@studiometa/trafic-agent 0.1.47 → 0.1.49

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { H as step, I as exec, L as execSilent, R as info, T as closeDb, U as success, W as warn, it as loadConfig, ot as validateConfig, s as startServer, z as isRoot } from "./server-EPU5dtPx.js";
-import { i as runPendingMigrations, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-4zlNJqDe.js";
+import { B as info, D as closeDb, G as success, K as warn, R as exec, V as isRoot, W as step, ct as validateConfig, ot as loadConfig, s as startServer, z as execSilent } from "./server-DZAo8Clg.js";
+import { i as runPendingMigrations, n as setup, r as listMigrations, s as startIdleScheduler, t as audit } from "./setup-DWgb6dAD.js";
 import { readFileSync } from "node:fs";
 import { execSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
@@ -113,7 +113,7 @@ function upgradeDdev(dryRun) {
 /** The real collaborators, used unless a caller passes their own. */
 function nodeUpgradeIo() {
 	return {
-		currentVersion: "0.1.47",
+		currentVersion: "0.1.49",
 		alreadyReExeced: process.env["TRAFIC_UPGRADE_REEXEC"] === "1",
 		isRoot,
 		fetchLatestVersion,
@@ -260,7 +260,7 @@ function printHelp() {
 	console.log(HELP.trim());
 }
 function printVersion() {
-	console.log("0.1.47");
+	console.log("0.1.49");
 }
 async function runStart(values) {
 	const config = loadConfig(values.config);

package/dist/index.js

@@ -1,3 +1,3 @@
-import { $ as checkAuth, A as initDb, C as shouldNeverStop, D as getDb, E as getAccessLogs, G as buildHostnameIndex, J as listProjects, K as getProjectFromHostname, M as setProjectStatus, N as updateProjectAccess, O as getIdleProjects, Q as watchProjectList, S as loadProjectConfig, T as closeDb, X as startProject, Y as loadProjectList, Z as stopProject, at as parseDuration, et as matchHostname, it as loadConfig, j as logAccess, k as getProject, nt as parseBasicAuth, ot as validateConfig, q as getProjectInfo, rt as parseBearerToken, s as startServer, tt as matchIp, w as cleanOldLogs, x as getIdleTimeoutMs } from "./server-EPU5dtPx.js";
-import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, l as DOCKER_FIREWALL_SCRIPT, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-4zlNJqDe.js";
+import { $ as stopProject, A as getIdleProjects, C as getIdleTimeoutMs, D as closeDb, E as cleanOldLogs, F as updateProjectAccess, J as getProjectFromHostname, M as initDb, N as logAccess, O as getAccessLogs, P as setProjectStatus, Q as startProject, T as shouldNeverStop, X as listProjects, Y as getProjectInfo, Z as loadProjectList, at as parseBearerToken, ct as validateConfig, et as watchProjectList, it as parseBasicAuth, j as getProject, k as getDb, nt as matchHostname, ot as loadConfig, q as buildHostnameIndex, rt as matchIp, s as startServer, st as parseDuration, tt as checkAuth, w as loadProjectConfig } from "./server-DZAo8Clg.js";
+import { a as printAuditResults, c as stopIdleProjects, d as buildDockerFirewallScript, f as buildDockerFirewallUnit, l as DOCKER_FIREWALL_SCRIPT, n as setup, o as runAudit, p as configureDockerFirewall, s as startIdleScheduler, t as audit, u as DOCKER_FIREWALL_UNIT } from "./setup-DWgb6dAD.js";
 export { DOCKER_FIREWALL_SCRIPT, DOCKER_FIREWALL_UNIT, audit, buildDockerFirewallScript, buildDockerFirewallUnit, buildHostnameIndex, checkAuth, cleanOldLogs, closeDb, configureDockerFirewall, getAccessLogs, getDb, getIdleProjects, getIdleTimeoutMs, getProject, getProjectFromHostname, getProjectInfo, initDb, listProjects, loadConfig, loadProjectConfig, loadProjectList, logAccess, matchHostname, matchIp, parseBasicAuth, parseBearerToken, parseDuration, printAuditResults, runAudit, setProjectStatus, setup, shouldNeverStop, startIdleScheduler, startProject, startServer, stopIdleProjects, stopProject, updateProjectAccess, validateConfig, watchProjectList };

package/dist/{server-EPU5dtPx.js → server-DZAo8Clg.js}

@@ -838,15 +838,34 @@ function installSystemDeps(io = nodeIo) {
 	io.exec("DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync gnupg ca-certificates", { silent: true });
 	success("System dependencies installed: jq, curl, rsync, gnupg, ca-certificates");
 }
+/** Where the DDEV signing key is installed. */
+var DDEV_KEYRING = "/etc/apt/keyrings/ddev.asc";
+/** The deb822 source file naming the DDEV repository. */
+var DDEV_SOURCES = "/etc/apt/sources.list.d/ddev.sources";
 /**
-* Add the official DDEV apt repository and GPG key.
+* Add the official DDEV apt repository and signing key.
+*
+* The repository is the Cloudsmith one DDEV 1.25.4 moved to
+* (ddev/ddev#8698). The former Gemfury host, `pkg.ddev.com`, still serves
+* packages and carries no retirement date, but DDEV now tells Linux users to
+* switch, so this follows the documented install.
+*
+* Two differences from the copy/paste block in DDEV's docs, both deliberate:
+* the key is written by curl rather than piped into `tee`, so a failed
+* download exits non-zero here instead of surfacing as a confusing GPG error
+* on the next `apt-get update` (the same reasoning as the NodeSource key);
+* and the docs' `sudo` is dropped because setup already runs as root.
+*
+* The key is served armoured and stays that way — `.asc` rather than a
+* dearmoured `.gpg` — which is what `Signed-By` in the source file names.
+*
 * Idempotent: safe to call even if the repository is already configured.
 */
 function addDdevAptRepo(io = nodeIo) {
 	io.exec("install -m 0755 -d /etc/apt/keyrings", { silent: true });
-	io.exec("curl -fsSL https://pkg.ddev.com/apt/gpg.key | gpg --dearmor | tee /etc/apt/keyrings/ddev.gpg > /dev/null", { silent: true });
-	io.exec("chmod a+r /etc/apt/keyrings/ddev.gpg", { silent: true });
-	io.exec("echo \"deb [signed-by=/etc/apt/keyrings/ddev.gpg] https://pkg.ddev.com/apt/ * *\" | tee /etc/apt/sources.list.d/ddev.list > /dev/null", { silent: true });
+	io.exec(`curl -fsSL https://packages.ddev.com/public/gpg.key -o ${DDEV_KEYRING}`, { silent: true });
+	io.exec(`chmod a+r ${DDEV_KEYRING}`, { silent: true });
+	io.exec(`printf "Types: deb\\nURIs: https://packages.ddev.com/public/deb/ubuntu\\nSuites: stable\\nComponents: main\\nSigned-By: ${DDEV_KEYRING}\\n" | tee ${DDEV_SOURCES} > /dev/null`, { silent: true });
 }
 /**
 * Install DDEV
@@ -1200,12 +1219,24 @@ function configureTraefik(options = {}, io = nodeIo) {
 	success("Traefik configured with Trafic middleware");
 }
 /**
-* Name of one running DDEV project, or null when none runs.
+* Names of the running DDEV projects.
 *
 * `ddev list -j` is the only source that knows: `project_list.yaml`, which the
 * agent watches for discovery, records every project DDEV has ever seen but
 * carries no live status — a project stopped an hour ago still sits there.
 * `ddev list -j` asks Docker, and wraps the entries in a `raw` array.
+*/
+function findRunningProjects(io = nodeIo) {
+	const output = io.execSilent("su - ddev -c 'ddev list -j'");
+	if (!output) return [];
+	try {
+		return (JSON.parse(output).raw ?? []).filter((project) => project.status === "running" && project.name).map((project) => project.name);
+	} catch {
+		return [];
+	}
+}
+/**
+* Name of one running DDEV project, or null when none runs.
 *
 * Used to push a changed global Traefik config into the running router: DDEV
 * copies `custom-global-config/*.yaml` into it on any `ddev start`, so
@@ -1213,13 +1244,7 @@ function configureTraefik(options = {}, io = nodeIo) {
 * serving traffic has to be stopped.
 */
 function findRunningProject(io = nodeIo) {
-	const output = io.execSilent("su - ddev -c 'ddev list -j'");
-	if (!output) return null;
-	try {
-		return (JSON.parse(output).raw ?? []).find((project) => project.status === "running")?.name ?? null;
-	} catch {
-		return null;
-	}
+	return findRunningProjects(io)[0] ?? null;
 }
 /**
 * Turn the agent's TLS config into what the static config needs.
@@ -1546,6 +1571,6 @@ function startServer(agentConfig) {
 	});
 }
 //#endregion
-export { checkAuth as $, initDb as A, resetSteps as B, shouldNeverStop as C, getDb as D, getAccessLogs as E, error as F, buildHostnameIndex as G, step as H, exec as I, listProjects as J, getProjectFromHostname as K, execSilent as L, setProjectStatus as M, updateProjectAccess as N, getIdleProjects as O, nodeIo as P, watchProjectList as Q, info as R, loadProjectConfig as S, closeDb as T, success as U, setDryRun as V, warn as W, startProject as X, loadProjectList as Y, stopProject as Z, installDdev as _, handleStatus as a, parseDuration as at, readToolPorts as b, DNS_RESOLVER as c, TLS_STORE_CONFIG as d, matchHostname as et, addDdevAptRepo as f, getDockerGatewayIp as g, findRunningProject as h, handleRequest as i, loadConfig as it, logAccess as j, getProject as k, ROUTER_COMPOSE_OVERRIDE as l, configureTraefik as m, handleAuth as n, parseBasicAuth as nt, routePath as o, validateConfig as ot, configureDdev as p, getProjectInfo as q, handleErrors as r, parseBearerToken as rt, startServer as s, getEffectiveAuthConfig as t, matchIp as tt, STATIC_CONFIG as u, installSystemDeps as v, cleanOldLogs as w, getIdleTimeoutMs as x, purgeTraefikAcmeStorage as y, isRoot as z };
+export { stopProject as $, getIdleProjects as A, info as B, getIdleTimeoutMs as C, closeDb as D, cleanOldLogs as E, updateProjectAccess as F, success as G, resetSteps as H, nodeIo as I, getProjectFromHostname as J, warn as K, error as L, initDb as M, logAccess as N, getAccessLogs as O, setProjectStatus as P, startProject as Q, exec as R, readToolPorts as S, shouldNeverStop as T, setDryRun as U, isRoot as V, step as W, listProjects as X, getProjectInfo as Y, loadProjectList as Z, findRunningProjects as _, handleStatus as a, parseBearerToken as at, installSystemDeps as b, DDEV_SOURCES as c, validateConfig as ct, STATIC_CONFIG as d, watchProjectList as et, TLS_STORE_CONFIG as f, findRunningProject as g, configureTraefik as h, handleRequest as i, parseBasicAuth as it, getProject as j, getDb as k, DNS_RESOLVER as l, configureDdev as m, handleAuth as n, matchHostname as nt, routePath as o, loadConfig as ot, addDdevAptRepo as p, buildHostnameIndex as q, handleErrors as r, matchIp as rt, startServer as s, parseDuration as st, getEffectiveAuthConfig as t, checkAuth as tt, ROUTER_COMPOSE_OVERRIDE as u, getDockerGatewayIp as v, loadProjectConfig as w, purgeTraefikAcmeStorage as x, installDdev as y, execSilent as z };
 
-//# sourceMappingURL=server-EPU5dtPx.js.map
+//# sourceMappingURL=server-DZAo8Clg.js.map

package/dist/server-DZAo8Clg.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-DZAo8Clg.js","names":[],"sources":["../src/utils/config.ts","../src/utils/auth.ts","../src/utils/ddev.ts","../src/setup/steps.ts","../src/setup/io.ts","../src/utils/db.ts","../src/utils/project-config.ts","../src/setup/ddev.ts","../src/utils/traefik.ts","../src/utils/tls.ts","../src/server.ts"],"sourcesContent":["import { readFileSync, existsSync } from \"node:fs\";\nimport { parse } from \"smol-toml\";\nimport type { AgentConfig, AuthConfig, AuthRule, TlsConfig } from \"../types.js\";\n\nconst DEFAULT_CONFIG_PATHS = [\n  \"/etc/trafic/config.toml\",\n  \"./config.toml\",\n  \"./trafic.toml\",\n];\n\nconst DEFAULT_CONFIG: AgentConfig = {\n  tld: \"\",\n  port: 9876,\n  dbPath: \"/var/lib/trafic/db.sqlite\",\n  projectListPath: \"/home/ddev/.ddev/project_list.yaml\",\n  projectsDir: \"/home/ddev/www\",\n  idleTimeout: \"30m\",\n  idleCheckInterval: \"5m\",\n  auth: {\n    defaultPolicy: \"basic\",\n    allowedIps: [],\n    tokens: [],\n    basicAuth: [],\n    rules: [],\n    trustedProxyHops: 1,\n  },\n  tls: {\n    dnsEnv: {},\n  },\n};\n\n/**\n * Parse a duration string (e.g., \"30m\", \"1h\", \"2h30m\") to milliseconds\n */\nexport function parseDuration(duration: string): number {\n  const regex = /(?:(\\d+)h)?(?:(\\d+)m)?(?:(\\d+)s)?/;\n  const match = duration.match(regex);\n  if (!match) return 0;\n\n  const hours = parseInt(match[1] ?? \"0\", 10);\n  const minutes = parseInt(match[2] ?? \"0\", 10);\n  const seconds = parseInt(match[3] ?? \"0\", 10);\n\n  return (hours * 3600 + minutes * 60 + seconds) * 1000;\n}\n\n/**\n * Load configuration from TOML file\n */\nexport function loadConfig(configPath?: string): AgentConfig {\n  // Find config file\n  let path = configPath;\n  if (!path) {\n    path = DEFAULT_CONFIG_PATHS.find((p) => existsSync(p));\n  }\n\n  if (!path || !existsSync(path)) {\n    console.warn(\"No config file found, using defaults\");\n    return DEFAULT_CONFIG;\n  }\n\n  const content = readFileSync(path, \"utf-8\");\n  const parsed = parse(content) as Record<string, unknown>;\n\n  // Merge with defaults\n  const auth = mergeAuthConfig(parsed.auth as Record<string, unknown>);\n  const tls = mergeTlsConfig(parsed.tls as Record<string, unknown>);\n\n  return {\n    tld: (parsed.tld as string) ?? DEFAULT_CONFIG.tld,\n    port: (parsed.port as number) ?? DEFAULT_CONFIG.port,\n    dbPath: (parsed.db_path as string) ?? DEFAULT_CONFIG.dbPath,\n    projectListPath:\n      (parsed.project_list_path as string) ?? DEFAULT_CONFIG.projectListPath,\n    projectsDir: (parsed.projects_dir as string) ?? DEFAULT_CONFIG.projectsDir,\n    idleTimeout:\n      (parsed.idle_timeout as string) ?? DEFAULT_CONFIG.idleTimeout,\n    idleCheckInterval:\n      (parsed.idle_check_interval as string) ??\n      DEFAULT_CONFIG.idleCheckInterval,\n    auth,\n    tls,\n  };\n}\n\n/**\n * Read the [tls] section.\n *\n * `dns_env` holds provider credentials, so its values are taken as-is and\n * only checked for being strings — validateConfig reports the rest.\n */\nfunction mergeTlsConfig(raw?: Record<string, unknown>): TlsConfig {\n  if (!raw) return DEFAULT_CONFIG.tls;\n\n  const env = (raw.dns_env as Record<string, unknown> | undefined) ?? {};\n  const dnsEnv: Record<string, string> = {};\n\n  for (const [key, value] of Object.entries(env)) {\n    // Kept as read: a number or a boolean here is a config mistake, and\n    // validateConfig says so rather than coercing it into a credential\n    dnsEnv[key] = value as string;\n  }\n\n  return {\n    dnsProvider: (raw.dns_provider as string | undefined) || undefined,\n    caServer: (raw.ca_server as string | undefined) || undefined,\n    dnsEnv,\n  };\n}\n\n/**\n * Parse basic_auth entries from TOML.\n * Accepts either plain strings (\"user:pass\") or objects ({username, password}).\n */\nfunction parseBasicAuthEntries(raw: unknown): string[] | null {\n  if (!Array.isArray(raw)) return null;\n  return raw.map((entry) => {\n    if (typeof entry === \"string\") return entry;\n    if (typeof entry === \"object\" && entry !== null) {\n      const { username, password } = entry as Record<string, unknown>;\n      return `${username}:${password}`;\n    }\n    return String(entry);\n  });\n}\n\nfunction mergeAuthConfig(raw?: Record<string, unknown>): AuthConfig {\n  if (!raw) return DEFAULT_CONFIG.auth;\n\n  const rules = (raw.rules as Array<Record<string, unknown>>) ?? [];\n\n  return {\n    defaultPolicy:\n      (raw.default_policy as AuthConfig[\"defaultPolicy\"]) ??\n      DEFAULT_CONFIG.auth.defaultPolicy,\n    allowedIps:\n      (raw.allowed_ips as string[]) ?? DEFAULT_CONFIG.auth.allowedIps,\n    tokens: (raw.tokens as string[]) ?? DEFAULT_CONFIG.auth.tokens,\n    basicAuth: parseBasicAuthEntries(raw.basic_auth) ?? DEFAULT_CONFIG.auth.basicAuth,\n    rules: rules.map(\n      (r): AuthRule => ({\n        match: r.match as string,\n        policy: r.policy as AuthRule[\"policy\"],\n        tokens: r.tokens as string[] | undefined,\n        allowedIps: r.allowed_ips as string[] | undefined,\n      }),\n    ),\n    trustedProxyHops: parseTrustedProxyHops(raw.trusted_proxy_hops),\n  };\n}\n\n/**\n * Parse trusted_proxy_hops, ignoring values that cannot be a hop count.\n *\n * A bad value falls back to the default rather than 0, because 0 would read\n * the socket peer — always the proxy — and quietly stop the IP allowlist and\n * per-hostname IP rules from ever matching.\n */\nfunction parseTrustedProxyHops(raw: unknown): number {\n  const hops = typeof raw === \"number\" ? raw : Number(raw);\n\n  if (!Number.isInteger(hops) || hops < 1) {\n    return DEFAULT_CONFIG.auth.trustedProxyHops;\n  }\n\n  return hops;\n}\n\n/**\n * Validate configuration\n */\nexport function validateConfig(config: AgentConfig): string[] {\n  const errors: string[] = [];\n\n  if (!config.tld) {\n    errors.push(\"tld is required\");\n  }\n\n  if (config.port < 1 || config.port > 65535) {\n    errors.push(\"port must be between 1 and 65535\");\n  }\n\n  if (\n    config.auth.defaultPolicy !== \"allow\" &&\n    config.auth.defaultPolicy !== \"deny\" &&\n    config.auth.defaultPolicy !== \"basic\" &&\n    config.auth.defaultPolicy !== \"token\"\n  ) {\n    errors.push('auth.default_policy must be \"allow\", \"deny\", \"basic\", or \"token\"');\n  }\n\n  for (const [key, value] of Object.entries(config.tls.dnsEnv)) {\n    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {\n      errors.push(`tls.dns_env key \"${key}\" is not a valid environment variable name`);\n    }\n\n    if (typeof value !== \"string\") {\n      errors.push(`tls.dns_env.${key} must be a string`);\n    }\n  }\n\n  return errors;\n}\n","import type { AuthConfig, AuthRequest, AuthResult, AuthRule } from \"../types.js\";\n\n/**\n * Check if an IP matches a pattern (supports CIDR notation)\n */\nexport function matchIp(ip: string, pattern: string): boolean {\n  // Exact match\n  if (ip === pattern) return true;\n\n  // CIDR notation\n  if (pattern.includes(\"/\")) {\n    return matchCidr(ip, pattern);\n  }\n\n  // Wildcard (e.g., 192.168.*)\n  if (pattern.includes(\"*\")) {\n    const regex = new RegExp(\n      \"^\" + pattern.replace(/\\./g, \"\\\\.\").replace(/\\*/g, \".*\") + \"$\",\n    );\n    return regex.test(ip);\n  }\n\n  return false;\n}\n\n/**\n * Match IP against CIDR range\n */\nfunction matchCidr(ip: string, cidr: string): boolean {\n  const [range, bits] = cidr.split(\"/\");\n  const mask = parseInt(bits, 10);\n\n  const ipNum = ipToNumber(ip);\n  const rangeNum = ipToNumber(range);\n\n  if (ipNum === null || rangeNum === null) return false;\n\n  const maskNum = ~((1 << (32 - mask)) - 1);\n  return (ipNum & maskNum) === (rangeNum & maskNum);\n}\n\n/**\n * Convert IP string to number\n */\nfunction ipToNumber(ip: string): number | null {\n  const parts = ip.split(\".\");\n  if (parts.length !== 4) return null;\n\n  let num = 0;\n  for (const part of parts) {\n    const n = parseInt(part, 10);\n    if (isNaN(n) || n < 0 || n > 255) return null;\n    num = (num << 8) | n;\n  }\n  return num >>> 0; // Convert to unsigned\n}\n\n/**\n * Match hostname against a glob pattern\n */\nexport function matchHostname(hostname: string, pattern: string): boolean {\n  // Exact match\n  if (hostname === pattern) return true;\n\n  // Glob pattern\n  const regex = new RegExp(\n    \"^\" +\n      pattern\n        .replace(/[.+^${}()|[\\]\\\\]/g, \"\\\\$&\")\n        .replace(/\\*/g, \".*\")\n        .replace(/\\?/g, \".\") +\n      \"$\",\n  );\n  return regex.test(hostname);\n}\n\n/**\n * Parse Basic auth header\n */\nexport function parseBasicAuth(\n  header: string,\n): { username: string; password: string } | null {\n  if (!header.startsWith(\"Basic \")) return null;\n\n  try {\n    const encoded = header.slice(6);\n    const decoded = Buffer.from(encoded, \"base64\").toString(\"utf-8\");\n    const colonIndex = decoded.indexOf(\":\");\n    if (colonIndex === -1) return null;\n\n    return {\n      username: decoded.slice(0, colonIndex),\n      password: decoded.slice(colonIndex + 1),\n    };\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Parse Bearer token from header\n */\nexport function parseBearerToken(header: string): string | null {\n  if (!header.startsWith(\"Bearer \")) return null;\n  return header.slice(7);\n}\n\n/**\n * Resolve the client address from the socket peer and X-Forwarded-For.\n *\n * Every proxy appends the address it saw, so the entries grow left to right\n * and the rightmost ones were added by the proxies closest to us. Counting\n * `trustedHops` from the right therefore lands on the client, while anything\n * further left is whatever the client sent and must be ignored.\n *\n * Reading the leftmost entry instead — as this used to — let a client set\n * `X-Forwarded-For: <allowed-ip>` and match the IP allowlist, which grants\n * access unconditionally.\n *\n * Falls back to the socket peer whenever the header cannot be trusted to\n * hold that many entries.\n */\nexport function resolveClientIp(\n  socketIp: string,\n  forwardedFor: string | undefined,\n  trustedHops = 1,\n): string {\n  if (!forwardedFor || trustedHops < 1) {\n    return socketIp;\n  }\n\n  const entries = forwardedFor\n    .split(\",\")\n    .map((entry) => entry.trim())\n    .filter(Boolean);\n\n  // Fewer entries than trusted proxies means the chain is shorter than\n  // configured — the socket peer is the only address we can rely on.\n  if (entries.length < trustedHops) {\n    return socketIp;\n  }\n\n  return entries[entries.length - trustedHops] ?? socketIp;\n}\n\n/**\n * Check authentication for a request\n */\nexport function checkAuth(request: AuthRequest, config: AuthConfig): AuthResult {\n  const { hostname, ip, authorization } = request;\n\n  const realIp = resolveClientIp(ip, request.forwardedFor, config.trustedProxyHops);\n\n  // Check IP whitelist first (always allows)\n  for (const pattern of config.allowedIps) {\n    if (matchIp(realIp, pattern)) {\n      return { allowed: true, reason: \"ip\" };\n    }\n  }\n\n  // Check per-hostname rules\n  for (const rule of config.rules) {\n    if (matchHostname(hostname, rule.match)) {\n      return checkRule(rule, realIp, authorization, config);\n    }\n  }\n\n  // Apply default policy\n  return applyDefaultPolicy(config, realIp, authorization);\n}\n\n/**\n * Check a specific rule\n */\nfunction checkRule(\n  rule: AuthRule,\n  ip: string,\n  authorization: string | undefined,\n  config: AuthConfig,\n): AuthResult {\n  // Rule-specific IP whitelist\n  if (rule.allowedIps) {\n    for (const pattern of rule.allowedIps) {\n      if (matchIp(ip, pattern)) {\n        return { allowed: true, reason: \"rule\" };\n      }\n    }\n  }\n\n  switch (rule.policy) {\n    case \"allow\":\n      return { allowed: true, reason: \"rule\" };\n\n    case \"deny\":\n      return { allowed: false, reason: \"rule\" };\n\n    case \"token\": {\n      if (!authorization) return { allowed: false, reason: \"rule\" };\n      const token = parseBearerToken(authorization);\n      const tokens = rule.tokens ?? config.tokens;\n      if (token && tokens.includes(token)) {\n        return { allowed: true, reason: \"token\" };\n      }\n      return { allowed: false, reason: \"rule\" };\n    }\n\n    case \"basic\": {\n      if (!authorization) return { allowed: false, reason: \"rule\" };\n      const creds = parseBasicAuth(authorization);\n      if (creds) {\n        const credString = `${creds.username}:${creds.password}`;\n        if (config.basicAuth.includes(credString)) {\n          return { allowed: true, reason: \"basic\" };\n        }\n      }\n      return { allowed: false, reason: \"rule\" };\n    }\n\n    default:\n      return { allowed: false, reason: \"rule\" };\n  }\n}\n\n/**\n * Apply default policy\n */\nfunction applyDefaultPolicy(\n  config: AuthConfig,\n  ip: string,\n  authorization: string | undefined,\n): AuthResult {\n  switch (config.defaultPolicy) {\n    case \"allow\":\n      return { allowed: true, reason: \"default\" };\n\n    case \"deny\":\n      return { allowed: false, reason: \"default\" };\n\n    case \"basic\": {\n      if (!authorization) return { allowed: false, reason: \"default\" };\n      const creds = parseBasicAuth(authorization);\n      if (creds) {\n        const credString = `${creds.username}:${creds.password}`;\n        if (config.basicAuth.includes(credString)) {\n          return { allowed: true, reason: \"basic\" };\n        }\n      }\n      // Also check tokens as fallback\n      const token = parseBearerToken(authorization);\n      if (token && config.tokens.includes(token)) {\n        return { allowed: true, reason: \"token\" };\n      }\n      return { allowed: false, reason: \"default\" };\n    }\n\n    case \"token\": {\n      if (!authorization) return { allowed: false, reason: \"default\" };\n      const token = parseBearerToken(authorization);\n      if (token && config.tokens.includes(token)) {\n        return { allowed: true, reason: \"token\" };\n      }\n      return { allowed: false, reason: \"default\" };\n    }\n\n    default:\n      return { allowed: false, reason: \"default\" };\n  }\n}\n","import { readFileSync, existsSync, watch } from \"node:fs\";\nimport { execSync, execFile } from \"node:child_process\";\nimport type { DdevProject } from \"../types.js\";\n\n/** Strip a single pair of surrounding quotes. */\nfunction unquote(value: string): string {\n  if (\n    (value.startsWith('\"') && value.endsWith('\"')) ||\n    (value.startsWith(\"'\") && value.endsWith(\"'\"))\n  ) {\n    return value.slice(1, -1);\n  }\n\n  return value;\n}\n\n/** A project name at the start of a line, e.g. `my-project:` */\nconst PROJECT_LINE = /^(\\S[^:]*):\\s*$/;\n\n/** An indented `approot: /path` belonging to the project above it */\nconst APPROOT_LINE = /^\\s+approot:\\s*(.+?)\\s*$/;\n\n/**\n * Load projects from DDEV's project_list.yaml\n * Returns a map of project name -> app root path\n *\n * The file nests the path under the project name:\n *\n *   scalian:\n *       approot: /home/ddev/www/scalian\n *\n * Indentation therefore has to be read. A flat key/value pass produces one\n * entry per line instead: the project mapped to an empty string, plus a\n * phantom project called `approot`. Both did damage — the empty path meant\n * `loadProjectConfig` looked for `.ddev/config.trafic.yaml` relative to the\n * working directory and never found it, so per-project settings were silently\n * ignored, and the phantom entered the hostname index, where the TLS ask\n * endpoint would vouch for `approot.<tld>` and have a certificate issued for\n * a project that does not exist.\n */\nexport function loadProjectList(\n  projectListPath: string,\n): Map<string, string> {\n  if (!existsSync(projectListPath)) {\n    return new Map();\n  }\n\n  const projects = new Map<string, string>();\n  let current: string | undefined;\n\n  for (const line of readFileSync(projectListPath, \"utf-8\").split(\"\\n\")) {\n    if (!line.trim() || line.trimStart().startsWith(\"#\")) {\n      continue;\n    }\n\n    const project = PROJECT_LINE.exec(line);\n\n    if (project) {\n      current = unquote(project[1]!.trim());\n      // Recorded now so a project keeps its hostname even if DDEV writes no\n      // approot for it\n      projects.set(current, \"\");\n      continue;\n    }\n\n    const approot = APPROOT_LINE.exec(line);\n\n    if (approot && current) {\n      projects.set(current, unquote(approot[1]!));\n    }\n  }\n\n  return projects;\n}\n\n/**\n * Build a hostname -> project name index\n */\nexport function buildHostnameIndex(\n  projects: Map<string, string>,\n  tld: string,\n): Map<string, string> {\n  const index = new Map<string, string>();\n\n  for (const [name] of projects) {\n    // Primary hostname: project-name.tld\n    index.set(`${name}.${tld}`, name);\n  }\n\n  return index;\n}\n\n/**\n * Get project name from hostname\n */\nexport function getProjectFromHostname(\n  hostname: string,\n  index: Map<string, string>,\n): string | undefined {\n  return index.get(hostname);\n}\n\n/**\n * Watch project_list.yaml for changes\n */\nexport function watchProjectList(\n  projectListPath: string,\n  onChange: () => void,\n): void {\n  if (!existsSync(projectListPath)) {\n    console.warn(`Project list not found: ${projectListPath}`);\n    return;\n  }\n\n  watch(projectListPath, (eventType) => {\n    if (eventType === \"change\") {\n      onChange();\n    }\n  });\n}\n\n/**\n * Run a ddev command without blocking the event loop.\n *\n * The agent is single-threaded and serves forward auth for every project, so\n * an `execSync` here stops the whole server for the duration of the command.\n * `ddev start` takes over a minute, which froze auth for every unrelated\n * project and produced request timeouts on a live server. Nothing about\n * \"background\" work with setTimeout helps: the timer callback still runs on\n * the same thread.\n */\nexport interface DdevResult {\n  ok: boolean;\n  stdout: string;\n}\n\n/**\n * Runs a ddev command. Injected so tests drive the outcome directly instead\n * of replacing node:child_process for the whole module.\n */\nexport type DdevRunner = (\n  args: string[],\n  timeoutMs: number,\n) => Promise<DdevResult>;\n\n/** The real runner, used unless a caller passes its own. */\nexport const nodeDdevRunner: DdevRunner = (args, timeoutMs) =>\n  new Promise((resolve) => {\n    execFile(\n      \"ddev\",\n      args,\n      { encoding: \"utf-8\", timeout: timeoutMs },\n      (error, stdout) => {\n        if (error) {\n          console.error(`ddev ${args.join(\" \")} failed:`, error.message);\n          resolve({ ok: false, stdout: stdout ?? \"\" });\n          return;\n        }\n\n        resolve({ ok: true, stdout: stdout ?? \"\" });\n      },\n    );\n  });\n\n/**\n * Get detailed project info using ddev describe\n */\nexport async function getProjectInfo(\n  name: string,\n  run: DdevRunner = nodeDdevRunner,\n): Promise<DdevProject | undefined> {\n  const { ok, stdout } = await run([\"describe\", name, \"-j\"], 10000);\n\n  if (!ok) {\n    return undefined;\n  }\n\n  try {\n    const data = JSON.parse(stdout);\n\n    if (!data.raw) return undefined;\n\n    const raw = data.raw;\n    return {\n      name: raw.name,\n      status: raw.status,\n      appRoot: raw.approot,\n      httpURLs: raw.httpURLs ?? [],\n      httpsURLs: raw.httpsURLs ?? [],\n      type: raw.type,\n      phpVersion: raw.php_version,\n      dbType: raw.dbinfo?.dbType,\n    };\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Start a DDEV project.\n *\n * Resolves when the project is up. Callers in the request path must not await\n * it — respond first, then let this settle and record the outcome.\n */\nexport async function startProject(\n  name: string,\n  run: DdevRunner = nodeDdevRunner,\n): Promise<boolean> {\n  const { ok } = await run([\"start\", name], 120000);\n  return ok;\n}\n\n/**\n * Stop a DDEV project\n */\nexport async function stopProject(\n  name: string,\n  run: DdevRunner = nodeDdevRunner,\n): Promise<boolean> {\n  const { ok } = await run([\"stop\", name], 60000);\n  return ok;\n}\n\n/**\n * List all DDEV projects with their status\n */\nexport function listProjects(): DdevProject[] {\n  try {\n    const output = execSync(\"ddev list -j\", {\n      encoding: \"utf-8\",\n      timeout: 30000,\n    });\n    const data = JSON.parse(output);\n\n    if (!Array.isArray(data)) return [];\n\n    return data.map((p: Record<string, unknown>) => ({\n      name: p.name as string,\n      status: p.status as DdevProject[\"status\"],\n      appRoot: p.approot as string,\n      httpURLs: (p.httpURLs as string[]) ?? [],\n      httpsURLs: (p.httpsURLs as string[]) ?? [],\n      type: p.type as string,\n    }));\n  } catch {\n    return [];\n  }\n}\n","import { execSync } from \"node:child_process\";\nimport { writeFileSync as fsWriteFile } from \"node:fs\";\n\nlet stepNumber = 0;\nlet dryRun = false;\n\n/**\n * Set dry-run mode\n */\nexport function setDryRun(value: boolean): void {\n  dryRun = value;\n}\n\n/**\n * Reset step counter\n */\nexport function resetSteps(): void {\n  stepNumber = 0;\n}\n\n/**\n * Log a step\n */\nexport function step(message: string): void {\n  stepNumber++;\n  console.log(`\\n\\x1b[36m[${stepNumber}]\\x1b[0m ${message}`);\n}\n\n/**\n * Log success\n */\nexport function success(message: string): void {\n  console.log(`    \\x1b[32m✓\\x1b[0m ${message}`);\n}\n\n/**\n * Log warning\n */\nexport function warn(message: string): void {\n  console.log(`    \\x1b[33m⚠\\x1b[0m ${message}`);\n}\n\n/**\n * Log error\n */\nexport function error(message: string): void {\n  console.log(`    \\x1b[31m✗\\x1b[0m ${message}`);\n}\n\n/**\n * Log info\n */\nexport function info(message: string): void {\n  console.log(`    ${message}`);\n}\n\n/**\n * Execute a command (or show in dry-run mode)\n */\nexport function exec(command: string, options?: { silent?: boolean }): string {\n  if (dryRun) {\n    if (!options?.silent) {\n      console.log(`    \\x1b[90m$ ${command}\\x1b[0m`);\n    }\n    return \"\";\n  }\n\n  try {\n    return execSync(command, {\n      encoding: \"utf-8\",\n      stdio: options?.silent ? \"pipe\" : \"inherit\",\n    });\n  } catch (err) {\n    const e = err as { status?: number; stderr?: string };\n    throw new Error(`Command failed: ${command}\\n${e.stderr ?? \"\"}`);\n  }\n}\n\n/**\n * Execute a command and return output (silent)\n */\nexport function execSilent(command: string): string {\n  if (dryRun) {\n    return \"\";\n  }\n\n  try {\n    return execSync(command, {\n      encoding: \"utf-8\",\n      stdio: \"pipe\",\n    }).trim();\n  } catch {\n    return \"\";\n  }\n}\n\n/**\n * Check if a command exists\n */\nexport function commandExists(command: string): boolean {\n  try {\n    execSync(`which ${command}`, { stdio: \"pipe\" });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if running as root\n */\nexport function isRoot(): boolean {\n  return process.getuid?.() === 0;\n}\n\n/**\n * Write a file (or show in dry-run mode)\n */\nexport function writeFile(path: string, content: string): void {\n  if (dryRun) {\n    console.log(`    \\x1b[90mWrite ${path}:\\x1b[0m`);\n    const lines = content.split(\"\\n\").slice(0, 5);\n    for (const line of lines) {\n      console.log(`    \\x1b[90m  ${line}\\x1b[0m`);\n    }\n    if (content.split(\"\\n\").length > 5) {\n      console.log(`    \\x1b[90m  ...\\x1b[0m`);\n    }\n    return;\n  }\n\n  fsWriteFile(path, content);\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { commandExists, exec, execSilent, writeFile } from \"./steps.js\";\n\n/**\n * The effectful operations the setup steps need.\n *\n * Injected into every setup function so tests can drive them with plain\n * fakes — no module mocking — and so dry-run has one place to intercept\n * writes instead of each module reaching for `node:fs` itself.\n */\nexport interface SetupIo {\n  /** Run a shell command. Throws when it exits non-zero. */\n  exec(command: string, options?: { silent?: boolean }): string;\n  /**\n   * Run a probe. Returns trimmed stdout, or \"\" when the command fails.\n   *\n   * Use this wherever a non-zero exit is an answer rather than an error —\n   * `id -u ddev` on a server without that user, for instance.\n   */\n  execSilent(command: string): string;\n  /** Whether a command is on the PATH. */\n  commandExists(command: string): boolean;\n  /** Write a file. Honours dry-run. */\n  writeFile(path: string, content: string): void;\n  /** Whether a path exists. */\n  fileExists(path: string): boolean;\n  /** Read a UTF-8 file. */\n  readFile(path: string): string;\n  /** Process environment, for values like SUDO_USER. */\n  env: Record<string, string | undefined>;\n}\n\n/**\n * The real implementation, used when no io is injected.\n *\n * `writeFile` comes from steps.js rather than `node:fs` so writes are\n * skipped in dry-run mode. Reads stay direct: they change nothing.\n */\nexport const nodeIo: SetupIo = {\n  exec,\n  execSilent,\n  commandExists,\n  writeFile,\n  fileExists: existsSync,\n  readFile: (path) => readFileSync(path, \"utf-8\"),\n  env: process.env,\n};\n","import { DatabaseSync } from \"node:sqlite\";\nimport type { ProjectRecord, AccessLog } from \"../types.js\";\n\n/**\n * Reads the current time in epoch milliseconds.\n *\n * Injected so a test can place a project's last access at a chosen moment\n * without freezing the clock for everything else in the process.\n */\nexport type Clock = () => number;\n\n/** The real clock, used unless a caller passes its own. */\nexport const systemClock: Clock = () => Date.now();\n\nlet db: DatabaseSync | null = null;\n\n/**\n * Initialize the database connection and schema\n */\nexport function initDb(dbPath: string): DatabaseSync {\n  db = new DatabaseSync(dbPath);\n  db.exec(\"PRAGMA journal_mode=WAL\");\n\n  // Create tables\n  db.exec(`\n    CREATE TABLE IF NOT EXISTS projects (\n      name TEXT PRIMARY KEY,\n      last_access INTEGER NOT NULL,\n      status TEXT NOT NULL DEFAULT 'stopped'\n    );\n\n    CREATE TABLE IF NOT EXISTS access_logs (\n      id INTEGER PRIMARY KEY AUTOINCREMENT,\n      project TEXT NOT NULL,\n      timestamp INTEGER NOT NULL,\n      ip TEXT NOT NULL,\n      user_agent TEXT NOT NULL,\n      path TEXT NOT NULL\n    );\n\n    CREATE INDEX IF NOT EXISTS idx_access_logs_project ON access_logs(project);\n    CREATE INDEX IF NOT EXISTS idx_access_logs_timestamp ON access_logs(timestamp);\n  `);\n\n  return db;\n}\n\n/**\n * Get the database instance\n */\nexport function getDb(): DatabaseSync {\n  if (!db) {\n    throw new Error(\"Database not initialized. Call initDb first.\");\n  }\n  return db;\n}\n\n/**\n * Close the database connection\n */\nexport function closeDb(): void {\n  if (db) {\n    db.close();\n    db = null;\n  }\n}\n\n/**\n * Update project last access time\n */\nexport function updateProjectAccess(name: string, now: Clock = systemClock): void {\n  const database = getDb();\n  const stmt = database.prepare(`\n    INSERT INTO projects (name, last_access, status)\n    VALUES (?, ?, 'running')\n    ON CONFLICT(name) DO UPDATE SET last_access = excluded.last_access\n  `);\n  stmt.run(name, now());\n}\n\n/**\n * Get project record\n */\nexport function getProject(name: string): ProjectRecord | undefined {\n  const database = getDb();\n  const stmt = database.prepare(\n    \"SELECT name, last_access as lastAccess, status FROM projects WHERE name = ?\",\n  );\n  return stmt.get(name) as unknown as ProjectRecord | undefined;\n}\n\n/**\n * Set project status\n */\nexport function setProjectStatus(\n  name: string,\n  status: ProjectRecord[\"status\"],\n  now: Clock = systemClock,\n): void {\n  const database = getDb();\n  const stmt = database.prepare(`\n    INSERT INTO projects (name, last_access, status)\n    VALUES (?, ?, ?)\n    ON CONFLICT(name) DO UPDATE SET status = excluded.status\n  `);\n  stmt.run(name, now(), status);\n}\n\n/**\n * Get idle projects (last access older than threshold)\n */\nexport function getIdleProjects(\n  thresholdMs: number,\n  now: Clock = systemClock,\n): ProjectRecord[] {\n  const database = getDb();\n  const cutoff = now() - thresholdMs;\n  const stmt = database.prepare(`\n    SELECT name, last_access as lastAccess, status\n    FROM projects\n    WHERE last_access < ? AND status = 'running'\n  `);\n  return stmt.all(cutoff) as unknown as ProjectRecord[];\n}\n\n/**\n * Log an access\n */\nexport function logAccess(log: Omit<AccessLog, \"id\">): void {\n  const database = getDb();\n  const stmt = database.prepare(`\n    INSERT INTO access_logs (project, timestamp, ip, user_agent, path)\n    VALUES (?, ?, ?, ?, ?)\n  `);\n  stmt.run(log.project, log.timestamp, log.ip, log.userAgent, log.path);\n}\n\n/**\n * Get recent access logs for a project\n */\nexport function getAccessLogs(project: string, limit = 100): AccessLog[] {\n  const database = getDb();\n  const stmt = database.prepare(`\n    SELECT id, project, timestamp, ip, user_agent as userAgent, path\n    FROM access_logs\n    WHERE project = ?\n    ORDER BY timestamp DESC\n    LIMIT ?\n  `);\n  return stmt.all(project, limit) as unknown as AccessLog[];\n}\n\n/**\n * Clean old access logs (older than given days)\n */\nexport function cleanOldLogs(days: number, now: Clock = systemClock): number {\n  const database = getDb();\n  const cutoff = now() - days * 24 * 60 * 60 * 1000;\n  const stmt = database.prepare(\"DELETE FROM access_logs WHERE timestamp < ?\");\n  const result = stmt.run(cutoff);\n  return Number(result.changes);\n}\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\n/**\n * Per-project Trafic configuration\n * Read from .ddev/config.trafic.yaml\n */\nexport interface ProjectConfig {\n  /** Auth policy override: allow | deny | basic | token */\n  auth_policy?: \"allow\" | \"deny\" | \"basic\" | \"token\";\n  /** Idle timeout override: \"never\" or duration like \"30m\", \"4h\" */\n  idle_timeout?: string;\n}\n\n/**\n * Simple YAML parser for config.trafic.yaml\n * Only supports simple key: value pairs (no nesting, no arrays)\n */\nfunction parseSimpleYaml(content: string): Record<string, string> {\n  const result: Record<string, string> = {};\n  const lines = content.split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n\n    // Skip empty lines and comments\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const colonIndex = trimmed.indexOf(\":\");\n    if (colonIndex === -1) continue;\n\n    const key = trimmed.slice(0, colonIndex).trim();\n    let value = trimmed.slice(colonIndex + 1).trim();\n\n    // Remove quotes if present\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    result[key] = value;\n  }\n\n  return result;\n}\n\n/**\n * Load project-specific Trafic config from .ddev/config.trafic.yaml\n */\nexport function loadProjectConfig(projectDir: string): ProjectConfig {\n  const configPath = join(projectDir, \".ddev\", \"config.trafic.yaml\");\n\n  if (!existsSync(configPath)) {\n    return {};\n  }\n\n  try {\n    const content = readFileSync(configPath, \"utf-8\");\n    const parsed = parseSimpleYaml(content);\n\n    const config: ProjectConfig = {};\n\n    // Validate auth_policy\n    if (parsed.auth_policy) {\n      const policy = parsed.auth_policy.toLowerCase();\n      if ([\"allow\", \"deny\", \"basic\", \"token\"].includes(policy)) {\n        config.auth_policy = policy as ProjectConfig[\"auth_policy\"];\n      }\n    }\n\n    // Validate idle_timeout\n    if (parsed.idle_timeout) {\n      config.idle_timeout = parsed.idle_timeout;\n    }\n\n    return config;\n  } catch (error) {\n    console.warn(`Failed to load project config from ${configPath}:`, error);\n    return {};\n  }\n}\n\n/**\n * Check if a project should never be stopped (idle_timeout = \"never\")\n */\nexport function shouldNeverStop(config: ProjectConfig): boolean {\n  return config.idle_timeout?.toLowerCase() === \"never\";\n}\n\n/**\n * Get idle timeout in milliseconds, or undefined to use global default\n */\nexport function getIdleTimeoutMs(config: ProjectConfig): number | undefined {\n  if (!config.idle_timeout) return undefined;\n  if (shouldNeverStop(config)) return undefined;\n\n  // Parse duration string (e.g., \"30m\", \"4h\", \"2h30m\")\n  const regex = /(?:(\\d+)h)?(?:(\\d+)m)?(?:(\\d+)s)?/;\n  const match = config.idle_timeout.match(regex);\n  if (!match) return undefined;\n\n  const hours = parseInt(match[1] ?? \"0\", 10);\n  const minutes = parseInt(match[2] ?? \"0\", 10);\n  const seconds = parseInt(match[3] ?? \"0\", 10);\n\n  const ms = (hours * 3600 + minutes * 60 + seconds) * 1000;\n  return ms > 0 ? ms : undefined;\n}\n","import { nodeIo, type SetupIo } from \"./io.js\";\nimport { step, success, info } from \"./steps.js\";\nimport { loadConfig } from \"../utils/config.js\";\nimport type { TlsConfig } from \"../types.js\";\n\n/**\n * Install system dependencies required by Trafic\n */\nexport function installSystemDeps(io: SetupIo = nodeIo): void {\n  step(\"Install system dependencies\");\n\n  io.exec(\"apt-get update -qq\", { silent: true });\n  // gnupg and ca-certificates are needed to add the DDEV and NodeSource\n  // apt repositories — a minimal Ubuntu image ships with neither\n  io.exec(\n    \"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y jq curl rsync gnupg ca-certificates\",\n    { silent: true },\n  );\n\n  success(\"System dependencies installed: jq, curl, rsync, gnupg, ca-certificates\");\n}\n\n/** Where the DDEV signing key is installed. */\nexport const DDEV_KEYRING = \"/etc/apt/keyrings/ddev.asc\";\n\n/** The deb822 source file naming the DDEV repository. */\nexport const DDEV_SOURCES = \"/etc/apt/sources.list.d/ddev.sources\";\n\n/**\n * Add the official DDEV apt repository and signing key.\n *\n * The repository is the Cloudsmith one DDEV 1.25.4 moved to\n * (ddev/ddev#8698). The former Gemfury host, `pkg.ddev.com`, still serves\n * packages and carries no retirement date, but DDEV now tells Linux users to\n * switch, so this follows the documented install.\n *\n * Two differences from the copy/paste block in DDEV's docs, both deliberate:\n * the key is written by curl rather than piped into `tee`, so a failed\n * download exits non-zero here instead of surfacing as a confusing GPG error\n * on the next `apt-get update` (the same reasoning as the NodeSource key);\n * and the docs' `sudo` is dropped because setup already runs as root.\n *\n * The key is served armoured and stays that way — `.asc` rather than a\n * dearmoured `.gpg` — which is what `Signed-By` in the source file names.\n *\n * Idempotent: safe to call even if the repository is already configured.\n */\nexport function addDdevAptRepo(io: SetupIo = nodeIo): void {\n  io.exec(\"install -m 0755 -d /etc/apt/keyrings\", { silent: true });\n  io.exec(`curl -fsSL https://packages.ddev.com/public/gpg.key -o ${DDEV_KEYRING}`, {\n    silent: true,\n  });\n  io.exec(`chmod a+r ${DDEV_KEYRING}`, { silent: true });\n  io.exec(\n    `printf \"Types: deb\\\\nURIs: https://packages.ddev.com/public/deb/ubuntu\\\\nSuites: stable\\\\nComponents: main\\\\nSigned-By: ${DDEV_KEYRING}\\\\n\" | tee ${DDEV_SOURCES} > /dev/null`,\n    { silent: true },\n  );\n}\n\n/**\n * Install DDEV\n */\nexport function installDdev(io: SetupIo = nodeIo): void {\n  step(\"Install DDEV\");\n\n  if (io.commandExists(\"ddev\")) {\n    const version = io.exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n    info(`DDEV already installed: ${version?.trim() ?? \"unknown version\"}`);\n    return;\n  }\n\n  // Install DDEV via the official apt repository\n  // See https://docs.ddev.com/en/stable/users/install/ddev-installation/#debianubuntu\n  info(\"Adding DDEV apt repository...\");\n  addDdevAptRepo(io);\n\n  info(\"Installing DDEV...\");\n  io.exec(\"apt-get update -qq\", { silent: true });\n  io.exec(\"DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a apt-get install -y ddev\", { silent: true });\n\n  // Initialize mkcert certificate authority for the ddev user.\n  // mkcert installs the CA into the home directory of the current user.\n  // Since setup runs as root, we must point HOME to the ddev user's home\n  // so the CA is trusted by DDEV when it runs as that user.\n  io.exec(\"HOME=/home/ddev mkcert -install\", { silent: true });\n  io.exec(\"chown -R ddev:ddev /home/ddev/.local/share/mkcert\", { silent: true });\n\n  const version = io.exec(\"ddev --version 2>/dev/null | head -1\", { silent: true });\n  success(`DDEV installed: ${version?.trim() ?? \"unknown version\"}`);\n}\n\n/** The Docker volume Traefik keeps its state in. */\nconst GLOBAL_CACHE_VOLUME = \"ddev-global-cache\";\n\n/**\n * Delete Traefik's ACME storage.\n *\n * Turning `use_letsencrypt` off stops DDEV asking for new certificates, but\n * it does not discard the ones already issued: Traefik keeps them in\n * acme.json inside the ddev-global-cache volume and serves them again after a\n * restart. On a server where a host ingress terminates TLS and verifies the\n * hop against the mkcert root, that resurrected certificate fails validation\n * and every request answers 502 — seen on a live server.\n *\n * The volume's mountpoint is resolved rather than reached through a\n * container, so this works whether or not ddev-router is running and needs no\n * extra image. Setup and migrations already run as root, which is what\n * reading a Docker volume from the host needs.\n *\n * Returns true when something was removed.\n */\nexport function purgeTraefikAcmeStorage(io: SetupIo = nodeIo): boolean {\n  const mountpoint = io\n    .execSilent(`docker volume inspect ${GLOBAL_CACHE_VOLUME} --format '{{.Mountpoint}}'`)\n    .trim();\n\n  if (!mountpoint) {\n    // No volume yet — a fresh server has nothing to purge\n    return false;\n  }\n\n  const acmeDir = `${mountpoint}/traefik`;\n\n  // acme.json.* covers the copies a hand-fix or an upgrade may have left\n  const found = io.execSilent(`ls ${acmeDir}/acme.json ${acmeDir}/acme.json.* 2>/dev/null`).trim();\n\n  if (!found) {\n    return false;\n  }\n\n  io.exec(`rm -f ${acmeDir}/acme.json ${acmeDir}/acme.json.*`, { silent: true });\n  return true;\n}\n\n/**\n * Configure DDEV global settings for production\n *\n * Note on DNS and /etc/hosts:\n * When using a custom TLD (not ddev.site), DDEV may try to edit /etc/hosts\n * if it can't resolve project hostnames via DNS. To avoid this:\n * 1. Configure DNS so *.{tld} resolves to the server's IP (recommended)\n * 2. Or install dnsmasq for local wildcard DNS resolution\n *\n * With proper DNS, DDEV won't need sudo for hostname management.\n */\nexport function configureDdev(\n  tld: string,\n  email?: string,\n  io: SetupIo = nodeIo,\n): void {\n  step(\"Configure DDEV\");\n\n  // Run as ddev user\n  const ddevCmd = (cmd: string) => `su - ddev -c '${cmd}'`;\n\n  // Configure all global settings in a single call\n  io.exec(\n    ddevCmd(\n      `ddev config global --project-tld=${tld} --router-http-port=80 --router-https-port=443 --router-bind-all-interfaces=true --use-letsencrypt=${email ? \"true\" : \"false\"} ${email ? `--letsencrypt-email=${email}` : \"\"} --instrumentation-opt-in=false`,\n    ),\n    { silent: true },\n  );\n\n  success(`DDEV configured with TLD: ${tld}`);\n  info(`Ensure DNS is configured: *.${tld} → server IP`);\n\n  if (email) {\n    success(`Let's Encrypt enabled with email: ${email}`);\n  } else if (purgeTraefikAcmeStorage(io)) {\n    // Otherwise a certificate issued before it was turned off comes back on\n    // the next router restart, and a proxy verifying against mkcert rejects it\n    success(\"Removed Traefik's Let's Encrypt storage\");\n  }\n\n  success(\"DDEV global settings configured\");\n}\n\n/**\n * Install dnsmasq for local DNS resolution (optional)\n * This allows the server itself to resolve *.{tld} hostnames\n * without needing to edit /etc/hosts for each project\n */\nexport function installDnsmasq(tld: string, io: SetupIo = nodeIo): void {\n  step(\"Install dnsmasq for local DNS\");\n\n  io.exec(\"apt-get update && apt-get install -y dnsmasq\", { silent: true });\n\n  // Get server's public IP\n  const serverIp = io.exec(\n    \"curl -4 -s ifconfig.me || hostname -I | awk '{print $1}'\",\n    { silent: true },\n  )?.trim() || \"127.0.0.1\";\n\n  // Configure dnsmasq to resolve *.{tld} to server IP\n  const dnsmasqConfig = `# Trafic: Local DNS for DDEV projects\n# Resolve all *.${tld} to this server\naddress=/${tld}/${serverIp}\n\n# Don't read /etc/resolv.conf\nno-resolv\n\n# Use upstream DNS for everything else\nserver=1.1.1.1\nserver=8.8.8.8\n\n# Listen on localhost only\nlisten-address=127.0.0.1\nbind-interfaces\n`;\n\n  io.writeFile(\"/etc/dnsmasq.d/trafic.conf\", dnsmasqConfig);\n\n  // Configure system to use local dnsmasq\n  io.exec(\"systemctl restart dnsmasq\");\n  io.exec(\"systemctl enable dnsmasq\");\n\n  // Update resolv.conf to use local DNS first\n  info(\"Configure /etc/resolv.conf to use 127.0.0.1 as primary DNS\");\n\n  success(`dnsmasq configured: *.${tld} → ${serverIp}`);\n}\n\n/**\n * Get the Docker gateway IP reachable from inside DDEV containers on Linux.\n * DDEV runs containers on the `ddev_default` network — we inspect that first.\n * Falls back to the default `bridge` network, then to 172.17.0.1.\n * `host.docker.internal` is not available on Linux without extra configuration.\n */\nexport function getDockerGatewayIp(io: SetupIo = nodeIo): string {\n  // Prefer the ddev_default network gateway — that's the network ddev-router is on\n  const ddevIp = io.execSilent(\n    \"docker network inspect ddev_default --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}'\",\n  );\n  if (ddevIp) return ddevIp;\n\n  // Fall back to the default bridge network\n  const bridgeIp = io.execSilent(\n    \"docker network inspect bridge --format '{{range .IPAM.Config}}{{.Gateway}}{{end}}'\",\n  );\n  return bridgeIp || \"172.17.0.1\";\n}\n\n/** DDEV tool ports, used when the global config does not say otherwise */\nconst DEFAULT_TOOL_PORTS = {\n  \"mailpit-http-port\": \"8025\",\n  \"mailpit-https-port\": \"8026\",\n  \"xhgui-http-port\": \"8143\",\n  \"xhgui-https-port\": \"8142\",\n} as const;\n\n/**\n * Read the ports DDEV publishes its tools on.\n *\n * ddev-router publishes these on 0.0.0.0, and Docker bypasses UFW for\n * published ports, so a firewall rule cannot protect them — the forward auth\n * middleware is the only thing that can. Read them rather than hardcode: they\n * are configurable, and an entry point Traefik does not know about is ignored.\n */\nexport function readToolPorts(io: SetupIo = nodeIo): string[] {\n  const output = io.execSilent(\"su - ddev -c 'ddev config global'\");\n  const ports: string[] = [];\n\n  for (const [key, fallback] of Object.entries(DEFAULT_TOOL_PORTS)) {\n    const match = new RegExp(`^${key}=(\\\\d+)$`, \"m\").exec(output);\n    ports.push(match?.[1] ?? fallback);\n  }\n\n  return [...new Set(ports)];\n}\n\n/** The ports ddev-router serves projects on. */\nexport interface RouterPorts {\n  http: string;\n  https: string;\n}\n\n/** Used when the global config does not say otherwise */\nconst DEFAULT_ROUTER_PORTS: RouterPorts = { http: \"80\", https: \"443\" };\n\n/**\n * Read the ports ddev-router serves projects on.\n *\n * Traefik names an entry point after its port, so these decide what the\n * catch-all routers and the auth middleware must attach to. Hardcoding 80 and\n * 443 is wrong on any server where the router was moved — which is every\n * server running a host ingress in front of it.\n */\nexport function readRouterPorts(io: SetupIo = nodeIo): RouterPorts {\n  const output = io.execSilent(\"su - ddev -c 'ddev config global'\");\n\n  const read = (key: string, fallback: string): string =>\n    new RegExp(`^${key}=(\\\\d+)$`, \"m\").exec(output)?.[1] ?? fallback;\n\n  return {\n    http: read(\"router-http-port\", DEFAULT_ROUTER_PORTS.http),\n    https: read(\"router-https-port\", DEFAULT_ROUTER_PORTS.https),\n  };\n}\n\n/** Where the agent writes the Traefik files it owns. */\nexport const TRAEFIK_DIR = \"/home/ddev/.ddev/traefik\";\n\n/** Static config the agent owns, merged by DDEV into .static_config.yaml. */\nexport const STATIC_CONFIG = `${TRAEFIK_DIR}/static_config.trafic.yaml`;\n\n/** Wildcard TLS store, read before DDEV's own default_config.yaml. */\nexport const TLS_STORE_CONFIG = `${TRAEFIK_DIR}/custom-global-config/0-trafic-tls.yaml`;\n\n/** Router compose override carrying the DNS provider credentials. */\nexport const ROUTER_COMPOSE_OVERRIDE = \"/home/ddev/.ddev/router-compose.trafic.yaml\";\n\n/** Name of the DNS-01 resolver the agent adds to Traefik. */\nexport const DNS_RESOLVER = \"acme-dns\";\n\n/** What buildStaticConfig needs to emit the DNS-01 resolver. */\nexport interface TlsResolverOptions {\n  /** lego provider name, e.g. \"cloudflare\" */\n  provider: string;\n  /** Account email — Let's Encrypt refuses a registration without one */\n  email: string;\n  /** ACME CA directory URL; the provider default is used when omitted */\n  caServer?: string;\n}\n\n/**\n * Build the static config attaching forward auth to every entry point.\n *\n * The error page middleware stays on the web entry points only: a 502 from a\n * stopped project should show the waiting page, while a tool port has nothing\n * to wait for.\n *\n * With `tls`, a DNS-01 certificate resolver is added. It is only ever used by\n * the default TLS store (see buildTlsStoreConfig): DDEV keeps writing\n * `certResolver: acme-tlsChallenge` on every project router, and Traefik\n * skips those requests once the default store holds a certificate matching\n * the host with wildcard semantics.\n *\n * The propagation check is disabled on purpose. lego sets two TXT values at\n * the same name, one for `<tld>` and one for `*.<tld>`, then asks public\n * resolvers for each. A resolver that answered between the two writes caches\n * the partial answer for the record TTL — 120s on Cloudflare, longer than\n * lego's check window — and the order fails with \"NS 9.9.9.9:53 did not\n * return the expected TXT record\" although both records were correct. That\n * was seen on a live server; the staging run had passed by timing luck.\n * Let's Encrypt resolves authoritatively itself, so the check adds a failure\n * mode without adding safety. `PropagationWait(delay, skipCheck)` sleeps the\n * delay and then skips the check, so the 30s covers propagation to the\n * provider's edges before the CA looks.\n */\nexport function buildStaticConfig(\n  toolPorts: string[],\n  routerPorts: RouterPorts = DEFAULT_ROUTER_PORTS,\n  tls?: TlsResolverOptions,\n): string {\n  const webEntryPoint = (name: string) => `  ${name}:\n    http:\n      middlewares:\n        - trafic-auth@file\n        - trafic-errors@file\n`;\n\n  const toolEntryPoint = (port: string) => `  http-${port}:\n    http:\n      middlewares:\n        - trafic-auth@file\n`;\n\n  // A tool port that happens to equal a router port must not be emitted\n  // twice: a duplicate key makes the whole static config invalid\n  const web = [routerPorts.http, routerPorts.https];\n  const tools = toolPorts.filter((port) => !web.includes(port));\n\n  const entryPoints = `entryPoints:\n${web.map((port) => webEntryPoint(`http-${port}`)).join(\"\")}${tools.map(toolEntryPoint).join(\"\")}`;\n\n  if (!tls) {\n    return entryPoints;\n  }\n\n  return `${entryPoints}\ncertificatesResolvers:\n  ${DNS_RESOLVER}:\n    acme:\n      email: \"${escapeYamlDouble(tls.email)}\"\n      storage: /mnt/ddev-global-cache/traefik/${DNS_RESOLVER}.json\n${tls.caServer ? `      caServer: \"${escapeYamlDouble(tls.caServer)}\"\\n` : \"\"}      dnsChallenge:\n        provider: \"${escapeYamlDouble(tls.provider)}\"\n        propagation:\n          delayBeforeChecks: 30s\n          disableChecks: true\n`;\n}\n\n/**\n * Build the default TLS store holding the wildcard certificate.\n *\n * Traefik's file provider keeps the first `tls.stores.default` it reads in\n * directory order and logs \"TLS store default already configured, skipping\"\n * for every later file. DDEV writes an empty one in `default_config.yaml`,\n * so this has to be read first — hence the `0-` prefix on the file name.\n */\nexport function buildTlsStoreConfig(tld: string): string {\n  return `# Trafic: wildcard certificate served to every host without its own\n#\n# Read before DDEV's default_config.yaml — Traefik keeps the first default\n# store it sees, so the file name has to sort first.\ntls:\n  stores:\n    default:\n      defaultGeneratedCert:\n        resolver: ${DNS_RESOLVER}\n        domain:\n          main: \"${escapeYamlDouble(tld)}\"\n          sans:\n            - \"*.${escapeYamlDouble(tld)}\"\n`;\n}\n\n/**\n * Build the router compose override carrying the provider credentials.\n *\n * lego reads them from the router container's environment, so they cannot be\n * passed through a config file. DDEV merges `~/.ddev/router-compose.*.yaml`\n * into the router compose and recreates the container when it changes, on the\n * next `ddev start`.\n */\nexport function buildRouterComposeOverride(env: Record<string, string>): string {\n  const entries = Object.entries(env);\n\n  return `# Trafic: DNS-01 provider credentials for the Traefik router\n# Contains secrets — this file is mode 600.\nservices:\n  ddev-router:\n    environment:\n${entries.map(([key, value]) => `      - \"${key}=${escapeYamlDouble(value)}\"`).join(\"\\n\")}\n`;\n}\n\n/** Escape a value for a double-quoted YAML scalar. */\nfunction escapeYamlDouble(value: string): string {\n  return value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n\n/**\n * Build the dynamic config: the middlewares, the agent service, and the\n * catch-all routers that hand a stopped project to the waiting page.\n *\n * One catch-all per web entry point, each naming the entry point it serves.\n * A router that names none is instantiated by Traefik on *every* entry point,\n * and DDEV's router health check compares the number of router definitions in\n * its config files against the number Traefik reports. Two unpinned\n * definitions became fourteen instances on a server with six tool entry\n * points, so the counts never matched, the health check waited out its\n * timeout, and every `ddev start` failed after 60 seconds.\n */\nexport function buildDynamicConfig(\n  gatewayIp: string,\n  routerPorts: RouterPorts = DEFAULT_ROUTER_PORTS,\n): string {\n  return `# Trafic: Forward auth middleware definition\nhttp:\n  middlewares:\n    trafic-auth:\n      forwardAuth:\n        address: \"http://${gatewayIp}:9876/__auth__\"\n        authResponseHeaders:\n          - \"X-Trafic-Project\"\n\n    trafic-errors:\n      errors:\n        status:\n          - \"502\"\n          - \"503\"\n        service: trafic-service\n        query: \"/\"\n\n  routers:\n    # The lowest priority above DDEV's own fallback routers, which sit at\n    # priority 1 since DDEV 1.25.4, and still far below any project router —\n    # so a DDEV project router always wins. These only match when none does —\n    # which is what a stopped project produces, because DDEV removes that\n    # project's router and Traefik would otherwise answer 404. Without them\n    # the waiting page never appears and scale-to-zero never restarts\n    # anything. Auth is unaffected: it is attached at the entry point, not\n    # here, so this cannot reintroduce the bypass that #27 fixed.\n    #\n    # Priority 1 is not enough any more: DDEV 1.25.4 ships\n    # ddev-router-fallback-http and ddev-router-fallback-https with the same\n    # PathPrefix(\\`/\\`) rule at priority 1, pointing at a 404 responder. With\n    # equal priority and identical rules Traefik picked DDEV's, so a stopped\n    # project answered DDEV's 404 page instead of the waiting page.\n    #\n    # Each names exactly one entry point. Leaving entryPoints out attaches a\n    # router to all of them, which breaks DDEV's router health check — it\n    # counts definitions and compares them to what Traefik loaded.\n    trafic-catchall:\n      rule: \"PathPrefix(\\`/\\`)\"\n      entryPoints:\n        - http-${routerPorts.http}\n      priority: 2\n      service: trafic-service\n\n    # Carries tls, so it only matches the https entry point. The plain one\n    # above cannot serve it, and one alone would leave HTTP answering 404.\n    trafic-catchall-tls:\n      rule: \"PathPrefix(\\`/\\`)\"\n      entryPoints:\n        - http-${routerPorts.https}\n      priority: 2\n      service: trafic-service\n      tls: {}\n\n  services:\n    trafic-service:\n      loadBalancer:\n        servers:\n          - url: \"http://${gatewayIp}:9876\"\n`;\n}\n\n/** What DDEV knows about Let's Encrypt, read from its global config. */\nexport interface LetsEncryptSettings {\n  enabled: boolean;\n  email?: string;\n}\n\n/**\n * Read DDEV's Let's Encrypt settings.\n *\n * DDEV owns them — `ddev config global --use-letsencrypt --letsencrypt-email`\n * — so they are the single source of truth for the ACME account, wildcard\n * mode included.\n */\nexport function readLetsEncryptSettings(io: SetupIo = nodeIo): LetsEncryptSettings {\n  const output = io.execSilent(\"su - ddev -c 'ddev config global'\");\n\n  return {\n    enabled: /^use-letsencrypt=true$/m.test(output),\n    email: /^letsencrypt-email=(.+)$/m.exec(output)?.[1]?.trim() || undefined,\n  };\n}\n\n/** Read the project TLD from DDEV's global config. */\nexport function readProjectTld(io: SetupIo = nodeIo): string {\n  const output = io.execSilent(\"su - ddev -c 'ddev config global'\");\n\n  return /^project-tld=(.+)$/m.exec(output)?.[1]?.trim() ?? \"\";\n}\n\n/** Options for configureTraefik. */\nexport interface ConfigureTraefikOptions {\n  /**\n   * TLS settings. Read from /etc/trafic/config.toml when omitted, which is\n   * what migrations do — setup passes them, since it writes that file later.\n   */\n  tls?: TlsConfig;\n  /** Project TLD. Read from DDEV's global config when omitted. */\n  tld?: string;\n}\n\n/**\n * Configure Traefik for forward auth, and for the wildcard certificate when\n * a DNS provider is configured.\n *\n * Everything the agent owns in Traefik's configuration is written here, so\n * setup and the migrations share one code path and cannot drift apart.\n */\nexport function configureTraefik(\n  options: ConfigureTraefikOptions = {},\n  io: SetupIo = nodeIo,\n): void {\n  step(\"Configure Traefik for forward auth\");\n\n  // Create custom Traefik config directories\n  io.exec(`mkdir -p ${TRAEFIK_DIR}/custom-global-config`, { silent: true });\n  io.exec(\"chown -R ddev:ddev /home/ddev/.ddev\", { silent: true });\n\n  // Use the Docker bridge gateway IP instead of host.docker.internal —\n  // the latter is not available on Linux without extra Docker configuration.\n  const gatewayIp = getDockerGatewayIp(io);\n\n  // Entry point names come from the ports, so both configs need them\n  const routerPorts = readRouterPorts(io);\n\n  // Dynamic configuration: the middlewares, the agent service and the\n  // catch-all routers. Written to custom-global-config/, which DDEV copies\n  // into the ddev-global-cache volume on project start. It used to be written\n  // to the traefik root as well, for DDEV versions that watched it — nothing\n  // reads that copy on 1.25, and having two made debugging harder.\n  const dynamicConfig = buildDynamicConfig(gatewayIp, routerPorts);\n\n  io.writeFile(`${TRAEFIK_DIR}/custom-global-config/trafic.yaml`, dynamicConfig);\n  io.exec(`chown ddev:ddev ${TRAEFIK_DIR}/custom-global-config/trafic.yaml`, { silent: true });\n\n  const tls = options.tls ?? loadConfig().tls;\n  const resolver = tls.dnsProvider\n    ? buildTlsResolverOptions(tls, io)\n    : undefined;\n\n  // Read and check the TLD before anything is written: a static config that\n  // names the resolver without the TLS store behind it is a broken pairing,\n  // and there is no reason to leave one on disk when the TLD is missing.\n  const tld = resolver ? readWildcardTld(options.tld, io) : \"\";\n\n  // Static configuration: attaches trafic-auth to every entry point DDEV\n  // publishes, and trafic-errors to the web ones, so every request goes\n  // through auth regardless of which project router handles it.\n  // DDEV merges all static_config.*.yaml files into .static_config.yaml on start.\n  const staticConfig = buildStaticConfig(readToolPorts(io), routerPorts, resolver);\n\n  io.writeFile(STATIC_CONFIG, staticConfig);\n  io.exec(`chown ddev:ddev ${STATIC_CONFIG}`, { silent: true });\n\n  info(`Entry points: http-${routerPorts.http}, http-${routerPorts.https} (web) plus tool ports`);\n\n  if (resolver) {\n    writeWildcardFiles(tls, tld, io);\n  } else {\n    removeWildcardFiles(io);\n  }\n\n  success(\"Traefik configured with Trafic middleware\");\n}\n\n/**\n * Names of the running DDEV projects.\n *\n * `ddev list -j` is the only source that knows: `project_list.yaml`, which the\n * agent watches for discovery, records every project DDEV has ever seen but\n * carries no live status — a project stopped an hour ago still sits there.\n * `ddev list -j` asks Docker, and wraps the entries in a `raw` array.\n */\nexport function findRunningProjects(io: SetupIo = nodeIo): string[] {\n  const output = io.execSilent(\"su - ddev -c 'ddev list -j'\");\n\n  if (!output) {\n    return [];\n  }\n\n  try {\n    const parsed = JSON.parse(output) as { raw?: { name?: string; status?: string }[] };\n    return (parsed.raw ?? [])\n      .filter((project) => project.status === \"running\" && project.name)\n      .map((project) => project.name as string);\n  } catch {\n    // A DDEV that answers something other than JSON is not worth guessing at\n    return [];\n  }\n}\n\n/**\n * Name of one running DDEV project, or null when none runs.\n *\n * Used to push a changed global Traefik config into the running router: DDEV\n * copies `custom-global-config/*.yaml` into it on any `ddev start`, so\n * starting a project that is already running is enough, and nothing that is\n * serving traffic has to be stopped.\n */\nexport function findRunningProject(io: SetupIo = nodeIo): string | null {\n  return findRunningProjects(io)[0] ?? null;\n}\n\n/**\n * Turn the agent's TLS config into what the static config needs.\n *\n * The ACME account comes from DDEV: a resolver without an email is refused by\n * Let's Encrypt, and `use_letsencrypt=false` means DDEV is also stripping the\n * certificate resolver from the project routers.\n */\nfunction buildTlsResolverOptions(tls: TlsConfig, io: SetupIo): TlsResolverOptions {\n  const letsEncrypt = readLetsEncryptSettings(io);\n\n  if (!letsEncrypt.enabled || !letsEncrypt.email) {\n    throw new Error(\n      \"tls.dns_provider needs Let's Encrypt enabled in DDEV with an account email.\\n\" +\n        \"  Run setup again with --email=<address>, or unset tls.dns_provider.\",\n    );\n  }\n\n  return {\n    provider: tls.dnsProvider!,\n    email: letsEncrypt.email,\n    caServer: tls.caServer,\n  };\n}\n\n/** Read the TLD the wildcard certificate covers, or fail before any write. */\nfunction readWildcardTld(configured: string | undefined, io: SetupIo): string {\n  const tld = configured || readProjectTld(io);\n\n  if (!tld) {\n    throw new Error(\n      \"Cannot configure the wildcard certificate: no project TLD is set in DDEV\",\n    );\n  }\n\n  return tld;\n}\n\n/** Write the wildcard TLS store and the router credentials. */\nfunction writeWildcardFiles(tls: TlsConfig, tld: string, io: SetupIo): void {\n  io.writeFile(TLS_STORE_CONFIG, buildTlsStoreConfig(tld));\n  io.exec(`chown ddev:ddev ${TLS_STORE_CONFIG}`, { silent: true });\n\n  // Holds the provider token: created empty and mode 600 first, so the\n  // credentials never exist on disk under the umask default. `install`\n  // truncates an existing file and resets its mode, and the later write\n  // keeps it.\n  io.exec(`install -m 600 -o ddev -g ddev /dev/null ${ROUTER_COMPOSE_OVERRIDE}`, {\n    silent: true,\n  });\n  io.writeFile(ROUTER_COMPOSE_OVERRIDE, buildRouterComposeOverride(tls.dnsEnv));\n\n  success(`Wildcard certificate: *.${tld} via the ${tls.dnsProvider} DNS-01 provider`);\n}\n\n/** Remove the wildcard files where no DNS provider is configured. */\nfunction removeWildcardFiles(io: SetupIo): void {\n  if (io.fileExists(TLS_STORE_CONFIG)) {\n    io.exec(`rm -f ${TLS_STORE_CONFIG}`, { silent: true });\n  }\n\n  if (io.fileExists(ROUTER_COMPOSE_OVERRIDE)) {\n    io.exec(`rm -f ${ROUTER_COMPOSE_OVERRIDE}`, { silent: true });\n  }\n}\n","import { dirname, join } from \"node:path\";\nimport { getDockerGatewayIp } from \"../setup/ddev.js\";\nimport { nodeIo, type SetupIo } from \"../setup/io.js\";\n\n/**\n * Files DDEV reads the dynamic Traefik configuration from, relative to the\n * .ddev directory.\n *\n * Only custom-global-config: DDEV copies that into the ddev-global-cache\n * volume, which is where Traefik actually reads from. Setup used to write a\n * second copy at the traefik root for older DDEV versions; migration 0010\n * removes it, and nothing reads it on 1.25.\n */\nconst DYNAMIC_CONFIGS = [\"traefik/custom-global-config/trafic.yaml\"];\n\n/** Matches the host in an agent URL, e.g. http://172.17.0.1:9876/__auth__ */\nconst AGENT_URL = /http:\\/\\/(\\d+\\.\\d+\\.\\d+\\.\\d+):(\\d+)/g;\n\n/**\n * The address the forward-auth middleware currently points at.\n */\nexport function readForwardAuthAddress(content: string): string | undefined {\n  const match = /http:\\/\\/(\\d+\\.\\d+\\.\\d+\\.\\d+):\\d+/.exec(content);\n  return match?.[1];\n}\n\n/**\n * Point every agent URL in a dynamic config at a different host, keeping\n * each port as it was.\n */\nexport function rewriteForwardAuthAddress(\n  content: string,\n  gatewayIp: string,\n): string {\n  return content.replace(AGENT_URL, `http://${gatewayIp}:$2`);\n}\n\n/**\n * Correct the forward-auth address if the Docker gateway has moved.\n *\n * setup runs `configureTraefik` before any DDEV project exists, so the\n * `ddev_default` network is absent and the address falls back to the default\n * bridge. Once a project starts, that address is stale. Migration 0006 exists\n * to fix it on servers provisioned earlier, but `markAllMigrationsApplied()`\n * marks it applied on fresh ones, so nothing ever recomputed it.\n *\n * Traefik watches the dynamic config, so rewriting the file is enough — no\n * restart. Any failure is logged and ignored: a stale address is survivable,\n * an agent that will not start is not.\n */\nexport function syncForwardAuthAddress(\n  projectListPath: string,\n  io: SetupIo = nodeIo,\n): void {\n  try {\n    const ddevDir = dirname(projectListPath);\n    const gatewayIp = getDockerGatewayIp(io);\n    const changed: string[] = [];\n\n    for (const relative of DYNAMIC_CONFIGS) {\n      const path = join(ddevDir, relative);\n\n      if (!io.fileExists(path)) {\n        continue;\n      }\n\n      const content = io.readFile(path);\n      const current = readForwardAuthAddress(content);\n\n      if (!current || current === gatewayIp) {\n        continue;\n      }\n\n      io.writeFile(path, rewriteForwardAuthAddress(content, gatewayIp));\n      changed.push(path);\n    }\n\n    if (changed.length > 0) {\n      console.log(\n        `Traefik forward auth: corrected address to ${gatewayIp} in ${changed.length} file(s)`,\n      );\n    }\n  } catch (error) {\n    console.warn(\n      `Could not check the Traefik forward auth address: ${error instanceof Error ? error.message : error}`,\n    );\n  }\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { DNS_RESOLVER, STATIC_CONFIG } from \"../setup/ddev.js\";\nimport type { AgentConfig } from \"../types.js\";\n\n/**\n * Warn when the config asks for a wildcard certificate that Traefik never got.\n *\n * The files are written by setup and by migration 0016, not by the running\n * agent: writing them needs root, and applying them needs a project start.\n * So this only reports, and says which command fixes it.\n */\nexport function warnIfWildcardNotApplied(\n  config: AgentConfig,\n  staticConfigPath: string = STATIC_CONFIG,\n): boolean {\n  if (!config.tls.dnsProvider) {\n    return false;\n  }\n\n  const configured =\n    existsSync(staticConfigPath) &&\n    readFileSync(staticConfigPath, \"utf-8\").includes(`${DNS_RESOLVER}:`);\n\n  if (configured) {\n    return false;\n  }\n\n  console.warn(\n    `tls.dns_provider is set to \"${config.tls.dnsProvider}\" but Traefik has no ${DNS_RESOLVER} resolver.`,\n  );\n  console.warn(\n    \"  The wildcard certificate is not being requested. Run `sudo trafic-agent upgrade`, or re-run setup.\",\n  );\n\n  return true;\n}\n","import { createServer, type IncomingMessage, type ServerResponse } from \"node:http\";\nimport { readFileSync } from \"node:fs\";\nimport { resolve, dirname } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { AgentConfig, AuthConfig } from \"./types.js\";\nimport { checkAuth, resolveClientIp } from \"./utils/auth.js\";\nimport {\n  loadProjectList,\n  buildHostnameIndex,\n  watchProjectList,\n  startProject,\n  getProjectInfo,\n} from \"./utils/ddev.js\";\nimport {\n  initDb,\n  updateProjectAccess,\n  logAccess,\n  setProjectStatus,\n  getProject,\n} from \"./utils/db.js\";\nimport { loadProjectConfig } from \"./utils/project-config.js\";\nimport { syncForwardAuthAddress } from \"./utils/traefik.js\";\nimport { warnIfWildcardNotApplied } from \"./utils/tls.js\";\n\nconst __dirname = dirname(fileURLToPath(import.meta.url));\n\n// State\nlet config: AgentConfig;\nlet projectList: Map<string, string>;\nlet hostnameIndex: Map<string, string>;\n// Cache of per-project configs (project name -> config)\nconst projectConfigs = new Map<string, ReturnType<typeof loadProjectConfig>>();\n\n/**\n * What the request handlers need from the outside world.\n *\n * Gathered into one seam so a test can drive the handlers with a known\n * project list and record what they did, without a listening socket, a real\n * database or a DDEV install. `startServer` builds the real one.\n */\nexport interface ServerDeps {\n  auth: AuthConfig;\n  /** hostname -> project name */\n  hostnameIndex: Map<string, string>;\n  /** project name -> its own config, where it has one */\n  projectConfigs: Map<string, ReturnType<typeof loadProjectConfig>>;\n  loadTemplate: (name: string) => string;\n  updateProjectAccess: (name: string) => void;\n  logAccess: (log: Parameters<typeof logAccess>[0]) => void;\n  getProject: (name: string) => ReturnType<typeof getProject>;\n  setProjectStatus: (name: string, status: \"running\" | \"stopped\" | \"starting\") => void;\n  startProject: (name: string) => Promise<boolean>;\n  getProjectInfo: (name: string) => ReturnType<typeof getProjectInfo>;\n}\n\n/**\n * Load HTML template\n */\nfunction loadTemplate(name: string): string {\n  const templatePath = resolve(__dirname, \"..\", \"templates\", `${name}.html`);\n  try {\n    return readFileSync(templatePath, \"utf-8\");\n  } catch {\n    return `<html><body><h1>${name}</h1></body></html>`;\n  }\n}\n\n/**\n * Get effective auth config for a project (merges global + per-project)\n */\nexport function getEffectiveAuthConfig(\n  projectName: string | undefined,\n  deps: Pick<ServerDeps, \"auth\" | \"projectConfigs\">,\n): AuthConfig {\n  if (!projectName) return deps.auth;\n\n  const projectConfig = deps.projectConfigs.get(projectName);\n  if (!projectConfig?.auth_policy) return deps.auth;\n\n  // Override default policy with project-specific policy\n  return {\n    ...deps.auth,\n    defaultPolicy: projectConfig.auth_policy,\n  };\n}\n\n/**\n * Handle forward auth requests from Traefik\n * Traefik sends the original request headers, we return 200 (allow) or 401 (deny)\n */\nexport function handleAuth(\n  req: IncomingMessage,\n  res: ServerResponse,\n  deps: ServerDeps,\n): void {\n  const hostname = req.headers[\"x-forwarded-host\"] as string ?? \"\";\n  // Keep the two apart: the socket peer cannot be forged, X-Forwarded-For\n  // partly can. checkAuth decides which entry to trust.\n  const socketIp = req.socket.remoteAddress ?? \"\";\n  const forwardedFor = req.headers[\"x-forwarded-for\"] as string | undefined;\n  const authorization = req.headers[\"authorization\"];\n  const path = req.headers[\"x-forwarded-uri\"] as string ?? \"/\";\n\n  // Find project from hostname\n  const projectName = deps.hostnameIndex.get(hostname);\n\n  // Get effective auth config (global + per-project overrides)\n  const authConfig = getEffectiveAuthConfig(projectName, deps);\n\n  const clientIp = resolveClientIp(\n    socketIp,\n    forwardedFor,\n    authConfig.trustedProxyHops,\n  );\n\n  const result = checkAuth(\n    {\n      hostname,\n      ip: socketIp,\n      authorization,\n      forwardedFor,\n    },\n    authConfig,\n  );\n\n  if (result.allowed) {\n    // Log access and update last access time\n    if (projectName) {\n      deps.updateProjectAccess(projectName);\n      deps.logAccess({\n        project: projectName,\n        timestamp: Date.now(),\n        ip: clientIp,\n        userAgent: req.headers[\"user-agent\"] ?? \"\",\n        path,\n      });\n    }\n\n    res.writeHead(200);\n    res.end();\n  } else {\n    // Return 401 with WWW-Authenticate header for basic auth\n    res.writeHead(401, {\n      \"WWW-Authenticate\": 'Basic realm=\"Trafic\"',\n    });\n    res.end(\"Unauthorized\");\n  }\n}\n\n/**\n * Handle errors middleware requests (502 from Traefik)\n * When a project is stopped, Traefik returns 502. We show a waiting page and start the project.\n */\nexport async function handleErrors(\n  req: IncomingMessage,\n  res: ServerResponse,\n  deps: ServerDeps,\n): Promise<void> {\n  const hostname = req.headers[\"x-forwarded-host\"] as string ?? req.headers.host ?? \"\";\n  const projectName = deps.hostnameIndex.get(hostname);\n\n  if (!projectName) {\n    // Unknown project\n    const template = deps.loadTemplate(\"error\");\n    res.writeHead(404, { \"Content-Type\": \"text/html\" });\n    res.end(template.replace(\"{{message}}\", \"Project not found\"));\n    return;\n  }\n\n  // Check if project is already starting\n  const record = deps.getProject(projectName);\n  if (record?.status === \"starting\") {\n    // Show waiting page\n    const template = deps.loadTemplate(\"wait\");\n    res.writeHead(503, {\n      \"Content-Type\": \"text/html\",\n      \"Retry-After\": \"5\",\n    });\n    res.end(\n      template\n        .replace(/\\{\\{project\\}\\}/g, projectName)\n        .replace(/\\{\\{hostname\\}\\}/g, hostname),\n    );\n    return;\n  }\n\n  // Mark as starting\n  deps.setProjectStatus(projectName, \"starting\");\n\n  // Show waiting page immediately\n  const template = deps.loadTemplate(\"wait\");\n  res.writeHead(503, {\n    \"Content-Type\": \"text/html\",\n    \"Retry-After\": \"5\",\n  });\n  res.end(\n    template\n      .replace(/\\{\\{project\\}\\}/g, projectName)\n      .replace(/\\{\\{hostname\\}\\}/g, hostname),\n  );\n\n  // Start the project without waiting for it. The response is already sent,\n  // and `startProject` no longer blocks the event loop, so the agent keeps\n  // serving forward auth for every other project while this runs. The status\n  // is recorded when it settles, which is what stops a second request from\n  // starting the same project again.\n  void deps.startProject(projectName)\n    .then((success) => {\n      deps.setProjectStatus(projectName, success ? \"running\" : \"stopped\");\n    })\n    .catch((error: unknown) => {\n      // Leaving it \"starting\" forever would wedge the waiting page\n      deps.setProjectStatus(projectName, \"stopped\");\n      console.error(`Could not start ${projectName}:`, error);\n    });\n}\n\n/**\n * Handle status polling requests\n */\nexport async function handleStatus(\n  req: IncomingMessage,\n  res: ServerResponse,\n  deps: ServerDeps,\n): Promise<void> {\n  const url = new URL(req.url ?? \"/\", `http://${req.headers.host}`);\n  const projectName = url.searchParams.get(\"project\");\n\n  if (!projectName) {\n    res.writeHead(400, { \"Content-Type\": \"application/json\" });\n    res.end(JSON.stringify({ error: \"Missing project parameter\" }));\n    return;\n  }\n\n  const info = await deps.getProjectInfo(projectName);\n  const record = deps.getProject(projectName);\n\n  res.writeHead(200, { \"Content-Type\": \"application/json\" });\n  res.end(\n    JSON.stringify({\n      name: projectName,\n      status: info?.status ?? record?.status ?? \"unknown\",\n      ready: info?.status === \"running\",\n    }),\n  );\n}\n\n/**\n * The path a request should be routed on, without the query string.\n *\n * `req.url` is a target, not a URL: it carries the query and, for a proxied\n * request, may be absolute. Parsing against a fixed base keeps a malformed or\n * absolute target from deciding the route, and a trailing slash is dropped so\n * `/__auth__/` and `/__auth__` are the same endpoint.\n */\nexport function routePath(target: string | undefined): string {\n  let path: string;\n\n  try {\n    path = new URL(target ?? \"/\", \"http://localhost\").pathname;\n  } catch {\n    return \"/\";\n  }\n\n  return path.length > 1 && path.endsWith(\"/\") ? path.slice(0, -1) : path;\n}\n\n/**\n * Request handler\n */\nexport async function handleRequest(\n  req: IncomingMessage,\n  res: ServerResponse,\n  deps: ServerDeps,\n): Promise<void> {\n  // Route on the path alone. Matching the raw URL meant a query string threw\n  // every internal route off: Traefik's catch-all and errors middleware pass\n  // the original request through, so `/?s=term` on a stopped project missed\n  // every branch and fell to the waiting page — which then started an\n  // already-running project. `/__status__?project=` never reached its handler\n  // for the same reason: it needs the query it was being routed away from.\n  const path = routePath(req.url);\n\n  try {\n    // Route requests\n    if (path === \"/__auth__\" || path.startsWith(\"/__auth__/\")) {\n      handleAuth(req, res, deps);\n    } else if (path === \"/__status__\" || path.startsWith(\"/__status__/\")) {\n      await handleStatus(req, res, deps);\n    } else if (path === \"/__health__\") {\n      res.writeHead(200, { \"Content-Type\": \"application/json\" });\n      res.end(JSON.stringify({ status: \"ok\", version: \"__VERSION__\" }));\n    } else {\n      // Default: errors middleware\n      await handleErrors(req, res, deps);\n    }\n  } catch (error) {\n    console.error(\"Request error:\", error);\n    res.writeHead(500, { \"Content-Type\": \"text/plain\" });\n    res.end(\"Internal Server Error\");\n  }\n}\n\n/**\n * Reload project list and their configs\n */\nfunction reloadProjects(): void {\n  projectList = loadProjectList(config.projectListPath);\n  hostnameIndex = buildHostnameIndex(projectList, config.tld);\n\n  // Load per-project configs\n  projectConfigs.clear();\n  for (const [name, projectDir] of projectList) {\n    const projectConfig = loadProjectConfig(projectDir);\n    if (projectConfig.auth_policy || projectConfig.idle_timeout) {\n      projectConfigs.set(name, projectConfig);\n      console.log(`  ${name}: auth=${projectConfig.auth_policy ?? \"default\"}, idle=${projectConfig.idle_timeout ?? \"default\"}`);\n    }\n  }\n\n  console.log(`Loaded ${projectList.size} projects (${projectConfigs.size} with custom config)`);\n}\n\n/**\n * Start the agent server\n */\nexport function startServer(agentConfig: AgentConfig): void {\n  config = agentConfig;\n\n  // Initialize database\n  initDb(config.dbPath);\n\n  // setup wrote the forward auth address before any DDEV network existed, so\n  // correct it now that one may have appeared\n  syncForwardAuthAddress(config.projectListPath);\n\n  // A DNS provider in the config that never reached Traefik means the\n  // wildcard certificate is not being requested at all\n  warnIfWildcardNotApplied(config);\n\n  // Load projects\n  reloadProjects();\n\n  // Watch for changes\n  watchProjectList(config.projectListPath, () => {\n    console.log(\"Project list changed, reloading...\");\n    reloadProjects();\n  });\n\n  // The real dependencies. Rebuilt per request for the two maps, which\n  // reloadProjects replaces wholesale when the project list changes.\n  const deps = (): ServerDeps => ({\n    auth: config.auth,\n    hostnameIndex,\n    projectConfigs,\n    loadTemplate,\n    updateProjectAccess,\n    logAccess,\n    getProject,\n    setProjectStatus,\n    startProject,\n    getProjectInfo,\n  });\n\n  // Create HTTP server\n  const server = createServer((req, res) => {\n    handleRequest(req, res, deps()).catch((error) => {\n      console.error(\"Unhandled error:\", error);\n      if (!res.headersSent) {\n        res.writeHead(500);\n        res.end(\"Internal Server Error\");\n      }\n    });\n  });\n\n  server.listen(config.port, () => {\n    console.log(`Trafic agent listening on port ${config.port}`);\n    console.log(`TLD: ${config.tld}`);\n    console.log(`Projects: ${projectList.size}`);\n  });\n}\n"],"mappings":";;;;;;;;AAIA,IAAM,uBAAuB;CAC3B;CACA;CACA;AACF;AAEA,IAAM,iBAA8B;CAClC,KAAK;CACL,MAAM;CACN,QAAQ;CACR,iBAAiB;CACjB,aAAa;CACb,aAAa;CACb,mBAAmB;CACnB,MAAM;EACJ,eAAe;EACf,YAAY,CAAC;EACb,QAAQ,CAAC;EACT,WAAW,CAAC;EACZ,OAAO,CAAC;EACR,kBAAkB;CACpB;CACA,KAAK,EACH,QAAQ,CAAC,EACX;AACF;;;;AAKA,SAAgB,cAAc,UAA0B;CAEtD,MAAM,QAAQ,SAAS,MAAM,mCAAK;CAClC,IAAI,CAAC,OAAO,OAAO;CAEnB,MAAM,QAAQ,SAAS,MAAM,MAAM,KAAK,EAAE;CAC1C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,EAAE;CAC5C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,EAAE;CAE5C,QAAQ,QAAQ,OAAO,UAAU,KAAK,WAAW;AACnD;;;;AAKA,SAAgB,WAAW,YAAkC;CAE3D,IAAI,OAAO;CACX,IAAI,CAAC,MACH,OAAO,qBAAqB,MAAM,MAAM,WAAW,CAAC,CAAC;CAGvD,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,GAAG;EAC9B,QAAQ,KAAK,sCAAsC;EACnD,OAAO;CACT;CAEA,MAAM,UAAU,aAAa,MAAM,OAAO;CAC1C,MAAM,SAAS,MAAM,OAAO;CAG5B,MAAM,OAAO,gBAAgB,OAAO,IAA+B;CACnE,MAAM,MAAM,eAAe,OAAO,GAA8B;CAEhE,OAAO;EACL,KAAM,OAAO,OAAkB,eAAe;EAC9C,MAAO,OAAO,QAAmB,eAAe;EAChD,QAAS,OAAO,WAAsB,eAAe;EACrD,iBACG,OAAO,qBAAgC,eAAe;EACzD,aAAc,OAAO,gBAA2B,eAAe;EAC/D,aACG,OAAO,gBAA2B,eAAe;EACpD,mBACG,OAAO,uBACR,eAAe;EACjB;EACA;CACF;AACF;;;;;;;AAQA,SAAS,eAAe,KAA0C;CAChE,IAAI,CAAC,KAAK,OAAO,eAAe;CAEhC,MAAM,MAAO,IAAI,WAAmD,CAAC;CACrE,MAAM,SAAiC,CAAC;CAExC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,GAAG,GAG3C,OAAO,OAAO;CAGhB,OAAO;EACL,aAAc,IAAI,gBAAuC,KAAA;EACzD,UAAW,IAAI,aAAoC,KAAA;EACnD;CACF;AACF;;;;;AAMA,SAAS,sBAAsB,KAA+B;CAC5D,IAAI,CAAC,MAAM,QAAQ,GAAG,GAAG,OAAO;CAChC,OAAO,IAAI,KAAK,UAAU;EACxB,IAAI,OAAO,UAAU,UAAU,OAAO;EACtC,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;GAC/C,MAAM,EAAE,UAAU,aAAa;GAC/B,OAAO,GAAG,SAAS,GAAG;EACxB;EACA,OAAO,OAAO,KAAK;CACrB,CAAC;AACH;AAEA,SAAS,gBAAgB,KAA2C;CAClE,IAAI,CAAC,KAAK,OAAO,eAAe;CAEhC,MAAM,QAAS,IAAI,SAA4C,CAAC;CAEhE,OAAO;EACL,eACG,IAAI,kBACL,eAAe,KAAK;EACtB,YACG,IAAI,eAA4B,eAAe,KAAK;EACvD,QAAS,IAAI,UAAuB,eAAe,KAAK;EACxD,WAAW,sBAAsB,IAAI,UAAU,KAAK,eAAe,KAAK;EACxE,OAAO,MAAM,KACV,OAAiB;GAChB,OAAO,EAAE;GACT,QAAQ,EAAE;GACV,QAAQ,EAAE;GACV,YAAY,EAAE;EAChB,EACF;EACA,kBAAkB,sBAAsB,IAAI,kBAAkB;CAChE;AACF;;;;;;;;AASA,SAAS,sBAAsB,KAAsB;CACnD,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;CAEvD,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,OAAO,GACpC,OAAO,eAAe,KAAK;CAG7B,OAAO;AACT;;;;AAKA,SAAgB,eAAe,QAA+B;CAC5D,MAAM,SAAmB,CAAC;CAE1B,IAAI,CAAC,OAAO,KACV,OAAO,KAAK,iBAAiB;CAG/B,IAAI,OAAO,OAAO,KAAK,OAAO,OAAO,OACnC,OAAO,KAAK,kCAAkC;CAGhD,IACE,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,UAC9B,OAAO,KAAK,kBAAkB,WAC9B,OAAO,KAAK,kBAAkB,SAE9B,OAAO,KAAK,0EAAkE;CAGhF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,IAAI,MAAM,GAAG;EAC5D,IAAI,CAAC,2BAA2B,KAAK,GAAG,GACtC,OAAO,KAAK,oBAAoB,IAAI,2CAA2C;EAGjF,IAAI,OAAO,UAAU,UACnB,OAAO,KAAK,eAAe,IAAI,kBAAkB;CAErD;CAEA,OAAO;AACT;;;;;;ACrMA,SAAgB,QAAQ,IAAY,SAA0B;CAE5D,IAAI,OAAO,SAAS,OAAO;CAG3B,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,UAAU,IAAI,OAAO;CAI9B,IAAI,QAAQ,SAAS,GAAG,GAItB,OAAO,IAHW,OAChB,MAAM,QAAQ,QAAQ,OAAO,KAAK,CAAC,CAAC,QAAQ,OAAO,IAAI,IAAI,GAEtD,CAAA,CAAM,KAAK,EAAE;CAGtB,OAAO;AACT;;;;AAKA,SAAS,UAAU,IAAY,MAAuB;CACpD,MAAM,CAAC,OAAO,QAAQ,KAAK,MAAM,GAAG;CACpC,MAAM,OAAO,SAAS,MAAM,EAAE;CAE9B,MAAM,QAAQ,WAAW,EAAE;CAC3B,MAAM,WAAW,WAAW,KAAK;CAEjC,IAAI,UAAU,QAAQ,aAAa,MAAM,OAAO;CAEhD,MAAM,UAAU,GAAG,KAAM,KAAK,QAAS;CACvC,QAAQ,QAAQ,cAAc,WAAW;AAC3C;;;;AAKA,SAAS,WAAW,IAA2B;CAC7C,MAAM,QAAQ,GAAG,MAAM,GAAG;CAC1B,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,IAAI,MAAM;CACV,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,IAAI,SAAS,MAAM,EAAE;EAC3B,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,IAAI,KAAK,OAAO;EACzC,MAAO,OAAO,IAAK;CACrB;CACA,OAAO,QAAQ;AACjB;;;;AAKA,SAAgB,cAAc,UAAkB,SAA0B;CAExE,IAAI,aAAa,SAAS,OAAO;CAWjC,OAAO,IARW,OAChB,MACE,QACG,QAAQ,qBAAqB,MAAM,CAAC,CACpC,QAAQ,OAAO,IAAI,CAAC,CACpB,QAAQ,OAAO,GAAG,IACrB,GAEG,CAAA,CAAM,KAAK,QAAQ;AAC5B;;;;AAKA,SAAgB,eACd,QAC+C;CAC/C,IAAI,CAAC,OAAO,WAAW,QAAQ,GAAG,OAAO;CAEzC,IAAI;EACF,MAAM,UAAU,OAAO,MAAM,CAAC;EAC9B,MAAM,UAAU,OAAO,KAAK,SAAS,QAAQ,CAAC,CAAC,SAAS,OAAO;EAC/D,MAAM,aAAa,QAAQ,QAAQ,GAAG;EACtC,IAAI,eAAe,IAAI,OAAO;EAE9B,OAAO;GACL,UAAU,QAAQ,MAAM,GAAG,UAAU;GACrC,UAAU,QAAQ,MAAM,aAAa,CAAC;EACxC;CACF,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,SAAgB,iBAAiB,QAA+B;CAC9D,IAAI,CAAC,OAAO,WAAW,SAAS,GAAG,OAAO;CAC1C,OAAO,OAAO,MAAM,CAAC;AACvB;;;;;;;;;;;;;;;;AAiBA,SAAgB,gBACd,UACA,cACA,cAAc,GACN;CACR,IAAI,CAAC,gBAAgB,cAAc,GACjC,OAAO;CAGT,MAAM,UAAU,aACb,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO;CAIjB,IAAI,QAAQ,SAAS,aACnB,OAAO;CAGT,OAAO,QAAQ,QAAQ,SAAS,gBAAgB;AAClD;;;;AAKA,SAAgB,UAAU,SAAsB,QAAgC;CAC9E,MAAM,EAAE,UAAU,IAAI,kBAAkB;CAExC,MAAM,SAAS,gBAAgB,IAAI,QAAQ,cAAc,OAAO,gBAAgB;CAGhF,KAAK,MAAM,WAAW,OAAO,YAC3B,IAAI,QAAQ,QAAQ,OAAO,GACzB,OAAO;EAAE,SAAS;EAAM,QAAQ;CAAK;CAKzC,KAAK,MAAM,QAAQ,OAAO,OACxB,IAAI,cAAc,UAAU,KAAK,KAAK,GACpC,OAAO,UAAU,MAAM,QAAQ,eAAe,MAAM;CAKxD,OAAO,mBAAmB,QAAQ,QAAQ,aAAa;AACzD;;;;AAKA,SAAS,UACP,MACA,IACA,eACA,QACY;CAEZ,IAAI,KAAK,YACF;OAAA,MAAM,WAAW,KAAK,YACzB,IAAI,QAAQ,IAAI,OAAO,GACrB,OAAO;GAAE,SAAS;GAAM,QAAQ;EAAO;CAAA;CAK7C,QAAQ,KAAK,QAAb;EACE,KAAK,SACH,OAAO;GAAE,SAAS;GAAM,QAAQ;EAAO;EAEzC,KAAK,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;EAAO;EAE1C,KAAK,SAAS;GACZ,IAAI,CAAC,eAAe,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAO;GAC5D,MAAM,QAAQ,iBAAiB,aAAa;GAC5C,MAAM,SAAS,KAAK,UAAU,OAAO;GACrC,IAAI,SAAS,OAAO,SAAS,KAAK,GAChC,OAAO;IAAE,SAAS;IAAM,QAAQ;GAAQ;GAE1C,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAO;EAC1C;EAEA,KAAK,SAAS;GACZ,IAAI,CAAC,eAAe,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAO;GAC5D,MAAM,QAAQ,eAAe,aAAa;GAC1C,IAAI,OAAO;IACT,MAAM,aAAa,GAAG,MAAM,SAAS,GAAG,MAAM;IAC9C,IAAI,OAAO,UAAU,SAAS,UAAU,GACtC,OAAO;KAAE,SAAS;KAAM,QAAQ;IAAQ;GAE5C;GACA,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAO;EAC1C;EAEA,SACE,OAAO;GAAE,SAAS;GAAO,QAAQ;EAAO;CAC5C;AACF;;;;AAKA,SAAS,mBACP,QACA,IACA,eACY;CACZ,QAAQ,OAAO,eAAf;EACE,KAAK,SACH,OAAO;GAAE,SAAS;GAAM,QAAQ;EAAU;EAE5C,KAAK,QACH,OAAO;GAAE,SAAS;GAAO,QAAQ;EAAU;EAE7C,KAAK,SAAS;GACZ,IAAI,CAAC,eAAe,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAU;GAC/D,MAAM,QAAQ,eAAe,aAAa;GAC1C,IAAI,OAAO;IACT,MAAM,aAAa,GAAG,MAAM,SAAS,GAAG,MAAM;IAC9C,IAAI,OAAO,UAAU,SAAS,UAAU,GACtC,OAAO;KAAE,SAAS;KAAM,QAAQ;IAAQ;GAE5C;GAEA,MAAM,QAAQ,iBAAiB,aAAa;GAC5C,IAAI,SAAS,OAAO,OAAO,SAAS,KAAK,GACvC,OAAO;IAAE,SAAS;IAAM,QAAQ;GAAQ;GAE1C,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAU;EAC7C;EAEA,KAAK,SAAS;GACZ,IAAI,CAAC,eAAe,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAU;GAC/D,MAAM,QAAQ,iBAAiB,aAAa;GAC5C,IAAI,SAAS,OAAO,OAAO,SAAS,KAAK,GACvC,OAAO;IAAE,SAAS;IAAM,QAAQ;GAAQ;GAE1C,OAAO;IAAE,SAAS;IAAO,QAAQ;GAAU;EAC7C;EAEA,SACE,OAAO;GAAE,SAAS;GAAO,QAAQ;EAAU;CAC/C;AACF;;;;ACtQA,SAAS,QAAQ,OAAuB;CACtC,IACG,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAE5C,OAAO,MAAM,MAAM,GAAG,EAAE;CAG1B,OAAO;AACT;;AAGA,IAAM,eAAe;;AAGrB,IAAM,eAAe;;;;;;;;;;;;;;;;;;;AAoBrB,SAAgB,gBACd,iBACqB;CACrB,IAAI,CAAC,WAAW,eAAe,GAC7B,uBAAO,IAAI,IAAI;CAGjB,MAAM,2BAAW,IAAI,IAAoB;CACzC,IAAI;CAEJ,KAAK,MAAM,QAAQ,aAAa,iBAAiB,OAAO,CAAC,CAAC,MAAM,IAAI,GAAG;EACrE,IAAI,CAAC,KAAK,KAAK,KAAK,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,GACjD;EAGF,MAAM,UAAU,aAAa,KAAK,IAAI;EAEtC,IAAI,SAAS;GACX,UAAU,QAAQ,QAAQ,EAAE,CAAE,KAAK,CAAC;GAGpC,SAAS,IAAI,SAAS,EAAE;GACxB;EACF;EAEA,MAAM,UAAU,aAAa,KAAK,IAAI;EAEtC,IAAI,WAAW,SACb,SAAS,IAAI,SAAS,QAAQ,QAAQ,EAAG,CAAC;CAE9C;CAEA,OAAO;AACT;;;;AAKA,SAAgB,mBACd,UACA,KACqB;CACrB,MAAM,wBAAQ,IAAI,IAAoB;CAEtC,KAAK,MAAM,CAAC,SAAS,UAEnB,MAAM,IAAI,GAAG,KAAK,GAAG,OAAO,IAAI;CAGlC,OAAO;AACT;;;;AAKA,SAAgB,uBACd,UACA,OACoB;CACpB,OAAO,MAAM,IAAI,QAAQ;AAC3B;;;;AAKA,SAAgB,iBACd,iBACA,UACM;CACN,IAAI,CAAC,WAAW,eAAe,GAAG;EAChC,QAAQ,KAAK,2BAA2B,iBAAiB;EACzD;CACF;CAEA,MAAM,kBAAkB,cAAc;EACpC,IAAI,cAAc,UAChB,SAAS;CAEb,CAAC;AACH;;AA2BA,IAAa,kBAA8B,MAAM,cAC/C,IAAI,SAAS,YAAY;CACvB,SACE,QACA,MACA;EAAE,UAAU;EAAS,SAAS;CAAU,IACvC,OAAO,WAAW;EACjB,IAAI,OAAO;GACT,QAAQ,MAAM,QAAQ,KAAK,KAAK,GAAG,EAAE,WAAW,MAAM,OAAO;GAC7D,QAAQ;IAAE,IAAI;IAAO,QAAQ,UAAU;GAAG,CAAC;GAC3C;EACF;EAEA,QAAQ;GAAE,IAAI;GAAM,QAAQ,UAAU;EAAG,CAAC;CAC5C,CACF;AACF,CAAC;;;;AAKH,eAAsB,eACpB,MACA,MAAkB,gBACgB;CAClC,MAAM,EAAE,IAAI,WAAW,MAAM,IAAI;EAAC;EAAY;EAAM;CAAI,GAAG,GAAK;CAEhE,IAAI,CAAC,IACH;CAGF,IAAI;EACF,MAAM,OAAO,KAAK,MAAM,MAAM;EAE9B,IAAI,CAAC,KAAK,KAAK,OAAO,KAAA;EAEtB,MAAM,MAAM,KAAK;EACjB,OAAO;GACL,MAAM,IAAI;GACV,QAAQ,IAAI;GACZ,SAAS,IAAI;GACb,UAAU,IAAI,YAAY,CAAC;GAC3B,WAAW,IAAI,aAAa,CAAC;GAC7B,MAAM,IAAI;GACV,YAAY,IAAI;GAChB,QAAQ,IAAI,QAAQ;EACtB;CACF,QAAQ;EACN;CACF;AACF;;;;;;;AAQA,eAAsB,aACpB,MACA,MAAkB,gBACA;CAClB,MAAM,EAAE,OAAO,MAAM,IAAI,CAAC,SAAS,IAAI,GAAG,IAAM;CAChD,OAAO;AACT;;;;AAKA,eAAsB,YACpB,MACA,MAAkB,gBACA;CAClB,MAAM,EAAE,OAAO,MAAM,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAK;CAC9C,OAAO;AACT;;;;AAKA,SAAgB,eAA8B;CAC5C,IAAI;EACF,MAAM,SAAS,SAAS,gBAAgB;GACtC,UAAU;GACV,SAAS;EACX,CAAC;EACD,MAAM,OAAO,KAAK,MAAM,MAAM;EAE9B,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,CAAC;EAElC,OAAO,KAAK,KAAK,OAAgC;GAC/C,MAAM,EAAE;GACR,QAAQ,EAAE;GACV,SAAS,EAAE;GACX,UAAW,EAAE,YAAyB,CAAC;GACvC,WAAY,EAAE,aAA0B,CAAC;GACzC,MAAM,EAAE;EACV,EAAE;CACJ,QAAQ;EACN,OAAO,CAAC;CACV;AACF;;;ACpPA,IAAI,aAAa;AACjB,IAAI,SAAS;;;;AAKb,SAAgB,UAAU,OAAsB;CAC9C,SAAS;AACX;;;;AAKA,SAAgB,aAAmB;CACjC,aAAa;AACf;;;;AAKA,SAAgB,KAAK,SAAuB;CAC1C;CACA,QAAQ,IAAI,cAAc,WAAW,WAAW,SAAS;AAC3D;;;;AAKA,SAAgB,QAAQ,SAAuB;CAC7C,QAAQ,IAAI,wBAAwB,SAAS;AAC/C;;;;AAKA,SAAgB,KAAK,SAAuB;CAC1C,QAAQ,IAAI,wBAAwB,SAAS;AAC/C;;;;AAKA,SAAgB,MAAM,SAAuB;CAC3C,QAAQ,IAAI,wBAAwB,SAAS;AAC/C;;;;AAKA,SAAgB,KAAK,SAAuB;CAC1C,QAAQ,IAAI,OAAO,SAAS;AAC9B;;;;AAKA,SAAgB,KAAK,SAAiB,SAAwC;CAC5E,IAAI,QAAQ;EACV,IAAI,CAAC,SAAS,QACZ,QAAQ,IAAI,iBAAiB,QAAQ,QAAQ;EAE/C,OAAO;CACT;CAEA,IAAI;EACF,OAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO,SAAS,SAAS,SAAS;EACpC,CAAC;CACH,SAAS,KAAK;EAEZ,MAAM,IAAI,MAAM,mBAAmB,QAAQ,IAAI,IAAE,UAAU,IAAI;CACjE;AACF;;;;AAKA,SAAgB,WAAW,SAAyB;CAClD,IAAI,QACF,OAAO;CAGT,IAAI;EACF,OAAO,SAAS,SAAS;GACvB,UAAU;GACV,OAAO;EACT,CAAC,CAAC,CAAC,KAAK;CACV,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,SAAgB,cAAc,SAA0B;CACtD,IAAI;EACF,SAAS,SAAS,WAAW,EAAE,OAAO,OAAO,CAAC;EAC9C,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;;;AAKA,SAAgB,SAAkB;CAChC,OAAO,QAAQ,SAAS,MAAM;AAChC;;;;AAKA,SAAgB,UAAU,MAAc,SAAuB;CAC7D,IAAI,QAAQ;EACV,QAAQ,IAAI,qBAAqB,KAAK,SAAS;EAC/C,MAAM,QAAQ,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;EAC5C,KAAK,MAAM,QAAQ,OACjB,QAAQ,IAAI,iBAAiB,KAAK,QAAQ;EAE5C,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,SAAS,GAC/B,QAAQ,IAAI,0BAA0B;EAExC;CACF;CAEA,cAAY,MAAM,OAAO;AAC3B;;;;;;;;;AC9FA,IAAa,SAAkB;CAC7B;CACA;CACA;CACA;CACA,YAAY;CACZ,WAAW,SAAS,aAAa,MAAM,OAAO;CAC9C,KAAK,QAAQ;AACf;;;;AClCA,IAAa,oBAA2B,KAAK,IAAI;AAEjD,IAAI,KAA0B;;;;AAK9B,SAAgB,OAAO,QAA8B;CACnD,KAAK,IAAI,aAAa,MAAM;CAC5B,GAAG,KAAK,yBAAyB;CAGjC,GAAG,KAAK;;;;;;;;;;;;;;;;;;GAkBP;CAED,OAAO;AACT;;;;AAKA,SAAgB,QAAsB;CACpC,IAAI,CAAC,IACH,MAAM,IAAI,MAAM,8CAA8C;CAEhE,OAAO;AACT;;;;AAKA,SAAgB,UAAgB;CAC9B,IAAI,IAAI;EACN,GAAG,MAAM;EACT,KAAK;CACP;AACF;;;;AAKA,SAAgB,oBAAoB,MAAc,MAAa,aAAmB;CAOhF,MALa,CAAA,CAAS,QAAQ;;;;GAK9B,CAAA,CAAK,IAAI,MAAM,IAAI,CAAC;AACtB;;;;AAKA,SAAgB,WAAW,MAAyC;CAKlE,OAJiB,MACJ,CAAA,CAAS,QACpB,6EAEK,CAAA,CAAK,IAAI,IAAI;AACtB;;;;AAKA,SAAgB,iBACd,MACA,QACA,MAAa,aACP;CAON,MALa,CAAA,CAAS,QAAQ;;;;GAK9B,CAAA,CAAK,IAAI,MAAM,IAAI,GAAG,MAAM;AAC9B;;;;AAKA,SAAgB,gBACd,aACA,MAAa,aACI;CACjB,MAAM,WAAW,MAAM;CACvB,MAAM,SAAS,IAAI,IAAI;CAMvB,OALa,SAAS,QAAQ;;;;GAKvB,CAAA,CAAK,IAAI,MAAM;AACxB;;;;AAKA,SAAgB,UAAU,KAAkC;CAM1D,MAJa,CAAA,CAAS,QAAQ;;;GAI9B,CAAA,CAAK,IAAI,IAAI,SAAS,IAAI,WAAW,IAAI,IAAI,IAAI,WAAW,IAAI,IAAI;AACtE;;;;AAKA,SAAgB,cAAc,SAAiB,QAAQ,KAAkB;CASvE,OARiB,MACJ,CAAA,CAAS,QAAQ;;;;;;GAOvB,CAAA,CAAK,IAAI,SAAS,KAAK;AAChC;;;;AAKA,SAAgB,aAAa,MAAc,MAAa,aAAqB;CAC3E,MAAM,WAAW,MAAM;CACvB,MAAM,SAAS,IAAI,IAAI,OAAO,KAAK,KAAK,KAAK;CAE7C,MAAM,SADO,SAAS,QAAQ,6CACf,CAAA,CAAK,IAAI,MAAM;CAC9B,OAAO,OAAO,OAAO,OAAO;AAC9B;;;;;;;AC/IA,SAAS,gBAAgB,SAAyC;CAChE,MAAM,SAAiC,CAAC;CACxC,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAEhC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,UAAU,KAAK,KAAK;EAG1B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,GAAG;EAEzC,MAAM,aAAa,QAAQ,QAAQ,GAAG;EACtC,IAAI,eAAe,IAAI;EAEvB,MAAM,MAAM,QAAQ,MAAM,GAAG,UAAU,CAAC,CAAC,KAAK;EAC9C,IAAI,QAAQ,QAAQ,MAAM,aAAa,CAAC,CAAC,CAAC,KAAK;EAG/C,IACG,MAAM,WAAW,IAAG,KAAK,MAAM,SAAS,IAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAE5C,QAAQ,MAAM,MAAM,GAAG,EAAE;EAG3B,OAAO,OAAO;CAChB;CAEA,OAAO;AACT;;;;AAKA,SAAgB,kBAAkB,YAAmC;CACnE,MAAM,aAAa,KAAK,YAAY,SAAS,oBAAoB;CAEjE,IAAI,CAAC,WAAW,UAAU,GACxB,OAAO,CAAC;CAGV,IAAI;EAEF,MAAM,SAAS,gBADC,aAAa,YAAY,OACV,CAAO;EAEtC,MAAM,SAAwB,CAAC;EAG/B,IAAI,OAAO,aAAa;GACtB,MAAM,SAAS,OAAO,YAAY,YAAY;GAC9C,IAAI;IAAC;IAAS;IAAQ;IAAS;GAAO,CAAC,CAAC,SAAS,MAAM,GACrD,OAAO,cAAc;EAEzB;EAGA,IAAI,OAAO,cACT,OAAO,eAAe,OAAO;EAG/B,OAAO;CACT,SAAS,OAAO;EACd,QAAQ,KAAK,sCAAsC,WAAW,IAAI,KAAK;EACvE,OAAO,CAAC;CACV;AACF;;;;AAKA,SAAgB,gBAAgB,QAAgC;CAC9D,OAAO,OAAO,cAAc,YAAY,MAAM;AAChD;;;;AAKA,SAAgB,iBAAiB,QAA2C;CAC1E,IAAI,CAAC,OAAO,cAAc,OAAO,KAAA;CACjC,IAAI,gBAAgB,MAAM,GAAG,OAAO,KAAA;CAIpC,MAAM,QAAQ,OAAO,aAAa,MAAM,mCAAK;CAC7C,IAAI,CAAC,OAAO,OAAO,KAAA;CAEnB,MAAM,QAAQ,SAAS,MAAM,MAAM,KAAK,EAAE;CAC1C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,EAAE;CAC5C,MAAM,UAAU,SAAS,MAAM,MAAM,KAAK,EAAE;CAE5C,MAAM,MAAM,QAAQ,OAAO,UAAU,KAAK,WAAW;CACrD,OAAO,KAAK,IAAI,KAAK,KAAA;AACvB;;;;;;ACrGA,SAAgB,kBAAkB,KAAc,QAAc;CAC5D,KAAK,6BAA6B;CAElC,GAAG,KAAK,sBAAsB,EAAE,QAAQ,KAAK,CAAC;CAG9C,GAAG,KACD,4GACA,EAAE,QAAQ,KAAK,CACjB;CAEA,QAAQ,wEAAwE;AAClF;;AAGA,IAAa,eAAe;;AAG5B,IAAa,eAAe;;;;;;;;;;;;;;;;;;;;AAqB5B,SAAgB,eAAe,KAAc,QAAc;CACzD,GAAG,KAAK,wCAAwC,EAAE,QAAQ,KAAK,CAAC;CAChE,GAAG,KAAK,0DAA0D,gBAAgB,EAChF,QAAQ,KACV,CAAC;CACD,GAAG,KAAK,aAAa,gBAAgB,EAAE,QAAQ,KAAK,CAAC;CACrD,GAAG,KACD,2HAA2H,aAAa,aAAa,aAAa,eAClK,EAAE,QAAQ,KAAK,CACjB;AACF;;;;AAKA,SAAgB,YAAY,KAAc,QAAc;CACtD,KAAK,cAAc;CAEnB,IAAI,GAAG,cAAc,MAAM,GAAG;EAE5B,KAAK,2BADW,GAAG,KAAK,wCAAwC,EAAE,QAAQ,KAAK,CAC/C,CAAA,EAAS,KAAK,KAAK,mBAAmB;EACtE;CACF;CAIA,KAAK,+BAA+B;CACpC,eAAe,EAAE;CAEjB,KAAK,oBAAoB;CACzB,GAAG,KAAK,sBAAsB,EAAE,QAAQ,KAAK,CAAC;CAC9C,GAAG,KAAK,6EAA6E,EAAE,QAAQ,KAAK,CAAC;CAMrG,GAAG,KAAK,mCAAmC,EAAE,QAAQ,KAAK,CAAC;CAC3D,GAAG,KAAK,qDAAqD,EAAE,QAAQ,KAAK,CAAC;CAG7E,QAAQ,mBADQ,GAAG,KAAK,wCAAwC,EAAE,QAAQ,KAAK,CACpD,CAAA,EAAS,KAAK,KAAK,mBAAmB;AACnE;;AAGA,IAAM,sBAAsB;;;;;;;;;;;;;;;;;;AAmB5B,SAAgB,wBAAwB,KAAc,QAAiB;CACrE,MAAM,aAAa,GAChB,WAAW,yBAAyB,oBAAoB,4BAA4B,CAAC,CACrF,KAAK;CAER,IAAI,CAAC,YAEH,OAAO;CAGT,MAAM,UAAU,GAAG,WAAW;CAK9B,IAAI,CAFU,GAAG,WAAW,MAAM,QAAQ,aAAa,QAAQ,yBAAyB,CAAC,CAAC,KAErF,GACH,OAAO;CAGT,GAAG,KAAK,SAAS,QAAQ,aAAa,QAAQ,eAAe,EAAE,QAAQ,KAAK,CAAC;CAC7E,OAAO;AACT;;;;;;;;;;;;AAaA,SAAgB,cACd,KACA,OACA,KAAc,QACR;CACN,KAAK,gBAAgB;CAGrB,MAAM,WAAW,QAAgB,iBAAiB,IAAI;CAGtD,GAAG,KACD,QACE,oCAAoC,IAAI,qGAAqG,QAAQ,SAAS,QAAQ,GAAG,QAAQ,uBAAuB,UAAU,GAAG,gCACvN,GACA,EAAE,QAAQ,KAAK,CACjB;CAEA,QAAQ,6BAA6B,KAAK;CAC1C,KAAK,+BAA+B,IAAI,aAAa;CAErD,IAAI,OACF,QAAQ,qCAAqC,OAAO;MAC/C,IAAI,wBAAwB,EAAE,GAGnC,QAAQ,yCAAyC;CAGnD,QAAQ,iCAAiC;AAC3C;;;;;;;AAqDA,SAAgB,mBAAmB,KAAc,QAAgB;CAE/D,MAAM,SAAS,GAAG,WAChB,0FACF;CACA,IAAI,QAAQ,OAAO;CAMnB,OAHiB,GAAG,WAClB,oFAEK,KAAY;AACrB;;AAGA,IAAM,qBAAqB;CACzB,qBAAqB;CACrB,sBAAsB;CACtB,mBAAmB;CACnB,oBAAoB;AACtB;;;;;;;;;AAUA,SAAgB,cAAc,KAAc,QAAkB;CAC5D,MAAM,SAAS,GAAG,WAAW,mCAAmC;CAChE,MAAM,QAAkB,CAAC;CAEzB,KAAK,MAAM,CAAC,KAAK,aAAa,OAAO,QAAQ,kBAAkB,GAAG;EAChE,MAAM,QAAQ,IAAI,OAAO,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,KAAK,MAAM;EAC5D,MAAM,KAAK,QAAQ,MAAM,QAAQ;CACnC;CAEA,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC;AAC3B;;AASA,IAAM,uBAAoC;CAAE,MAAM;CAAM,OAAO;AAAM;;;;;;;;;AAUrE,SAAgB,gBAAgB,KAAc,QAAqB;CACjE,MAAM,SAAS,GAAG,WAAW,mCAAmC;CAEhE,MAAM,QAAQ,KAAa,aACzB,IAAI,OAAO,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,MAAM;CAE1D,OAAO;EACL,MAAM,KAAK,oBAAoB,qBAAqB,IAAI;EACxD,OAAO,KAAK,qBAAqB,qBAAqB,KAAK;CAC7D;AACF;;AAGA,IAAa,cAAc;;AAG3B,IAAa,gBAAgB,GAAG,YAAY;;AAG5C,IAAa,mBAAmB,GAAG,YAAY;;AAG/C,IAAa,0BAA0B;;AAGvC,IAAa,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;AAqC5B,SAAgB,kBACd,WACA,cAA2B,sBAC3B,KACQ;CACR,MAAM,iBAAiB,SAAiB,KAAK,KAAK;;;;;;CAOlD,MAAM,kBAAkB,SAAiB,UAAU,KAAK;;;;;CAQxD,MAAM,MAAM,CAAC,YAAY,MAAM,YAAY,KAAK;CAChD,MAAM,QAAQ,UAAU,QAAQ,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC;CAE5D,MAAM,cAAc;EACpB,IAAI,KAAK,SAAS,cAAc,QAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,MAAM,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE;CAE7F,IAAI,CAAC,KACH,OAAO;CAGT,OAAO,GAAG,YAAY;;IAEpB,aAAa;;gBAED,iBAAiB,IAAI,KAAK,EAAE;gDACI,aAAa;EAC3D,IAAI,WAAW,oBAAoB,iBAAiB,IAAI,QAAQ,EAAE,OAAO,GAAG;qBACzD,iBAAiB,IAAI,QAAQ,EAAE;;;;;AAKpD;;;;;;;;;AAUA,SAAgB,oBAAoB,KAAqB;CACvD,OAAO;;;;;;;;oBAQW,aAAa;;mBAEd,iBAAiB,GAAG,EAAE;;mBAEtB,iBAAiB,GAAG,EAAE;;AAEzC;;;;;;;;;AAUA,SAAgB,2BAA2B,KAAqC;CAG9E,OAAO;;;;;EAFS,OAAO,QAAQ,GAO/B,CAAA,CAAQ,KAAK,CAAC,KAAK,WAAW,YAAY,IAAI,GAAG,iBAAiB,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;;AAE1F;;AAGA,SAAS,iBAAiB,OAAuB;CAC/C,OAAO,MAAM,QAAQ,OAAO,MAAM,CAAC,CAAC,QAAQ,MAAM,MAAK;AACzD;;;;;;;;;;;;;AAcA,SAAgB,mBACd,WACA,cAA2B,sBACnB;CACR,OAAO;;;;;2BAKkB,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkCpB,YAAY,KAAK;;;;;;;;;iBASjB,YAAY,MAAM;;;;;;;;;2BASR,UAAU;;AAErC;;;;;;;;AAeA,SAAgB,wBAAwB,KAAc,QAA6B;CACjF,MAAM,SAAS,GAAG,WAAW,mCAAmC;CAEhE,OAAO;EACL,SAAS,0BAA0B,KAAK,MAAM;EAC9C,OAAO,4BAA4B,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK,KAAA;CAClE;AACF;;AAGA,SAAgB,eAAe,KAAc,QAAgB;CAC3D,MAAM,SAAS,GAAG,WAAW,mCAAmC;CAEhE,OAAO,sBAAsB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;AAC5D;;;;;;;;AAoBA,SAAgB,iBACd,UAAmC,CAAC,GACpC,KAAc,QACR;CACN,KAAK,oCAAoC;CAGzC,GAAG,KAAK,YAAY,YAAY,wBAAwB,EAAE,QAAQ,KAAK,CAAC;CACxE,GAAG,KAAK,uCAAuC,EAAE,QAAQ,KAAK,CAAC;CAI/D,MAAM,YAAY,mBAAmB,EAAE;CAGvC,MAAM,cAAc,gBAAgB,EAAE;CAOtC,MAAM,gBAAgB,mBAAmB,WAAW,WAAW;CAE/D,GAAG,UAAU,GAAG,YAAY,oCAAoC,aAAa;CAC7E,GAAG,KAAK,mBAAmB,YAAY,oCAAoC,EAAE,QAAQ,KAAK,CAAC;CAE3F,MAAM,MAAM,QAAQ,OAAO,WAAW,CAAC,CAAC;CACxC,MAAM,WAAW,IAAI,cACjB,wBAAwB,KAAK,EAAE,IAC/B,KAAA;CAKJ,MAAM,MAAM,WAAW,gBAAgB,QAAQ,KAAK,EAAE,IAAI;CAM1D,MAAM,eAAe,kBAAkB,cAAc,EAAE,GAAG,aAAa,QAAQ;CAE/E,GAAG,UAAU,eAAe,YAAY;CACxC,GAAG,KAAK,mBAAmB,iBAAiB,EAAE,QAAQ,KAAK,CAAC;CAE5D,KAAK,sBAAsB,YAAY,KAAK,SAAS,YAAY,MAAM,uBAAuB;CAE9F,IAAI,UACF,mBAAmB,KAAK,KAAK,EAAE;MAE/B,oBAAoB,EAAE;CAGxB,QAAQ,2CAA2C;AACrD;;;;;;;;;AAUA,SAAgB,oBAAoB,KAAc,QAAkB;CAClE,MAAM,SAAS,GAAG,WAAW,6BAA6B;CAE1D,IAAI,CAAC,QACH,OAAO,CAAC;CAGV,IAAI;EAEF,QADe,KAAK,MAAM,MAClB,CAAA,CAAO,OAAO,CAAC,EAAA,CACpB,QAAQ,YAAY,QAAQ,WAAW,aAAa,QAAQ,IAAI,CAAC,CACjE,KAAK,YAAY,QAAQ,IAAc;CAC5C,QAAQ;EAEN,OAAO,CAAC;CACV;AACF;;;;;;;;;AAUA,SAAgB,mBAAmB,KAAc,QAAuB;CACtE,OAAO,oBAAoB,EAAE,CAAC,CAAC,MAAM;AACvC;;;;;;;;AASA,SAAS,wBAAwB,KAAgB,IAAiC;CAChF,MAAM,cAAc,wBAAwB,EAAE;CAE9C,IAAI,CAAC,YAAY,WAAW,CAAC,YAAY,OACvC,MAAM,IAAI,MACR,mJAEF;CAGF,OAAO;EACL,UAAU,IAAI;EACd,OAAO,YAAY;EACnB,UAAU,IAAI;CAChB;AACF;;AAGA,SAAS,gBAAgB,YAAgC,IAAqB;CAC5E,MAAM,MAAM,cAAc,eAAe,EAAE;CAE3C,IAAI,CAAC,KACH,MAAM,IAAI,MACR,0EACF;CAGF,OAAO;AACT;;AAGA,SAAS,mBAAmB,KAAgB,KAAa,IAAmB;CAC1E,GAAG,UAAU,kBAAkB,oBAAoB,GAAG,CAAC;CACvD,GAAG,KAAK,mBAAmB,oBAAoB,EAAE,QAAQ,KAAK,CAAC;CAM/D,GAAG,KAAK,4CAA4C,2BAA2B,EAC7E,QAAQ,KACV,CAAC;CACD,GAAG,UAAU,yBAAyB,2BAA2B,IAAI,MAAM,CAAC;CAE5E,QAAQ,2BAA2B,IAAI,WAAW,IAAI,YAAY,iBAAiB;AACrF;;AAGA,SAAS,oBAAoB,IAAmB;CAC9C,IAAI,GAAG,WAAW,gBAAgB,GAChC,GAAG,KAAK,SAAS,oBAAoB,EAAE,QAAQ,KAAK,CAAC;CAGvD,IAAI,GAAG,WAAA,6CAAkC,GACvC,GAAG,KAAK,SAAS,2BAA2B,EAAE,QAAQ,KAAK,CAAC;AAEhE;;;;;;;;;;;;ACxsBA,IAAM,kBAAkB,CAAC,0CAA0C;;AAGnE,IAAM,YAAY;;;;AAKlB,SAAgB,uBAAuB,SAAqC;CAE1E,OADc,oCAAoC,KAAK,OAChD,CAAA,GAAQ;AACjB;;;;;AAMA,SAAgB,0BACd,SACA,WACQ;CACR,OAAO,QAAQ,QAAQ,WAAW,UAAU,UAAU,IAAI;AAC5D;;;;;;;;;;;;;;AAeA,SAAgB,uBACd,iBACA,KAAc,QACR;CACN,IAAI;EACF,MAAM,UAAU,QAAQ,eAAe;EACvC,MAAM,YAAY,mBAAmB,EAAE;EACvC,MAAM,UAAoB,CAAC;EAE3B,KAAK,MAAM,YAAY,iBAAiB;GACtC,MAAM,OAAO,KAAK,SAAS,QAAQ;GAEnC,IAAI,CAAC,GAAG,WAAW,IAAI,GACrB;GAGF,MAAM,UAAU,GAAG,SAAS,IAAI;GAChC,MAAM,UAAU,uBAAuB,OAAO;GAE9C,IAAI,CAAC,WAAW,YAAY,WAC1B;GAGF,GAAG,UAAU,MAAM,0BAA0B,SAAS,SAAS,CAAC;GAChE,QAAQ,KAAK,IAAI;EACnB;EAEA,IAAI,QAAQ,SAAS,GACnB,QAAQ,IACN,8CAA8C,UAAU,MAAM,QAAQ,OAAO,SAC/E;CAEJ,SAAS,OAAO;EACd,QAAQ,KACN,qDAAqD,iBAAiB,QAAQ,MAAM,UAAU,OAChG;CACF;AACF;;;;;;;;;;AC5EA,SAAgB,yBACd,QACA,mBAA2B,eAClB;CACT,IAAI,CAAC,OAAO,IAAI,aACd,OAAO;CAOT,IAHE,WAAW,gBAAgB,KAC3B,aAAa,kBAAkB,OAAO,CAAC,CAAC,SAAS,WAAkB,GAGnE,OAAO;CAGT,QAAQ,KACN,+BAA+B,OAAO,IAAI,YAAY,uBAAuB,aAAa,WAC5F;CACA,QAAQ,KACN,sGACF;CAEA,OAAO;AACT;;;ACXA,IAAM,YAAY,QAAQ,cAAc,YAAY,GAAG,CAAC;AAGxD,IAAI;AACJ,IAAI;AACJ,IAAI;AAEJ,IAAM,iCAAiB,IAAI,IAAkD;;;;AA2B7E,SAAS,aAAa,MAAsB;CAC1C,MAAM,eAAe,QAAQ,WAAW,MAAM,aAAa,GAAG,KAAK,MAAM;CACzE,IAAI;EACF,OAAO,aAAa,cAAc,OAAO;CAC3C,QAAQ;EACN,OAAO,mBAAmB,KAAK;CACjC;AACF;;;;AAKA,SAAgB,uBACd,aACA,MACY;CACZ,IAAI,CAAC,aAAa,OAAO,KAAK;CAE9B,MAAM,gBAAgB,KAAK,eAAe,IAAI,WAAW;CACzD,IAAI,CAAC,eAAe,aAAa,OAAO,KAAK;CAG7C,OAAO;EACL,GAAG,KAAK;EACR,eAAe,cAAc;CAC/B;AACF;;;;;AAMA,SAAgB,WACd,KACA,KACA,MACM;CACN,MAAM,WAAW,IAAI,QAAQ,uBAAiC;CAG9D,MAAM,WAAW,IAAI,OAAO,iBAAiB;CAC7C,MAAM,eAAe,IAAI,QAAQ;CACjC,MAAM,gBAAgB,IAAI,QAAQ;CAClC,MAAM,OAAO,IAAI,QAAQ,sBAAgC;CAGzD,MAAM,cAAc,KAAK,cAAc,IAAI,QAAQ;CAGnD,MAAM,aAAa,uBAAuB,aAAa,IAAI;CAE3D,MAAM,WAAW,gBACf,UACA,cACA,WAAW,gBACb;CAYA,IAVe,UACb;EACE;EACA,IAAI;EACJ;EACA;CACF,GACA,UAGE,CAAA,CAAO,SAAS;EAElB,IAAI,aAAa;GACf,KAAK,oBAAoB,WAAW;GACpC,KAAK,UAAU;IACb,SAAS;IACT,WAAW,KAAK,IAAI;IACpB,IAAI;IACJ,WAAW,IAAI,QAAQ,iBAAiB;IACxC;GACF,CAAC;EACH;EAEA,IAAI,UAAU,GAAG;EACjB,IAAI,IAAI;CACV,OAAO;EAEL,IAAI,UAAU,KAAK,EACjB,oBAAoB,yBACtB,CAAC;EACD,IAAI,IAAI,cAAc;CACxB;AACF;;;;;AAMA,eAAsB,aACpB,KACA,KACA,MACe;CACf,MAAM,WAAW,IAAI,QAAQ,uBAAiC,IAAI,QAAQ,QAAQ;CAClF,MAAM,cAAc,KAAK,cAAc,IAAI,QAAQ;CAEnD,IAAI,CAAC,aAAa;EAEhB,MAAM,WAAW,KAAK,aAAa,OAAO;EAC1C,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;EAClD,IAAI,IAAI,SAAS,QAAQ,eAAe,mBAAmB,CAAC;EAC5D;CACF;CAIA,IADe,KAAK,WAAW,WAC3B,CAAA,EAAQ,WAAW,YAAY;EAEjC,MAAM,WAAW,KAAK,aAAa,MAAM;EACzC,IAAI,UAAU,KAAK;GACjB,gBAAgB;GAChB,eAAe;EACjB,CAAC;EACD,IAAI,IACF,SACG,QAAQ,oBAAoB,WAAW,CAAC,CACxC,QAAQ,qBAAqB,QAAQ,CAC1C;EACA;CACF;CAGA,KAAK,iBAAiB,aAAa,UAAU;CAG7C,MAAM,WAAW,KAAK,aAAa,MAAM;CACzC,IAAI,UAAU,KAAK;EACjB,gBAAgB;EAChB,eAAe;CACjB,CAAC;CACD,IAAI,IACF,SACG,QAAQ,oBAAoB,WAAW,CAAC,CACxC,QAAQ,qBAAqB,QAAQ,CAC1C;CAOA,KAAU,aAAa,WAAW,CAAC,CAChC,MAAM,YAAY;EACjB,KAAK,iBAAiB,aAAa,UAAU,YAAY,SAAS;CACpE,CAAC,CAAC,CACD,OAAO,UAAmB;EAEzB,KAAK,iBAAiB,aAAa,SAAS;EAC5C,QAAQ,MAAM,mBAAmB,YAAY,IAAI,KAAK;CACxD,CAAC;AACL;;;;AAKA,eAAsB,aACpB,KACA,KACA,MACe;CAEf,MAAM,cAAc,IADJ,IAAI,IAAI,OAAO,KAAK,UAAU,IAAI,QAAQ,MACtC,CAAA,CAAI,aAAa,IAAI,SAAS;CAElD,IAAI,CAAC,aAAa;EAChB,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;EACzD,IAAI,IAAI,KAAK,UAAU,EAAE,OAAO,4BAA4B,CAAC,CAAC;EAC9D;CACF;CAEA,MAAM,OAAO,MAAM,KAAK,eAAe,WAAW;CAClD,MAAM,SAAS,KAAK,WAAW,WAAW;CAE1C,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;CACzD,IAAI,IACF,KAAK,UAAU;EACb,MAAM;EACN,QAAQ,MAAM,UAAU,QAAQ,UAAU;EAC1C,OAAO,MAAM,WAAW;CAC1B,CAAC,CACH;AACF;;;;;;;;;AAUA,SAAgB,UAAU,QAAoC;CAC5D,IAAI;CAEJ,IAAI;EACF,OAAO,IAAI,IAAI,UAAU,KAAK,kBAAkB,CAAC,CAAC;CACpD,QAAQ;EACN,OAAO;CACT;CAEA,OAAO,KAAK,SAAS,KAAK,KAAK,SAAS,GAAG,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI;AACrE;;;;AAKA,eAAsB,cACpB,KACA,KACA,MACe;CAOf,MAAM,OAAO,UAAU,IAAI,GAAG;CAE9B,IAAI;EAEF,IAAI,SAAS,eAAe,KAAK,WAAW,YAAY,GACtD,WAAW,KAAK,KAAK,IAAI;OACpB,IAAI,SAAS,iBAAiB,KAAK,WAAW,cAAc,GACjE,MAAM,aAAa,KAAK,KAAK,IAAI;OAC5B,IAAI,SAAS,eAAe;GACjC,IAAI,UAAU,KAAK,EAAE,gBAAgB,mBAAmB,CAAC;GACzD,IAAI,IAAI,KAAK,UAAU;IAAE,QAAQ;IAAM,SAAS;GAAc,CAAC,CAAC;EAClE,OAEE,MAAM,aAAa,KAAK,KAAK,IAAI;CAErC,SAAS,OAAO;EACd,QAAQ,MAAM,kBAAkB,KAAK;EACrC,IAAI,UAAU,KAAK,EAAE,gBAAgB,aAAa,CAAC;EACnD,IAAI,IAAI,uBAAuB;CACjC;AACF;;;;AAKA,SAAS,iBAAuB;CAC9B,cAAc,gBAAgB,OAAO,eAAe;CACpD,gBAAgB,mBAAmB,aAAa,OAAO,GAAG;CAG1D,eAAe,MAAM;CACrB,KAAK,MAAM,CAAC,MAAM,eAAe,aAAa;EAC5C,MAAM,gBAAgB,kBAAkB,UAAU;EAClD,IAAI,cAAc,eAAe,cAAc,cAAc;GAC3D,eAAe,IAAI,MAAM,aAAa;GACtC,QAAQ,IAAI,KAAK,KAAK,SAAS,cAAc,eAAe,UAAU,SAAS,cAAc,gBAAgB,WAAW;EAC1H;CACF;CAEA,QAAQ,IAAI,UAAU,YAAY,KAAK,aAAa,eAAe,KAAK,qBAAqB;AAC/F;;;;AAKA,SAAgB,YAAY,aAAgC;CAC1D,SAAS;CAGT,OAAO,OAAO,MAAM;CAIpB,uBAAuB,OAAO,eAAe;CAI7C,yBAAyB,MAAM;CAG/B,eAAe;CAGf,iBAAiB,OAAO,uBAAuB;EAC7C,QAAQ,IAAI,oCAAoC;EAChD,eAAe;CACjB,CAAC;CAID,MAAM,cAA0B;EAC9B,MAAM,OAAO;EACb;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACF;CAaA,cAV6B,KAAK,QAAQ;EACxC,cAAc,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,OAAO,UAAU;GAC/C,QAAQ,MAAM,oBAAoB,KAAK;GACvC,IAAI,CAAC,IAAI,aAAa;IACpB,IAAI,UAAU,GAAG;IACjB,IAAI,IAAI,uBAAuB;GACjC;EACF,CAAC;CACH,CAEA,CAAA,CAAO,OAAO,OAAO,YAAY;EAC/B,QAAQ,IAAI,kCAAkC,OAAO,MAAM;EAC3D,QAAQ,IAAI,QAAQ,OAAO,KAAK;EAChC,QAAQ,IAAI,aAAa,YAAY,MAAM;CAC7C,CAAC;AACH"}

package/dist/server.js

@@ -1,2 +1,2 @@
-import { a as handleStatus, i as handleRequest, n as handleAuth, o as routePath, r as handleErrors, s as startServer, t as getEffectiveAuthConfig } from "./server-EPU5dtPx.js";
+import { a as handleStatus, i as handleRequest, n as handleAuth, o as routePath, r as handleErrors, s as startServer, t as getEffectiveAuthConfig } from "./server-DZAo8Clg.js";
 export { getEffectiveAuthConfig, handleAuth, handleErrors, handleRequest, handleStatus, routePath, startServer };

package/dist/setup/ddev.d.ts

@@ -4,8 +4,27 @@ import type { TlsConfig } from "../types.js";
  * Install system dependencies required by Trafic
  */
 export declare function installSystemDeps(io?: SetupIo): void;
+/** Where the DDEV signing key is installed. */
+export declare const DDEV_KEYRING = "/etc/apt/keyrings/ddev.asc";
+/** The deb822 source file naming the DDEV repository. */
+export declare const DDEV_SOURCES = "/etc/apt/sources.list.d/ddev.sources";
 /**
- * Add the official DDEV apt repository and GPG key.
+ * Add the official DDEV apt repository and signing key.
+ *
+ * The repository is the Cloudsmith one DDEV 1.25.4 moved to
+ * (ddev/ddev#8698). The former Gemfury host, `pkg.ddev.com`, still serves
+ * packages and carries no retirement date, but DDEV now tells Linux users to
+ * switch, so this follows the documented install.
+ *
+ * Two differences from the copy/paste block in DDEV's docs, both deliberate:
+ * the key is written by curl rather than piped into `tee`, so a failed
+ * download exits non-zero here instead of surfacing as a confusing GPG error
+ * on the next `apt-get update` (the same reasoning as the NodeSource key);
+ * and the docs' `sudo` is dropped because setup already runs as root.
+ *
+ * The key is served armoured and stays that way — `.asc` rather than a
+ * dearmoured `.gpg` — which is what `Signed-By` in the source file names.
+ *
  * Idempotent: safe to call even if the repository is already configured.
  */
 export declare function addDdevAptRepo(io?: SetupIo): void;
@@ -189,12 +208,16 @@ export interface ConfigureTraefikOptions {
  */
 export declare function configureTraefik(options?: ConfigureTraefikOptions, io?: SetupIo): void;
 /**
- * Name of one running DDEV project, or null when none runs.
+ * Names of the running DDEV projects.
  *
  * `ddev list -j` is the only source that knows: `project_list.yaml`, which the
  * agent watches for discovery, records every project DDEV has ever seen but
  * carries no live status — a project stopped an hour ago still sits there.
  * `ddev list -j` asks Docker, and wraps the entries in a `raw` array.
+ */
+export declare function findRunningProjects(io?: SetupIo): string[];
+/**
+ * Name of one running DDEV project, or null when none runs.
  *
  * Used to push a changed global Traefik config into the running router: DDEV
  * copies `custom-global-config/*.yaml` into it on any `ddev start`, so

package/dist/setup/ddev.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ddev.d.ts","sourceRoot":"","sources":["../../src/setup/ddev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAY5D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAWzD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CA2BtD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,GAAE,OAAgB,GAAG,OAAO,CAqBrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,EACd,EAAE,GAAE,OAAgB,GACnB,IAAI,CA0BN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,OAAgB,GAAG,IAAI,CAsCtE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,CAY/D;AAUD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,EAAE,CAU5D;AAED,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,OAAgB,GAAG,WAAW,CAUjE;AAED,wDAAwD;AACxD,eAAO,MAAM,WAAW,6BAA6B,CAAC;AAEtD,6EAA6E;AAC7E,eAAO,MAAM,aAAa,uDAA6C,CAAC;AAExE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,oEAA0D,CAAC;AAExF,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,gDAAgD,CAAC;AAErF,6DAA6D;AAC7D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,GAAE,WAAkC,EAC/C,GAAG,CAAC,EAAE,kBAAkB,GACvB,MAAM,CAsCR;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAU9E;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,WAAkC,GAC9C,MAAM,CA4DR;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,GAAE,OAAgB,GAAG,mBAAmB,CAOjF;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,CAI3D;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,uBAA4B,EACrC,EAAE,GAAE,OAAgB,GACnB,IAAI,CAoDN;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,GAAG,IAAI,CAetE"}
+{"version":3,"file":"ddev.d.ts","sourceRoot":"","sources":["../../src/setup/ddev.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAY5D;AAED,+CAA+C;AAC/C,eAAO,MAAM,YAAY,+BAA+B,CAAC;AAEzD,yDAAyD;AACzD,eAAO,MAAM,YAAY,yCAAyC,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAUzD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CA2BtD;AAKD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,GAAE,OAAgB,GAAG,OAAO,CAqBrE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,EACd,EAAE,GAAE,OAAgB,GACnB,IAAI,CA0BN;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,OAAgB,GAAG,IAAI,CAsCtE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,CAY/D;AAUD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,EAAE,CAU5D;AAED,gDAAgD;AAChD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAKD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,OAAgB,GAAG,WAAW,CAUjE;AAED,wDAAwD;AACxD,eAAO,MAAM,WAAW,6BAA6B,CAAC;AAEtD,6EAA6E;AAC7E,eAAO,MAAM,aAAa,uDAA6C,CAAC;AAExE,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,oEAA0D,CAAC;AAExF,qEAAqE;AACrE,eAAO,MAAM,uBAAuB,gDAAgD,CAAC;AAErF,6DAA6D;AAC7D,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,gEAAgE;AAChE,MAAM,WAAW,kBAAkB;IACjC,4CAA4C;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,WAAW,GAAE,WAAkC,EAC/C,GAAG,CAAC,EAAE,kBAAkB,GACvB,MAAM,CAsCR;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAevD;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAU9E;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,EACjB,WAAW,GAAE,WAAkC,GAC9C,MAAM,CA4DR;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,GAAE,OAAgB,GAAG,mBAAmB,CAOjF;AAED,sDAAsD;AACtD,wBAAgB,cAAc,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,CAI3D;AAED,oCAAoC;AACpC,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,GAAG,CAAC,EAAE,SAAS,CAAC;IAChB,gEAAgE;IAChE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,uBAA4B,EACrC,EAAE,GAAE,OAAgB,GACnB,IAAI,CAoDN;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,EAAE,CAgBlE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,GAAE,OAAgB,GAAG,MAAM,GAAG,IAAI,CAEtE"}

package/dist/setup/docker.d.ts

@@ -30,6 +30,26 @@ export declare function addDockerAddressPools(io?: SetupIo): boolean;
  * Configure Docker for production use
  */
 export declare function configureDocker(io?: SetupIo): void;
+/**
+ * Restart Docker to apply daemon.json, without orphaning running containers.
+ *
+ * `live-restore` keeps containers running across a restart, but only when
+ * the storage driver stays the same. Before 0.1.47, setup applied daemon.json
+ * with a reload, and a reload does not apply `storage-driver`. Docker 29
+ * defaults a fresh install to the containerd image store (`overlayfs`), so
+ * such a server runs `overlayfs` while daemon.json says `overlay2`. The first
+ * full restart switches the driver, and dockerd silently skips every
+ * container created with the other one. Their processes keep running and
+ * keep the locks on the database volumes. DDEV then creates new containers
+ * that exit at once on "Can't lock aria control file". Seen on a live server
+ * after migration 0018: 66 containers lost, 27 of them databases.
+ *
+ * So when the driver is about to change, the DDEV projects are stopped first,
+ * which shuts their databases down cleanly, and the projects that were running
+ * are started again on the new driver. Volumes do not depend on the storage
+ * driver, so no data moves. Images are pulled again for the new driver.
+ */
+export declare function restartDocker(io?: SetupIo): void;
 /**
  * Setup Docker system prune cron job
  */

package/dist/setup/docker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/setup/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAG/C;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAwBxD;AAED,gCAAgC;AAChC,eAAO,MAAM,aAAa,4BAA4B,CAAC;AAEvD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;;;GAAwC,CAAC;AAE1E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,GAAE,OAAgB,GAAG,OAAO,CAsBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAuC1D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAW3D"}
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../src/setup/docker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAI/C;;GAEG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAwBxD;AAED,gCAAgC;AAChC,eAAO,MAAM,aAAa,4BAA4B,CAAC;AAEvD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;;;GAAwC,CAAC;AAE1E;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,GAAE,OAAgB,GAAG,OAAO,CAsBnE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAsC1D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,aAAa,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAsBxD;AAuBD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAW3D"}

package/dist/setup/migrations/0014__unattended_upgrades_docker_origin.d.ts

@@ -11,9 +11,9 @@ import type { Migration } from "../types.js";
  * and its dist is the Ubuntu codename, so
  * `"origin=Docker,codename=${distro_codename}"` is the entry that matches it.
  *
- * DDEV, installed from pkg.ddev.com, is deliberately not added: a DDEV major
- * landing unattended can break running previews. DDEV is updated by
- * `trafic-agent upgrade` instead, when an operator is there to see it.
+ * DDEV, installed from its own apt repository, is deliberately not added: a
+ * DDEV major landing unattended can break running previews. DDEV is updated
+ * by `trafic-agent upgrade` instead, when an operator is there to see it.
  *
  * `configureUnattendedUpgrades` now writes the Docker entry, which covers
  * fresh installs. Servers set up by an earlier release still carry the old

package/dist/setup/migrations/0017__ddev_apt_cloudsmith.d.ts

@@ -0,0 +1,28 @@
+import { type SetupIo } from "../io.js";
+import type { Migration } from "../types.js";
+/**
+ * Migration 0017: move the DDEV apt repository from Gemfury to Cloudsmith.
+ *
+ * DDEV 1.25.4 moved its Debian and RPM packages to Cloudsmith
+ * (ddev/ddev#8698) and its install docs now name
+ * `https://packages.ddev.com/public/deb/ubuntu` with the key at
+ * `https://packages.ddev.com/public/gpg.key`. The former Gemfury host,
+ * `pkg.ddev.com`, still receives packages and DDEV has announced no
+ * retirement date, so nothing is broken today — but a server left on the old
+ * repository would stop seeing new DDEV releases the day it is switched off,
+ * and `trafic-agent upgrade` runs `apt-get install --only-upgrade ddev`
+ * against whatever repository is configured.
+ *
+ * The old files are removed rather than left alongside the new ones, as
+ * DDEV's own instructions do: two sources offering the same package make apt
+ * pick by version and would leave the Gemfury host in the picture for as
+ * long as it answers. `setup` writes only the Cloudsmith source, so a fresh
+ * server and an upgraded one end up identical.
+ *
+ * Idempotent: skipped once the Cloudsmith source file is in place, and each
+ * removal is guarded by the file's existence.
+ */
+export declare const migration0017DdevAptCloudsmith: Migration;
+/** The migration body, with its effects injected so tests can drive it. */
+export declare function runDdevAptCloudsmithMigration(io?: SetupIo): void;
+//# sourceMappingURL=0017__ddev_apt_cloudsmith.d.ts.map

package/dist/setup/migrations/0017__ddev_apt_cloudsmith.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0017__ddev_apt_cloudsmith.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0017__ddev_apt_cloudsmith.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAQ7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAO5C,CAAC;AAEF,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAkBxE"}

package/dist/setup/migrations/0018__docker_address_pools.d.ts

@@ -19,6 +19,13 @@ import type { Migration } from "../types.js";
  * networks keep their subnets; only new networks get a /24, and Docker skips
  * subnets an existing network already uses.
  *
+ * Changed after release: the first version ran `systemctl restart docker`
+ * directly. On servers set up before 0.1.47 that restart also switched the
+ * storage driver, which `live-restore` cannot survive, and orphaned every
+ * running container (see restartDocker). The result on a server is the same
+ * either way; only servers that have not run it yet get the safe restart.
+ * Servers that already ran it are repaired by migration 0019.
+ *
  * Idempotent: does nothing when the config already sets pools.
  */
 export declare const migration0018DockerAddressPools: Migration;

package/dist/setup/migrations/0018__docker_address_pools.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"0018__docker_address_pools.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0018__docker_address_pools.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAO7C,CAAC;AAEF;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAIzE"}
+{"version":3,"file":"0018__docker_address_pools.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0018__docker_address_pools.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,+BAA+B,EAAE,SAO7C,CAAC;AAEF;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CAIzE"}

package/dist/setup/migrations/0019__recover_orphan_containers.d.ts

@@ -0,0 +1,36 @@
+import { type SetupIo } from "../io.js";
+import type { Migration } from "../types.js";
+/** How long a container gets to stop after SIGTERM, in seconds. */
+export declare const STOP_TIMEOUT = 600;
+/**
+ * Migration 0019: stop the containers Docker lost track of in migration 0018.
+ *
+ * 0018 restarted Docker to apply the address pools. On a server set up before
+ * 0.1.47, Docker ran the containerd image store (`overlayfs`) although
+ * daemon.json asked for `overlay2`, and the restart switched the driver.
+ * dockerd skips containers created with another driver, so it forgot every
+ * running container — but `live-restore` had left their processes running.
+ * Those orphans keep the locks on the project volumes: each new database
+ * container exits on "Can't lock aria control file", each Elasticsearch on
+ * "failed to obtain node locks", and the project never starts again. Seen
+ * on a live server: 66 orphans, 27 of them databases.
+ *
+ * containerd still knows the orphans: they are the tasks in the `moby`
+ * namespace with no matching Docker container. Each one gets SIGTERM, which
+ * MariaDB, MySQL and Elasticsearch handle as a clean shutdown, and as long as
+ * it needs. No SIGKILL: a database killed mid-write is the one outcome worse
+ * than the outage, so a process that does not stop is reported and left
+ * alone. The stopped tasks are then deleted, which ends their shims.
+ *
+ * Nothing is restarted here: the volumes are free again, and the agent starts
+ * each project on its next request, on the new driver.
+ *
+ * Idempotent: does nothing when every containerd task belongs to a container
+ * Docker knows.
+ */
+export declare const migration0019RecoverOrphanContainers: Migration;
+/**
+ * The migration body, with its effects injected so tests can drive it.
+ */
+export declare function recoverOrphanContainers(io?: SetupIo): void;
+//# sourceMappingURL=0019__recover_orphan_containers.d.ts.map

package/dist/setup/migrations/0019__recover_orphan_containers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"0019__recover_orphan_containers.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/0019__recover_orphan_containers.ts"],"names":[],"mappings":"AACA,OAAO,EAAU,KAAK,OAAO,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,mEAAmE;AACnE,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,oCAAoC,EAAE,SAOlD,CAAC;AASF;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,EAAE,GAAE,OAAgB,GAAG,IAAI,CA8BlE"}

package/dist/setup/migrations/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAmBjF,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,EAkBrC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/setup/migrations/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAqBjF,iDAAiD;AACjD,eAAO,MAAM,qBAAqB,iCAAiC,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,cAAc,EAAE,SAAS,EAoBrC,CAAC;AAMF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAqBnD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAG9D;AAMD;;GAEG;AACH,wBAAgB,cAAc,IAAI,kBAAkB,EAAE,CAMrD;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,UAAQ,GAAG,IAAI,CAyBzD;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAU/C"}