ysk-server-core 1.0.0

package/dist/hosting/apply-audit.js

@@ -0,0 +1,149 @@
+/**
+ * Honesty audit of apply_status / last ops across control plane.
+ * Surfaces written ≠ applied, blocked, and dishonest ok+blocked last_apply blobs.
+ */
+import { assertHonestOps, tl } from 'ysk-server-shared';
+/** @deprecated import assertHonestOps from ysk-server-shared */
+/** Re-export honesty layer helper for apply paths (SSOT with apply-honesty.ts). */
+export { honestyFromFlags } from './apply-honesty.js';
+export function normalizeOpsHonesty(result) {
+    return assertHonestOps(result);
+}
+function classifyStatus(st) {
+    const s = (st || 'unknown').toLowerCase();
+    if (s === 'blocked' || s === 'failed' || s === 'error') {
+        return { severity: 'bad', issue: `apply_status=${st}` };
+    }
+    if (s === 'written' || s === 'draft' || s === 'planned' || s === 'partial') {
+        return { severity: 'warn', issue: tl('notes.auto.t0226', { v0: (st) }) };
+    }
+    if (s === 'applied' ||
+        s === 'active' ||
+        s === 'running' ||
+        s === 'ok' ||
+        s === 'enabled') {
+        return { severity: 'ok' };
+    }
+    if (s === 'unknown' || !s) {
+        return { severity: 'warn', issue: tl('notes.auto.n1070') };
+    }
+    return { severity: 'warn', issue: tl('notes.auto.t0227', { v0: (st) }) };
+}
+/** Detect dishonest last_apply payloads stored on resources */
+function auditLastApply(kind, id, name, last, href) {
+    if (!last || typeof last !== 'object')
+        return null;
+    const o = last;
+    const ok = o.ok === true;
+    const blocked = Boolean(o.blocked || o.requiresExecute || o.requiresRoot);
+    if (ok && blocked) {
+        return {
+            kind,
+            id,
+            name,
+            apply_status: String(o.apply_status ?? 'unknown'),
+            issue: tl('notes.auto.n0318'),
+            severity: 'bad',
+            href,
+        };
+    }
+    if (String(o.apply_status) === 'applied' && blocked) {
+        return {
+            kind,
+            id,
+            name,
+            apply_status: 'applied',
+            issue: tl('notes.auto.n0317'),
+            severity: 'bad',
+            href,
+        };
+    }
+    return null;
+}
+export function auditApplyStatuses(db) {
+    const findings = [];
+    const addRes = (kind, rows, nameKey, hrefPrefix) => {
+        for (const r of rows ?? []) {
+            const id = String(r.id ?? '');
+            const name = String(r[nameKey] ?? id);
+            const st = String(r.apply_status ?? r.status ?? 'unknown');
+            const { severity, issue } = classifyStatus(st);
+            const href = hrefPrefix.includes(':id')
+                ? hrefPrefix.replace(':id', encodeURIComponent(id))
+                : hrefPrefix;
+            findings.push({
+                kind,
+                id,
+                name,
+                apply_status: st,
+                issue,
+                severity,
+                href,
+            });
+            const dishonest = auditLastApply(kind, id, name, r.last_apply, href);
+            if (dishonest)
+                findings.push(dishonest);
+        }
+    };
+    addRes('dns_zone', db.snapshot.dns_zones ?? [], 'zone', '/dns');
+    addRes('ftp', db.snapshot.ftp_accounts ?? [], 'username', '/ftp');
+    addRes('nginx_site', db.snapshot.nginx_sites ?? [], 'serverName', '/nginx');
+    addRes('certificate', db.snapshot.certificates ?? [], 'domain', '/ssl');
+    addRes('mysql_db', db.snapshot.mysql_databases ?? [], 'name', '/databases/mysql');
+    addRes('postgres_db', db.snapshot.postgres_databases ?? [], 'name', '/databases/postgres');
+    addRes('redis', db.snapshot.redis_instances ?? [], 'name', '/databases/redis');
+    addRes('cron', db.snapshot.cron_jobs ?? [], 'name', '/cron');
+    for (const p of db.snapshot.projects) {
+        const st = p.status ?? 'unknown';
+        let severity = 'ok';
+        let issue;
+        if (st === 'failed' || st === 'unhealthy') {
+            severity = 'bad';
+            issue = `status=${st}`;
+        }
+        else if (st === 'suspended') {
+            severity = 'warn';
+            issue = 'suspended';
+        }
+        else if (!p.nginx_config_path) {
+            severity = 'warn';
+            issue = tl('notes.auto.n0963');
+        }
+        findings.push({
+            kind: 'project',
+            id: p.id,
+            name: p.name,
+            apply_status: st,
+            issue,
+            severity,
+            href: `/projects/${p.id}`,
+        });
+    }
+    for (const e of db.snapshot.email_domains ?? []) {
+        const st = String(e.apply_status ?? e.status ?? 'unknown');
+        const { severity, issue } = classifyStatus(st);
+        findings.push({
+            kind: 'email_domain',
+            id: String(e.id ?? ''),
+            name: String(e.domain ?? ''),
+            apply_status: st,
+            issue: st === 'suspended'
+                ? 'suspended'
+                : issue,
+            severity: st === 'suspended' ? 'warn' : severity,
+            href: `/email/domains/${e.id}`,
+        });
+        const dishonest = auditLastApply('email_domain', String(e.id ?? ''), String(e.domain ?? ''), e.last_apply, `/email/domains/${e.id}`);
+        if (dishonest)
+            findings.push(dishonest);
+    }
+    const summary = { ok: 0, warn: 0, bad: 0, total: findings.length };
+    for (const f of findings)
+        summary[f.severity]++;
+    findings.sort((a, b) => {
+        const r = { bad: 0, warn: 1, ok: 2 };
+        return r[a.severity] - r[b.severity];
+    });
+    return { findings, summary };
+}
+//# sourceMappingURL=apply-audit.js.map

package/dist/hosting/apply-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-audit.js","sourceRoot":"","sources":["../../src/hosting/apply-audit.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,eAAe,EAEO,EAAE,EAAC,MAAM,mBAAmB,CAAC;AAGrD,gEAAgE;AAChE,mFAAmF;AACnF,OAAO,EAAE,gBAAgB,EAAqB,MAAM,oBAAoB,CAAC;AAEzE,MAAM,UAAU,mBAAmB,CAA2B,MAAS;IACrE,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAmBD,SAAS,cAAc,CAAC,EAAU;IAIhC,MAAM,CAAC,GAAG,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,CAAC;IACD,IACE,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,QAAQ;QACd,CAAC,KAAK,SAAS;QACf,CAAC,KAAK,IAAI;QACV,CAAC,KAAK,SAAS,EACf,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,+DAA+D;AAC/D,SAAS,cAAc,CACrB,IAAY,EACZ,EAAU,EACV,IAAY,EACZ,IAAa,EACb,IAAY;IAEZ,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;IACzB,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,eAAe,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,EAAE,IAAI,OAAO,EAAE,CAAC;QAClB,OAAO;YACL,IAAI;YACJ,EAAE;YACF,IAAI;YACJ,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,CAAC;YACjD,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,QAAQ,EAAE,KAAK;YACf,IAAI;SACL,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,SAAS,IAAI,OAAO,EAAE,CAAC;QACpD,OAAO;YACL,IAAI;YACJ,EAAE;YACF,IAAI;YACJ,YAAY,EAAE,SAAS;YACvB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;YAC7B,QAAQ,EAAE,KAAK;YACf,IAAI;SACL,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAe;IAChD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IAEzC,MAAM,MAAM,GAAG,CACb,IAAY,EACZ,IAAgD,EAChD,OAAe,EACf,UAAkB,EAClB,EAAE;QACF,KAAK,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;YAC3D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;YAC/C,MAAM,IAAI,GACR,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;gBACxB,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC;gBACnD,CAAC,CAAC,UAAU,CAAC;YACjB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI;gBACJ,EAAE;gBACF,IAAI;gBACJ,YAAY,EAAE,EAAE;gBAChB,KAAK;gBACL,QAAQ;gBACR,IAAI;aACL,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACrE,IAAI,SAAS;gBAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,CAAC,YAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAClF,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,MAAM,EAAE,qBAAqB,CAAC,CAAC;IAC3F,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAE7D,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC;QACjC,IAAI,QAAQ,GAAkC,IAAI,CAAC;QACnD,IAAI,KAAyB,CAAC;QAC9B,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YAC1C,QAAQ,GAAG,KAAK,CAAC;YACjB,KAAK,GAAG,UAAU,EAAE,EAAE,CAAC;QACzB,CAAC;aAAM,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;YAC9B,QAAQ,GAAG,MAAM,CAAC;YAClB,KAAK,GAAG,WAAW,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC;YAChC,QAAQ,GAAG,MAAM,CAAC;YAClB,KAAK,GAAG,EAAE,CAAC,kBAAkB,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,YAAY,EAAE,EAAE;YAChB,KAAK;YACL,QAAQ;YACR,IAAI,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;QAC3D,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAC/C,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACtB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;YAC5B,YAAY,EAAE,EAAE;YAChB,KAAK,EACH,EAAE,KAAK,WAAW;gBAChB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,KAAK;YACX,QAAQ,EAAE,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAChD,IAAI,EAAE,kBAAkB,CAAC,CAAC,EAAE,EAAE;SAC/B,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,cAAc,CAC9B,cAAc,EACd,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAClB,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,EACtB,CAAC,CAAC,UAAU,EACZ,kBAAkB,CAAC,CAAC,EAAE,EAAE,CACzB,CAAC;QACF,IAAI,SAAS;YAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACnE,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEhD,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/hosting/apply-honesty.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Shared honesty model: panel state ≠ disk write ≠ system loaded ≠ external truth.
+ *
+ * Layers used across DNS / nginx / firewall / SSL:
+ *   draft    — only in control-plane DB
+ *   written  — artifact on disk under dataDir (or plan file)
+ *   applied  — system process reloaded AND post-condition probe passed
+ *   external — public view (CDN NS, Let's Encrypt, etc.) may still differ
+ *
+ * Never mark `applied` from reload exit code alone when the subsystem needs
+ * extra registration (PowerDNS named.conf, nginx -t, ufw status).
+ *
+ * Prefer mapping to shared `ApplyStatus` via:
+ *   honestyFromFlags → 'draft'|'written'|'applied'
+ *   then assertHonestOps / sendOpsResult on the HTTP edge.
+ */
+export type HonestyLayer = 'draft' | 'written' | 'applied' | 'external';
+export declare function honestyFromFlags(input: {
+    written: boolean;
+    systemOk: boolean;
+    probeOk?: boolean;
+}): Extract<HonestyLayer, 'draft' | 'written' | 'applied'>;
+/** Map honesty layer to shared apply_status vocabulary used by OpsResultDto. */
+export declare function applyStatusFromHonesty(layer: Extract<HonestyLayer, 'draft' | 'written' | 'applied'>): 'written' | 'applied' | 'failed';
+//# sourceMappingURL=apply-honesty.d.ts.map

package/dist/hosting/apply-honesty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-honesty.d.ts","sourceRoot":"","sources":["../../src/hosting/apply-honesty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAExE,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC,CAIzD;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC,GAC5D,SAAS,GAAG,SAAS,GAAG,QAAQ,CAIlC"}

package/dist/hosting/apply-honesty.js

@@ -0,0 +1,16 @@
+export function honestyFromFlags(input) {
+    if (!input.written)
+        return 'draft';
+    if (input.systemOk && input.probeOk !== false)
+        return 'applied';
+    return 'written';
+}
+/** Map honesty layer to shared apply_status vocabulary used by OpsResultDto. */
+export function applyStatusFromHonesty(layer) {
+    if (layer === 'applied')
+        return 'applied';
+    if (layer === 'written')
+        return 'written';
+    return 'failed'; // draft is not yet written — callers usually keep ok:false notes
+}
+//# sourceMappingURL=apply-honesty.js.map

package/dist/hosting/apply-honesty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-honesty.js","sourceRoot":"","sources":["../../src/hosting/apply-honesty.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,gBAAgB,CAAC,KAIhC;IACC,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IACnC,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC;IAChE,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CACpC,KAA6D;IAE7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO,QAAQ,CAAC,CAAC,iEAAiE;AACpF,CAAC"}

package/dist/hosting/backup-cron.d.ts

@@ -0,0 +1,299 @@
+/**
+ * Real backup (tar) and cron job management under dataDir.
+ */
+import type { HostExecutor } from '../host/executor.js';
+import type { YskDatabase } from '../db/database.js';
+/** Constrain archive under dataDir/backups/<projectId>/ */
+export declare function resolveManagedBackupArchive(dataDir: string, projectId: string, archiveName: string): {
+    ok: true;
+    root: string;
+    path: string;
+    name: string;
+} | {
+    ok: false;
+    notes: string[];
+};
+export interface BackupResult {
+    ok: boolean;
+    archivePath?: string;
+    bytes?: number;
+    notes: string[];
+    commandResults: Array<{
+        argv: string[];
+        exitCode: number;
+        stderr: string;
+    }>;
+}
+export interface BackupListItem {
+    projectId: string;
+    name: string;
+    path: string;
+    bytes: number;
+    mtime: string;
+}
+/**
+ * List backup archives under dataDir/backups.
+ */
+export declare function listBackups(dataDir: string): BackupListItem[];
+/** Notes that mean "not attempted" (skip) — Chinese or English */
+export declare function isBackupSkipNote(note: string): boolean;
+export declare function isBackupSkippedResult(r: {
+    ok: boolean;
+    notes: string[];
+    skipped?: boolean;
+}): boolean;
+/**
+ * Backup every project that has a home_dir on disk.
+ * - 0 projects → ok (nothing to do)
+ * - missing home → skipped (not a failure)
+ * - ok only if every *attempted* backup succeeds
+ */
+export declare function backupAllProjects(input: {
+    host: HostExecutor;
+    dataDir: string;
+    projects: Array<{
+        id: string;
+        home_dir: string;
+        name?: string;
+    }>;
+    excludes?: string[];
+}): Promise<{
+    ok: boolean;
+    results: Array<BackupResult & {
+        projectId: string;
+        skipped?: boolean;
+    }>;
+    notes: string[];
+    empty?: boolean;
+}>;
+/**
+ * Re-localize a persisted last_backup_run payload under the current request locale.
+ * Historical runs stored free-text notes (often zh-HK); recompute summary notes from structure.
+ */
+export declare function localizeLastBackupRun(last: Record<string, unknown> | null | undefined): Record<string, unknown> | null;
+/**
+ * Create tar.gz of project home into dataDir/backups/<projectId>/.
+ */
+export declare function backupProject(input: {
+    host: HostExecutor;
+    dataDir: string;
+    projectId: string;
+    homeDir: string;
+    extraSources?: string[];
+    /** tar --exclude patterns e.g. node_modules, .git */
+    excludes?: string[];
+}): Promise<BackupResult>;
+/**
+ * Restore a managed backup archive into the project home.
+ * Path must live under dataDir/backups/<projectId>/ — never accepts arbitrary paths.
+ */
+export declare function restoreProjectBackup(input: {
+    host: HostExecutor;
+    dataDir: string;
+    projectId: string;
+    archiveName: string;
+    homeDir: string;
+    /** When set, chown home to project user after restore (root+execute) */
+    linuxUser?: string;
+    linuxGroup?: string;
+    /**
+     * full = entire archive (default)
+     * web = only files under project home (strip to app/ when possible)
+     * dry-run = list archive contents only
+     */
+    mode?: 'full' | 'web' | 'dry-run';
+}): Promise<BackupResult>;
+/** Delete one managed backup archive (path constrained). */
+export declare function deleteProjectBackup(dataDir: string, projectId: string, archiveName: string): {
+    ok: boolean;
+    notes: string[];
+};
+/** Resolve a managed backup path for download (path constrained). */
+export declare function resolveBackupDownloadPath(dataDir: string, projectId: string, archiveName: string): {
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    notes: string[];
+};
+/** Stable id for control-plane (store + config) archives under dataDir/backups/. */
+export declare const CONTROL_PLANE_BACKUP_ID = "control-plane";
+/**
+ * Filter backup list by projectId and free-text q (name / path / id).
+ */
+export declare function filterBackupList(items: BackupListItem[], opts?: {
+    projectId?: string;
+    q?: string;
+}): BackupListItem[];
+/**
+ * Tar control-plane state: ysk.json (+ config.json if present).
+ * Stored under dataDir/backups/control-plane/ — same path rules as project backups.
+ * Does NOT include project homes (use backup all / project backup for those).
+ */
+export declare function backupControlPlane(input: {
+    host: HostExecutor;
+    dataDir: string;
+}): Promise<BackupResult & {
+    projectId: string;
+}>;
+/**
+ * Restore control-plane archive into dataDir (ysk.json / config.json).
+ * Default dry-run lists contents. Real restore requires confirmPhrase === RESTORE-CONTROL-PLANE.
+ * Does not restart the API process — operator must reload/restart after restore.
+ */
+export declare function restoreControlPlaneBackup(input: {
+    host: HostExecutor;
+    dataDir: string;
+    archiveName: string;
+    /** dry-run (default) | full */
+    mode?: 'dry-run' | 'full';
+    confirmPhrase?: string;
+}): Promise<BackupResult>;
+export interface CronJobRecord {
+    id: string;
+    project_id?: string;
+    user: string;
+    schedule: string;
+    command: string;
+    enabled: boolean;
+    created_at: string;
+    updated_at: string;
+    last_install?: Record<string, unknown>;
+}
+/** One parsed line from a user crontab (host truth inventory). */
+export type HostCronLineKind = 'job' | 'env' | 'comment' | 'unknown';
+export type HostCronSource = 'ysk' | 'host';
+export interface HostCronLine {
+    user: string;
+    projectId?: string;
+    projectName?: string;
+    schedule?: string;
+    command?: string;
+    raw: string;
+    kind: HostCronLineKind;
+    source: HostCronSource;
+    managedJobId?: string;
+}
+export interface HostCronUserSlot {
+    user: string;
+    projectId?: string;
+    projectName?: string;
+    available: boolean;
+    notes: string[];
+    lineCount: number;
+    jobCount: number;
+}
+export interface HostCronInventory {
+    users: HostCronUserSlot[];
+    lines: HostCronLine[];
+    notes: string[];
+    partial: boolean;
+    isRoot: boolean;
+    executeEnabled: boolean;
+}
+export declare function extractYskManagedId(text: string): string | undefined;
+export declare function classifyCronSource(raw: string): HostCronSource;
+/**
+ * Parse crontab -l text into structured lines (pure; no host I/O).
+ */
+export declare function parseCrontabText(user: string, text: string, meta?: {
+    projectId?: string;
+    projectName?: string;
+}): HostCronLine[];
+/**
+ * Build user list for host crontab scan (root + unique project linux users).
+ */
+export declare function cronHostUserSlots(projects: Array<{
+    id: string;
+    name: string;
+    linuxUser?: string;
+    linux_user?: string;
+}>): Array<{
+    user: string;
+    projectId?: string;
+    projectName?: string;
+}>;
+/**
+ * Wrap project-scoped cron command to run as project Linux user.
+ * Avoid double-wrapping if already uses runuser.
+ */
+export declare function wrapCronCommandAsLinuxUser(command: string, linuxUser: string): string;
+export declare class CronJobService {
+    private readonly db;
+    private readonly host;
+    private readonly dataDir;
+    constructor(db: YskDatabase, host: HostExecutor, dataDir: string);
+    list(projectId?: string): CronJobRecord[];
+    /** Resolve project linux_user from DB when projectId set */
+    private resolveProjectLinuxUser;
+    create(input: {
+        projectId?: string;
+        user: string;
+        schedule: string;
+        command: string;
+        actor: string;
+        /** Skip auto runuser wrap (e.g. system backup jobs) */
+        skipRunuserWrap?: boolean;
+    }): CronJobRecord;
+    delete(id: string): boolean;
+    /** Enable or disable a job and rewrite managed crontab. */
+    setEnabled(id: string, enabled: boolean): CronJobRecord | undefined;
+    /**
+     * Run job command once (test). Requires EXECUTE; fail-closed.
+     */
+    runNow(id: string, actor: string): Promise<{
+        ok: boolean;
+        notes: string[];
+        exitCode?: number;
+        stdout?: string;
+        stderr?: string;
+        requiresExecute?: boolean;
+        blocked?: boolean;
+    }>;
+    /** Ensure a daily full-backup job exists (idempotent by command marker). */
+    ensureBackupSchedule(schedule?: string): CronJobRecord;
+    /** Absolute-ish CLI for scheduled full backup (must match apps/server cli). */
+    private backupAllCliCommand;
+    /** Write all enabled jobs to dataDir/cron/ysk.crontab */
+    writeManagedCrontab(): string;
+    /**
+     * Install managed crontab for current user when EXECUTE.
+     * Merges with existing host lines that are not YSK-managed (preserves operator jobs).
+     * Never fakes success.
+     */
+    installCrontab(actor: string): Promise<{
+        ok: boolean;
+        path: string;
+        requiresExecute: boolean;
+        notes: string[];
+        blocked?: boolean;
+        hostInstalled?: boolean;
+        preservedHostLines?: number;
+    }>;
+    /**
+     * Read real host crontabs for root + project Linux users (Terminal-style inventory).
+     * Non-root: only `crontab -l` for the control-plane process user (honest partial).
+     */
+    listHostCrontabs(projects?: Array<{
+        id: string;
+        name: string;
+        linuxUser?: string;
+        linux_user?: string;
+    }>): Promise<HostCronInventory>;
+    /** Probe managed file vs host crontab (honest status). */
+    probeInstallStatus(): Promise<{
+        managedPath: string;
+        managedLines: number;
+        enabledJobs: number;
+        totalJobs: number;
+        hostHasYskEntries: boolean | null;
+        hostCrontabPreview: string;
+        /** Non-YSK job lines on host crontab (honesty for operators) */
+        hostOtherLines: number | null;
+        hostTotalLines: number | null;
+        executeEnabled: boolean;
+        lastInstallOk: boolean | null;
+        lastInstallAt: string | null;
+    }>;
+}
+//# sourceMappingURL=backup-cron.d.ts.map

package/dist/hosting/backup-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-cron.d.ts","sourceRoot":"","sources":["../../src/hosting/backup-cron.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,2DAA2D;AAC3D,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAkBzF;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,EAAE,CAuB7D;AAED,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQtD;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,OAAO,CAGV;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE;IAC7C,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,KAAK,CAAC,YAAY,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACxE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,CAAC,CA2DD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,SAAS,GAC/C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAkChC;AAED;;GAEG;AACH,wBAAsB,aAAa,CAAC,KAAK,EAAE;IACzC,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB,GAAG,OAAO,CAAC,YAAY,CAAC,CA+DxB;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CAAC,KAAK,EAAE;IAChD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAAC;CACnC,GAAG,OAAO,CAAC,YAAY,CAAC,CAiFxB;AA2BD,4DAA4D;AAC5D,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAYlC;AAED,qEAAqE;AACrE,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAO7D;AAED,oFAAoF;AACpF,eAAO,MAAM,uBAAuB,kBAAkB,CAAC;AAEvD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,cAAc,EAAE,EACvB,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GACxC,cAAc,EAAE,CAiBlB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,YAAY,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAsEhD;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,KAAK,EAAE;IACrD,IAAI,EAAE,YAAY,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,OAAO,CAAC,YAAY,CAAC,CAiExB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,SAAS,CAAC;AACrE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,CAAC;AAE5C,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,cAAc,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,gBAAgB,EAAE,CAAC;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGpE;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAM9D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,YAAY,EAAE,CA4DhB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,KAAK,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC,GACD,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAYnE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAQrF;AAED,qBAAa,cAAc;IAEvB,OAAO,CAAC,QAAQ,CAAC,EAAE;IACnB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAFP,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,MAAM;IAGlC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,aAAa,EAAE;IAMzC,4DAA4D;IAC5D,OAAO,CAAC,uBAAuB;IAM/B,MAAM,CAAC,KAAK,EAAE;QACZ,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,uDAAuD;QACvD,eAAe,CAAC,EAAE,OAAO,CAAC;KAC3B,GAAG,aAAa;IA6BjB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAQ3B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS;IAUnE;;OAEG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;QACT,EAAE,EAAE,OAAO,CAAC;QACZ,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IA2BF,4EAA4E;IAC5E,oBAAoB,CAAC,QAAQ,SAAc,GAAG,aAAa;IA8B3D,+EAA+E;IAC/E,OAAO,CAAC,mBAAmB;IAM3B,yDAAyD;IACzD,mBAAmB,IAAI,MAAM;IAe7B;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAC3C,EAAE,EAAE,OAAO,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,eAAe,EAAE,OAAO,CAAC;QACzB,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC7B,CAAC;IA4EF;;;OAGG;IACG,gBAAgB,CACpB,QAAQ,GAAE,KAAK,CAAC;QACd,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAM,GACN,OAAO,CAAC,iBAAiB,CAAC;IAyG7B,0DAA0D;IACpD,kBAAkB,IAAI,OAAO,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,SAAS,EAAE,MAAM,CAAC;QAClB,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;QAClC,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gEAAgE;QAChE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,cAAc,EAAE,OAAO,CAAC;QACxB,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;QAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;KAC9B,CAAC;CA0DH"}