fix(deploy): complete ISO build with serialport parsers, device policy, and sintra model

- Add all 10 @serialport/parser-* packages to live.nix atm-app derivation
  (serialport@12 barrel import eagerly requires all of them)
- Add DevicePolicy=auto + DeviceAllow=char-* rw for serial port access
- Make envTemplate model-aware (machineModel + fiatCodeForModel)
- Add sintra model (EUR) to flake.nix and build-iso.sh
- Fix tejo fiat code from USD to GTQ

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

deploy/nixos/build-iso.sh

@@ -6,14 +6,16 @@
 #
 # Usage: bash build-iso.sh <model>
 #   bash build-iso.sh douro   # Bay Trail, kernel 5.15, GTQ
-#   bash build-iso.sh tejo    # UP4000, kernel 6.6, USD
+#   bash build-iso.sh tejo    # UP4000, kernel 6.6, GTQ
+#   bash build-iso.sh sintra  # UPBoard, kernel 6.6, EUR
 set -euo pipefail
 
 MODEL="${1:-}"
 if [ -z "$MODEL" ]; then
   echo "Usage: bash build-iso.sh <model>"
-  echo "  douro  - Bay Trail Atom, kernel 5.15, eDP panel"
+  echo "  douro  - Bay Trail Atom, kernel 5.15, eDP panel, GTQ"
-  echo "  tejo   - UP4000/UPBoard, kernel 6.6"
+  echo "  tejo   - UP4000/UPBoard, kernel 6.6, GTQ"
+  echo "  sintra - UPBoard, kernel 6.6, EUR"
   exit 1
 fi
 
@@ -57,11 +59,17 @@ EOF
   tejo)
     cat >> "$ENV_FILE" << 'EOF'
 VITE_LAMASSU_MACHINE_MODEL=tejo
-VITE_LAMASSU_FIAT_CODE=USD
+VITE_LAMASSU_FIAT_CODE=GTQ
+EOF
+    ;;
+  sintra)
+    cat >> "$ENV_FILE" << 'EOF'
+VITE_LAMASSU_MACHINE_MODEL=sintra
+VITE_LAMASSU_FIAT_CODE=EUR
 EOF
     ;;
   *)
-    echo "ERROR: Unknown model '$MODEL'. Use 'douro' or 'tejo'."
+    echo "ERROR: Unknown model '$MODEL'. Use 'douro', 'tejo', or 'sintra'."
     # Restore backup
     if [ -n "$ENV_BACKUP" ]; then
       mv "$ENV_BACKUP" "$ENV_FILE"

deploy/nixos/flake.nix

@@ -46,6 +46,7 @@
       # Live USB configurations per machine model
       nixosConfigurations.lamassu-live-douro = mkLiveConfig "douro";
       nixosConfigurations.lamassu-live-tejo = mkLiveConfig "tejo";
+      nixosConfigurations.lamassu-live-sintra = mkLiveConfig "sintra";
 
       # Keep generic for backwards compat
       nixosConfigurations.lamassu-live = mkLiveConfig "douro";
@@ -58,6 +59,7 @@
         # ISO images per machine model
         iso-douro = self.nixosConfigurations.lamassu-live-douro.config.system.build.isoImage;
         iso-tejo = self.nixosConfigurations.lamassu-live-tejo.config.system.build.isoImage;
+        iso-sintra = self.nixosConfigurations.lamassu-live-sintra.config.system.build.isoImage;
 
         # Default (backwards compat)
         iso = self.nixosConfigurations.lamassu-live.config.system.build.isoImage;

deploy/nixos/live.nix

@@ -31,12 +31,21 @@ let
   serialportBindingsCppStore = pnpmStore + "/@serialport+bindings-cpp@12.0.1/node_modules/@serialport";
   serialportBindingsIfaceStore = pnpmStore + "/@serialport+bindings-interface@1.2.2/node_modules/@serialport";
   serialportBindingMockStore = pnpmStore + "/@serialport+binding-mock@10.2.2/node_modules/@serialport";
+  # serialport parser sub-packages (barrel import in serialport@12 eagerly requires all of these)
+  parserStore = suffix: pnpmStore + "/@serialport+${suffix}@12.0.0/node_modules/@serialport";
   debugStore = pnpmStore + "/debug@4.3.4/node_modules";
   msStore = pnpmStore + "/ms@2.1.2/node_modules";
   nodeAddonApiStore = pnpmStore + "/node-addon-api@7.0.0/node_modules";
   nodeGypBuildStore = pnpmStore + "/node-gyp-build@4.6.0/node_modules";
   lodashEsStore = pnpmStore + "/lodash-es@4.17.23/node_modules";
 
+  # Fiat code per machine model
+  fiatCodeForModel = {
+    douro = "GTQ";
+    tejo = "GTQ";
+    sintra = "EUR";
+  }.${machineModel} or "USD";
+
   atm-app = assert machineDir != ""
     || throw "MACHINE_DIR env var must be set (use build-iso.sh or: export MACHINE_DIR=/path/to/apps/machine)";
     pkgs.runCommand "lamassu-atm-app" { } ''
@@ -71,6 +80,18 @@ let
       cp -rL ${builtins.path { path = nodeAddonApiStore + "/node-addon-api"; name = "node-addon-api"; }} $out/node_modules/node-addon-api
       cp -rL ${builtins.path { path = nodeGypBuildStore + "/node-gyp-build"; name = "node-gyp-build"; }} $out/node_modules/node-gyp-build
       cp -rL ${builtins.path { path = lodashEsStore + "/lodash-es"; name = "lodash-es"; }} $out/node_modules/lodash-es
+
+      # serialport parser sub-packages (barrel import requires all 10)
+      cp -rL ${builtins.path { path = parserStore "parser-byte-length" + "/parser-byte-length"; name = "parser-byte-length"; }} $out/node_modules/@serialport/parser-byte-length
+      cp -rL ${builtins.path { path = parserStore "parser-cctalk" + "/parser-cctalk"; name = "parser-cctalk"; }} $out/node_modules/@serialport/parser-cctalk
+      cp -rL ${builtins.path { path = parserStore "parser-delimiter" + "/parser-delimiter"; name = "parser-delimiter"; }} $out/node_modules/@serialport/parser-delimiter
+      cp -rL ${builtins.path { path = parserStore "parser-inter-byte-timeout" + "/parser-inter-byte-timeout"; name = "parser-inter-byte-timeout"; }} $out/node_modules/@serialport/parser-inter-byte-timeout
+      cp -rL ${builtins.path { path = parserStore "parser-packet-length" + "/parser-packet-length"; name = "parser-packet-length"; }} $out/node_modules/@serialport/parser-packet-length
+      cp -rL ${builtins.path { path = parserStore "parser-readline" + "/parser-readline"; name = "parser-readline"; }} $out/node_modules/@serialport/parser-readline
+      cp -rL ${builtins.path { path = parserStore "parser-ready" + "/parser-ready"; name = "parser-ready"; }} $out/node_modules/@serialport/parser-ready
+      cp -rL ${builtins.path { path = parserStore "parser-regex" + "/parser-regex"; name = "parser-regex"; }} $out/node_modules/@serialport/parser-regex
+      cp -rL ${builtins.path { path = parserStore "parser-slip-encoder" + "/parser-slip-encoder"; name = "parser-slip-encoder"; }} $out/node_modules/@serialport/parser-slip-encoder
+      cp -rL ${builtins.path { path = parserStore "parser-spacepacket" + "/parser-spacepacket"; name = "parser-spacepacket"; }} $out/node_modules/@serialport/parser-spacepacket
     '';
 
   # .env template with regtest defaults pointing to the dev machine
@@ -83,8 +104,8 @@ let
     VITE_EXTENSION_API_URL=https://lp-ext.atm.aiolabs.dev
     VITE_APP_ID=6016dadc6c677f131bc82cc0cb780d2b1090b83b8b7d0c972e469010270a4208
     VITE_LNDCONNECT_URL=lndconnect://lnd.atm.aiolabs.dev:443?cert=&macaroon=AgEDbG5kAvgBAwoQjLYgcUni_8EKmwpX_vwOWxIBMBoWCgdhZGRyZXNzEgRyZWFkEgV3cml0ZRoTCgRpbmZvEgRyZWFkEgV3cml0ZRoXCghpbnZvaWNlcxIEcmVhZBIFd3JpdGUaIQoIbWFjYXJvb24SCGdlbmVyYXRlEgRyZWFkEgV3cml0ZRoWCgdtZXNzYWdlEgRyZWFkEgV3cml0ZRoXCghvZmZjaGFpbhIEcmVhZBIFd3JpdGUaFgoHb25jaGFpbhIEcmVhZBIFd3JpdGUaFAoFcGVlcnMSBHJlYWQSBXdyaXRlGhgKBnNpZ25lchIIZ2VuZXJhdGUSBHJlYWQAAAYgClsDux9_gPaKUK7PI54y-sTwt5WGmSzrzfKaKamwvK0
-    VITE_LAMASSU_MACHINE_MODEL=douro
+    VITE_LAMASSU_MACHINE_MODEL=${machineModel}
-    VITE_LAMASSU_FIAT_CODE=GTQ
+    VITE_LAMASSU_FIAT_CODE=${fiatCodeForModel}
     ELECTRON_FORCE_PROD=1
     DISPLAY=:0
   '';
@@ -199,6 +220,9 @@ in
       ProtectSystem = lib.mkForce false;
       ProtectHome = lib.mkForce false;
       PrivateTmp = lib.mkForce false;
+      # Allow access to all character devices (serial ports for HAL hardware)
+      DevicePolicy = lib.mkForce "auto";
+      DeviceAllow = lib.mkForce [ "char-* rw" ];
     };
   };