ysk-server-core 1.0.0

package/dist/hosting/firewall-ops.js

@@ -0,0 +1,398 @@
+import { tl } from 'ysk-server-shared';
+import { isValidIp, normalizeIp, normalizeIpOrCidr } from '../net/ip.js';
+import { HostSoftwareProbe } from './software-probe/index.js';
+function humanActive(active, installed, isRoot) {
+    if (!installed)
+        return tl('notes.notInstalled');
+    const a = (active || '').toLowerCase();
+    if (a.includes('need to be root') || a.includes('error')) {
+        return isRoot ? tl('notes.readFailed') : tl('notes.tpl.needRootRead');
+    }
+    if (a === 'active')
+        return tl('notes.auto.n0623');
+    if (a === 'inactive')
+        return tl('notes.state.closed');
+    return active || tl('notes.unknown');
+}
+/** Extract trailing `# comment` from a UFW status line. */
+export function extractUfwComment(raw) {
+    const m = String(raw ?? '').match(/#\s*(.+?)\s*$/);
+    if (!m)
+        return undefined;
+    const c = m[1].trim().replace(/^['"]|['"]$/g, '');
+    return c || undefined;
+}
+/** Parse `ufw status numbered` lines into structured rules. */
+export function parseUfwNumbered(lines) {
+    const out = [];
+    for (const line of lines) {
+        const t = line.trim();
+        // [ 1] 22/tcp                     ALLOW IN    Anywhere
+        // [ 3] Anywhere                   DENY IN     203.0.113.10
+        // [ 5] 80/tcp                     ALLOW IN    Anywhere                   # ysk-svc:nginx:http
+        const m = t.match(/^\[\s*(\d+)\]\s+(.+?)\s+(ALLOW|DENY|REJECT|LIMIT)\s+(IN|OUT)?\s*(.*)$/i);
+        if (m) {
+            const rest = (m[5] || '').trim() || 'Anywhere';
+            const comment = extractUfwComment(rest) ?? extractUfwComment(t);
+            const from = rest.replace(/#\s*.+$/, '').trim() || 'Anywhere';
+            out.push({
+                num: Number(m[1]),
+                to: m[2].trim(),
+                action: m[3].toUpperCase(),
+                direction: (m[4] || 'IN').toUpperCase(),
+                from,
+                comment,
+                raw: t,
+            });
+            continue;
+        }
+        if (/ALLOW|DENY|REJECT/i.test(t)) {
+            out.push({ action: '?', comment: extractUfwComment(t), raw: t });
+        }
+    }
+    return out;
+}
+export function extractDenyFromIps(rules) {
+    const ips = [];
+    for (const r of rules) {
+        if (!/^DENY/i.test(r.action))
+            continue;
+        const from = (r.from || '').replace(/\s*\(v6\)\s*/i, '').trim();
+        // UFW may show "Anywhere (v6)" — skip non-IP labels
+        const n = normalizeIp(from);
+        if (n && isValidIp(n))
+            ips.push(n);
+    }
+    return [...new Set(ips)];
+}
+export async function probeFirewallDeep(host) {
+    const notes = [];
+    const installed = (await new HostSoftwareProbe(host).presence('ufw')).installed;
+    let active = 'unknown';
+    let statusText = '';
+    const numberedRules = [];
+    let defaultIncoming;
+    let defaultOutgoing;
+    if (installed) {
+        try {
+            const st = await host.runCommand(['ufw', 'status', 'verbose'], { timeoutMs: 10_000 });
+            statusText = `${st.stdout || ''}\n${st.stderr || ''}`.trim();
+            const first = statusText.split('\n')[0] || '';
+            if (/inactive/i.test(statusText.slice(0, 200)))
+                active = 'inactive';
+            else if (/Status:\s*active/i.test(statusText) || /active/i.test(first))
+                active = 'active';
+            else if (/need to be root|ERROR/i.test(statusText))
+                active = statusText.slice(0, 60);
+            else
+                active = first.slice(0, 40) || 'unknown';
+            const di = statusText.match(/Default:\s*(\w+)\s*\(incoming\)/i);
+            const dout = statusText.match(/,\s*(\w+)\s*\(outgoing\)/i);
+            if (di)
+                defaultIncoming = di[1];
+            if (dout)
+                defaultOutgoing = dout[1];
+        }
+        catch {
+            active = 'unknown';
+        }
+        try {
+            const num = await host.runCommand(['ufw', 'status', 'numbered'], { timeoutMs: 10_000 });
+            const body = `${num.stdout || ''}`.trim();
+            for (const line of body.split('\n')) {
+                const t = line.trim();
+                if (/^\[\s*\d+\]/.test(t) || /\b(ALLOW|DENY|REJECT)\b/i.test(t)) {
+                    numberedRules.push(t);
+                }
+            }
+        }
+        catch {
+            notes.push(tl('notes.auto.n1184'));
+        }
+    }
+    else {
+        notes.push(tl('notes.auto.n0197'));
+    }
+    const rules = parseUfwNumbered(numberedRules);
+    const denyFromIps = extractDenyFromIps(rules);
+    const allowCount = rules.filter((r) => /ALLOW/i.test(r.action)).length;
+    const denyCount = rules.filter((r) => /DENY|REJECT/i.test(r.action)).length;
+    return {
+        installed,
+        active,
+        activeLabel: humanActive(active, installed, host.isRoot()),
+        statusText: statusText.slice(0, 6000),
+        numberedRules: numberedRules.slice(0, 120),
+        rules: rules.slice(0, 120),
+        denyFromIps,
+        allowCount,
+        denyCount,
+        defaultIncoming,
+        defaultOutgoing,
+        executeEnabled: host.executeEnabled(),
+        isRoot: host.isRoot(),
+        notes
+    };
+}
+function needExec(host) {
+    if (!host.executeEnabled()) {
+        return {
+            ok: false,
+            blocked: true,
+            notes: [tl('notes.auto.n1189')]
+        };
+    }
+    return null;
+}
+export async function firewallSetEnabled(host, enabled) {
+    const block = needExec(host);
+    if (block)
+        return block;
+    if (enabled) {
+        const r = await host.runCommand(['ufw', '--force', 'enable'], { timeoutMs: 20_000 });
+        return {
+            ok: r.exitCode === 0,
+            notes: [
+                r.exitCode === 0
+                    ? tl('notes.auto.n0747')
+                    : tl('notes.auto.t0160', { v0: ((r.stderr || r.stdout || '').slice(0, 300)) }),
+            ]
+        };
+    }
+    const r = await host.runCommand(['ufw', 'disable'], { timeoutMs: 15_000 });
+    return {
+        ok: r.exitCode === 0,
+        notes: [
+            r.exitCode === 0
+                ? tl('notes.auto.n0732')
+                : tl('notes.auto.t0161', { v0: ((r.stderr || r.stdout || '').slice(0, 300)) }),
+        ]
+    };
+}
+export async function firewallDenyIp(host, ip) {
+    const block = needExec(host);
+    if (block)
+        return block;
+    const safe = normalizeIp(ip.trim()) ?? '';
+    if (!safe || !isValidIp(safe)) {
+        return { ok: false, notes: [tl('notes.invalidIp46')] };
+    }
+    const r = await host.runCommand(['ufw', 'deny', 'from', safe], { timeoutMs: 12_000 });
+    return {
+        ok: r.exitCode === 0,
+        notes: [
+            r.exitCode === 0
+                ? tl('notes.auto.t0162', { v0: (safe) })
+                : tl('notes.auto.t0163', { v0: ((r.stderr || r.stdout || '').slice(0, 300)) }),
+        ]
+    };
+}
+export async function firewallDeleteDenyIp(host, ip) {
+    const block = needExec(host);
+    if (block)
+        return block;
+    const safe = normalizeIp(ip.trim()) ?? ip.trim();
+    if (!safe || !isValidIp(safe)) {
+        return { ok: false, notes: [tl('notes.invalidIp46')] };
+    }
+    const r = await host.runCommand(['ufw', 'delete', 'deny', 'from', safe], {
+        timeoutMs: 12_000
+    });
+    return {
+        ok: r.exitCode === 0,
+        notes: [
+            r.exitCode === 0
+                ? tl('notes.auto.t0164', { v0: (safe) })
+                : tl('notes.auto.t0165', { v0: ((r.stderr || r.stdout || '').slice(0, 300)) }),
+        ]
+    };
+}
+export async function firewallDeleteRuleNumber(host, num) {
+    const block = needExec(host);
+    if (block)
+        return block;
+    if (!Number.isInteger(num) || num < 1 || num > 999) {
+        return { ok: false, notes: [tl('notes.auto.n1118')] };
+    }
+    // ufw delete N is interactive; use yes pipe
+    const r = await host.runCommand(['bash', '-c', `yes | ufw delete ${num}`], { timeoutMs: 15_000 });
+    return {
+        ok: r.exitCode === 0,
+        notes: [
+            r.exitCode === 0
+                ? tl('notes.auto.t0166', { v0: (num) })
+                : tl('notes.auto.t0167', { v0: (num), v1: ((r.stderr || r.stdout || '').slice(0, 300)) }),
+        ]
+    };
+}
+/**
+ * Sanitize optional UFW comment (single-quoted in shell argv — no quotes/newlines).
+ */
+function sanitizeUfwComment(raw) {
+    if (raw == null)
+        return undefined;
+    const c = String(raw)
+        .trim()
+        .replace(/['"\\\n\r\t]/g, '')
+        .slice(0, 64);
+    return c || undefined;
+}
+/**
+ * Allow a single port or UFW range (e.g. 30000:30100 for FTPS PASV).
+ * `port` may be number, "80", or "30000:30100".
+ * `proto: 'both'` opens TCP and UDP (two UFW rules).
+ * Optional `from` (IPv4/IPv6 or CIDR) → `ufw allow from <src> to any port <n> proto <p>`.
+ * Empty / omitted `from` → public allow (anywhere).
+ * Optional `comment` → UFW `comment '…'` for managed service rules (ysk-svc:…).
+ */
+export async function firewallAllowPort(host, port, proto = 'tcp', from, comment) {
+    const block = needExec(host);
+    if (block)
+        return block;
+    const { parsePortSpec, ufwPortTarget } = await import('ysk-server-shared');
+    const raw = typeof port === 'number' ? String(port) : String(port ?? '').trim();
+    const spec = parsePortSpec(raw);
+    if (!spec) {
+        return { ok: false, notes: [tl('notes.auto.n1113')] };
+    }
+    // Cap range size so a typo does not open the whole stack
+    if (spec.to - spec.from > 200) {
+        return { ok: false, notes: [tl('notes.auto.n1113')] };
+    }
+    const label = spec.from === spec.to ? String(spec.from) : `${spec.from}:${spec.to}`;
+    const protos = proto === 'both' ? ['tcp', 'udp'] : [proto === 'udp' ? 'udp' : 'tcp'];
+    const fromRaw = String(from ?? '').trim();
+    let fromNorm = null;
+    if (fromRaw) {
+        fromNorm = normalizeIpOrCidr(fromRaw);
+        if (!fromNorm) {
+            return { ok: false, notes: [tl('notes.invalidIp46')] };
+        }
+    }
+    const cmt = sanitizeUfwComment(comment);
+    const notes = [];
+    let okCount = 0;
+    let failCount = 0;
+    // Idempotent hint: if rule already present, ufw still exits 0 with "Skipping"
+    for (const p of protos) {
+        const target = ufwPortTarget(raw, p);
+        if (!target) {
+            return { ok: false, notes: [tl('notes.auto.n1113')] };
+        }
+        const argv = fromNorm
+            ? ['ufw', 'allow', 'from', fromNorm, 'to', 'any', 'port', label, 'proto', p]
+            : ['ufw', 'allow', target];
+        if (cmt) {
+            argv.push('comment', cmt);
+        }
+        const r = await host.runCommand(argv, { timeoutMs: 12_000 });
+        const combined = `${r.stdout || ''}\n${r.stderr || ''}`;
+        const fromLabel = fromNorm
+            ? tl('notes.firewallAllow.fromLabel', { from: fromNorm })
+            : '';
+        if (r.exitCode === 0) {
+            okCount += 1;
+            if (/skipping|existing|already/i.test(combined)) {
+                notes.push(tl('notes.firewallAllow.already', {
+                    port: label,
+                    proto: p,
+                    from: fromLabel,
+                }));
+            }
+            else {
+                const base = tl('notes.auto.t0168', { v0: label, v1: p });
+                notes.push(fromLabel ? `${base}${fromLabel}` : base);
+            }
+        }
+        else {
+            failCount += 1;
+            notes.push(tl('notes.auto.t0169', { v0: (r.stderr || r.stdout || '').slice(0, 300) }));
+        }
+    }
+    if (okCount > 0 && failCount > 0) {
+        notes.unshift(tl('notes.firewallAllow.partial', { ok: okCount, fail: failCount }));
+    }
+    return { ok: failCount === 0 && okCount > 0, notes };
+}
+/**
+ * Delete all UFW rules whose comment starts with `commentPrefix`
+ * (e.g. `ysk-svc:vsftpd:`). Deletes highest rule numbers first.
+ */
+export async function firewallDeleteByComment(host, commentPrefix) {
+    const block = needExec(host);
+    if (block)
+        return { ...block, removed: 0 };
+    const prefix = String(commentPrefix ?? '').trim();
+    if (!prefix || prefix.length < 3) {
+        return { ok: false, removed: 0, notes: [tl('notes.auto.n1113')] };
+    }
+    const notes = [];
+    let removed = 0;
+    // Multiple passes: deleting renumbers; cap loops
+    for (let pass = 0; pass < 40; pass++) {
+        const num = await host.runCommand(['ufw', 'status', 'numbered'], { timeoutMs: 10_000 });
+        const body = `${num.stdout || ''}`.trim();
+        const rules = parseUfwNumbered(body
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((t) => /^\[\s*\d+\]/.test(t) || /\b(ALLOW|DENY|REJECT)\b/i.test(t)));
+        const match = rules
+            .filter((r) => {
+            const c = r.comment || extractUfwComment(r.raw) || '';
+            return c === prefix || c.startsWith(prefix);
+        })
+            .filter((r) => typeof r.num === 'number' && r.num >= 1)
+            .sort((a, b) => (b.num ?? 0) - (a.num ?? 0));
+        if (match.length === 0)
+            break;
+        const rule = match[0];
+        const del = await host.runCommand(['bash', '-c', `yes | ufw delete ${rule.num}`], { timeoutMs: 15_000 });
+        if (del.exitCode === 0) {
+            removed += 1;
+        }
+        else {
+            notes.push(tl('notes.auto.t0167', {
+                v0: rule.num,
+                v1: (del.stderr || del.stdout || '').slice(0, 300),
+            }));
+            break;
+        }
+    }
+    if (removed > 0) {
+        notes.unshift(tl('notes.firewallDeleteByComment.removed', { n: removed, prefix }));
+    }
+    else if (notes.length === 0) {
+        notes.push(tl('notes.firewallDeleteByComment.none', { prefix }));
+    }
+    return { ok: notes.every((n) => !/fail|error|boom/i.test(n)) || removed > 0, removed, notes };
+}
+/** Hosting-oriented quick profiles (ports only — not fail2ban). */
+export const FIREWALL_PROFILES = {
+    web: {
+        id: 'web',
+        label: tl('notes.auto.n0203'),
+        short: 'SSH + 80/443',
+        allowSmtp: false,
+        extraTcpPorts: [],
+        /** Prefer UFW range specs over expanded port lists */
+        extraPortSpecs: []
+    },
+    mail: {
+        id: 'mail',
+        label: tl('notes.auto.n0201'),
+        short: 'SSH + Web + SMTP/IMAP',
+        allowSmtp: true,
+        extraTcpPorts: [],
+        extraPortSpecs: []
+    },
+    ftps: {
+        id: 'ftps',
+        label: 'Web + FTPS',
+        short: tl('notes.auto.n0609'),
+        allowSmtp: false,
+        extraTcpPorts: [],
+        // One UFW rule for PASV band — not 101 individual allows
+        extraPortSpecs: ['21', '990', '30000:30100']
+    }
+};
+//# sourceMappingURL=firewall-ops.js.map

package/dist/hosting/firewall-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-ops.js","sourceRoot":"","sources":["../../src/hosting/firewall-ops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAOvC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA8B9D,SAAS,WAAW,CAAC,MAAc,EAAE,SAAkB,EAAE,MAAe;IACtE,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,UAAU;QAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;IACtD,OAAO,MAAM,IAAI,EAAE,CAAC,eAAe,CAAC,CAAC;AACvC,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,IAAI,SAAS,CAAC;AACxB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,KAAe;IAC9C,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,uDAAuD;QACvD,2DAA2D;QAC3D,8FAA8F;QAC9F,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CACf,wEAAwE,CACzE,CAAC;QACF,IAAI,CAAC,EAAE,CAAC;YACN,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC;gBACP,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACjB,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;gBACf,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAC1B,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE;gBACvC,IAAI;gBACJ,OAAO;gBACP,GAAG,EAAE,CAAC;aACP,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAgB;IACjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,SAAS;QACvC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,oDAAoD;QACpD,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAkB;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAEhF,IAAI,MAAM,GAAG,SAAS,CAAC;IACvB,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,eAAmC,CAAC;IACxC,IAAI,eAAmC,CAAC;IAExC,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACtF,UAAU,GAAG,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9C,IAAI,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAE,MAAM,GAAG,UAAU,CAAC;iBAC/D,IAAI,mBAAmB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,GAAG,QAAQ,CAAC;iBACrF,IAAI,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC;gBAAE,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;;gBAChF,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;YAE9C,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;YAC3D,IAAI,EAAE;gBAAE,eAAe,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAChC,IAAI,IAAI;gBAAE,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBACtB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,KAAK,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IACvE,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;IAE5E,OAAO;QACL,SAAS;QACT,MAAM;QACN,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1D,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QACrC,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC1C,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;QAC1B,WAAW;QACX,UAAU;QACV,SAAS;QACT,eAAe;QACf,eAAe;QACf,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;QACrC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE;QACrB,KAAK;KAAE,CAAC;AACZ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAkB;IAClC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;SAAE,CAAC;IACtC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAkB,EAClB,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACrF,OAAO;YACL,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;YACpB,KAAK,EAAE;gBACL,CAAC,CAAC,QAAQ,KAAK,CAAC;oBACd,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;oBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;aACjF;SAAE,CAAC;IACR,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAC3E,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;QACpB,KAAK,EAAE;YACL,CAAC,CAAC,QAAQ,KAAK,CAAC;gBACd,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC;gBACxB,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;SACjF;KAAE,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAkB,EAClB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;QACpB,KAAK,EAAE;YACL,CAAC,CAAC,QAAQ,KAAK,CAAC;gBACd,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;SACjF;KAAE,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAkB,EAClB,EAAU;IAEV,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;IACzD,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QACvE,SAAS,EAAE,MAAM;KAAE,CAAC,CAAC;IACvB,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;QACpB,KAAK,EAAE;YACL,CAAC,CAAC,QAAQ,KAAK,CAAC;gBACd,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;gBACxC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;SACjF;KAAE,CAAC;AACR,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAkB,EAClB,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,4CAA4C;IAC5C,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAC7B,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,EAAE,CAAC,EACzC,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;IACF,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,QAAQ,KAAK,CAAC;QACpB,KAAK,EAAE;YACL,CAAC,CAAC,QAAQ,KAAK,CAAC;gBACd,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,CAAC,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;SAC5F;KAAE,CAAC;AACR,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CAAC,GAAuB;IACjD,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC;SAClB,IAAI,EAAE;SACN,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;SAC5B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,IAAI,SAAS,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAkB,EAClB,IAAqB,EACrB,QAAgC,KAAK,EACrC,IAAa,EACb,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IAExB,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChF,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,yDAAyD;IACzD,IAAI,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;QAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACxD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;IACpF,MAAM,MAAM,GACV,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAExE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,EAAE,CAAC;QACZ,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAExC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,8EAA8E;IAC9E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ;YACnB,CAAC,CAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAc;YAC1F,CAAC,CAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAc,CAAC;QAC3C,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACxD,MAAM,SAAS,GAAG,QAAQ;YACxB,CAAC,CAAC,EAAE,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YACzD,CAAC,CAAC,EAAE,CAAC;QACP,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,CAAC;YACb,IAAI,4BAA4B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,6BAA6B,EAAE;oBAChC,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,CAAC;oBACR,IAAI,EAAE,SAAS;iBAChB,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,GAAG,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC1D,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,SAAS,IAAI,CAAC,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACjC,KAAK,CAAC,OAAO,CACX,EAAE,CAAC,6BAA6B,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,SAAS,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,IAAkB,EAClB,aAAqB;IAErB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAE3C,MAAM,MAAM,GAAG,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,iDAAiD;IACjD,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,gBAAgB,CAC5B,IAAI;aACD,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAC9E,CAAC;QACF,MAAM,KAAK,GAAG,KAAK;aAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACtD,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAI,IAAI,CAAC,CAAC;aACvD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAE9B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAC/B,CAAC,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,CAAC,EAC9C,EAAE,SAAS,EAAE,MAAM,EAAE,CACtB,CAAC;QACF,IAAI,GAAG,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,CAAC;QACf,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CACR,EAAE,CAAC,kBAAkB,EAAE;gBACrB,EAAE,EAAE,IAAI,CAAC,GAAG;gBACZ,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACnD,CAAC,CACH,CAAC;YACF,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,uCAAuC,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;SAAM,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oCAAoC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAChG,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,GAAG,EAAE;QACH,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,KAAK,EAAE,cAAc;QACrB,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,EAAc;QAC7B,sDAAsD;QACtD,cAAc,EAAE,EAAc;KAAE;IAClC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,KAAK,EAAE,uBAAuB;QAC9B,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,EAAc;QAC7B,cAAc,EAAE,EAAc;KAAE;IAClC,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,YAAY;QACnB,KAAK,EAAE,EAAE,CAAC,kBAAkB,CAAC;QAC7B,SAAS,EAAE,KAAK;QAChB,aAAa,EAAE,EAAc;QAC7B,yDAAyD;QACzD,cAAc,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC;KAAE;CAAW,CAAC"}

package/dist/hosting/ftps-service.d.ts

@@ -0,0 +1,182 @@
+import type { HostExecutor } from '../host/executor.js';
+import type { JsonStore } from '../db/store.js';
+import { type ApplyResult } from './system-apply.js';
+/**
+ * crypt(3)-compatible hash for pam_userdb (crypt=crypt).
+ * Prefer openssl passwd -6; fallback MD5-crypt-like is not ideal — use $6$ when possible.
+ */
+export declare function hashFtpPassword(plain: string): string;
+export declare function isCryptPasswordHash(value: string): boolean;
+export declare const FTPS_SETTINGS_KEY = "ftps_settings";
+export interface FtpsSettings {
+    listen: boolean;
+    /**
+     * IPv6 listen (vsftpd: listen_ipv6).
+     * When true with dual-stack intent: listen=NO + listen_ipv6=YES
+     * (IPv6 socket; may accept v4-mapped depending on bindv6only).
+     * Default false keeps classic IPv4-only.
+     */
+    listenIpv6: boolean;
+    listenPort: number;
+    sslEnable: boolean;
+    forceSsl: boolean;
+    /** Domain used to locate cert under dataDir/certs or LE path */
+    sslDomain: string;
+    certPath?: string;
+    keyPath?: string;
+    pasvMin: number;
+    pasvMax: number;
+    pasvAddress?: string;
+    writeEnable: boolean;
+    chrootLocalUser: boolean;
+    allowWriteableChroot: boolean;
+    banner: string;
+    /** Guest system user for virtual accounts */
+    guestUsername: string;
+}
+export declare const DEFAULT_FTPS_SETTINGS: FtpsSettings;
+export type FtpsStep = {
+    name: string;
+    status: 'ok' | 'skipped' | 'failed' | 'blocked';
+    detail?: string;
+};
+export interface FtpsStatus {
+    installed: boolean;
+    active: string;
+    confManaged: string;
+    confSystemExists: boolean;
+    accountCount: number;
+    settings: FtpsSettings;
+    lastAppliedAt?: string;
+}
+/**
+ * Create a jailed FTP account rooted at a project home (or home/app).
+ * Virtual user maps to project linuxUser on apply (guest_username per user_conf).
+ * Does not apply vsftpd until panel apply — status draft/written honestly.
+ */
+export declare function createProjectFtpAccount(db: JsonStore, input: {
+    projectId: string;
+    projectHome: string;
+    linuxUser: string;
+    linuxGroup?: string;
+    username?: string;
+    password: string;
+    /** default: projectHome/app if exists, else projectHome */
+    homeSubdir?: 'app' | 'root';
+}): {
+    ok: boolean;
+    account: Record<string, unknown>;
+    notes: string[];
+    written: string[];
+};
+export declare function loadFtpsSettings(db: JsonStore): FtpsSettings;
+export declare function saveFtpsSettings(db: JsonStore, patch: Partial<FtpsSettings>): FtpsSettings;
+export declare function ftpsPaths(dataDir: string): {
+    root: string;
+    conf: string;
+    pam: string;
+    userDbTxt: string;
+    userDb: string;
+    userConfDir: string;
+    homes: string;
+    mapPath: string;
+};
+/** Resolve cert/key paths from settings + dataDir certs */
+export declare function resolveCertPaths(dataDir: string, settings: FtpsSettings): {
+    cert: string;
+    key: string;
+    ok: boolean;
+};
+export declare function buildVsftpdConf(input: {
+    dataDir: string;
+    settings: FtpsSettings;
+}): string;
+/**
+ * pam_userdb requires the Berkeley DB path **without** the `.db` suffix
+ * (the module / libdb append `.db` themselves). Passing `…/virtual_users.db`
+ * makes it open `…/virtual_users.db.db` → every login fails with 530.
+ *
+ * Note: do not use `/\\.db$/` in a JS regex literal — that matches a
+ * backslash + any char + "db", not a literal ".db" extension.
+ */
+export declare function pamUserDbBasePath(userDbPath: string): string;
+/**
+ * Ports the operator must open (host firewall + cloud security group).
+ * Apply never mutates UFW — only reminds. LIST timeout after login = PASV blocked.
+ */
+export declare function ftpsFirewallPortSpecs(settings: Pick<FtpsSettings, 'listenPort' | 'pasvMin' | 'pasvMax'>): string[];
+/** Reminder notes only — does not open ports. */
+export declare function ftpsFirewallReminderNotes(settings: Pick<FtpsSettings, 'listenPort' | 'pasvMin' | 'pasvMax'>): string[];
+export declare function buildPamSnippet(dataDir: string): string;
+/**
+ * Write managed account files under dataDir (always allowed).
+ * Returns paths written; does not touch system unless host provided with execute.
+ */
+export declare function writeManagedFtpAccounts(input: {
+    db: JsonStore;
+    dataDir: string;
+}): {
+    written: string[];
+    accounts: Array<{
+        username: string;
+        home: string;
+    }>;
+    notes: string[];
+};
+export declare function probeFtpsStatus(input: {
+    db: JsonStore;
+    dataDir: string;
+    host: HostExecutor;
+}): Promise<FtpsStatus>;
+/**
+ * Full FTPS apply: write conf + accounts, optionally install/start vsftpd.
+ */
+export declare function applyFtpsService(input: {
+    db: JsonStore;
+    dataDir: string;
+    host: HostExecutor;
+    /** Install packages + copy to system + enable (default true for panel) */
+    applySystem?: boolean;
+    settingsPatch?: Partial<FtpsSettings>;
+}): Promise<ApplyResult & {
+    requiresExecute: boolean;
+    requiresRoot: boolean;
+    settings: FtpsSettings;
+    status?: FtpsStatus;
+    executed: boolean;
+}>;
+/**
+ * Apply one FTP account: rewrite all managed users + try system reload if possible.
+ */
+export declare function applyFtpAccountReal(input: {
+    db: JsonStore;
+    dataDir: string;
+    host: HostExecutor;
+    id: string;
+}): Promise<{
+    ok: boolean;
+    notes: string[];
+    blocked?: boolean;
+    blockMessage?: string;
+    executed?: boolean;
+    steps?: FtpsStep[];
+}>;
+/**
+ * chown each FTP jail to its project linuxUser (or guest for unbound accounts).
+ */
+export declare function chownFtpAccountHomes(host: HostExecutor, db: JsonStore, fallbackGuest: string): Promise<string[]>;
+/** Home path options for panel select */
+export declare function listFtpHomeOptions(input: {
+    db: JsonStore;
+    dataDir: string;
+    username?: string;
+}): Array<{
+    value: string;
+    label: string;
+}>;
+/** Domain options for panel select */
+export declare function listFtpDomainOptions(db: JsonStore): Array<{
+    value: string;
+    label: string;
+}>;
+//# sourceMappingURL=ftps-service.d.ts.map

package/dist/hosting/ftps-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ftps-service.d.ts","sourceRoot":"","sources":["../../src/hosting/ftps-service.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAqB,KAAK,WAAW,EAAoB,MAAM,mBAAmB,CAAC;AAQ1F;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAyBrD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAQ1D;AAED,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,OAAO,CAAC;IAChB;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;IAClB,gEAAgE;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,qBAAqB,EAAE,YAaZ,CAAC;AAEzB,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;IAChD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE,SAAS,EACb,KAAK,EAAE;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,UAAU,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;CAC7B,GACA;IACD,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB,CAgFA;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,GAAG,YAAY,CAS5D;AAED,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAa1F;AAQD,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM;;;;;;;;;EAWxC;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,YAAY,GACrB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,OAAO,CAAA;CAAE,CAwB5C;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,YAAY,CAAC;CACxB,GAAG,MAAM,CAwDT;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG,MAAM,EAAE,CAYlH;AAED,iDAAiD;AACjD,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC,GACjE,MAAM,EAAE,CAMV;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAQvD;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG;IACF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CA0GA;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE;IAC3C,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC,UAAU,CAAC,CAyBtB;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,0EAA0E;IAC1E,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;CACvC,GAAG,OAAO,CACT,WAAW,GAAG;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB,CACF,CA4PA;AAED;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;CACpB,CAAC,CA2FD;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,YAAY,EAClB,EAAE,EAAE,SAAS,EACb,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,EAAE,CAAC,CAqCnB;AAED,yCAAyC;AACzC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE;IACxC,EAAE,EAAE,SAAS,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB1C;AAED,sCAAsC;AACtC,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,SAAS,GAAG,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAmB3F"}