ysk-server-core 1.0.0

package/dist/hosting/panel-tls.js

@@ -0,0 +1,533 @@
+/**
+ * Control-plane (panel) TLS — enable HTTPS on ysk-server listenPort.
+ * Uses Let's Encrypt live paths or managed dataDir certs; config written to config.json.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { mergePanelTlsConfig, parseConfig } from '../config/schema.js';
+import { parseCertExpiryFromPath, resolveBestCertPaths, resolveLetsEncryptLivePaths, upsertLetsEncryptRecord, } from './ssl-certs.js';
+import { panelBlockMessage } from './system-apply.js';
+import { tl } from 'ysk-server-shared';
+/** Bootstrap self-signed materials for first IP login (under dataDir). */
+export function panelBootstrapTlsDir(dataDir) {
+    return join(dataDir, 'ssl', 'panel');
+}
+export function panelBootstrapCertPaths(dataDir) {
+    const dir = panelBootstrapTlsDir(dataDir);
+    return {
+        dir,
+        certPath: join(dir, 'bootstrap-cert.pem'),
+        keyPath: join(dir, 'bootstrap-key.pem'),
+    };
+}
+/** Detect primary non-loopback IPv4 for SAN (best-effort). */
+export function detectPrimaryIpv4() {
+    try {
+        const r = spawnSync('hostname', ['-I'], { encoding: 'utf8', timeout: 3000 });
+        if (r.status === 0 && r.stdout) {
+            for (const part of r.stdout.trim().split(/\s+/)) {
+                if (/^\d+\.\d+\.\d+\.\d+$/.test(part) && !part.startsWith('127.')) {
+                    return part;
+                }
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        const r = spawnSync('ip', ['-4', 'route', 'get', '1.1.1.1'], { encoding: 'utf8', timeout: 3000 });
+        const m = r.stdout?.match(/\bsrc\s+(\d+\.\d+\.\d+\.\d+)\b/);
+        if (m?.[1] && !m[1].startsWith('127.'))
+            return m[1];
+    }
+    catch {
+        /* ignore */
+    }
+    return undefined;
+}
+/**
+ * Build OpenSSL -addext subjectAltName value from IPs + DNS names.
+ */
+export function buildBootstrapSan(input) {
+    const ips = new Set(['127.0.0.1']);
+    for (const ip of input.ips ?? []) {
+        const t = String(ip || '').trim();
+        if (/^\d+\.\d+\.\d+\.\d+$/.test(t))
+            ips.add(t);
+    }
+    const dns = new Set(['localhost']);
+    for (const d of input.dns ?? []) {
+        const t = String(d || '').trim().toLowerCase();
+        if (t && /^[a-z0-9._-]+$/i.test(t))
+            dns.add(t);
+    }
+    const parts = [
+        ...[...ips].map((ip) => `IP:${ip}`),
+        ...[...dns].map((d) => `DNS:${d}`),
+    ];
+    return parts.join(',');
+}
+/**
+ * Generate (or reuse) self-signed panel cert for IP-first login and enable TLS in config.
+ * HTTPS-only: sets tlsHttpsOnly + listenHost 0.0.0.0 by default.
+ */
+export function ensureBootstrapPanelTls(input) {
+    const notes = [];
+    const dataDir = input.dataDir;
+    if (!dataDir) {
+        return { ok: false, notes: ['dataDir required'], regenerated: false, configUpdated: false };
+    }
+    const configPath = input.configPath ?? join(dataDir, 'config.json');
+    const paths = panelBootstrapCertPaths(dataDir);
+    const detected = detectPrimaryIpv4();
+    const ips = [...(input.ips ?? [])];
+    if (detected)
+        ips.unshift(detected);
+    mkdirSync(paths.dir, { recursive: true, mode: 0o700 });
+    try {
+        chmodSync(paths.dir, 0o700);
+    }
+    catch {
+        /* best-effort */
+    }
+    let regenerated = false;
+    const have = existsSync(paths.certPath) &&
+        existsSync(paths.keyPath) &&
+        !input.force;
+    if (have) {
+        notes.push('reusing existing bootstrap cert/key');
+    }
+    else {
+        {
+            const ov = spawnSync('openssl', ['version'], { encoding: 'utf8' });
+            if (ov.error || ov.status !== 0) {
+                return {
+                    ok: false,
+                    notes: ['openssl not found — install openssl to bootstrap panel TLS'],
+                    regenerated: false,
+                    configUpdated: false,
+                };
+            }
+        }
+        const san = buildBootstrapSan({ ips, dns: input.dns });
+        const days = input.days ?? 825;
+        // OpenSSL 1.1.1+ -addext; write temp config for broader compatibility
+        const cnf = join(paths.dir, 'bootstrap-openssl.cnf');
+        writeFileSync(cnf, [
+            '[req]',
+            'distinguished_name = req_distinguished_name',
+            'x509_extensions = v3_req',
+            'prompt = no',
+            '[req_distinguished_name]',
+            'CN = ysk-server-bootstrap',
+            'O = YSK Server',
+            '[v3_req]',
+            'subjectAltName = ' + san,
+            'basicConstraints = CA:FALSE',
+            'keyUsage = digitalSignature, keyEncipherment',
+            'extendedKeyUsage = serverAuth',
+            '',
+        ].join('\n'), { mode: 0o600 });
+        const r = spawnSync('openssl', [
+            'req',
+            '-x509',
+            '-newkey',
+            'rsa:2048',
+            '-nodes',
+            '-keyout',
+            paths.keyPath,
+            '-out',
+            paths.certPath,
+            '-days',
+            String(days),
+            '-config',
+            cnf,
+            '-extensions',
+            'v3_req',
+        ], { encoding: 'utf8' });
+        if (r.status !== 0) {
+            return {
+                ok: false,
+                notes: [
+                    `openssl failed: ${(r.stderr || r.stdout || '').slice(0, 300)}`,
+                ],
+                regenerated: false,
+                configUpdated: false,
+            };
+        }
+        regenerated = true;
+        notes.push(`generated bootstrap cert (SAN ${san})`);
+    }
+    try {
+        chmodSync(paths.keyPath, 0o600);
+        chmodSync(paths.certPath, 0o644);
+    }
+    catch {
+        notes.push('WARN: could not chmod cert/key');
+    }
+    let fingerprintSha256;
+    try {
+        const fp = spawnSync('openssl', ['x509', '-in', paths.certPath, '-noout', '-fingerprint', '-sha256'], { encoding: 'utf8' });
+        const line = (fp.stdout || '').trim();
+        const m = line.match(/Fingerprint=([0-9A-Fa-f:]+)/);
+        fingerprintSha256 = m?.[1] ?? (line || undefined);
+        if (fingerprintSha256)
+            notes.push(`SHA256 Fingerprint=${fingerprintSha256}`);
+    }
+    catch {
+        /* ignore */
+    }
+    let configUpdated = false;
+    if (existsSync(configPath)) {
+        const base = readConfigFile(configPath);
+        const next = mergePanelTlsConfig(base, {
+            tlsEnabled: true,
+            tlsCertPath: paths.certPath,
+            tlsKeyPath: paths.keyPath,
+            tlsHttpsOnly: true,
+            listenHost: input.listenHost ?? '0.0.0.0',
+        });
+        if (input.listenPort != null)
+            next.listenPort = input.listenPort;
+        writeConfigFile(configPath, next);
+        configUpdated = true;
+        notes.push('config.json: tlsEnabled + tlsHttpsOnly + listenHost=0.0.0.0');
+    }
+    else {
+        notes.push(`config missing at ${configPath} — cert written; run setup then tls bootstrap again`);
+    }
+    const port = input.listenPort ?? 9287;
+    const primaryIp = detected ?? ips.find((i) => i !== '127.0.0.1') ?? '127.0.0.1';
+    return {
+        ok: true,
+        notes,
+        certPath: paths.certPath,
+        keyPath: paths.keyPath,
+        fingerprintSha256,
+        primaryIp,
+        httpsUrl: `https://${primaryIp}:${port}`,
+        regenerated,
+        configUpdated,
+    };
+}
+function readConfigFile(configPath) {
+    const raw = JSON.parse(readFileSync(configPath, 'utf8'));
+    return parseConfig(raw);
+}
+function writeConfigFile(configPath, config) {
+    writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n', 'utf8');
+}
+export function resolvePanelTlsMaterials(config) {
+    const certPath = config?.tlsCertPath;
+    const keyPath = config?.tlsKeyPath;
+    const certExists = Boolean(certPath && existsSync(certPath));
+    const keyExists = Boolean(keyPath && existsSync(keyPath));
+    let expiresAt;
+    if (certExists && certPath) {
+        expiresAt = parseCertExpiryFromPath(certPath);
+    }
+    return { certPath, keyPath, certExists, keyExists, expiresAt };
+}
+/** Materials for https.createServer — null if TLS off or files missing. */
+export function loadPanelTlsOptions(config) {
+    if (!config?.tlsEnabled)
+        return null;
+    const m = resolvePanelTlsMaterials(config);
+    if (!m.certExists || !m.keyExists || !m.certPath || !m.keyPath)
+        return null;
+    try {
+        return {
+            cert: readFileSync(m.certPath),
+            key: readFileSync(m.keyPath),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function getPanelTlsStatus(input) {
+    const config = input.config;
+    const listenPort = config?.listenPort ?? 9287;
+    const listenHost = config?.listenHost ?? '127.0.0.1';
+    const domain = config?.panelDomain?.trim() || undefined;
+    const m = resolvePanelTlsMaterials(config);
+    const tlsEnabled = Boolean(config?.tlsEnabled);
+    const servingHttps = Boolean(input.servingHttps);
+    const notes = [];
+    if (tlsEnabled && (!m.certExists || !m.keyExists)) {
+        notes.push(tl('system.panelTls.certMissing'));
+    }
+    if (tlsEnabled && !servingHttps) {
+        notes.push(tl('system.panelTls.restartToApply'));
+    }
+    const hostLabel = domain ||
+        (listenHost === '0.0.0.0' || listenHost === '::' ? '127.0.0.1' : listenHost);
+    return {
+        ok: !tlsEnabled || (m.certExists && m.keyExists),
+        tlsEnabled,
+        servingHttps,
+        panelDomain: domain,
+        certPath: m.certPath,
+        keyPath: m.keyPath,
+        certExists: m.certExists,
+        keyExists: m.keyExists,
+        expiresAt: m.expiresAt,
+        listenPort,
+        listenHost,
+        httpsUrl: `https://${hostLabel}:${listenPort}`,
+        httpUrl: `http://${hostLabel}:${listenPort}`,
+        notes,
+        restartRequired: tlsEnabled !== servingHttps,
+    };
+}
+/**
+ * Enable panel HTTPS: resolve cert for domain (existing LE/managed), write config.
+ * Does not restart serve — operator restarts ysk-server (or we try systemctl).
+ */
+export function enablePanelTls(input) {
+    const notes = [];
+    if (!input.configPath || !existsSync(input.configPath)) {
+        return {
+            ok: false,
+            notes: [tl('system.panelTls.noConfig')],
+            status: getPanelTlsStatus({}),
+            restartRequired: false,
+        };
+    }
+    const domain = input.domain.trim().toLowerCase().replace(/\.$/, '');
+    if (!domain) {
+        return {
+            ok: false,
+            notes: [tl('system.panelTls.needDomain')],
+            status: getPanelTlsStatus({ config: readConfigFile(input.configPath) }),
+            restartRequired: false,
+        };
+    }
+    let certPath = input.certPath?.trim();
+    let keyPath = input.keyPath?.trim();
+    if (!certPath || !keyPath) {
+        const best = resolveBestCertPaths(input.dataDir, domain);
+        if (best.exists) {
+            certPath = best.fullchain;
+            keyPath = best.privkey;
+            notes.push(tl('system.panelTls.usingExisting'));
+        }
+        else {
+            const le = resolveLetsEncryptLivePaths(domain);
+            if (le.exists) {
+                certPath = le.fullchain;
+                keyPath = le.privkey;
+                notes.push(tl('system.panelTls.usingLe'));
+            }
+        }
+    }
+    if (!certPath || !keyPath || !existsSync(certPath) || !existsSync(keyPath)) {
+        return {
+            ok: false,
+            notes: [tl('system.panelTls.needCertFirst', { domain })],
+            status: getPanelTlsStatus({ config: readConfigFile(input.configPath) }),
+            restartRequired: false,
+        };
+    }
+    const base = readConfigFile(input.configPath);
+    const next = mergePanelTlsConfig(base, {
+        tlsEnabled: input.enabled !== false,
+        tlsCertPath: certPath,
+        tlsKeyPath: keyPath,
+        panelDomain: domain,
+    });
+    writeConfigFile(input.configPath, next);
+    notes.push(tl('system.panelTls.configWritten'));
+    notes.push(tl('system.panelTls.restartToApply'));
+    return {
+        ok: true,
+        notes,
+        status: getPanelTlsStatus({ config: next, servingHttps: false }),
+        restartRequired: true,
+    };
+}
+export function disablePanelTls(input) {
+    if (!input.configPath || !existsSync(input.configPath)) {
+        return {
+            ok: false,
+            notes: [tl('system.panelTls.noConfig')],
+            status: getPanelTlsStatus({}),
+            restartRequired: false,
+        };
+    }
+    const base = readConfigFile(input.configPath);
+    const next = mergePanelTlsConfig(base, { tlsEnabled: false });
+    writeConfigFile(input.configPath, next);
+    return {
+        ok: true,
+        notes: [tl('system.panelTls.disabledNote'), tl('system.panelTls.restartToApply')],
+        status: getPanelTlsStatus({ config: next, servingHttps: false }),
+        restartRequired: true,
+    };
+}
+/**
+ * Panel-specific ACME: certonly (no nginx --redirect).
+ * Tries webroot under dataDir → nginx plugin → standalone (port 80 free).
+ */
+export async function applyPanelLetsEncrypt(input) {
+    const domain = input.domain.trim().toLowerCase().replace(/\.$/, '');
+    const email = input.email.trim();
+    const notes = [];
+    const commands = [];
+    if (!input.host.executeEnabled()) {
+        const blockMessage = panelBlockMessage('no_execute');
+        return { ok: false, executed: false, blocked: true, blockMessage, notes: [blockMessage], commands };
+    }
+    if (!input.host.isRoot()) {
+        const blockMessage = panelBlockMessage('no_root');
+        return { ok: false, executed: false, blocked: true, blockMessage, notes: [blockMessage], commands };
+    }
+    const webroot = join(input.dataDir, 'acme-www');
+    try {
+        mkdirSync(join(webroot, '.well-known', 'acme-challenge'), { recursive: true });
+    }
+    catch {
+        /* best-effort */
+    }
+    // Single bash: try strategies in order; succeed if live cert appears
+    const script = [
+        '#!/usr/bin/env bash',
+        'set -u',
+        `DOMAIN=${JSON.stringify(domain)}`,
+        `EMAIL=${JSON.stringify(email)}`,
+        `WEBROOT=${JSON.stringify(webroot)}`,
+        'mkdir -p "$WEBROOT/.well-known/acme-challenge"',
+        'if ! command -v certbot >/dev/null 2>&1; then echo "certbot missing" >&2; exit 2; fi',
+        'try() { echo "trying: $*" >&2; "$@" && return 0; return 1; }',
+        // 1) webroot (works if any reverse-proxy serves this path)
+        'try certbot certonly --webroot -w "$WEBROOT" -d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --keep-until-expiring && exit 0',
+        // 2) nginx plugin without --redirect (does not force site redirect)
+        'try certbot certonly --nginx -d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --keep-until-expiring && exit 0',
+        // 3) standalone (needs free :80 — may fail if nginx holds it)
+        'try certbot certonly --standalone -d "$DOMAIN" --email "$EMAIL" --agree-tos --non-interactive --preferred-challenges http --keep-until-expiring && exit 0',
+        'echo "all ACME strategies failed for $DOMAIN" >&2',
+        'exit 1',
+        '',
+    ].join('\n');
+    commands.push('certbot certonly (webroot|nginx|standalone)');
+    notes.push(tl('system.panelTls.leStrategies'));
+    const r = await input.host.runCommand(['bash', '-c', script], { timeoutMs: 300_000 });
+    const live = resolveLetsEncryptLivePaths(domain);
+    const ok = r.exitCode === 0 || live.exists;
+    if (ok) {
+        notes.push(tl('system.panelTls.leOk', { domain }));
+    }
+    else {
+        const detail = `${r.stderr || ''}\n${r.stdout || ''}`.trim().slice(0, 400);
+        notes.push(tl('system.panelTls.leFailed', { detail: detail || `exit ${r.exitCode}` }));
+        notes.push(tl('system.panelTls.leHint'));
+    }
+    return { ok, executed: true, notes, commands };
+}
+/**
+ * Issue LE for panel domain then enable TLS in config.
+ */
+export async function issueAndEnablePanelTls(input) {
+    const domain = input.domain.trim().toLowerCase();
+    const notes = [];
+    // Already have live cert? skip issue
+    const existing = resolveBestCertPaths(input.dataDir, domain);
+    const le = resolveLetsEncryptLivePaths(domain);
+    let issueOk = existing.exists || le.exists;
+    if (!issueOk) {
+        const r = await applyPanelLetsEncrypt({
+            domain,
+            email: input.email,
+            dataDir: input.dataDir,
+            host: input.host,
+        });
+        notes.push(...(r.notes ?? []));
+        if (r.blocked) {
+            return {
+                ok: false,
+                blocked: true,
+                blockMessage: r.blockMessage,
+                notes,
+                status: getPanelTlsStatus({
+                    config: existsSync(input.configPath) ? readConfigFile(input.configPath) : undefined,
+                }),
+                restartRequired: false,
+                executed: r.executed,
+            };
+        }
+        issueOk = Boolean(r.ok);
+        upsertLetsEncryptRecord({
+            db: input.db,
+            domain,
+            email: input.email,
+            actor: input.actor,
+            ok: issueOk,
+            run: true,
+            executed: Boolean(r.executed),
+            commands: r.commands ?? [],
+            notes: r.notes ?? [],
+        });
+        if (!issueOk) {
+            return {
+                ok: false,
+                notes,
+                status: getPanelTlsStatus({
+                    config: existsSync(input.configPath) ? readConfigFile(input.configPath) : undefined,
+                }),
+                restartRequired: false,
+                executed: true,
+            };
+        }
+    }
+    else {
+        notes.push(tl('system.panelTls.certAlreadyPresent'));
+    }
+    const en = enablePanelTls({
+        configPath: input.configPath,
+        dataDir: input.dataDir,
+        domain,
+        enabled: true,
+    });
+    notes.push(...en.notes);
+    // Firewall reminder for panel port
+    const port = en.status.listenPort || 9287;
+    notes.push(tl('system.panelTls.openFirewall', { port: String(port) }));
+    return {
+        ok: en.ok,
+        notes,
+        status: en.status,
+        restartRequired: en.restartRequired,
+        executed: true,
+    };
+}
+/** Best-effort restart of control plane unit after TLS config change. */
+export async function tryRestartPanelService(host) {
+    if (!host.executeEnabled() || !host.isRoot()) {
+        return {
+            ok: false,
+            notes: [tl('system.panelTls.restartManual')],
+        };
+    }
+    const r = await host.runCommand(['systemctl', 'restart', 'ysk-server'], {
+        timeoutMs: 60_000,
+    });
+    if (r.exitCode === 0) {
+        return { ok: true, notes: [tl('system.panelTls.restarted')] };
+    }
+    return {
+        ok: false,
+        notes: [
+            tl('system.panelTls.restartFailed', {
+                detail: (r.stderr || r.stdout || '').slice(0, 200),
+            }),
+            tl('system.panelTls.restartManual'),
+        ],
+    };
+}
+/** Unit path hint under dataDir for tests */
+export function panelTlsConfigHint(dataDir) {
+    return join(dataDir, 'config.json');
+}
+//# sourceMappingURL=panel-tls.js.map

package/dist/hosting/panel-tls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"panel-tls.js","sourceRoot":"","sources":["../../src/hosting/panel-tls.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGvE,OAAO,EACL,uBAAuB,EACvB,oBAAoB,EACpB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAEvC,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAe;IAKrD,MAAM,GAAG,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO;QACL,GAAG;QACH,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QACzC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,mBAAmB,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;YAC/B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,IAAI,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClE,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,SAAS,CACjB,IAAI,EACJ,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,EACjC,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC5D,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAGjC;IACC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAS,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG;QACZ,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;KACnC,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAcD;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAYvC;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;IAC9F,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;IACnC,IAAI,QAAQ;QAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,MAAM,IAAI,GACR,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC1B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QACzB,CAAC,KAAK,CAAC,KAAK,CAAC;IAEf,IAAI,IAAI,EAAE,CAAC;QACT,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IACpD,CAAC;SAAM,CAAC;QACN,CAAC;YACC,MAAM,EAAE,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACnE,IAAI,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,KAAK,EAAE,CAAC,4DAA4D,CAAC;oBACrE,WAAW,EAAE,KAAK;oBAClB,aAAa,EAAE,KAAK;iBACrB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,GAAG,CAAC;QAC/B,sEAAsE;QACtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QACrD,aAAa,CACX,GAAG,EACH;YACE,OAAO;YACP,6CAA6C;YAC7C,0BAA0B;YAC1B,aAAa;YACb,0BAA0B;YAC1B,2BAA2B;YAC3B,gBAAgB;YAChB,UAAU;YACV,mBAAmB,GAAG,GAAG;YACzB,6BAA6B;YAC7B,8CAA8C;YAC9C,+BAA+B;YAC/B,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;QACF,MAAM,CAAC,GAAG,SAAS,CACjB,SAAS,EACT;YACE,KAAK;YACL,OAAO;YACP,SAAS;YACT,UAAU;YACV,QAAQ;YACR,SAAS;YACT,KAAK,CAAC,OAAO;YACb,MAAM;YACN,KAAK,CAAC,QAAQ;YACd,OAAO;YACP,MAAM,CAAC,IAAI,CAAC;YACZ,SAAS;YACT,GAAG;YACH,aAAa;YACb,QAAQ;SACT,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE;oBACL,mBAAmB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;iBAChE;gBACD,WAAW,EAAE,KAAK;gBAClB,aAAa,EAAE,KAAK;aACrB,CAAC;QACJ,CAAC;QACD,WAAW,GAAG,IAAI,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,iCAAiC,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAChC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;IAED,IAAI,iBAAqC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,SAAS,CAClB,SAAS,EACT,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,CAAC,EACpE,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACpD,iBAAiB,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;QAClD,IAAI,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,sBAAsB,iBAAiB,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE;YACrC,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,KAAK,CAAC,QAAQ;YAC3B,UAAU,EAAE,KAAK,CAAC,OAAO;YACzB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,SAAS;SAC1C,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACjE,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAClC,aAAa,GAAG,IAAI,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,qBAAqB,UAAU,qDAAqD,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC;IACtC,MAAM,SAAS,GAAG,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,IAAI,WAAW,CAAC;IAChF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,iBAAiB;QACjB,SAAS;QACT,QAAQ,EAAE,WAAW,SAAS,IAAI,IAAI,EAAE;QACxC,WAAW;QACX,aAAa;KACd,CAAC;AACJ,CAAC;AAkCD,SAAS,cAAc,CAAC,UAAkB;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,MAAiB;IAC5D,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAyB;IAOhE,MAAM,QAAQ,GAAG,MAAM,EAAE,WAAW,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,EAAE,UAAU,CAAC;IACnC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,SAAoC,CAAC;IACzC,IAAI,UAAU,IAAI,QAAQ,EAAE,CAAC;QAC3B,SAAS,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AACjE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAI3D,IAAI,CAAC,MAAM,EAAE,UAAU;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC5E,IAAI,CAAC;QACH,OAAO;YACL,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC9B,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC;SAC7B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAIjC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,WAAW,CAAC;IACrD,MAAM,MAAM,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACxD,MAAM,CAAC,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,UAAU,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,SAAS,GACb,MAAM;QACN,CAAC,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAC/E,OAAO;QACL,EAAE,EAAE,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,CAAC;QAChD,UAAU;QACV,YAAY;QACZ,WAAW,EAAE,MAAM;QACnB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU;QACV,UAAU;QACV,QAAQ,EAAE,WAAW,SAAS,IAAI,UAAU,EAAE;QAC9C,OAAO,EAAE,UAAU,SAAS,IAAI,UAAU,EAAE;QAC5C,KAAK;QACL,eAAe,EAAE,UAAU,KAAK,YAAY;KAC7C,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAO9B;IACC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;YACvC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC7B,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC;YACzC,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACtC,IAAI,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;gBACd,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC;gBACxB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YACxD,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE;QACrC,UAAU,EAAE,KAAK,CAAC,OAAO,KAAK,KAAK;QACnC,WAAW,EAAE,QAAQ;QACrB,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,MAAM;KACpB,CAAC,CAAC;IACH,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC,CAAC;IAChD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,gCAAgC,CAAC,CAAC,CAAC;IAEjD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK;QACL,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAChE,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAA6B;IAC3D,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC;YACvC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YAC7B,eAAe,EAAE,KAAK;SACvB,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9D,eAAe,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACxC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,CAAC,EAAE,CAAC,8BAA8B,CAAC,EAAE,EAAE,CAAC,gCAAgC,CAAC,CAAC;QACjF,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;QAChE,eAAe,EAAE,IAAI;KACtB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAK3C;IAQC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QACzB,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,qEAAqE;IACrE,MAAM,MAAM,GAAG;QACb,qBAAqB;QACrB,QAAQ;QACR,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAClC,SAAS,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;QAChC,WAAW,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;QACpC,gDAAgD;QAChD,sFAAsF;QACtF,8DAA8D;QAC9D,2DAA2D;QAC3D,0IAA0I;QAC1I,oEAAoE;QACpE,0HAA0H;QAC1H,8DAA8D;QAC9D,2JAA2J;QAC3J,mDAAmD;QACnD,QAAQ;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,QAAQ,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAE/C,MAAM,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,EAAE,CAAC;QACP,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,KAAK,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;QACvF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,KAQ5C;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,qCAAqC;IACrC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,EAAE,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,MAAM,CAAC;IAE3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,MAAM,qBAAqB,CAAC;YACpC,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,IAAI,EAAE,KAAK,CAAC,IAAI;SACjB,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,CAAC,CAAC,YAAY;gBAC5B,KAAK;gBACL,MAAM,EAAE,iBAAiB,CAAC;oBACxB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;iBACpF,CAAC;gBACF,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;aACrB,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxB,uBAAuB,CAAC;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,EAAE,EAAE,OAAO;YACX,GAAG,EAAE,IAAI;YACT,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;YAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;YAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK;gBACL,MAAM,EAAE,iBAAiB,CAAC;oBACxB,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;iBACpF,CAAC;gBACF,eAAe,EAAE,KAAK;gBACtB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,EAAE,GAAG,cAAc,CAAC;QACxB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM;QACN,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACxB,mCAAmC;IACnC,MAAM,IAAI,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;IAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,8BAA8B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO;QACL,EAAE,EAAE,EAAE,CAAC,EAAE;QACT,KAAK;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,eAAe,EAAE,EAAE,CAAC,eAAe;QACnC,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAkB;IAI7D,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC7C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,CAAC,EAAE,CAAC,+BAA+B,CAAC,CAAC;SAC7C,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE;QACtE,SAAS,EAAE,MAAM;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC;IAChE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,EAAE,CAAC,+BAA+B,EAAE;gBAClC,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;aACnD,CAAC;YACF,EAAE,CAAC,+BAA+B,CAAC;SACpC;KACF,CAAC;AACJ,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;AACtC,CAAC"}

package/dist/hosting/php-disable-functions.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Researched PHP disable_functions catalog for selection UI (not free-text).
+ * Stored in php.ini as comma-separated names — UI multi-check maps to that string.
+ *
+ * Sources: common hosting hardening (cPanel/Plesk-style deny lists), OWASP PHP
+ * configuration cheatsheet, and panel default that already shipped in YSK.
+ */
+export type DisableFunctionOption = {
+    value: string;
+    /** i18n key under runtime.phpIniCatalog.disableFn.groups.* or plain group id */
+    group: 'process' | 'dynamic' | 'info' | 'filesystem' | 'network';
+    /** Recommended default for shared hosting */
+    recommended?: boolean;
+};
+/** Panel-recommended default (matches historical catalog default). */
+export declare const PHP_DISABLE_FUNCTIONS_DEFAULT = "exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source";
+/**
+ * Curated selectable functions. Keep values exact PHP function names.
+ * Labels in UI = value (function name); group labels via i18n.
+ */
+export declare const PHP_DISABLE_FUNCTIONS_OPTIONS: DisableFunctionOption[];
+export declare function parseDisableFunctions(raw: string | null | undefined): string[];
+export declare function serializeDisableFunctions(names: string[]): string;
+export declare function recommendedDisableFunctions(): string[];
+//# sourceMappingURL=php-disable-functions.d.ts.map

package/dist/hosting/php-disable-functions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"php-disable-functions.d.ts","sourceRoot":"","sources":["../../src/hosting/php-disable-functions.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,GAAG,SAAS,CAAC;IACjE,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,6BAA6B,+FACoD,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,qBAAqB,EAmChE,CAAC;AAEF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,EAAE,CAW9E;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAUjE;AAED,wBAAgB,2BAA2B,IAAI,MAAM,EAAE,CAEtD"}

package/dist/hosting/php-disable-functions.js

@@ -0,0 +1,79 @@
+/**
+ * Researched PHP disable_functions catalog for selection UI (not free-text).
+ * Stored in php.ini as comma-separated names — UI multi-check maps to that string.
+ *
+ * Sources: common hosting hardening (cPanel/Plesk-style deny lists), OWASP PHP
+ * configuration cheatsheet, and panel default that already shipped in YSK.
+ */
+/** Panel-recommended default (matches historical catalog default). */
+export const PHP_DISABLE_FUNCTIONS_DEFAULT = 'exec,passthru,shell_exec,system,proc_open,popen,curl_multi_exec,parse_ini_file,show_source';
+/**
+ * Curated selectable functions. Keep values exact PHP function names.
+ * Labels in UI = value (function name); group labels via i18n.
+ */
+export const PHP_DISABLE_FUNCTIONS_OPTIONS = [
+    // Process execution
+    { value: 'exec', group: 'process', recommended: true },
+    { value: 'system', group: 'process', recommended: true },
+    { value: 'passthru', group: 'process', recommended: true },
+    { value: 'shell_exec', group: 'process', recommended: true },
+    { value: 'proc_open', group: 'process', recommended: true },
+    { value: 'proc_close', group: 'process' },
+    { value: 'proc_get_status', group: 'process' },
+    { value: 'proc_nice', group: 'process' },
+    { value: 'proc_terminate', group: 'process' },
+    { value: 'popen', group: 'process', recommended: true },
+    { value: 'pcntl_exec', group: 'process' },
+    { value: 'pcntl_fork', group: 'process' },
+    // Dangerous dynamic loading
+    { value: 'dl', group: 'dynamic', recommended: true },
+    { value: 'assert', group: 'dynamic' },
+    // Information disclosure
+    { value: 'phpinfo', group: 'info' },
+    { value: 'show_source', group: 'info', recommended: true },
+    { value: 'highlight_file', group: 'info' },
+    { value: 'highlight_string', group: 'info' },
+    { value: 'get_cfg_var', group: 'info' },
+    { value: 'php_uname', group: 'info' },
+    // Filesystem / ownership (aggressive — not all recommended)
+    { value: 'symlink', group: 'filesystem' },
+    { value: 'link', group: 'filesystem' },
+    { value: 'chown', group: 'filesystem' },
+    { value: 'chgrp', group: 'filesystem' },
+    // Network / misc
+    { value: 'curl_multi_exec', group: 'network', recommended: true },
+    { value: 'parse_ini_file', group: 'network', recommended: true },
+    { value: 'fsockopen', group: 'network' },
+    { value: 'pfsockopen', group: 'network' },
+    { value: 'stream_socket_client', group: 'network' },
+];
+export function parseDisableFunctions(raw) {
+    if (!raw)
+        return [];
+    const seen = new Set();
+    const out = [];
+    for (const part of String(raw).split(/[\s,]+/)) {
+        const n = part.trim();
+        if (!n || seen.has(n))
+            continue;
+        seen.add(n);
+        out.push(n);
+    }
+    return out;
+}
+export function serializeDisableFunctions(names) {
+    const seen = new Set();
+    const out = [];
+    for (const n of names) {
+        const v = n.trim();
+        if (!v || seen.has(v))
+            continue;
+        seen.add(v);
+        out.push(v);
+    }
+    return out.join(',');
+}
+export function recommendedDisableFunctions() {
+    return PHP_DISABLE_FUNCTIONS_OPTIONS.filter((o) => o.recommended).map((o) => o.value);
+}
+//# sourceMappingURL=php-disable-functions.js.map