ysk-server-core 1.0.0

package/dist/hosting/node-apply.js

@@ -0,0 +1,86 @@
+import { tl } from 'ysk-server-shared';
+/**
+ * Apply Node.js hosting artifacts under dataDir (real files).
+ */
+import { mkdirSync, writeFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { selectNodeRuntime, renderNodeProcessUnit } from './runtime.js';
+/**
+ * Write env file + systemd unit for a project under dataDir.
+ */
+export async function applyNodeHosting(input) {
+    const runtime = selectNodeRuntime(input.nodeVersion);
+    const nodeBinary = input.nodeBinary ?? runtime.binaryPath;
+    const appDir = join(input.homeDir, 'app');
+    mkdirSync(appDir, { recursive: true });
+    mkdirSync(join(input.homeDir, 'logs'), { recursive: true });
+    const envPath = join(input.homeDir, 'app', '.env');
+    const envLines = Object.entries({
+        NODE_ENV: 'production',
+        PORT: String(input.port ?? 3000),
+        HOST: '127.0.0.1',
+        ...(input.env ?? {}),
+    }).map(([k, v]) => `${k}=${v}`);
+    writeFileSync(envPath, envLines.join('\n') + '\n', 'utf8');
+    const unitsDir = join(input.dataDir, 'systemd');
+    mkdirSync(unitsDir, { recursive: true });
+    const unitName = `ysk-project-${input.linuxUser}.service`;
+    const unitPath = join(unitsDir, unitName);
+    const unit = renderNodeProcessUnit({
+        projectName: input.projectName,
+        linuxUser: input.linuxUser,
+        appDir,
+        nodeBinary,
+        entry: input.entry ?? 'server.js',
+        port: input.port ?? 3000,
+        memoryMax: input.memoryMax,
+        cpuQuotaPercent: input.cpuQuotaPercent,
+        limitNOFILE: input.limitNOFILE,
+        env: input.env,
+    });
+    writeFileSync(unitPath, unit, 'utf8');
+    // default entry stub if missing — bind 127.0.0.1 so deploy health is local-only
+    const entryPath = join(appDir, input.entry ?? 'server.js');
+    if (!existsSync(entryPath)) {
+        writeFileSync(entryPath, `// Generated by YSK Server — real HTTP listen for health checks
+const http = require('http');
+const port = Number(process.env.PORT || 3000);
+const host = process.env.HOST || '127.0.0.1';
+const server = http.createServer((req, res) => {
+  res.statusCode = 200;
+  res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+  res.end('ok ' + port + ' ' + (req.url || '/'));
+});
+server.listen(port, host, () => {
+  process.stdout.write('ysk-app listening on ' + host + ':' + port + '\\n');
+});
+`, 'utf8');
+    }
+    const notes = [
+        `Unit written to ${unitPath}`,
+        `Env written to ${envPath}`,
+        `Node major ${runtime.version} binary: ${nodeBinary}`,
+    ];
+    let enabled = false;
+    if (input.enableService && input.host.executeEnabled() && input.host.isRoot()) {
+        const r1 = await input.host.runCommand(['cp', unitPath, `/etc/systemd/system/${unitName}`]);
+        const r2 = await input.host.runCommand(['systemctl', 'daemon-reload']);
+        const r3 = await input.host.runCommand(['systemctl', 'enable', '--now', unitName]);
+        if (r1.exitCode === 0 && r2.exitCode === 0 && r3.exitCode === 0) {
+            const { assertSystemdUnitHealthy } = await import('./project-ops.js');
+            const health = await assertSystemdUnitHealthy(input.host, unitName);
+            notes.push(...health.notes);
+            enabled = health.ok;
+            if (!health.ok) {
+                await input.host.runCommand(['systemctl', 'stop', unitName], { timeoutMs: 15_000 });
+                await input.host.runCommand(['systemctl', 'reset-failed', unitName], { timeoutMs: 10_000 });
+            }
+        }
+        notes.push(enabled ? tl('notes.auto.n0749') : tl('notes.auto.n1153'));
+    }
+    else {
+        notes.push(tl('notes.auto.n1154'));
+    }
+    return { envPath, unitPath, appDir, runtime, enabled, notes };
+}
+//# sourceMappingURL=node-apply.js.map

package/dist/hosting/node-apply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-apply.js","sourceRoot":"","sources":["../../src/hosting/node-apply.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAYxE;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAiBtC;IACC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1C,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC;QAC9B,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QAChC,IAAI,EAAE,WAAW;QACjB,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC;KACrB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChC,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAChD,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,eAAe,KAAK,CAAC,SAAS,UAAU,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,qBAAqB,CAAC;QACjC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM;QACN,UAAU;QACV,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW;QACjC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;KACf,CAAC,CAAC;IACH,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAEtC,gFAAgF;IAChF,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,IAAI,WAAW,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,aAAa,CACX,SAAS,EACT;;;;;;;;;;;;CAYL,EACK,MAAM,CACP,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,mBAAmB,QAAQ,EAAE;QAC7B,kBAAkB,OAAO,EAAE;QAC3B,cAAc,OAAO,CAAC,OAAO,YAAY,UAAU,EAAE;KACtD,CAAC;IACF,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9E,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,uBAAuB,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5F,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;QACvE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnF,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAChE,MAAM,EAAE,wBAAwB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACtE,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,OAAO,GAAG,MAAM,CAAC,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;gBACpF,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC"}

package/dist/hosting/package-limits.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Enforce hosting package quotas — **per-user** counts when resources are owned.
+ * Host-wide totals remain for honesty / ops dashboards.
+ */
+import type { YskDatabase } from '../db/database.js';
+export type PackageUsage = {
+    scope: 'user' | 'host';
+    userId?: string;
+    projects: number;
+    mailboxes: number;
+    databases: number;
+    /** Soft: sum of owned projects' quota_mb (0 = unlimited/unset) */
+    diskQuotaAssignedMb: number;
+};
+/** Host-level totals (ops honesty — not isolation). */
+export declare function hostPackageUsage(db: YskDatabase): PackageUsage;
+/**
+ * Count resources owned by a panel user.
+ * Unowned legacy rows do **not** count against the user (migrate by setting owner_user_id).
+ */
+export declare function userPackageUsage(db: YskDatabase, userId: string): PackageUsage;
+export declare function getUserPackage(db: YskDatabase, userId: string): import("../index.js").StorePackage | null;
+export declare function assertCanCreateProject(db: YskDatabase, actorUserId?: string): void;
+export declare function assertCanCreateMailbox(db: YskDatabase, actorUserId?: string): void;
+export declare function assertCanCreateDatabase(db: YskDatabase, actorUserId?: string): void;
+/**
+ * Assign owner_user_id on projects missing ownership (B3 / package quota).
+ * Does not change linux users or homes.
+ */
+export declare function backfillProjectOwners(db: YskDatabase, ownerUserId: string, opts?: {
+    onlyUnowned?: boolean;
+    projectIds?: string[];
+}): {
+    updated: number;
+    skipped: number;
+    ownerUserId: string;
+};
+//# sourceMappingURL=package-limits.d.ts.map

package/dist/hosting/package-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-limits.d.ts","sourceRoot":"","sources":["../../src/hosting/package-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF,uDAAuD;AACvD,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,WAAW,GAAG,YAAY,CAU9D;AAyBD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,YAAY,CAwB9E;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,6CAI7D;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAoBlF;AAED,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAYlF;AAED,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAYnF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,EAAE,EAAE,WAAW,EACf,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,OAAO,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,GACtD;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAwB3D"}

package/dist/hosting/package-limits.js

@@ -0,0 +1,129 @@
+/**
+ * Enforce hosting package quotas — **per-user** counts when resources are owned.
+ * Host-wide totals remain for honesty / ops dashboards.
+ */
+import { ErrorCodes, YskError, tl } from 'ysk-server-shared';
+/** Host-level totals (ops honesty — not isolation). */
+export function hostPackageUsage(db) {
+    return {
+        scope: 'host',
+        projects: db.snapshot.projects?.length ?? 0,
+        mailboxes: (db.snapshot.mailboxes ?? []).length,
+        databases: (db.snapshot.mysql_databases ?? []).length +
+            (db.snapshot.postgres_databases ?? []).length,
+        diskQuotaAssignedMb: sumProjectQuotaMb(db.snapshot.projects ?? []),
+    };
+}
+function ownerOf(row) {
+    if (!row)
+        return undefined;
+    const id = row.owner_user_id ??
+        row.ownerUserId ??
+        row.user_id ??
+        row.userId ??
+        row.created_by_user_id;
+    return id != null && String(id) ? String(id) : undefined;
+}
+function sumProjectQuotaMb(projects, userId) {
+    let n = 0;
+    for (const p of projects) {
+        if (userId && p.owner_user_id !== userId)
+            continue;
+        if (p.quota_mb != null && p.quota_mb > 0)
+            n += p.quota_mb;
+    }
+    return n;
+}
+/**
+ * Count resources owned by a panel user.
+ * Unowned legacy rows do **not** count against the user (migrate by setting owner_user_id).
+ */
+export function userPackageUsage(db, userId) {
+    const projects = (db.snapshot.projects ?? []).filter((p) => p.owner_user_id === userId);
+    const mailboxes = (db.snapshot.mailboxes ?? []).filter((m) => ownerOf(m) === userId);
+    const mysql = (db.snapshot.mysql_databases ?? []).filter((d) => ownerOf(d) === userId);
+    const pg = (db.snapshot.postgres_databases ?? []).filter((d) => ownerOf(d) === userId);
+    return {
+        scope: 'user',
+        userId,
+        projects: projects.length,
+        mailboxes: mailboxes.length,
+        databases: mysql.length + pg.length,
+        diskQuotaAssignedMb: sumProjectQuotaMb(db.snapshot.projects, userId),
+    };
+}
+export function getUserPackage(db, userId) {
+    const u = db.snapshot.users.find((x) => x.id === userId);
+    if (!u?.package_id)
+        return null;
+    return (db.snapshot.packages ?? []).find((p) => p.id === u.package_id) ?? null;
+}
+export function assertCanCreateProject(db, actorUserId) {
+    if (!actorUserId)
+        return;
+    const pkg = getUserPackage(db, actorUserId);
+    if (!pkg)
+        return;
+    const usage = userPackageUsage(db, actorUserId);
+    if (pkg.max_projects > 0 && usage.projects >= pkg.max_projects) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0302', { v0: pkg.max_projects, v1: pkg.name }), { httpStatus: 403, details: { scope: 'user', usage, packageId: pkg.id } });
+    }
+    // Soft disk: assigned project quotas must not exceed package disk_mb
+    if (pkg.disk_mb > 0 && usage.diskQuotaAssignedMb > pkg.disk_mb) {
+        throw new YskError(ErrorCodes.VALIDATION, `Package disk quota exceeded (${usage.diskQuotaAssignedMb} / ${pkg.disk_mb} MiB assigned)`, { httpStatus: 403, details: { scope: 'user', usage, packageId: pkg.id } });
+    }
+}
+export function assertCanCreateMailbox(db, actorUserId) {
+    if (!actorUserId)
+        return;
+    const pkg = getUserPackage(db, actorUserId);
+    if (!pkg || pkg.max_mailboxes <= 0)
+        return;
+    const usage = userPackageUsage(db, actorUserId);
+    if (usage.mailboxes >= pkg.max_mailboxes) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0303', { v0: pkg.max_mailboxes, v1: pkg.name }), { httpStatus: 403, details: { scope: 'user', usage, packageId: pkg.id } });
+    }
+}
+export function assertCanCreateDatabase(db, actorUserId) {
+    if (!actorUserId)
+        return;
+    const pkg = getUserPackage(db, actorUserId);
+    if (!pkg || pkg.max_databases <= 0)
+        return;
+    const usage = userPackageUsage(db, actorUserId);
+    if (usage.databases >= pkg.max_databases) {
+        throw new YskError(ErrorCodes.VALIDATION, tl('notes.auto.t0304', { v0: pkg.max_databases, v1: pkg.name }), { httpStatus: 403, details: { scope: 'user', usage, packageId: pkg.id } });
+    }
+}
+/**
+ * Assign owner_user_id on projects missing ownership (B3 / package quota).
+ * Does not change linux users or homes.
+ */
+export function backfillProjectOwners(db, ownerUserId, opts) {
+    const onlyUnowned = opts?.onlyUnowned !== false;
+    const filter = opts?.projectIds ? new Set(opts.projectIds) : null;
+    let updated = 0;
+    let skipped = 0;
+    const user = db.snapshot.users.find((u) => u.id === ownerUserId);
+    if (!user) {
+        throw new YskError(ErrorCodes.NOT_FOUND, `user ${ownerUserId} not found`, {
+            httpStatus: 404,
+        });
+    }
+    for (const p of db.snapshot.projects ?? []) {
+        if (filter && !filter.has(p.id))
+            continue;
+        const hasOwner = Boolean(p.owner_user_id);
+        if (onlyUnowned && hasOwner) {
+            skipped++;
+            continue;
+        }
+        p.owner_user_id = ownerUserId;
+        p.updated_at = new Date().toISOString();
+        updated++;
+    }
+    if (updated)
+        db.persist();
+    return { updated, skipped, ownerUserId };
+}
+//# sourceMappingURL=package-limits.js.map

package/dist/hosting/package-limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-limits.js","sourceRoot":"","sources":["../../src/hosting/package-limits.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAY7D,uDAAuD;AACvD,MAAM,UAAU,gBAAgB,CAAC,EAAe;IAC9C,OAAO;QACL,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC;QAC3C,SAAS,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM;QAC/C,SAAS,EACP,CAAC,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM;YAC1C,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM;QAC/C,mBAAmB,EAAE,iBAAiB,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,GAAwC;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,EAAE,GACN,GAAG,CAAC,aAAa;QACjB,GAAG,CAAC,WAAW;QACf,GAAG,CAAC,OAAO;QACX,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,kBAAkB,CAAC;IACzB,OAAO,EAAE,IAAI,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,SAAS,iBAAiB,CACxB,QAA8D,EAC9D,MAAe;IAEf,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,MAAM,IAAI,CAAC,CAAC,aAAa,KAAK,MAAM;YAAE,SAAS;QACnD,IAAI,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC;YAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC5D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAe,EAAE,MAAc;IAC9D,MAAM,QAAQ,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAE,CAAgC,CAAC,aAAa,KAAK,MAAM,CAClE,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAA4B,CAAC,KAAK,MAAM,CACxD,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAA4B,CAAC,KAAK,MAAM,CACxD,CAAC;IACF,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,MAAM,CACtD,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAA4B,CAAC,KAAK,MAAM,CACxD,CAAC;IACF,OAAO;QACL,KAAK,EAAE,MAAM;QACb,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,MAAM;QACzB,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,SAAS,EAAE,KAAK,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM;QACnC,mBAAmB,EAAE,iBAAiB,CACpC,EAAE,CAAC,QAAQ,CAAC,QAAgE,EAC5E,MAAM,CACP;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAAe,EAAE,MAAc;IAC5D,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,CAAC,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAe,EAAE,WAAoB;IAC1E,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,GAAG,CAAC,YAAY,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAC9D,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,mBAAmB,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC/D,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,gCAAgC,KAAK,CAAC,mBAAmB,MAAM,GAAG,CAAC,OAAO,gBAAgB,EAC1F,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,EAAe,EAAE,WAAoB;IAC1E,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC;QAAE,OAAO;IAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAC/D,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,EAAe,EAAE,WAAoB;IAC3E,IAAI,CAAC,WAAW;QAAE,OAAO;IACzB,MAAM,GAAG,GAAG,cAAc,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC;QAAE,OAAO;IAC3C,MAAM,KAAK,GAAG,gBAAgB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;QACzC,MAAM,IAAI,QAAQ,CAChB,UAAU,CAAC,UAAU,EACrB,EAAE,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,EAC/D,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,EAAe,EACf,WAAmB,EACnB,IAAuD;IAEvD,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,KAAK,KAAK,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,WAAW,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,WAAW,YAAY,EAAE;YACxE,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC3C,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,SAAS;QAC1C,MAAM,QAAQ,GAAG,OAAO,CAAE,CAAgC,CAAC,aAAa,CAAC,CAAC;QAC1E,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;YAC5B,OAAO,EAAE,CAAC;YACV,SAAS;QACX,CAAC;QACA,CAAgC,CAAC,aAAa,GAAG,WAAW,CAAC;QAC9D,CAAC,CAAC,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,OAAO;QAAE,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;AAC3C,CAAC"}

package/dist/hosting/panel-tls.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Control-plane (panel) TLS — enable HTTPS on ysk-server listenPort.
+ * Uses Let's Encrypt live paths or managed dataDir certs; config written to config.json.
+ */
+import type { YskConfig } from '../config/schema.js';
+import type { HostExecutor } from '../host/executor.js';
+import type { YskDatabase } from '../db/store.js';
+/** Bootstrap self-signed materials for first IP login (under dataDir). */
+export declare function panelBootstrapTlsDir(dataDir: string): string;
+export declare function panelBootstrapCertPaths(dataDir: string): {
+    certPath: string;
+    keyPath: string;
+    dir: string;
+};
+/** Detect primary non-loopback IPv4 for SAN (best-effort). */
+export declare function detectPrimaryIpv4(): string | undefined;
+/**
+ * Build OpenSSL -addext subjectAltName value from IPs + DNS names.
+ */
+export declare function buildBootstrapSan(input: {
+    ips?: string[];
+    dns?: string[];
+}): string;
+export type BootstrapPanelTlsResult = {
+    ok: boolean;
+    notes: string[];
+    certPath?: string;
+    keyPath?: string;
+    fingerprintSha256?: string;
+    primaryIp?: string;
+    httpsUrl?: string;
+    regenerated: boolean;
+    configUpdated: boolean;
+};
+/**
+ * Generate (or reuse) self-signed panel cert for IP-first login and enable TLS in config.
+ * HTTPS-only: sets tlsHttpsOnly + listenHost 0.0.0.0 by default.
+ */
+export declare function ensureBootstrapPanelTls(input: {
+    dataDir: string;
+    configPath?: string;
+    /** Extra IPs for SAN */
+    ips?: string[];
+    /** Extra DNS names for SAN */
+    dns?: string[];
+    force?: boolean;
+    /** Days validity (default 825 ≈ 27 months) */
+    days?: number;
+    listenHost?: string;
+    listenPort?: number;
+}): BootstrapPanelTlsResult;
+export type PanelTlsStatus = {
+    ok: boolean;
+    /** Config wants TLS */
+    tlsEnabled: boolean;
+    /** This process is actually serving HTTPS */
+    servingHttps: boolean;
+    panelDomain?: string;
+    certPath?: string;
+    keyPath?: string;
+    certExists: boolean;
+    keyExists: boolean;
+    expiresAt?: string | null;
+    listenPort: number;
+    listenHost: string;
+    /** Suggested operator URL */
+    httpsUrl?: string;
+    httpUrl?: string;
+    notes: string[];
+    restartRequired: boolean;
+};
+export type PanelTlsResult = {
+    ok: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    notes: string[];
+    status: PanelTlsStatus;
+    /** True when config.json was updated — serve must restart to apply TLS */
+    restartRequired: boolean;
+    executed?: boolean;
+};
+export declare function resolvePanelTlsMaterials(config?: YskConfig | null): {
+    certPath?: string;
+    keyPath?: string;
+    certExists: boolean;
+    keyExists: boolean;
+    expiresAt?: string | null;
+};
+/** Materials for https.createServer — null if TLS off or files missing. */
+export declare function loadPanelTlsOptions(config?: YskConfig | null): {
+    cert: Buffer;
+    key: Buffer;
+} | null;
+export declare function getPanelTlsStatus(input: {
+    config?: YskConfig | null;
+    /** True when this process bound with HTTPS */
+    servingHttps?: boolean;
+}): PanelTlsStatus;
+/**
+ * Enable panel HTTPS: resolve cert for domain (existing LE/managed), write config.
+ * Does not restart serve — operator restarts ysk-server (or we try systemctl).
+ */
+export declare function enablePanelTls(input: {
+    configPath: string;
+    dataDir: string;
+    domain: string;
+    certPath?: string;
+    keyPath?: string;
+    enabled?: boolean;
+}): PanelTlsResult;
+export declare function disablePanelTls(input: {
+    configPath: string;
+}): PanelTlsResult;
+/**
+ * Panel-specific ACME: certonly (no nginx --redirect).
+ * Tries webroot under dataDir → nginx plugin → standalone (port 80 free).
+ */
+export declare function applyPanelLetsEncrypt(input: {
+    domain: string;
+    email: string;
+    dataDir: string;
+    host: HostExecutor;
+}): Promise<{
+    ok: boolean;
+    executed: boolean;
+    blocked?: boolean;
+    blockMessage?: string;
+    notes: string[];
+    commands: string[];
+}>;
+/**
+ * Issue LE for panel domain then enable TLS in config.
+ */
+export declare function issueAndEnablePanelTls(input: {
+    configPath: string;
+    dataDir: string;
+    db: YskDatabase;
+    host: HostExecutor;
+    domain: string;
+    email: string;
+    actor: string;
+}): Promise<PanelTlsResult>;
+/** Best-effort restart of control plane unit after TLS config change. */
+export declare function tryRestartPanelService(host: HostExecutor): Promise<{
+    ok: boolean;
+    notes: string[];
+}>;
+/** Unit path hint under dataDir for tests */
+export declare function panelTlsConfigHint(dataDir: string): string;
+//# sourceMappingURL=panel-tls.d.ts.map

package/dist/hosting/panel-tls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"panel-tls.d.ts","sourceRoot":"","sources":["../../src/hosting/panel-tls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAErD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUlD,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb,CAOA;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,SAAS,CAyBtD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB,GAAG,MAAM,CAgBT;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,OAAO,CAAC;IACrB,aAAa,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CAsJ1B;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,uBAAuB;IACvB,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,YAAY,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC;IACvB,0EAA0E;IAC1E,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,CAAC;AAWF,wBAAgB,wBAAwB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAUA;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,GAAG;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,IAAI,CAYP;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,SAAS,GAAG,IAAI,CAAC;IAC1B,8CAA8C;IAC9C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,GAAG,cAAc,CAmCjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,GAAG,cAAc,CAgEjB;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,cAAc,CAkB7E;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC,CAyDD;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,cAAc,CAAC,CA0E1B;AAED,yEAAyE;AACzE,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC;IACxE,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB,CAAC,CAsBD;AAED,6CAA6C;AAC7C,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D"}