ysk-server-core 1.0.0

package/dist/hosting/service-exposure/store.js

@@ -0,0 +1,158 @@
+/**
+ * Persist desired service network exposure under dataDir.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { defaultExposureMode, defaultPortsForService, isValidServiceId, normalizeExposureMode, normalizePortBinding, } from 'ysk-server-shared';
+import { normalizeIpOrCidr } from '../../net/ip.js';
+function storePath(dataDir) {
+    return join(dataDir, 'network', 'service-exposure.json');
+}
+export function emptyExposureStore() {
+    return { version: 1, services: {} };
+}
+export function loadExposureStore(dataDir) {
+    const path = storePath(dataDir);
+    if (!existsSync(path))
+        return emptyExposureStore();
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        return normalizeExposureStore(raw);
+    }
+    catch {
+        return emptyExposureStore();
+    }
+}
+export function saveExposureStore(dataDir, store) {
+    const path = storePath(dataDir);
+    mkdirSync(join(dataDir, 'network'), { recursive: true });
+    const clean = normalizeExposureStore(store);
+    writeFileSync(path, JSON.stringify(clean, null, 2) + '\n', 'utf8');
+    return path;
+}
+export function normalizeAllowFrom(list) {
+    if (!Array.isArray(list))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const item of list) {
+        const n = normalizeIpOrCidr(String(item ?? '').trim());
+        if (!n || seen.has(n))
+            continue;
+        seen.add(n);
+        out.push(n);
+        if (out.length >= 64)
+            break;
+    }
+    return out;
+}
+export function normalizeExposureDesired(raw) {
+    const serviceId = String(raw.serviceId ?? '').trim();
+    const mode = normalizeExposureMode(raw.mode);
+    const portsRaw = Array.isArray(raw.ports) ? raw.ports : [];
+    const ports = [];
+    for (const p of portsRaw) {
+        const b = normalizePortBinding(p);
+        if (b)
+            ports.push(b);
+    }
+    const allowFrom = normalizeAllowFrom(raw.allowFrom);
+    const allowCountries = Array.isArray(raw.allowCountries)
+        ? raw.allowCountries
+            .map((c) => String(c ?? '').trim().toUpperCase())
+            .filter((c) => /^[A-Z]{2}$/.test(c))
+            .slice(0, 64)
+        : undefined;
+    return {
+        serviceId,
+        mode,
+        ports,
+        allowFrom: mode === 'restricted' ? allowFrom : allowFrom.length ? allowFrom : undefined,
+        allowCountries: allowCountries?.length ? allowCountries : undefined,
+        decided: raw.decided === true,
+        updatedAt: typeof raw.updatedAt === 'string' && raw.updatedAt
+            ? raw.updatedAt
+            : new Date().toISOString(),
+    };
+}
+export function normalizeExposureStore(raw) {
+    const services = {};
+    const src = raw.services && typeof raw.services === 'object' ? raw.services : {};
+    for (const [k, v] of Object.entries(src)) {
+        if (!v || typeof v !== 'object')
+            continue;
+        const id = String(v.serviceId || k).trim();
+        if (!isValidServiceId(id) && !/^[a-zA-Z0-9._-]{1,64}$/.test(id))
+            continue;
+        services[id] = normalizeExposureDesired({
+            ...v,
+            serviceId: id,
+        });
+    }
+    return { version: 1, services };
+}
+/** Ensure a desired record exists (catalog defaults). Does not persist. */
+export function ensureDesired(store, serviceId, ports) {
+    const existing = store.services[serviceId];
+    if (existing) {
+        if (ports && ports.length > 0) {
+            return {
+                ...existing,
+                ports,
+                updatedAt: new Date().toISOString(),
+            };
+        }
+        return existing;
+    }
+    const mode = defaultExposureMode(serviceId);
+    const resolvedPorts = ports && ports.length > 0 ? ports : defaultPortsForService(serviceId);
+    return {
+        serviceId,
+        mode,
+        ports: resolvedPorts,
+        decided: mode === 'public',
+        updatedAt: new Date().toISOString(),
+    };
+}
+export function upsertDesired(dataDir, serviceId, patch) {
+    const store = loadExposureStore(dataDir);
+    const base = ensureDesired(store, serviceId);
+    const next = normalizeExposureDesired({
+        ...base,
+        ...patch,
+        serviceId,
+        updatedAt: new Date().toISOString(),
+    });
+    // preserve ports if patch omitted them
+    if (!Array.isArray(patch.ports)) {
+        next.ports = base.ports;
+    }
+    if (patch.mode === undefined) {
+        next.mode = base.mode;
+    }
+    else {
+        next.mode = normalizeExposureMode(patch.mode);
+    }
+    if (patch.decided !== undefined) {
+        next.decided = patch.decided === true;
+    }
+    else if (patch.mode !== undefined) {
+        // Explicit mode change from API/UI counts as a decision
+        next.decided = true;
+    }
+    else {
+        next.decided = base.decided;
+    }
+    store.services[serviceId] = next;
+    saveExposureStore(dataDir, store);
+    return next;
+}
+export function listDesired(dataDir) {
+    const store = loadExposureStore(dataDir);
+    return Object.values(store.services).sort((a, b) => a.serviceId.localeCompare(b.serviceId));
+}
+export function getDesired(dataDir, serviceId) {
+    const store = loadExposureStore(dataDir);
+    return store.services[serviceId] ?? null;
+}
+//# sourceMappingURL=store.js.map

package/dist/hosting/service-exposure/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/hosting/service-exposure/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,GAKrB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEpD,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,kBAAkB,EAAE,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAkC,CAAC;QACpF,OAAO,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,KAA2B;IAC5E,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAChC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,SAAS;QAChC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE;YAAE,MAAM;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,GAA4D;IAE5D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAyB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,oBAAoB,CAAC,CAAgC,CAAC,CAAC;QACjE,IAAI,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACtD,CAAC,CAAC,GAAG,CAAC,cAAc;aACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAChD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aACnC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,SAAS;QACT,IAAI;QACJ,KAAK;QACL,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACvF,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QACnE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;QAC7B,SAAS,EACP,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS;YAChD,CAAC,CAAC,GAAG,CAAC,SAAS;YACf,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAkC;IACvE,MAAM,QAAQ,GAA2C,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAS;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAE,CAA4B,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,SAAS;QAC1E,QAAQ,CAAC,EAAE,CAAC,GAAG,wBAAwB,CAAC;YACtC,GAAI,CAA4B;YAChC,SAAS,EAAE,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC;AAClC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAC3B,KAA2B,EAC3B,SAAiB,EACjB,KAA4B;IAE5B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,GAAG,QAAQ;gBACX,KAAK;gBACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,aAAa,GACjB,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACxE,OAAO;QACL,SAAS;QACT,IAAI;QACJ,KAAK,EAAE,aAAa;QACpB,OAAO,EAAE,IAAI,KAAK,QAAQ;QAC1B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,SAAiB,EACjB,KAAsC;IAEtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,wBAAwB,CAAC;QACpC,GAAG,IAAI;QACP,GAAG,KAAK;QACR,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,uCAAuC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC1B,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAiB,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC;IACxC,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,wDAAwD;QACxD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC9B,CAAC;IACD,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC;IACjC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACjD,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,OAAe,EACf,SAAiB;IAEjB,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC3C,CAAC"}

package/dist/hosting/service-exposure/sync.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Sync desired service exposure → UFW rules (ysk-svc comments).
+ */
+import { type ExposureDecision, type ServiceExposureDesired, type ServicePortBinding, type SyncReason } from 'ysk-server-shared';
+import type { HostExecutor } from '../../host/executor.js';
+export type SyncServiceExposureInput = {
+    host: HostExecutor;
+    dataDir: string;
+    serviceId: string;
+    ports?: ServicePortBinding[];
+    reason: SyncReason;
+    /** When start + private default needs user choice */
+    exposureDecision?: ExposureDecision;
+    allowFrom?: string[];
+    /** L2 ISO country codes for restricted mode (ipset best-effort) */
+    allowCountries?: string[];
+    /**
+     * When true on start with undecided private: return needsExposureDecision
+     * without mutating. Default true.
+     */
+    requireDecision?: boolean;
+};
+export type AppliedRule = {
+    role: string;
+    port: string;
+    proto: string;
+    from?: string;
+    comment: string;
+};
+export type SyncServiceExposureResult = {
+    ok: boolean;
+    serviceId: string;
+    desired: ServiceExposureDesired;
+    applied: AppliedRule[];
+    removed: number;
+    notes: string[];
+    blocked?: boolean;
+    /** Frontend should show private-exposure modal before start */
+    needsExposureDecision?: boolean;
+    defaultMode?: 'private' | 'public';
+};
+/** Build target UFW rule set from desired mode + ports (+ IP sources). Country geo is separate (ipset). */
+export declare function buildTargetRules(desired: ServiceExposureDesired): AppliedRule[];
+/**
+ * Idempotent sync: delete old ysk-svc:<serviceId>:* then apply desired.
+ * stop → delete only, keep desired in store.
+ */
+export declare function syncServiceExposure(input: SyncServiceExposureInput): Promise<SyncServiceExposureResult>;
+/**
+ * List live UFW rules tagged with ysk-svc for a service (or all).
+ */
+export declare function listManagedServiceRules(host: HostExecutor, serviceId?: string): Promise<Array<{
+    num?: number;
+    comment?: string;
+    raw: string;
+    from?: string;
+    to?: string;
+}>>;
+/**
+ * Snapshot for GET: desired + applied rule summary.
+ */
+export declare function getServiceExposureStatus(host: HostExecutor, dataDir: string, serviceId: string): Promise<{
+    desired: ServiceExposureDesired;
+    liveRules: Awaited<ReturnType<typeof listManagedServiceRules>>;
+    inSync: boolean;
+    defaultMode: import('ysk-server-shared').ExposureMode;
+    /** Host UFW / firewall probe for honest UI */
+    firewall?: {
+        installed: boolean;
+        active: string;
+        activeLabel: string;
+    };
+}>;
+/** PUT helper — update mode/allowFrom then optional sync. */
+export declare function putServiceExposure(input: {
+    host: HostExecutor;
+    dataDir: string;
+    serviceId: string;
+    mode?: ServiceExposureDesired['mode'];
+    ports?: ServicePortBinding[];
+    allowFrom?: string[];
+    allowCountries?: string[];
+    sync?: boolean;
+}): Promise<SyncServiceExposureResult | {
+    ok: true;
+    desired: ServiceExposureDesired;
+    notes: string[];
+}>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/hosting/service-exposure/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/hosting/service-exposure/sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAML,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAChB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAgB3D,MAAM,MAAM,wBAAwB,GAAG;IACrC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,sBAAsB,CAAC;IAChC,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,WAAW,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAC;CACpC,CAAC;AAOF,2GAA2G;AAC3G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,sBAAsB,GAAG,WAAW,EAAE,CA+B/E;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,wBAAwB,GAC9B,OAAO,CAAC,yBAAyB,CAAC,CAqPpC;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,YAAY,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,KAAK,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CAsB7F;AAED;;GAEG;AACH,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IACT,OAAO,EAAE,sBAAsB,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC;IAC/D,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,mBAAmB,EAAE,YAAY,CAAC;IACtD,8CAA8C;IAC9C,QAAQ,CAAC,EAAE;QACT,SAAS,EAAE,OAAO,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH,CAAC,CAqCD;AAED,6DAA6D;AAC7D,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACtC,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,yBAAyB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,sBAAsB,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CA6BtG"}

package/dist/hosting/service-exposure/sync.js

@@ -0,0 +1,365 @@
+/**
+ * Sync desired service exposure → UFW rules (ysk-svc comments).
+ */
+import { tl } from 'ysk-server-shared';
+import { defaultExposureMode, defaultPortsForService, isValidServiceId, yskSvcComment, yskSvcCommentPrefix, } from 'ysk-server-shared';
+import { normalizeIpOrCidr } from '../../net/ip.js';
+import { firewallAllowPort, firewallDeleteByComment, parseUfwNumbered, extractUfwComment, } from '../firewall-ops.js';
+import { ensureDesired, loadExposureStore, normalizeAllowFrom, saveExposureStore, upsertDesired, } from './store.js';
+function expandProtos(proto) {
+    if (proto === 'both')
+        return ['tcp', 'udp'];
+    return [proto === 'udp' ? 'udp' : 'tcp'];
+}
+/** Build target UFW rule set from desired mode + ports (+ IP sources). Country geo is separate (ipset). */
+export function buildTargetRules(desired) {
+    if (desired.mode === 'private')
+        return [];
+    const out = [];
+    const countries = desired.allowCountries?.length ?? 0;
+    const sources = desired.mode === 'restricted'
+        ? (desired.allowFrom ?? []).map((s) => normalizeIpOrCidr(s)).filter(Boolean)
+        : [undefined];
+    // Restricted with only countries (no IPs): no public UFW allow — geo ipset handles allowlist
+    if (desired.mode === 'restricted' && sources.length === 0) {
+        return [];
+    }
+    // Restricted with countries + IPs: UFW allowFrom only (geo is additive via ipset)
+    void countries;
+    for (const binding of desired.ports) {
+        for (const p of expandProtos(binding.proto)) {
+            for (const from of sources) {
+                out.push({
+                    role: binding.role,
+                    port: binding.port,
+                    proto: p,
+                    from,
+                    comment: yskSvcComment(desired.serviceId, binding.role),
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Idempotent sync: delete old ysk-svc:<serviceId>:* then apply desired.
+ * stop → delete only, keep desired in store.
+ */
+export async function syncServiceExposure(input) {
+    const serviceId = String(input.serviceId ?? '').trim();
+    const notes = [];
+    const applied = [];
+    if (!serviceId || (!isValidServiceId(serviceId) && !/^[a-zA-Z0-9._-]{1,64}$/.test(serviceId))) {
+        return {
+            ok: false,
+            serviceId,
+            desired: {
+                serviceId: serviceId || 'unknown',
+                mode: 'private',
+                ports: [],
+                updatedAt: new Date().toISOString(),
+            },
+            applied: [],
+            removed: 0,
+            notes: [tl('notes.auto.n1113')],
+        };
+    }
+    const store = loadExposureStore(input.dataDir);
+    let desired = ensureDesired(store, serviceId, input.ports);
+    // Apply exposure decision on start/manual
+    if (input.exposureDecision) {
+        if (input.exposureDecision === 'keep-private') {
+            desired = {
+                ...desired,
+                mode: 'private',
+                decided: true,
+                updatedAt: new Date().toISOString(),
+            };
+        }
+        else if (input.exposureDecision === 'public') {
+            desired = {
+                ...desired,
+                mode: 'public',
+                decided: true,
+                allowFrom: undefined,
+                updatedAt: new Date().toISOString(),
+            };
+        }
+        else if (input.exposureDecision === 'restricted') {
+            const allowFrom = normalizeAllowFrom(input.allowFrom ?? desired.allowFrom ?? []);
+            const { normalizeCountries } = await import('./geo-countries.js');
+            const allowCountries = normalizeCountries(input.allowCountries ?? desired.allowCountries ?? []);
+            desired = {
+                ...desired,
+                mode: 'restricted',
+                allowFrom,
+                allowCountries: allowCountries.length ? allowCountries : undefined,
+                decided: true,
+                updatedAt: new Date().toISOString(),
+            };
+        }
+    }
+    else if (input.allowFrom && input.reason === 'manual') {
+        desired = {
+            ...desired,
+            allowFrom: normalizeAllowFrom(input.allowFrom),
+            updatedAt: new Date().toISOString(),
+        };
+    }
+    if (input.allowCountries && (input.reason === 'manual' || input.exposureDecision === 'restricted')) {
+        const { normalizeCountries } = await import('./geo-countries.js');
+        const allowCountries = normalizeCountries(input.allowCountries);
+        desired = {
+            ...desired,
+            allowCountries: allowCountries.length ? allowCountries : undefined,
+            updatedAt: new Date().toISOString(),
+        };
+    }
+    if (input.ports && input.ports.length > 0) {
+        desired = { ...desired, ports: input.ports, updatedAt: new Date().toISOString() };
+    }
+    else if (desired.ports.length === 0) {
+        desired = {
+            ...desired,
+            ports: defaultPortsForService(serviceId),
+            updatedAt: new Date().toISOString(),
+        };
+    }
+    // Private start without decision → ask UI first (do not start opening ports)
+    const defMode = defaultExposureMode(serviceId);
+    const requireDecision = input.requireDecision !== false;
+    if (input.reason === 'start' &&
+        requireDecision &&
+        defMode === 'private' &&
+        !desired.decided &&
+        !input.exposureDecision) {
+        // Persist skeleton so UI can load it
+        store.services[serviceId] = desired;
+        saveExposureStore(input.dataDir, store);
+        return {
+            ok: true,
+            serviceId,
+            desired,
+            applied: [],
+            removed: 0,
+            notes: [tl('notes.serviceExposure.needsDecision', { service: serviceId })],
+            needsExposureDecision: true,
+            defaultMode: 'private',
+        };
+    }
+    // Persist desired before UFW mutations
+    store.services[serviceId] = desired;
+    saveExposureStore(input.dataDir, store);
+    const prefix = yskSvcCommentPrefix(serviceId);
+    // stop: only remove rules + country ipset
+    if (input.reason === 'stop') {
+        const del = await firewallDeleteByComment(input.host, prefix);
+        notes.push(...del.notes);
+        try {
+            const { clearCountryIpset } = await import('./geo-countries.js');
+            const clr = await clearCountryIpset({ host: input.host, serviceId });
+            notes.push(...clr.notes);
+        }
+        catch {
+            /* non-fatal */
+        }
+        return {
+            ok: del.ok || del.removed >= 0,
+            serviceId,
+            desired,
+            applied: [],
+            removed: del.removed,
+            notes,
+            blocked: del.blocked,
+        };
+    }
+    // Always clear old managed rules for this service, then re-apply
+    const del = await firewallDeleteByComment(input.host, prefix);
+    notes.push(...del.notes);
+    if (del.blocked) {
+        return {
+            ok: false,
+            serviceId,
+            desired,
+            applied: [],
+            removed: del.removed,
+            notes,
+            blocked: true,
+        };
+    }
+    // Clear previous geo ipset before re-apply (private/public/restricted rebuild)
+    try {
+        const { clearCountryIpset } = await import('./geo-countries.js');
+        const clr = await clearCountryIpset({ host: input.host, serviceId });
+        notes.push(...clr.notes);
+    }
+    catch {
+        /* non-fatal */
+    }
+    const targets = buildTargetRules(desired);
+    let fail = 0;
+    for (const t of targets) {
+        const r = await firewallAllowPort(input.host, t.port, t.proto, t.from, t.comment);
+        notes.push(...r.notes);
+        if (r.blocked) {
+            return {
+                ok: false,
+                serviceId,
+                desired,
+                applied,
+                removed: del.removed,
+                notes,
+                blocked: true,
+            };
+        }
+        if (r.ok) {
+            applied.push(t);
+        }
+        else {
+            fail += 1;
+        }
+    }
+    // L2: country allowlist via ipset (restricted only)
+    if (desired.mode === 'restricted' && (desired.allowCountries?.length ?? 0) > 0) {
+        try {
+            const { applyCountryIpsetAllow } = await import('./geo-countries.js');
+            const geoPorts = [];
+            for (const b of desired.ports) {
+                for (const p of expandProtos(b.proto)) {
+                    geoPorts.push({ port: b.port, proto: p });
+                }
+            }
+            const geo = await applyCountryIpsetAllow({
+                host: input.host,
+                dataDir: input.dataDir,
+                serviceId,
+                countries: desired.allowCountries ?? [],
+                ports: geoPorts,
+                fetchZones: true,
+            });
+            notes.push(...geo.notes.slice(0, 8));
+            if (geo.blocked) {
+                return {
+                    ok: false,
+                    serviceId,
+                    desired,
+                    applied,
+                    removed: del.removed,
+                    notes,
+                    blocked: true,
+                };
+            }
+            if (!geo.ok)
+                fail += 1;
+        }
+        catch (e) {
+            notes.push(e instanceof Error ? e.message.slice(0, 160) : tl('notes.serviceExposure.geoNoCidrs'));
+        }
+    }
+    if (desired.mode === 'private') {
+        notes.push(tl('notes.serviceExposure.private', { service: serviceId }));
+    }
+    else if (desired.mode === 'restricted' &&
+        targets.length === 0 &&
+        !(desired.allowCountries?.length)) {
+        notes.push(tl('notes.serviceExposure.restrictedEmpty'));
+    }
+    return {
+        ok: fail === 0,
+        serviceId,
+        desired,
+        applied,
+        removed: del.removed,
+        notes,
+    };
+}
+/**
+ * List live UFW rules tagged with ysk-svc for a service (or all).
+ */
+export async function listManagedServiceRules(host, serviceId) {
+    const num = await host.runCommand(['ufw', 'status', 'numbered'], { timeoutMs: 10_000 });
+    const body = `${num.stdout || ''}`.trim();
+    const rules = parseUfwNumbered(body
+        .split('\n')
+        .map((l) => l.trim())
+        .filter((t) => /^\[\s*\d+\]/.test(t)));
+    const prefix = serviceId ? yskSvcCommentPrefix(serviceId) : 'ysk-svc:';
+    return rules
+        .filter((r) => {
+        const c = r.comment || extractUfwComment(r.raw) || '';
+        return c.startsWith(prefix) || c === prefix.replace(/:$/, '');
+    })
+        .map((r) => ({
+        num: r.num,
+        comment: r.comment,
+        raw: r.raw,
+        from: r.from,
+        to: r.to,
+    }));
+}
+/**
+ * Snapshot for GET: desired + applied rule summary.
+ */
+export async function getServiceExposureStatus(host, dataDir, serviceId) {
+    const store = loadExposureStore(dataDir);
+    const desired = ensureDesired(store, serviceId);
+    // do not auto-persist on GET
+    const liveRules = await listManagedServiceRules(host, serviceId);
+    const targets = buildTargetRules(desired);
+    const inSync = desired.mode === 'private'
+        ? liveRules.length === 0
+        : liveRules.length >= targets.length && targets.length > 0
+            ? true
+            : targets.length === 0
+                ? liveRules.length === 0
+                : false;
+    let firewall;
+    try {
+        const { probeFirewallDeep } = await import('../firewall-ops.js');
+        const st = await probeFirewallDeep(host);
+        firewall = {
+            installed: st.installed,
+            active: st.active,
+            activeLabel: st.activeLabel,
+        };
+    }
+    catch {
+        firewall = undefined;
+    }
+    return {
+        desired,
+        liveRules,
+        inSync,
+        defaultMode: defaultExposureMode(serviceId),
+        firewall,
+    };
+}
+/** PUT helper — update mode/allowFrom then optional sync. */
+export async function putServiceExposure(input) {
+    const desired = upsertDesired(input.dataDir, input.serviceId, {
+        mode: input.mode,
+        ports: input.ports,
+        allowFrom: input.allowFrom,
+        allowCountries: input.allowCountries,
+        decided: true,
+    });
+    if (input.sync === false) {
+        return { ok: true, desired, notes: [] };
+    }
+    return syncServiceExposure({
+        host: input.host,
+        dataDir: input.dataDir,
+        serviceId: input.serviceId,
+        ports: desired.ports,
+        reason: 'manual',
+        exposureDecision: desired.mode === 'private'
+            ? 'keep-private'
+            : desired.mode === 'restricted'
+                ? 'restricted'
+                : 'public',
+        allowFrom: desired.allowFrom,
+        allowCountries: desired.allowCountries,
+        requireDecision: false,
+    });
+}
+//# sourceMappingURL=sync.js.map

package/dist/hosting/service-exposure/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/hosting/service-exposure/sync.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,EACb,mBAAmB,GAKpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,aAAa,GACd,MAAM,YAAY,CAAC;AAyCpB,SAAS,YAAY,CAAC,KAAkC;IACtD,IAAI,KAAK,KAAK,MAAM;QAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,OAAO,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAA+B;IAC9D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,OAAO,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GACX,OAAO,CAAC,IAAI,KAAK,YAAY;QAC3B,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAa;QACxF,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAElB,6FAA6F;IAC7F,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,kFAAkF;IAClF,KAAK,SAAS,CAAC;IAEf,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,IAAI,EAAE,OAAO,CAAC,IAAI;oBAClB,KAAK,EAAE,CAAC;oBACR,IAAI;oBACJ,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA+B;IAE/B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC9F,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,OAAO,EAAE;gBACP,SAAS,EAAE,SAAS,IAAI,SAAS;gBACjC,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,EAAE;gBACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC;YACD,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAE3D,0CAA0C;IAC1C,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,gBAAgB,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YAC/C,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,SAAS;gBACpB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;aAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,YAAY,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;YACjF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAClE,MAAM,cAAc,GAAG,kBAAkB,CACvC,KAAK,CAAC,cAAc,IAAI,OAAO,CAAC,cAAc,IAAI,EAAE,CACrD,CAAC;YACF,OAAO,GAAG;gBACR,GAAG,OAAO;gBACV,IAAI,EAAE,YAAY;gBAClB,SAAS;gBACT,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;gBAClE,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,GAAG;YACR,GAAG,OAAO;YACV,SAAS,EAAE,kBAAkB,CAAC,KAAK,CAAC,SAAS,CAAC;YAC9C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,gBAAgB,KAAK,YAAY,CAAC,EAAE,CAAC;QACnG,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAClE,MAAM,cAAc,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAChE,OAAO,GAAG;YACR,GAAG,OAAO;YACV,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;YAClE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACpF,CAAC;SAAM,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,GAAG;YACR,GAAG,OAAO;YACV,KAAK,EAAE,sBAAsB,CAAC,SAAS,CAAC;YACxC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/C,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,KAAK,KAAK,CAAC;IACxD,IACE,KAAK,CAAC,MAAM,KAAK,OAAO;QACxB,eAAe;QACf,OAAO,KAAK,SAAS;QACrB,CAAC,OAAO,CAAC,OAAO;QAChB,CAAC,KAAK,CAAC,gBAAgB,EACvB,CAAC;QACD,qCAAqC;QACrC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QACpC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,SAAS;YACT,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,CAAC,EAAE,CAAC,qCAAqC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1E,qBAAqB,EAAE,IAAI;YAC3B,WAAW,EAAE,SAAS;SACvB,CAAC;IACJ,CAAC;IAED,uCAAuC;IACvC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IACpC,iBAAiB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAE9C,0CAA0C;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACrE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC;YAC9B,SAAS;YACT,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK;YACL,OAAO,EAAE,GAAG,CAAC,OAAO;SACrB,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,MAAM,GAAG,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,SAAS;YACT,OAAO;YACP,OAAO,EAAE,EAAE;YACX,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK;YACL,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC;QACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,MAAM,iBAAiB,CAC/B,KAAK,CAAC,IAAI,EACV,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,KAAsB,EACxB,CAAC,CAAC,IAAI,EACN,CAAC,CAAC,OAAO,CACV,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,SAAS;gBACT,OAAO;gBACP,OAAO;gBACP,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,KAAK;gBACL,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;YACT,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,IAAI,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACtE,MAAM,QAAQ,GAAkD,EAAE,CAAC;YACnE,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC;gBACvC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS;gBACT,SAAS,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE;gBACvC,KAAK,EAAE,QAAQ;gBACf,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,SAAS;oBACT,OAAO;oBACP,OAAO;oBACP,OAAO,EAAE,GAAG,CAAC,OAAO;oBACpB,KAAK;oBACL,OAAO,EAAE,IAAI;iBACd,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,IAAI,IAAI,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,KAAK,CAAC,IAAI,CACR,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kCAAkC,CAAC,CACtF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;SAAM,IACL,OAAO,CAAC,IAAI,KAAK,YAAY;QAC7B,OAAO,CAAC,MAAM,KAAK,CAAC;QACpB,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,MAAM,CAAC,EACjC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,uCAAuC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI,KAAK,CAAC;QACd,SAAS;QACT,OAAO;QACP,OAAO;QACP,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAkB,EAClB,SAAkB;IAElB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,CAC5B,IAAI;SACD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACvE,OAAO,KAAK;SACT,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtD,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,EAAE,CAAC,CAAC,GAAG;QACV,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,EAAE,EAAE,CAAC,CAAC,EAAE;KACT,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAkB,EAClB,OAAe,EACf,SAAiB;IAajB,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAChD,6BAA6B;IAC7B,MAAM,SAAS,GAAG,MAAM,uBAAuB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GACV,OAAO,CAAC,IAAI,KAAK,SAAS;QACxB,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YACxD,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACpB,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBACxB,CAAC,CAAC,KAAK,CAAC;IAEhB,IAAI,QAES,CAAC;IACd,IAAI,CAAC;QACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACzC,QAAQ,GAAG;YACT,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,SAAS,CAAC;IACvB,CAAC;IAED,OAAO;QACL,OAAO;QACP,SAAS;QACT,MAAM;QACN,WAAW,EAAE,mBAAmB,CAAC,SAAS,CAAC;QAC3C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,KASxC;IACC,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,EAAE;QAC5D,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,mBAAmB,CAAC;QACzB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,QAAQ;QAChB,gBAAgB,EACd,OAAO,CAAC,IAAI,KAAK,SAAS;YACxB,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,YAAY;gBAC7B,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,QAAQ;QAChB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;AACL,CAAC"}