;;SASK;YACW,iBAAiB;YAuBjB,iBAAiB;YAmDjB,qBAAqB;IAyEnC;;;;;;OAMG;IAEG,mBAAmB,CACvB,IAAI,EAAE,OAAO,sCAAsC,EAAE,qBAAqB,GACzE,OAAO,CAAC,OAAO,sCAAsC,EAAE,cAAc,CAAC,CAUxE;IAGK,QAAQ,IAAI,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAGpD;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IAEG,cAAc,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAoBhD;IAED;;;;;;;;;;;;;;;;;;OAkBG;IAEG,iBAAiB,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAI1F;IAgBD;;OAEG;YACW,gBAAgB;IAQxB,cAAc,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAK1E;IAGK,aAAa,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAK3F;IAGK,eAAe,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAK3E;IAGK,gBAAgB,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAMvF;CACF"}