@geekmidas/cli 10.0.0-alpha.11 → 10.0.0-alpha.12

package/dist/discover-CAlFgYec.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"discover-CAlFgYec.mjs","names":["routes: Routes | undefined","DEFAULT_CACHE: Record<MainProvider, CacheBackend>","DEFAULT_STORAGE: Record<MainProvider, StorageBackend>","DEFAULT_EMAIL: EmailBackend","context: BuildContext","outputDir: string","generator: ConstructGenerator<T, R>","patterns?: Routes","options?: GeneratorOptions","logger","globPatterns: string[]","partitionFn: ((filepath: string) => string) | undefined","constructs: GeneratedConstruct<T>[]","value: unknown","options: DiscoverOptions","manifest: Record<string, Declaration>","sources: Record<string, string>","globs: readonly string[]","matched: number","declared: number","id: string","sources: readonly string[]"],"sources":["../src/types.ts","../src/generators/Generator.ts","../src/reconcile/discover.ts"],"sourcesContent":["import type { ServicesConfig, StagesConfig } from './workspace/types.js';\n\nexport type MainProvider = 'aws' | 'server';\nexport type LegacyProvider =\n\t| 'server'\n\t| 'aws-apigatewayv1'\n\t| 'aws-apigatewayv2'\n\t| 'aws-lambda';\n\nexport interface PartitionedRoutes {\n\tpaths: string | string[];\n\tpartition: (filepath: string) => string;\n}\n\nexport type Routes = string | string[] | PartitionedRoutes;\n\nexport function isPartitionedRoutes(\n\troutes: Routes | undefined,\n): routes is PartitionedRoutes {\n\treturn (\n\t\ttypeof routes === 'object' &&\n\t\troutes !== null &&\n\t\t!Array.isArray(routes) &&\n\t\t'paths' in routes\n\t);\n}\n\nexport interface ProviderConfig {\n\tenabled?: boolean;\n\toutputDir?: string;\n}\n\nexport interface AWSApiGatewayConfig extends ProviderConfig {\n\t// Additional AWS API Gateway specific options\n}\n\nexport interface AWSLambdaConfig extends ProviderConfig {\n\t// Additional AWS Lambda specific options\n}\n\nexport interface ProductionConfig {\n\t/** Enable production mode (default: false) */\n\tenabled?: boolean;\n\t/** Bundle server into single file (default: true) */\n\tbundle?: boolean;\n\t/** Minify bundled output (default: true) */\n\tminify?: boolean;\n\t/** Health check endpoint path (default: '/health') */\n\thealthCheck?: string;\n\t/** Enable graceful shutdown handling (default: true) */\n\tgracefulShutdown?: boolean;\n\t/** Packages to exclude from bundling (default: []) */\n\texternal?: string[];\n\t/** Include subscribers in production build (default: 'exclude' for serverless) */\n\tsubscribers?: 'include' | 'exclude';\n\t/** Include OpenAPI spec in production (default: false) */\n\topenapi?: boolean;\n\t/**\n\t * Enable build-time optimized handler generation (default: true)\n\t * Generates specialized handlers based on endpoint tier:\n\t * - minimal: Near-raw-Hono performance for simple endpoints\n\t * - standard: Optimized handlers for auth/services\n\t * - full: Uses HonoEndpoint.addRoutes for complex endpoints\n\t */\n\toptimizedHandlers?: boolean;\n}\n\n/** Service-specific configuration for docker-compose */\nexport interface ServiceConfig {\n\t/**\n\t * Full Docker image reference (e.g., 'postgis/postgis:16-3.4-alpine').\n\t * When specified, overrides the default image entirely.\n\t */\n\timage?: string;\n\t/**\n\t * Docker image version/tag (e.g., '15-alpine' for postgres).\n\t * Only used when `image` is not specified.\n\t */\n\tversion?: string;\n}\n\n/**\n * Supported event backend types.\n *\n * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.\n * - `sns`: Adds LocalStack container with SNS+SQS services.\n * - `rabbitmq`: Adds RabbitMQ container.\n *\n * All backends generate EVENT_PUBLISHER_CONNECTION_STRING and EVENT_SUBSCRIBER_CONNECTION_STRING.\n */\nexport type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';\n\n/**\n * Where a declared cache actually lives.\n *\n * A deployment choice, not an application one — the same code caches into any\n * of these — so it is config here beside `events` rather than a field on the\n * construct. Each backend is consistent between local and deployed, which is\n * the property worth having: a cache that behaves differently in the two places\n * is worse than a slower one.\n *\n * - `upstash` (default) — HTTP with a token. Reachable from a Lambda with no\n *   VPC and no connection pool, which is why it is the default; locally the\n *   `serverless-redis-http` proxy in front of Redis speaks the same protocol.\n * - `elasticache` — the Redis wire protocol, inside a VPC. Locally, plain Redis.\n * - `db` — a table in the database the app already declared. No infrastructure\n *   at all, and the same relationship pg-boss has to Postgres: it creates its\n *   own table on first use and needs a declared database to live in.\n */\nexport type CacheBackend = 'upstash' | 'elasticache' | 'db';\n\n/**\n * Where a declared bucket actually lives.\n *\n * The fourth of these selectors and the last to arrive, which is why\n * `UPLOADS_URL` had no answer on a container target: there was nothing to\n * choose with. Like the others it changes no application code — the `s3://`\n * scheme picks the driver, and every one of these speaks it.\n *\n * - `s3` — a real bucket. Nothing is created on the host; the URL is composed\n *   against credentials you already hold, the same way `resend` is an API key\n *   rather than infrastructure.\n * - `r2` — Cloudflare's, reached through the same S3 API and differing only in\n *   its endpoint.\n * - `minio` — a container. Everything the app declares lives on the box, which\n *   is what makes a single-host deploy self-contained, and what makes it a\n *   single disk with no replication. Locally this is what every backend is.\n */\nexport type StorageBackend = 'minio' | 's3' | 'r2';\n\n/**\n * The backend a project gets when it says nothing, by where it deploys.\n *\n * Flat defaults could not be right for both: `upstash` on a single box means a\n * SaaS round-trip for a cache the database could have held, and `minio` on AWS\n * means running a bucket beside S3. So the default is a function of the target,\n * and an app that says nothing gets the obvious answer in both places — which\n * is the whole of what \"zero config\" can mean once there is more than one\n * target.\n *\n * `server` covers Dokploy and a bare host alike: the question these answer is\n * whether the app is next to a managed cloud or next to its own containers, and\n * on that question the two are the same.\n *\n * A per-construct, per-stage override is the layer above this — see\n * `constructs-outstanding.md` — so two buckets in one app can differ. This is\n * only what happens when nobody has said anything at all.\n */\nexport const DEFAULT_CACHE: Record<MainProvider, CacheBackend> = {\n\t// Reachable from a Lambda with no VPC and no connection pool.\n\taws: 'upstash',\n\t// The database is already there and already has a connection pool open to\n\t// it. Anything else is a second service to run for a table.\n\tserver: 'db',\n};\n\n/** Where a bucket lives when nobody said — see {@link DEFAULT_CACHE}. */\nexport const DEFAULT_STORAGE: Record<MainProvider, StorageBackend> = {\n\taws: 's3',\n\tserver: 'minio',\n};\n\n/**\n * Who delivers a declared app's mail.\n *\n * Unlike a cache, this changes *nothing* about the client. Every backend speaks\n * SMTP, so the declaration's `smtp://` URL is true of all of them and only the\n * provisioner differs — which is the same reason the declaration has no\n * `provider` field and there is no `ses://` scheme.\n *\n * - `ses` (default) — the only backend that can be a *chain* of resources: an\n *   identity, a user, an access key, and an SMTP password derived from it,\n *   because SES issues IAM credentials rather than SMTP ones. Hand it a URL and\n *   it uses that instead, which is what you want when the credentials already\n *   exist — provisioning a second set of sending credentials for an identity\n *   that already has them is not a thing to do by default.\n * - `resend` — an API key you hold, composed into an SMTP URL. Nothing to\n *   provision: a SaaS account is not infrastructure.\n * - `smtp` — a URL supplied whole, for a relay somebody else runs.\n *\n * Locally every one of them is Mailpit, because locally none of it matters.\n */\nexport type EmailBackend = 'resend' | 'ses' | 'smtp';\n\n/**\n * Who delivers mail when nobody said.\n *\n * Flat, unlike the others, and deliberately: mail is a SaaS on every target.\n * There is no self-hosted preset to default a container deploy to — Mailpit is\n * a development inbox, not a sender — so `server` has no answer of its own to\n * give and would only be `ses` written twice.\n */\nexport const DEFAULT_EMAIL: EmailBackend = 'ses';\n\n/** Supported docker-compose service names */\nexport type ComposeServiceName =\n\t| 'postgres'\n\t| 'redis'\n\t| 'rabbitmq'\n\t| 'minio'\n\t| 'mailpit'\n\t| 'localstack';\n\n/** Services configuration - can be boolean (use defaults) or object with version */\nexport type ComposeServicesConfig = {\n\t[K in ComposeServiceName]?: boolean | ServiceConfig;\n};\n\nexport interface DockerConfig {\n\t/** Container registry URL (e.g., 'ghcr.io/myorg') */\n\tregistry?: string;\n\t/** Docker image name (default: derived from package.json name) */\n\timageName?: string;\n\t/** Base Docker image (default: 'node:22-alpine') */\n\tbaseImage?: string;\n\t/** Container port (default: 3000) */\n\tport?: number;\n\t/** docker-compose services to include */\n\tcompose?: {\n\t\t/**\n\t\t * Services to include in docker-compose.\n\t\t * Can be an object with service configs or an array of service names (legacy).\n\t\t *\n\t\t * @example Object format (recommended)\n\t\t * services: {\n\t\t *   postgres: { version: '15-alpine' },\n\t\t *   redis: true,  // use default version\n\t\t * }\n\t\t *\n\t\t * @example Array format (legacy, uses default versions)\n\t\t * services: ['postgres', 'redis']\n\t\t */\n\t\tservices?: ComposeServicesConfig | ComposeServiceName[];\n\t};\n}\n\nexport interface ServerConfig extends ProviderConfig {\n\tenableOpenApi?: boolean;\n\tport?: number;\n\t/** Production build configuration */\n\tproduction?: ProductionConfig;\n}\n\nexport type Runtime = 'node' | 'bun';\n\nexport interface TelescopeConfig {\n\t/** Enable/disable telescope (default: true in development) */\n\tenabled?: boolean;\n\t/** Port for telescope to use (defaults to server port) */\n\tport?: number;\n\t/** Path prefix for telescope UI (default: /__telescope) */\n\tpath?: string;\n\t/** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */\n\tignore?: string[];\n\t/** Record request/response bodies (default: true) */\n\trecordBody?: boolean;\n\t/** Maximum entries to keep in memory (default: 1000) */\n\tmaxEntries?: number;\n\t/** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */\n\twebsocket?: boolean;\n}\n\nexport interface StudioConfig {\n\t/** Enable/disable studio (default: true in development) */\n\tenabled?: boolean;\n\t/** Path prefix for studio UI (default: /__studio) */\n\tpath?: string;\n\t/** Schema to introspect (default: 'public') */\n\tschema?: string;\n}\n\nexport interface OpenApiConfig {\n\t/** Enable OpenAPI generation (default: true) */\n\tenabled?: boolean;\n\t/** API title */\n\ttitle?: string;\n\t/** API version */\n\tversion?: string;\n\t/** API description */\n\tdescription?: string;\n}\n\nexport interface HooksConfig {\n\t/**\n\t * Path to a module exporting server lifecycle hooks.\n\t * The module should export `beforeSetup` and/or `afterSetup` functions.\n\t *\n\t * @example\n\t * ```typescript\n\t * // src/config/hooks.ts\n\t * import type { Hono } from 'hono';\n\t * import type { Logger } from '@geekmidas/logger';\n\t * import type { EnvironmentParser } from '@geekmidas/envkit';\n\t *\n\t * // Called BEFORE gkm endpoints are registered\n\t * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.use('*', cors());\n\t *   app.get('/custom/health', (c) => c.json({ status: 'ok' }));\n\t * }\n\t *\n\t * // Called AFTER gkm endpoints are registered\n\t * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.notFound((c) => c.json({ error: 'Not found' }, 404));\n\t *   app.onError((err, c) => c.json({ error: err.message }, 500));\n\t * }\n\t * ```\n\t */\n\tserver?: string;\n}\n\n/** Dokploy deployment configuration */\nexport interface DokployProviderConfig {\n\t/** Dokploy API endpoint (e.g., 'https://dokploy.example.com') */\n\tendpoint: string;\n\t/** Project ID in Dokploy */\n\tprojectId: string;\n\t/** Application ID in Dokploy */\n\tapplicationId: string;\n\t/** Container registry (overrides docker.registry if set) */\n\tregistry?: string;\n\t/** Registry ID in Dokploy (recommended for private registries) */\n\tregistryId?: string;\n}\n\nexport interface ProvidersConfig {\n\taws?: {\n\t\tapiGateway?: {\n\t\t\tv1?: boolean | AWSApiGatewayConfig;\n\t\t\tv2?: boolean | AWSApiGatewayConfig;\n\t\t};\n\t\tlambda?: {\n\t\t\tfunctions?: boolean | AWSLambdaConfig;\n\t\t\tcrons?: boolean | AWSLambdaConfig;\n\t\t};\n\t};\n\tserver?: boolean | ServerConfig;\n\t/** Dokploy deployment configuration */\n\tdokploy?: boolean | DokployProviderConfig;\n}\n\nexport interface GkmConfig {\n\t/**\n\t * What this app is called, and therefore how everything it declares is named.\n\t *\n\t * The same field `sst.config.ts` carries, doing the same job: every physical\n\t * name is `{stage}-{name}-{construct}`, so `Database` in the `production`\n\t * stage of `kitchen-sink` is `production-kitchen-sink-database` on AWS and on\n\t * Dokploy alike. One statement, in the config, rather than a rule each\n\t * provider restates.\n\t *\n\t * `defineWorkspace` has always had this. A single-app config did not, so its\n\t * names fell back to whatever the directory happened to be called — the\n\t * monorepo's package name for the project and the app's for the application,\n\t * two accidents of layout standing in for a decision.\n\t *\n\t * Defaults to the package.json name with any scope stripped, then the\n\t * directory name.\n\t */\n\tname?: string;\n\t/** The project's stages: which one is local, which deploy */\n\tstages: StagesConfig;\n\t/**\n\t * Where the things no construct implies live.\n\t *\n\t * The same block a workspace config carries, and the same split: `db` and\n\t * `storage` are derived from the declared `KyselyDatabase` and\n\t * `ObjectStorage` and are ignored here, while `cache`, `mail`, and `events`\n\t * name a *backend* — where the cache lives, who delivers the mail, which\n\t * broker carries events. A single-app project had no way to say any of that\n\t * before, so its event backend could only be guessed.\n\t */\n\tservices?: ServicesConfig;\n\t/**\n\t * Constructs glob pattern — one glob, every kind.\n\t *\n\t * What reconcile reads to derive the containers a stage needs: a database\n\t * implies Postgres, objects imply MinIO, mail implies Mailpit. A glob per\n\t * kind cannot find a resource, because a declared `ObjectStorage` has no\n\t * kind to be listed under.\n\t *\n\t * @example './src/**\\/*.ts'\n\t */\n\tconstructs: Routes;\n\tproviders?: ProvidersConfig;\n\t/**\n\t * Server lifecycle hooks for customizing the Hono app.\n\t * Allows adding custom routes, middleware, error handlers, etc.\n\t *\n\t * @example\n\t * hooks: {\n\t *   server: './src/config/hooks'\n\t * }\n\t */\n\thooks?: HooksConfig;\n\t/**\n\t * Telescope configuration for debugging/monitoring.\n\t * Can be:\n\t * - A string path to a module that exports a Telescope instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A TelescopeConfig object for inline configuration\n\t */\n\ttelescope?: string | boolean | TelescopeConfig;\n\t/**\n\t * Studio configuration for database browsing.\n\t * Can be:\n\t * - A string path to a module that exports a Studio instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A StudioConfig object for inline configuration\n\t *\n\t * Requires a database connection configured via services.\n\t */\n\tstudio?: string | boolean | StudioConfig;\n\t/**\n\t * OpenAPI generation configuration.\n\t * Can be:\n\t * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)\n\t * - An OpenApiConfig object for customization\n\t *\n\t * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.\n\t *\n\t * @example\n\t * openapi: true\n\t *\n\t * @example\n\t * openapi: {\n\t *   output: './src/api/openapi.ts',\n\t *   title: 'My API',\n\t *   version: '1.0.0',\n\t * }\n\t */\n\topenapi?: boolean | OpenApiConfig;\n\t/** Runtime to use for dev server (default: 'node') */\n\truntime?: Runtime;\n\t/**\n\t * Environment file(s) to load for development.\n\t * Can be:\n\t * - A string path to a single env file (e.g., '.env.local')\n\t * - An array of paths to load in order (later files override earlier)\n\t * - Defaults to '.env' if not specified\n\t *\n\t * @example\n\t * env: '.env.local'\n\t *\n\t * @example\n\t * env: ['.env', '.env.local']\n\t */\n\tenv?: string | string[];\n\t/**\n\t * Docker deployment configuration.\n\t * Used by `gkm docker` and `gkm prepack` commands.\n\t *\n\t * @example\n\t * docker: {\n\t *   registry: 'ghcr.io/myorg',\n\t *   imageName: 'my-api',\n\t *   compose: {\n\t *     services: ['postgres', 'redis']\n\t *   }\n\t * }\n\t */\n\tdocker?: DockerConfig;\n\t/**\n\t * Where this app deploys, and what the target needs to know.\n\t *\n\t * Absent until now, which meant a single-app project could not configure a\n\t * Dokploy deploy at all: the wrap that turns one into a workspace hardcoded\n\t * `{ default: 'dokploy' }` and dropped everything else, so there was no\n\t * endpoint, no registry and no domain — and `resolveHost` failed with \"no\n\t * domain configured for stage\" on a config that had nowhere to put one.\n\t *\n\t * The same shape a workspace config uses, so moving from one to the other is\n\t * a rename rather than a rewrite.\n\t */\n\tdeploy?: import('./workspace/types').DeployConfig;\n}\n\nexport interface BuildOptions {\n\tprovider?: MainProvider;\n\t// Legacy support - will be deprecated\n\tproviders?: LegacyProvider[];\n\tenableOpenApi?: boolean;\n\t/** Build for production (no dev tools, bundled output) */\n\tproduction?: boolean;\n\t/** Skip bundling step in production build */\n\tskipBundle?: boolean;\n\t/** Stage for secrets injection (e.g., 'production', 'staging') */\n\tstage?: string;\n\t/**\n\t * When true, optional environment variables (those with `.optional()` or\n\t * `.default()` in the envParser) are suffixed with `?` within each\n\t * construct's `environment` array in the manifest (e.g. `PORT?`).\n\t * Defaults to false.\n\t */\n\tmarkOptional?: boolean;\n}\n\n/** Result from build command when secrets are injected */\nexport interface BuildResult {\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n// The deployment manifest types are a shared, dependency-free data contract\n// in `@geekmidas/manifest`, re-exported here for back-compat with existing\n// `@geekmidas/cli` imports.\nexport type {\n\tCronInfo,\n\tFunctionInfo,\n\tManifest,\n\tQueueInfo,\n\tRouteInfo,\n\tSubscriberInfo,\n\tTopicInfo,\n} from '@geekmidas/manifest';\n","import { relative } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\nimport fg from 'fast-glob';\nimport kebabCase from 'lodash.kebabcase';\nimport type { BuildContext } from '../build/types';\nimport {\n\tisPartitionedRoutes,\n\ttype LegacyProvider,\n\ttype Routes,\n} from '../types';\n\n/**\n * Zod v4 maintains a process-wide registry of schemas registered via\n * `.meta({ id })`. When we cache-bust user module imports (by appending a\n * `?t=timestamp` query), those modules re-execute and try to register the\n * same ids again, which throws `ID X already exists in the registry`.\n *\n * Clearing the registry in the CLI process is safe: the user's running\n * server lives in a subprocess and has its own isolated registry.\n *\n * Exported for tests.\n */\nexport function clearZodGlobalRegistry(): void {\n\tconst registry = (\n\t\tglobalThis as { __zod_globalRegistry?: { clear?: () => void } }\n\t).__zod_globalRegistry;\n\tif (registry && typeof registry.clear === 'function') {\n\t\tregistry.clear();\n\t}\n}\n\nexport interface GeneratorOptions {\n\tprovider?: LegacyProvider;\n\t[key: string]: any;\n}\n\nexport abstract class ConstructGenerator<T extends Construct, R = void> {\n\tabstract isConstruct(value: any): value is T;\n\n\tstatic async build<T extends Construct, R = void>(\n\t\tcontext: BuildContext,\n\t\toutputDir: string,\n\t\tgenerator: ConstructGenerator<T, R>,\n\t\tpatterns?: Routes,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R> {\n\t\tconst constructs = await generator.load(patterns);\n\t\treturn generator.build(context, constructs, outputDir, options);\n\t}\n\n\tabstract build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<T>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R>;\n\n\tasync load(\n\t\tpatterns?: Routes,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t): Promise<GeneratedConstruct<T>[]> {\n\t\tconst logger = console;\n\n\t\t// Extract glob patterns and optional partition function\n\t\tlet globPatterns: string[];\n\t\tlet partitionFn: ((filepath: string) => string) | undefined;\n\n\t\tif (isPartitionedRoutes(patterns)) {\n\t\t\tglobPatterns = Array.isArray(patterns.paths)\n\t\t\t\t? patterns.paths\n\t\t\t\t: [patterns.paths];\n\t\t\tpartitionFn = patterns.partition;\n\t\t} else {\n\t\t\tglobPatterns = Array.isArray(patterns)\n\t\t\t\t? patterns\n\t\t\t\t: patterns\n\t\t\t\t\t? [patterns]\n\t\t\t\t\t: [];\n\t\t}\n\n\t\t// Find all files\n\t\tconst files = fg.stream(globPatterns, {\n\t\t\tcwd,\n\t\t\tabsolute: true,\n\t\t});\n\n\t\t// Cache-busted re-imports re-execute user modules, which would try to\n\t\t// re-register Zod schemas with the same `.meta({ id })`. Clear the\n\t\t// global registry once per load to prevent duplicate-id errors.\n\t\tif (bustCache) {\n\t\t\tclearZodGlobalRegistry();\n\t\t}\n\n\t\t// Load constructs\n\t\tconst constructs: GeneratedConstruct<T>[] = [];\n\n\t\tfor await (const f of files) {\n\t\t\ttry {\n\t\t\t\tconst file = f.toString();\n\t\t\t\t// Append cache-busting query param to force re-import of changed modules\n\t\t\t\tconst importPath = bustCache ? `${file}?t=${Date.now()}` : file;\n\t\t\t\tconst module = await import(importPath);\n\n\t\t\t\t// Compute partition name for this file (if partition function provided)\n\t\t\t\tconst partition = partitionFn ? partitionFn(file) : undefined;\n\n\t\t\t\t// Check all exports for constructs\n\t\t\t\tfor (const [key, construct] of Object.entries(module)) {\n\t\t\t\t\tif (this.isConstruct(construct)) {\n\t\t\t\t\t\tconstructs.push({\n\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\tname: kebabCase(key),\n\t\t\t\t\t\t\tconstruct,\n\t\t\t\t\t\t\tpath: {\n\t\t\t\t\t\t\t\tabsolute: file,\n\t\t\t\t\t\t\t\trelative: relative(process.cwd(), file),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tpartition,\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tconst err = error as Error;\n\t\t\t\tlogger.error(`Failed to load ${f}: ${err.message}`);\n\t\t\t\tif (err.stack) {\n\t\t\t\t\tlogger.error(err.stack);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\treturn constructs;\n\t}\n}\n\nexport interface GeneratedConstruct<T extends Construct> {\n\tkey: string;\n\tname: string;\n\tconstruct: T;\n\tpath: {\n\t\tabsolute: string;\n\t\trelative: string;\n\t};\n\t/** Partition name assigned by the partition function, if configured. */\n\tpartition?: string;\n}\n","/**\n * Discovery — one glob, one structural test.\n *\n * A glob per kind is the same specialness the construct model removes, and\n * resources have no kind to be listed under: a declared `ObjectStorage` would\n * never be found by `routes:` or `crons:`. So there is one `constructs` glob,\n * every export of every matching module is inspected, and the per-kind\n * `isConstruct` checks collapse into a single question — does it have an id and\n * can it declare?\n *\n * Structural rather than `instanceof` on purpose. A construct from a different\n * copy of `@geekmidas/constructs` — a linked workspace, two versions in a\n * lockfile — is still a construct, and `instanceof` is exactly the check that\n * says otherwise.\n */\n\nimport { relative } from 'node:path';\nimport {\n\tassertDerivations,\n\ttype ConstructManifest,\n\tcanonicalId,\n\ttype Declaration,\n} from '@geekmidas/manifest';\nimport fg from 'fast-glob';\nimport { clearZodGlobalRegistry } from '../generators/Generator';\n\n/** Matches the rest of the CLI, which logs through `console` directly. */\nconst logger = console;\n\n/** The construct face discovery needs: an id, and the ability to declare. */\ninterface Declarable {\n\tid: string;\n\tdeclare(): Declaration[];\n}\n\n/**\n * Whether a module export is a construct.\n *\n * Deliberately loose about what else it carries — a construct that also has a\n * `service` is still a construct, and requiring one would exclude the kinds that\n * own no address.\n */\nexport function isDeclarable(value: unknown): value is Declarable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Declarable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\tcandidate.id.length > 0 &&\n\t\ttypeof candidate.declare === 'function'\n\t);\n}\n\nexport interface DiscoverOptions {\n\t/** The glob(s) to search. One pattern, not one per kind. */\n\tpatterns: string | readonly string[];\n\tcwd?: string;\n\t/**\n\t * Re-import changed modules, for the dev watcher.\n\t *\n\t * A single glob makes discovery more central, not less: a new construct file\n\t * has to be picked up on `add`, not only on `change`.\n\t */\n\tbustCache?: boolean;\n\t/**\n\t * Filled in with where each construct was found, when provided.\n\t *\n\t * Discovery is the only thing that knows: it globbed the files and imported\n\t * them. Everything downstream that needs to *write* an import — the build,\n\t * generating a server entry that reads a surface's logger — would otherwise\n\t * have to be told the path in config, which is the string this removes.\n\t *\n\t * An out-parameter rather than a second return value so that every existing\n\t * caller, which wants the manifest and nothing else, is unchanged.\n\t */\n\tsources?: Record<string, ConstructSource>;\n}\n\n/** Where a construct was declared, and under what name. */\nexport interface ConstructSource {\n\t/** Absolute path to the module that exported it. */\n\tfile: string;\n\t/** The name it was exported as — what an import statement has to say. */\n\texportName: string;\n}\n\n/**\n * Build the construct manifest for a project.\n *\n * Runs the manifest's own validation before returning, so an app is wrong here\n * — where the error names a file — rather than at deploy.\n *\n * @throws {DuplicateConstruct} when two exports claim one id.\n */\nexport async function discover(\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest> {\n\tconst {\n\t\tpatterns,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t\tsources: out,\n\t} = options;\n\n\t// Re-importing user modules re-executes them, and Zod v4 throws on a\n\t// re-registered `.meta({ id })`. Same reason the generators clear it.\n\tif (bustCache) clearZodGlobalRegistry();\n\n\tconst manifest: Record<string, Declaration> = {};\n\t/** Which file declared each id, for the error when two of them do. */\n\tconst sources: Record<string, string> = {};\n\t/**\n\t * Constructs already seen, by identity.\n\t *\n\t * A re-export is the *same object* reached through a second file — ESM\n\t * bindings are live, so `export * from './database.js'` hands back the\n\t * binding rather than a copy. Without this, a barrel file made every\n\t * construct in it appear declared twice, and `constructs/index.ts` is the\n\t * first thing anyone writes in a shared folder.\n\t *\n\t * Identity rather than file is also the more honest rule: what may not\n\t * happen twice is two *different* constructs claiming one id, and that is\n\t * still an error below.\n\t */\n\tconst seen = new WeakSet<object>();\n\n\tconst globs = Array.isArray(patterns) ? [...patterns] : [patterns as string];\n\tconst files = fg.stream(globs, { cwd, absolute: true });\n\n\t/** Matched files, for the diagnostic below. */\n\tlet matched = 0;\n\n\tfor await (const found of files) {\n\t\tmatched++;\n\t\tconst file = found.toString();\n\t\tconst module = await import(bustCache ? `${file}?t=${Date.now()}` : file);\n\n\t\tfor (const [exportName, exported] of Object.entries(module)) {\n\t\t\tif (!isDeclarable(exported)) continue;\n\n\t\t\t// The same construct, reached again through a re-export. Skipped\n\t\t\t// rather than re-declared: it has already claimed its id, from the\n\t\t\t// file that defined it.\n\t\t\tif (seen.has(exported as object)) continue;\n\t\t\tseen.add(exported as object);\n\n\t\t\tfor (const declaration of exported.declare()) {\n\t\t\t\t// Canonicalise here too: a construct built by hand rather than through\n\t\t\t\t// a constructor is still subject to the same identity rule.\n\t\t\t\tconst id = canonicalId(declaration.id);\n\t\t\t\tconst source = relative(cwd, file);\n\n\t\t\t\tconst claimed = sources[id];\n\t\t\t\tif (claimed !== undefined && claimed !== source) {\n\t\t\t\t\tthrow new DuplicateConstruct(id, [claimed, source]);\n\t\t\t\t}\n\n\t\t\t\tmanifest[id] = { ...declaration, id };\n\t\t\t\tsources[id] = source;\n\t\t\t\tif (out) out[id] = { file, exportName };\n\t\t\t}\n\t\t}\n\t}\n\n\t// Reference integrity before anyone reads it — a schema tenant naming a\n\t// database that was deleted is a manifest error, not a reconcile failure.\n\tassertDerivations(manifest);\n\n\twarnIfNothingFound(globs, matched, Object.keys(manifest).length);\n\n\treturn manifest;\n}\n\n/**\n * Say so when a glob was configured and found nothing.\n *\n * The glob is not a filter over declarations already known — it is *how they\n * are found*, by importing what it matches. So a file it misses is a\n * declaration that does not exist, and every symptom of that appears somewhere\n * other than the cause: no container starts, no env key is written, and the\n * application fails on first use against a resource it can see in its own\n * source.\n *\n * Nothing reported it before, because an unmatched file is indistinguishable\n * from a file nobody wrote. These two cases are the ones that are *not*\n * ambiguous — a glob was configured, so something was expected.\n *\n * Silent when no glob is configured at all: that is a project which has not\n * adopted constructs, and has nothing to be missing.\n */\nfunction warnIfNothingFound(\n\tglobs: readonly string[],\n\tmatched: number,\n\tdeclared: number,\n): void {\n\tif (globs.length === 0) return;\n\n\tif (matched === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched no files, so nothing was declared.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Nothing will be provisioned — no containers, no env keys, no ` +\n\t\t\t\t`resources.\\n` +\n\t\t\t\t`   A common cause is depth: '*.ts' matches one level, '**/*.ts' ` +\n\t\t\t\t`matches any.`,\n\t\t);\n\t\treturn;\n\t}\n\n\tif (declared === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched ${matched} file(s) but none declared ` +\n\t\t\t\t`anything.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Discovery keeps exports with an 'id' that can 'declare()'. A ` +\n\t\t\t\t`construct that is\\n` +\n\t\t\t\t`   built but never exported is invisible to it.`,\n\t\t);\n\t}\n}\n\n/** Two constructs claiming one id. */\nexport class DuplicateConstruct extends Error {\n\t/** The id claimed twice. */\n\treadonly id: string;\n\t/** The files that claimed it. */\n\treadonly sources: readonly string[];\n\n\tconstructor(id: string, sources: readonly string[]) {\n\t\tsuper('Two constructs declare the same id');\n\t\tthis.name = 'DuplicateConstruct';\n\t\tthis.id = id;\n\t\tthis.sources = sources;\n\t}\n}\n"],"mappings":";;;;;;AAgBA,SAAgB,oBACfA,QAC8B;AAC9B,eACQ,WAAW,YAClB,WAAW,SACV,MAAM,QAAQ,OAAO,IACtB,WAAW;AAEZ;;;;;;;;;;;;;;;;;;;AA2HD,MAAaC,gBAAoD;CAEhE,KAAK;CAGL,QAAQ;AACR;;AAGD,MAAaC,kBAAwD;CACpE,KAAK;CACL,QAAQ;AACR;;;;;;;;;AAgCD,MAAaC,gBAA8B;;;;;;;;;;;;;;;AC1K3C,SAAgB,yBAA+B;CAC9C,MAAM,WACL,WACC;AACF,KAAI,mBAAmB,SAAS,UAAU,WACzC,UAAS,OAAO;AAEjB;AAOD,IAAsB,qBAAtB,MAAwE;CAGvE,aAAa,MACZC,SACAC,WACAC,WACAC,UACAC,SACa;EACb,MAAM,aAAa,MAAM,UAAU,KAAK,SAAS;AACjD,SAAO,UAAU,MAAM,SAAS,YAAY,WAAW,QAAQ;CAC/D;CASD,MAAM,KACLD,UACA,MAAM,QAAQ,KAAK,EACnB,YAAY,OACuB;EACnC,MAAME,WAAS;EAGf,IAAIC;EACJ,IAAIC;AAEJ,MAAI,oBAAoB,SAAS,EAAE;AAClC,kBAAe,MAAM,QAAQ,SAAS,MAAM,GACzC,SAAS,QACT,CAAC,SAAS,KAAM;AACnB,iBAAc,SAAS;EACvB,MACA,gBAAe,MAAM,QAAQ,SAAS,GACnC,WACA,WACC,CAAC,QAAS,IACV,CAAE;EAIP,MAAM,QAAQ,GAAG,OAAO,cAAc;GACrC;GACA,UAAU;EACV,EAAC;AAKF,MAAI,UACH,yBAAwB;EAIzB,MAAMC,aAAsC,CAAE;AAE9C,aAAW,MAAM,KAAK,MACrB,KAAI;GACH,MAAM,OAAO,EAAE,UAAU;GAEzB,MAAM,aAAa,aAAa,EAAE,KAAK,KAAK,KAAK,KAAK,CAAC,IAAI;GAC3D,MAAM,SAAS,MAAM,OAAO;GAG5B,MAAM,YAAY,cAAc,YAAY,KAAK;AAGjD,QAAK,MAAM,CAAC,KAAK,UAAU,IAAI,OAAO,QAAQ,OAAO,CACpD,KAAI,KAAK,YAAY,UAAU,CAC9B,YAAW,KAAK;IACf;IACA,MAAM,YAAU,IAAI;IACpB;IACA,MAAM;KACL,UAAU;KACV,UAAU,SAAS,QAAQ,KAAK,EAAE,KAAK;IACvC;IACD;GACA,EAAC;EAGJ,SAAQ,OAAO;GACf,MAAM,MAAM;AACZ,YAAO,OAAO,iBAAiB,EAAE,IAAI,IAAI,QAAQ,EAAE;AACnD,OAAI,IAAI,MACP,UAAO,MAAM,IAAI,MAAM;AAExB,SAAM;EACN;AAGF,SAAO;CACP;AACD;;;;;AC3GD,MAAM,SAAS;;;;;;;;AAef,SAAgB,aAAaC,OAAqC;AACjE,YAAW,UAAU,YAAY,UAAU,KAAM,QAAO;CAExD,MAAM,YAAY;AAElB,eACQ,UAAU,OAAO,YACxB,UAAU,GAAG,SAAS,YACf,UAAU,YAAY;AAE9B;;;;;;;;;AA2CD,eAAsB,SACrBC,SAC6B;CAC7B,MAAM,EACL,UACA,MAAM,QAAQ,KAAK,EACnB,YAAY,OACZ,SAAS,KACT,GAAG;AAIJ,KAAI,UAAW,yBAAwB;CAEvC,MAAMC,WAAwC,CAAE;;CAEhD,MAAMC,UAAkC,CAAE;;;;;;;;;;;;;;CAc1C,MAAM,uBAAO,IAAI;CAEjB,MAAM,QAAQ,MAAM,QAAQ,SAAS,GAAG,CAAC,GAAG,QAAS,IAAG,CAAC,QAAmB;CAC5E,MAAM,QAAQ,GAAG,OAAO,OAAO;EAAE;EAAK,UAAU;CAAM,EAAC;;CAGvD,IAAI,UAAU;AAEd,YAAW,MAAM,SAAS,OAAO;AAChC;EACA,MAAM,OAAO,MAAM,UAAU;EAC7B,MAAM,SAAS,OAAa,YAoG7B,QApG0C,EAAE,KAAK,KAAK,KAAK,KAAK,CAAC,KAoGhE,OApGoE;AAEpE,OAAK,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,QAAQ,OAAO,EAAE;AAC5D,QAAK,aAAa,SAAS,CAAE;AAK7B,OAAI,KAAK,IAAI,SAAmB,CAAE;AAClC,QAAK,IAAI,SAAmB;AAE5B,QAAK,MAAM,eAAe,SAAS,SAAS,EAAE;IAG7C,MAAM,KAAK,YAAY,YAAY,GAAG;IACtC,MAAM,SAAS,SAAS,KAAK,KAAK;IAElC,MAAM,UAAU,QAAQ;AACxB,QAAI,sBAAyB,YAAY,OACxC,OAAM,IAAI,mBAAmB,IAAI,CAAC,SAAS,MAAO;AAGnD,aAAS,MAAM;KAAE,GAAG;KAAa;IAAI;AACrC,YAAQ,MAAM;AACd,QAAI,IAAK,KAAI,MAAM;KAAE;KAAM;IAAY;GACvC;EACD;CACD;AAID,mBAAkB,SAAS;AAE3B,oBAAmB,OAAO,SAAS,OAAO,KAAK,SAAS,CAAC,OAAO;AAEhE,QAAO;AACP;;;;;;;;;;;;;;;;;;AAmBD,SAAS,mBACRC,OACAC,SACAC,UACO;AACP,KAAI,MAAM,WAAW,EAAG;AAExB,KAAI,YAAY,GAAG;AAClB,SAAO,MACL,qFACgB,MAAM,KAAK,KAAK,CAAC,4JAKlC;AACD;CACA;AAED,KAAI,aAAa,EAChB,QAAO,MACL,oCAAoC,QAAQ,qDAE5B,MAAM,KAAK,KAAK,CAAC,sIAIlC;AAEF;;AAGD,IAAa,qBAAb,cAAwC,MAAM;;CAE7C,AAAS;;CAET,AAAS;CAET,YAAYC,IAAYC,SAA4B;AACnD,QAAM,qCAAqC;AAC3C,OAAK,OAAO;AACZ,OAAK,KAAK;AACV,OAAK,UAAU;CACf;AACD"}

package/dist/discover-DTmFeloL.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"discover-DTmFeloL.cjs","names":["routes: Routes | undefined","DEFAULT_CACHE: Record<MainProvider, CacheBackend>","DEFAULT_STORAGE: Record<MainProvider, StorageBackend>","DEFAULT_EMAIL: EmailBackend","context: BuildContext","outputDir: string","generator: ConstructGenerator<T, R>","patterns?: Routes","options?: GeneratorOptions","logger","globPatterns: string[]","partitionFn: ((filepath: string) => string) | undefined","constructs: GeneratedConstruct<T>[]","module","value: unknown","options: DiscoverOptions","manifest: Record<string, Declaration>","sources: Record<string, string>","module","globs: readonly string[]","matched: number","declared: number","id: string","sources: readonly string[]"],"sources":["../src/types.ts","../src/generators/Generator.ts","../src/reconcile/discover.ts"],"sourcesContent":["import type { ServicesConfig, StagesConfig } from './workspace/types.js';\n\nexport type MainProvider = 'aws' | 'server';\nexport type LegacyProvider =\n\t| 'server'\n\t| 'aws-apigatewayv1'\n\t| 'aws-apigatewayv2'\n\t| 'aws-lambda';\n\nexport interface PartitionedRoutes {\n\tpaths: string | string[];\n\tpartition: (filepath: string) => string;\n}\n\nexport type Routes = string | string[] | PartitionedRoutes;\n\nexport function isPartitionedRoutes(\n\troutes: Routes | undefined,\n): routes is PartitionedRoutes {\n\treturn (\n\t\ttypeof routes === 'object' &&\n\t\troutes !== null &&\n\t\t!Array.isArray(routes) &&\n\t\t'paths' in routes\n\t);\n}\n\nexport interface ProviderConfig {\n\tenabled?: boolean;\n\toutputDir?: string;\n}\n\nexport interface AWSApiGatewayConfig extends ProviderConfig {\n\t// Additional AWS API Gateway specific options\n}\n\nexport interface AWSLambdaConfig extends ProviderConfig {\n\t// Additional AWS Lambda specific options\n}\n\nexport interface ProductionConfig {\n\t/** Enable production mode (default: false) */\n\tenabled?: boolean;\n\t/** Bundle server into single file (default: true) */\n\tbundle?: boolean;\n\t/** Minify bundled output (default: true) */\n\tminify?: boolean;\n\t/** Health check endpoint path (default: '/health') */\n\thealthCheck?: string;\n\t/** Enable graceful shutdown handling (default: true) */\n\tgracefulShutdown?: boolean;\n\t/** Packages to exclude from bundling (default: []) */\n\texternal?: string[];\n\t/** Include subscribers in production build (default: 'exclude' for serverless) */\n\tsubscribers?: 'include' | 'exclude';\n\t/** Include OpenAPI spec in production (default: false) */\n\topenapi?: boolean;\n\t/**\n\t * Enable build-time optimized handler generation (default: true)\n\t * Generates specialized handlers based on endpoint tier:\n\t * - minimal: Near-raw-Hono performance for simple endpoints\n\t * - standard: Optimized handlers for auth/services\n\t * - full: Uses HonoEndpoint.addRoutes for complex endpoints\n\t */\n\toptimizedHandlers?: boolean;\n}\n\n/** Service-specific configuration for docker-compose */\nexport interface ServiceConfig {\n\t/**\n\t * Full Docker image reference (e.g., 'postgis/postgis:16-3.4-alpine').\n\t * When specified, overrides the default image entirely.\n\t */\n\timage?: string;\n\t/**\n\t * Docker image version/tag (e.g., '15-alpine' for postgres).\n\t * Only used when `image` is not specified.\n\t */\n\tversion?: string;\n}\n\n/**\n * Supported event backend types.\n *\n * - `pgboss`: Reuses PostgreSQL with a dedicated user/schema. Auto-enables db service.\n * - `sns`: Adds LocalStack container with SNS+SQS services.\n * - `rabbitmq`: Adds RabbitMQ container.\n *\n * All backends generate EVENT_PUBLISHER_CONNECTION_STRING and EVENT_SUBSCRIBER_CONNECTION_STRING.\n */\nexport type EventsBackend = 'pgboss' | 'sns' | 'rabbitmq';\n\n/**\n * Where a declared cache actually lives.\n *\n * A deployment choice, not an application one — the same code caches into any\n * of these — so it is config here beside `events` rather than a field on the\n * construct. Each backend is consistent between local and deployed, which is\n * the property worth having: a cache that behaves differently in the two places\n * is worse than a slower one.\n *\n * - `upstash` (default) — HTTP with a token. Reachable from a Lambda with no\n *   VPC and no connection pool, which is why it is the default; locally the\n *   `serverless-redis-http` proxy in front of Redis speaks the same protocol.\n * - `elasticache` — the Redis wire protocol, inside a VPC. Locally, plain Redis.\n * - `db` — a table in the database the app already declared. No infrastructure\n *   at all, and the same relationship pg-boss has to Postgres: it creates its\n *   own table on first use and needs a declared database to live in.\n */\nexport type CacheBackend = 'upstash' | 'elasticache' | 'db';\n\n/**\n * Where a declared bucket actually lives.\n *\n * The fourth of these selectors and the last to arrive, which is why\n * `UPLOADS_URL` had no answer on a container target: there was nothing to\n * choose with. Like the others it changes no application code — the `s3://`\n * scheme picks the driver, and every one of these speaks it.\n *\n * - `s3` — a real bucket. Nothing is created on the host; the URL is composed\n *   against credentials you already hold, the same way `resend` is an API key\n *   rather than infrastructure.\n * - `r2` — Cloudflare's, reached through the same S3 API and differing only in\n *   its endpoint.\n * - `minio` — a container. Everything the app declares lives on the box, which\n *   is what makes a single-host deploy self-contained, and what makes it a\n *   single disk with no replication. Locally this is what every backend is.\n */\nexport type StorageBackend = 'minio' | 's3' | 'r2';\n\n/**\n * The backend a project gets when it says nothing, by where it deploys.\n *\n * Flat defaults could not be right for both: `upstash` on a single box means a\n * SaaS round-trip for a cache the database could have held, and `minio` on AWS\n * means running a bucket beside S3. So the default is a function of the target,\n * and an app that says nothing gets the obvious answer in both places — which\n * is the whole of what \"zero config\" can mean once there is more than one\n * target.\n *\n * `server` covers Dokploy and a bare host alike: the question these answer is\n * whether the app is next to a managed cloud or next to its own containers, and\n * on that question the two are the same.\n *\n * A per-construct, per-stage override is the layer above this — see\n * `constructs-outstanding.md` — so two buckets in one app can differ. This is\n * only what happens when nobody has said anything at all.\n */\nexport const DEFAULT_CACHE: Record<MainProvider, CacheBackend> = {\n\t// Reachable from a Lambda with no VPC and no connection pool.\n\taws: 'upstash',\n\t// The database is already there and already has a connection pool open to\n\t// it. Anything else is a second service to run for a table.\n\tserver: 'db',\n};\n\n/** Where a bucket lives when nobody said — see {@link DEFAULT_CACHE}. */\nexport const DEFAULT_STORAGE: Record<MainProvider, StorageBackend> = {\n\taws: 's3',\n\tserver: 'minio',\n};\n\n/**\n * Who delivers a declared app's mail.\n *\n * Unlike a cache, this changes *nothing* about the client. Every backend speaks\n * SMTP, so the declaration's `smtp://` URL is true of all of them and only the\n * provisioner differs — which is the same reason the declaration has no\n * `provider` field and there is no `ses://` scheme.\n *\n * - `ses` (default) — the only backend that can be a *chain* of resources: an\n *   identity, a user, an access key, and an SMTP password derived from it,\n *   because SES issues IAM credentials rather than SMTP ones. Hand it a URL and\n *   it uses that instead, which is what you want when the credentials already\n *   exist — provisioning a second set of sending credentials for an identity\n *   that already has them is not a thing to do by default.\n * - `resend` — an API key you hold, composed into an SMTP URL. Nothing to\n *   provision: a SaaS account is not infrastructure.\n * - `smtp` — a URL supplied whole, for a relay somebody else runs.\n *\n * Locally every one of them is Mailpit, because locally none of it matters.\n */\nexport type EmailBackend = 'resend' | 'ses' | 'smtp';\n\n/**\n * Who delivers mail when nobody said.\n *\n * Flat, unlike the others, and deliberately: mail is a SaaS on every target.\n * There is no self-hosted preset to default a container deploy to — Mailpit is\n * a development inbox, not a sender — so `server` has no answer of its own to\n * give and would only be `ses` written twice.\n */\nexport const DEFAULT_EMAIL: EmailBackend = 'ses';\n\n/** Supported docker-compose service names */\nexport type ComposeServiceName =\n\t| 'postgres'\n\t| 'redis'\n\t| 'rabbitmq'\n\t| 'minio'\n\t| 'mailpit'\n\t| 'localstack';\n\n/** Services configuration - can be boolean (use defaults) or object with version */\nexport type ComposeServicesConfig = {\n\t[K in ComposeServiceName]?: boolean | ServiceConfig;\n};\n\nexport interface DockerConfig {\n\t/** Container registry URL (e.g., 'ghcr.io/myorg') */\n\tregistry?: string;\n\t/** Docker image name (default: derived from package.json name) */\n\timageName?: string;\n\t/** Base Docker image (default: 'node:22-alpine') */\n\tbaseImage?: string;\n\t/** Container port (default: 3000) */\n\tport?: number;\n\t/** docker-compose services to include */\n\tcompose?: {\n\t\t/**\n\t\t * Services to include in docker-compose.\n\t\t * Can be an object with service configs or an array of service names (legacy).\n\t\t *\n\t\t * @example Object format (recommended)\n\t\t * services: {\n\t\t *   postgres: { version: '15-alpine' },\n\t\t *   redis: true,  // use default version\n\t\t * }\n\t\t *\n\t\t * @example Array format (legacy, uses default versions)\n\t\t * services: ['postgres', 'redis']\n\t\t */\n\t\tservices?: ComposeServicesConfig | ComposeServiceName[];\n\t};\n}\n\nexport interface ServerConfig extends ProviderConfig {\n\tenableOpenApi?: boolean;\n\tport?: number;\n\t/** Production build configuration */\n\tproduction?: ProductionConfig;\n}\n\nexport type Runtime = 'node' | 'bun';\n\nexport interface TelescopeConfig {\n\t/** Enable/disable telescope (default: true in development) */\n\tenabled?: boolean;\n\t/** Port for telescope to use (defaults to server port) */\n\tport?: number;\n\t/** Path prefix for telescope UI (default: /__telescope) */\n\tpath?: string;\n\t/** Ignore patterns for telescope (e.g., ['/health', '/metrics']) */\n\tignore?: string[];\n\t/** Record request/response bodies (default: true) */\n\trecordBody?: boolean;\n\t/** Maximum entries to keep in memory (default: 1000) */\n\tmaxEntries?: number;\n\t/** Enable WebSocket for real-time updates (default: true, requires @hono/node-ws for Node.js) */\n\twebsocket?: boolean;\n}\n\nexport interface StudioConfig {\n\t/** Enable/disable studio (default: true in development) */\n\tenabled?: boolean;\n\t/** Path prefix for studio UI (default: /__studio) */\n\tpath?: string;\n\t/** Schema to introspect (default: 'public') */\n\tschema?: string;\n}\n\nexport interface OpenApiConfig {\n\t/** Enable OpenAPI generation (default: true) */\n\tenabled?: boolean;\n\t/** API title */\n\ttitle?: string;\n\t/** API version */\n\tversion?: string;\n\t/** API description */\n\tdescription?: string;\n}\n\nexport interface HooksConfig {\n\t/**\n\t * Path to a module exporting server lifecycle hooks.\n\t * The module should export `beforeSetup` and/or `afterSetup` functions.\n\t *\n\t * @example\n\t * ```typescript\n\t * // src/config/hooks.ts\n\t * import type { Hono } from 'hono';\n\t * import type { Logger } from '@geekmidas/logger';\n\t * import type { EnvironmentParser } from '@geekmidas/envkit';\n\t *\n\t * // Called BEFORE gkm endpoints are registered\n\t * export function beforeSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.use('*', cors());\n\t *   app.get('/custom/health', (c) => c.json({ status: 'ok' }));\n\t * }\n\t *\n\t * // Called AFTER gkm endpoints are registered\n\t * export function afterSetup(app: Hono, ctx: { envParser: EnvironmentParser; logger: Logger }) {\n\t *   app.notFound((c) => c.json({ error: 'Not found' }, 404));\n\t *   app.onError((err, c) => c.json({ error: err.message }, 500));\n\t * }\n\t * ```\n\t */\n\tserver?: string;\n}\n\n/** Dokploy deployment configuration */\nexport interface DokployProviderConfig {\n\t/** Dokploy API endpoint (e.g., 'https://dokploy.example.com') */\n\tendpoint: string;\n\t/** Project ID in Dokploy */\n\tprojectId: string;\n\t/** Application ID in Dokploy */\n\tapplicationId: string;\n\t/** Container registry (overrides docker.registry if set) */\n\tregistry?: string;\n\t/** Registry ID in Dokploy (recommended for private registries) */\n\tregistryId?: string;\n}\n\nexport interface ProvidersConfig {\n\taws?: {\n\t\tapiGateway?: {\n\t\t\tv1?: boolean | AWSApiGatewayConfig;\n\t\t\tv2?: boolean | AWSApiGatewayConfig;\n\t\t};\n\t\tlambda?: {\n\t\t\tfunctions?: boolean | AWSLambdaConfig;\n\t\t\tcrons?: boolean | AWSLambdaConfig;\n\t\t};\n\t};\n\tserver?: boolean | ServerConfig;\n\t/** Dokploy deployment configuration */\n\tdokploy?: boolean | DokployProviderConfig;\n}\n\nexport interface GkmConfig {\n\t/**\n\t * What this app is called, and therefore how everything it declares is named.\n\t *\n\t * The same field `sst.config.ts` carries, doing the same job: every physical\n\t * name is `{stage}-{name}-{construct}`, so `Database` in the `production`\n\t * stage of `kitchen-sink` is `production-kitchen-sink-database` on AWS and on\n\t * Dokploy alike. One statement, in the config, rather than a rule each\n\t * provider restates.\n\t *\n\t * `defineWorkspace` has always had this. A single-app config did not, so its\n\t * names fell back to whatever the directory happened to be called — the\n\t * monorepo's package name for the project and the app's for the application,\n\t * two accidents of layout standing in for a decision.\n\t *\n\t * Defaults to the package.json name with any scope stripped, then the\n\t * directory name.\n\t */\n\tname?: string;\n\t/** The project's stages: which one is local, which deploy */\n\tstages: StagesConfig;\n\t/**\n\t * Where the things no construct implies live.\n\t *\n\t * The same block a workspace config carries, and the same split: `db` and\n\t * `storage` are derived from the declared `KyselyDatabase` and\n\t * `ObjectStorage` and are ignored here, while `cache`, `mail`, and `events`\n\t * name a *backend* — where the cache lives, who delivers the mail, which\n\t * broker carries events. A single-app project had no way to say any of that\n\t * before, so its event backend could only be guessed.\n\t */\n\tservices?: ServicesConfig;\n\t/**\n\t * Constructs glob pattern — one glob, every kind.\n\t *\n\t * What reconcile reads to derive the containers a stage needs: a database\n\t * implies Postgres, objects imply MinIO, mail implies Mailpit. A glob per\n\t * kind cannot find a resource, because a declared `ObjectStorage` has no\n\t * kind to be listed under.\n\t *\n\t * @example './src/**\\/*.ts'\n\t */\n\tconstructs: Routes;\n\tproviders?: ProvidersConfig;\n\t/**\n\t * Server lifecycle hooks for customizing the Hono app.\n\t * Allows adding custom routes, middleware, error handlers, etc.\n\t *\n\t * @example\n\t * hooks: {\n\t *   server: './src/config/hooks'\n\t * }\n\t */\n\thooks?: HooksConfig;\n\t/**\n\t * Telescope configuration for debugging/monitoring.\n\t * Can be:\n\t * - A string path to a module that exports a Telescope instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A TelescopeConfig object for inline configuration\n\t */\n\ttelescope?: string | boolean | TelescopeConfig;\n\t/**\n\t * Studio configuration for database browsing.\n\t * Can be:\n\t * - A string path to a module that exports a Studio instance (recommended)\n\t * - A boolean to enable/disable with defaults\n\t * - A StudioConfig object for inline configuration\n\t *\n\t * Requires a database connection configured via services.\n\t */\n\tstudio?: string | boolean | StudioConfig;\n\t/**\n\t * OpenAPI generation configuration.\n\t * Can be:\n\t * - A boolean to enable/disable with defaults (output: ./src/api/openapi.ts)\n\t * - An OpenApiConfig object for customization\n\t *\n\t * When enabled, OpenAPI spec is generated on startup and regenerated on route changes.\n\t *\n\t * @example\n\t * openapi: true\n\t *\n\t * @example\n\t * openapi: {\n\t *   output: './src/api/openapi.ts',\n\t *   title: 'My API',\n\t *   version: '1.0.0',\n\t * }\n\t */\n\topenapi?: boolean | OpenApiConfig;\n\t/** Runtime to use for dev server (default: 'node') */\n\truntime?: Runtime;\n\t/**\n\t * Environment file(s) to load for development.\n\t * Can be:\n\t * - A string path to a single env file (e.g., '.env.local')\n\t * - An array of paths to load in order (later files override earlier)\n\t * - Defaults to '.env' if not specified\n\t *\n\t * @example\n\t * env: '.env.local'\n\t *\n\t * @example\n\t * env: ['.env', '.env.local']\n\t */\n\tenv?: string | string[];\n\t/**\n\t * Docker deployment configuration.\n\t * Used by `gkm docker` and `gkm prepack` commands.\n\t *\n\t * @example\n\t * docker: {\n\t *   registry: 'ghcr.io/myorg',\n\t *   imageName: 'my-api',\n\t *   compose: {\n\t *     services: ['postgres', 'redis']\n\t *   }\n\t * }\n\t */\n\tdocker?: DockerConfig;\n\t/**\n\t * Where this app deploys, and what the target needs to know.\n\t *\n\t * Absent until now, which meant a single-app project could not configure a\n\t * Dokploy deploy at all: the wrap that turns one into a workspace hardcoded\n\t * `{ default: 'dokploy' }` and dropped everything else, so there was no\n\t * endpoint, no registry and no domain — and `resolveHost` failed with \"no\n\t * domain configured for stage\" on a config that had nowhere to put one.\n\t *\n\t * The same shape a workspace config uses, so moving from one to the other is\n\t * a rename rather than a rewrite.\n\t */\n\tdeploy?: import('./workspace/types').DeployConfig;\n}\n\nexport interface BuildOptions {\n\tprovider?: MainProvider;\n\t// Legacy support - will be deprecated\n\tproviders?: LegacyProvider[];\n\tenableOpenApi?: boolean;\n\t/** Build for production (no dev tools, bundled output) */\n\tproduction?: boolean;\n\t/** Skip bundling step in production build */\n\tskipBundle?: boolean;\n\t/** Stage for secrets injection (e.g., 'production', 'staging') */\n\tstage?: string;\n\t/**\n\t * When true, optional environment variables (those with `.optional()` or\n\t * `.default()` in the envParser) are suffixed with `?` within each\n\t * construct's `environment` array in the manifest (e.g. `PORT?`).\n\t * Defaults to false.\n\t */\n\tmarkOptional?: boolean;\n}\n\n/** Result from build command when secrets are injected */\nexport interface BuildResult {\n\t/** Ephemeral master key for deployment (only if stage was provided) */\n\tmasterKey?: string;\n}\n\n// The deployment manifest types are a shared, dependency-free data contract\n// in `@geekmidas/manifest`, re-exported here for back-compat with existing\n// `@geekmidas/cli` imports.\nexport type {\n\tCronInfo,\n\tFunctionInfo,\n\tManifest,\n\tQueueInfo,\n\tRouteInfo,\n\tSubscriberInfo,\n\tTopicInfo,\n} from '@geekmidas/manifest';\n","import { relative } from 'node:path';\nimport type { Construct } from '@geekmidas/constructs';\nimport fg from 'fast-glob';\nimport kebabCase from 'lodash.kebabcase';\nimport type { BuildContext } from '../build/types';\nimport {\n\tisPartitionedRoutes,\n\ttype LegacyProvider,\n\ttype Routes,\n} from '../types';\n\n/**\n * Zod v4 maintains a process-wide registry of schemas registered via\n * `.meta({ id })`. When we cache-bust user module imports (by appending a\n * `?t=timestamp` query), those modules re-execute and try to register the\n * same ids again, which throws `ID X already exists in the registry`.\n *\n * Clearing the registry in the CLI process is safe: the user's running\n * server lives in a subprocess and has its own isolated registry.\n *\n * Exported for tests.\n */\nexport function clearZodGlobalRegistry(): void {\n\tconst registry = (\n\t\tglobalThis as { __zod_globalRegistry?: { clear?: () => void } }\n\t).__zod_globalRegistry;\n\tif (registry && typeof registry.clear === 'function') {\n\t\tregistry.clear();\n\t}\n}\n\nexport interface GeneratorOptions {\n\tprovider?: LegacyProvider;\n\t[key: string]: any;\n}\n\nexport abstract class ConstructGenerator<T extends Construct, R = void> {\n\tabstract isConstruct(value: any): value is T;\n\n\tstatic async build<T extends Construct, R = void>(\n\t\tcontext: BuildContext,\n\t\toutputDir: string,\n\t\tgenerator: ConstructGenerator<T, R>,\n\t\tpatterns?: Routes,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R> {\n\t\tconst constructs = await generator.load(patterns);\n\t\treturn generator.build(context, constructs, outputDir, options);\n\t}\n\n\tabstract build(\n\t\tcontext: BuildContext,\n\t\tconstructs: GeneratedConstruct<T>[],\n\t\toutputDir: string,\n\t\toptions?: GeneratorOptions,\n\t): Promise<R>;\n\n\tasync load(\n\t\tpatterns?: Routes,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t): Promise<GeneratedConstruct<T>[]> {\n\t\tconst logger = console;\n\n\t\t// Extract glob patterns and optional partition function\n\t\tlet globPatterns: string[];\n\t\tlet partitionFn: ((filepath: string) => string) | undefined;\n\n\t\tif (isPartitionedRoutes(patterns)) {\n\t\t\tglobPatterns = Array.isArray(patterns.paths)\n\t\t\t\t? patterns.paths\n\t\t\t\t: [patterns.paths];\n\t\t\tpartitionFn = patterns.partition;\n\t\t} else {\n\t\t\tglobPatterns = Array.isArray(patterns)\n\t\t\t\t? patterns\n\t\t\t\t: patterns\n\t\t\t\t\t? [patterns]\n\t\t\t\t\t: [];\n\t\t}\n\n\t\t// Find all files\n\t\tconst files = fg.stream(globPatterns, {\n\t\t\tcwd,\n\t\t\tabsolute: true,\n\t\t});\n\n\t\t// Cache-busted re-imports re-execute user modules, which would try to\n\t\t// re-register Zod schemas with the same `.meta({ id })`. Clear the\n\t\t// global registry once per load to prevent duplicate-id errors.\n\t\tif (bustCache) {\n\t\t\tclearZodGlobalRegistry();\n\t\t}\n\n\t\t// Load constructs\n\t\tconst constructs: GeneratedConstruct<T>[] = [];\n\n\t\tfor await (const f of files) {\n\t\t\ttry {\n\t\t\t\tconst file = f.toString();\n\t\t\t\t// Append cache-busting query param to force re-import of changed modules\n\t\t\t\tconst importPath = bustCache ? `${file}?t=${Date.now()}` : file;\n\t\t\t\tconst module = await import(importPath);\n\n\t\t\t\t// Compute partition name for this file (if partition function provided)\n\t\t\t\tconst partition = partitionFn ? partitionFn(file) : undefined;\n\n\t\t\t\t// Check all exports for constructs\n\t\t\t\tfor (const [key, construct] of Object.entries(module)) {\n\t\t\t\t\tif (this.isConstruct(construct)) {\n\t\t\t\t\t\tconstructs.push({\n\t\t\t\t\t\t\tkey,\n\t\t\t\t\t\t\tname: kebabCase(key),\n\t\t\t\t\t\t\tconstruct,\n\t\t\t\t\t\t\tpath: {\n\t\t\t\t\t\t\t\tabsolute: file,\n\t\t\t\t\t\t\t\trelative: relative(process.cwd(), file),\n\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\tpartition,\n\t\t\t\t\t\t});\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tconst err = error as Error;\n\t\t\t\tlogger.error(`Failed to load ${f}: ${err.message}`);\n\t\t\t\tif (err.stack) {\n\t\t\t\t\tlogger.error(err.stack);\n\t\t\t\t}\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\treturn constructs;\n\t}\n}\n\nexport interface GeneratedConstruct<T extends Construct> {\n\tkey: string;\n\tname: string;\n\tconstruct: T;\n\tpath: {\n\t\tabsolute: string;\n\t\trelative: string;\n\t};\n\t/** Partition name assigned by the partition function, if configured. */\n\tpartition?: string;\n}\n","/**\n * Discovery — one glob, one structural test.\n *\n * A glob per kind is the same specialness the construct model removes, and\n * resources have no kind to be listed under: a declared `ObjectStorage` would\n * never be found by `routes:` or `crons:`. So there is one `constructs` glob,\n * every export of every matching module is inspected, and the per-kind\n * `isConstruct` checks collapse into a single question — does it have an id and\n * can it declare?\n *\n * Structural rather than `instanceof` on purpose. A construct from a different\n * copy of `@geekmidas/constructs` — a linked workspace, two versions in a\n * lockfile — is still a construct, and `instanceof` is exactly the check that\n * says otherwise.\n */\n\nimport { relative } from 'node:path';\nimport {\n\tassertDerivations,\n\ttype ConstructManifest,\n\tcanonicalId,\n\ttype Declaration,\n} from '@geekmidas/manifest';\nimport fg from 'fast-glob';\nimport { clearZodGlobalRegistry } from '../generators/Generator';\n\n/** Matches the rest of the CLI, which logs through `console` directly. */\nconst logger = console;\n\n/** The construct face discovery needs: an id, and the ability to declare. */\ninterface Declarable {\n\tid: string;\n\tdeclare(): Declaration[];\n}\n\n/**\n * Whether a module export is a construct.\n *\n * Deliberately loose about what else it carries — a construct that also has a\n * `service` is still a construct, and requiring one would exclude the kinds that\n * own no address.\n */\nexport function isDeclarable(value: unknown): value is Declarable {\n\tif (typeof value !== 'object' || value === null) return false;\n\n\tconst candidate = value as Partial<Declarable>;\n\n\treturn (\n\t\ttypeof candidate.id === 'string' &&\n\t\tcandidate.id.length > 0 &&\n\t\ttypeof candidate.declare === 'function'\n\t);\n}\n\nexport interface DiscoverOptions {\n\t/** The glob(s) to search. One pattern, not one per kind. */\n\tpatterns: string | readonly string[];\n\tcwd?: string;\n\t/**\n\t * Re-import changed modules, for the dev watcher.\n\t *\n\t * A single glob makes discovery more central, not less: a new construct file\n\t * has to be picked up on `add`, not only on `change`.\n\t */\n\tbustCache?: boolean;\n\t/**\n\t * Filled in with where each construct was found, when provided.\n\t *\n\t * Discovery is the only thing that knows: it globbed the files and imported\n\t * them. Everything downstream that needs to *write* an import — the build,\n\t * generating a server entry that reads a surface's logger — would otherwise\n\t * have to be told the path in config, which is the string this removes.\n\t *\n\t * An out-parameter rather than a second return value so that every existing\n\t * caller, which wants the manifest and nothing else, is unchanged.\n\t */\n\tsources?: Record<string, ConstructSource>;\n}\n\n/** Where a construct was declared, and under what name. */\nexport interface ConstructSource {\n\t/** Absolute path to the module that exported it. */\n\tfile: string;\n\t/** The name it was exported as — what an import statement has to say. */\n\texportName: string;\n}\n\n/**\n * Build the construct manifest for a project.\n *\n * Runs the manifest's own validation before returning, so an app is wrong here\n * — where the error names a file — rather than at deploy.\n *\n * @throws {DuplicateConstruct} when two exports claim one id.\n */\nexport async function discover(\n\toptions: DiscoverOptions,\n): Promise<ConstructManifest> {\n\tconst {\n\t\tpatterns,\n\t\tcwd = process.cwd(),\n\t\tbustCache = false,\n\t\tsources: out,\n\t} = options;\n\n\t// Re-importing user modules re-executes them, and Zod v4 throws on a\n\t// re-registered `.meta({ id })`. Same reason the generators clear it.\n\tif (bustCache) clearZodGlobalRegistry();\n\n\tconst manifest: Record<string, Declaration> = {};\n\t/** Which file declared each id, for the error when two of them do. */\n\tconst sources: Record<string, string> = {};\n\t/**\n\t * Constructs already seen, by identity.\n\t *\n\t * A re-export is the *same object* reached through a second file — ESM\n\t * bindings are live, so `export * from './database.js'` hands back the\n\t * binding rather than a copy. Without this, a barrel file made every\n\t * construct in it appear declared twice, and `constructs/index.ts` is the\n\t * first thing anyone writes in a shared folder.\n\t *\n\t * Identity rather than file is also the more honest rule: what may not\n\t * happen twice is two *different* constructs claiming one id, and that is\n\t * still an error below.\n\t */\n\tconst seen = new WeakSet<object>();\n\n\tconst globs = Array.isArray(patterns) ? [...patterns] : [patterns as string];\n\tconst files = fg.stream(globs, { cwd, absolute: true });\n\n\t/** Matched files, for the diagnostic below. */\n\tlet matched = 0;\n\n\tfor await (const found of files) {\n\t\tmatched++;\n\t\tconst file = found.toString();\n\t\tconst module = await import(bustCache ? `${file}?t=${Date.now()}` : file);\n\n\t\tfor (const [exportName, exported] of Object.entries(module)) {\n\t\t\tif (!isDeclarable(exported)) continue;\n\n\t\t\t// The same construct, reached again through a re-export. Skipped\n\t\t\t// rather than re-declared: it has already claimed its id, from the\n\t\t\t// file that defined it.\n\t\t\tif (seen.has(exported as object)) continue;\n\t\t\tseen.add(exported as object);\n\n\t\t\tfor (const declaration of exported.declare()) {\n\t\t\t\t// Canonicalise here too: a construct built by hand rather than through\n\t\t\t\t// a constructor is still subject to the same identity rule.\n\t\t\t\tconst id = canonicalId(declaration.id);\n\t\t\t\tconst source = relative(cwd, file);\n\n\t\t\t\tconst claimed = sources[id];\n\t\t\t\tif (claimed !== undefined && claimed !== source) {\n\t\t\t\t\tthrow new DuplicateConstruct(id, [claimed, source]);\n\t\t\t\t}\n\n\t\t\t\tmanifest[id] = { ...declaration, id };\n\t\t\t\tsources[id] = source;\n\t\t\t\tif (out) out[id] = { file, exportName };\n\t\t\t}\n\t\t}\n\t}\n\n\t// Reference integrity before anyone reads it — a schema tenant naming a\n\t// database that was deleted is a manifest error, not a reconcile failure.\n\tassertDerivations(manifest);\n\n\twarnIfNothingFound(globs, matched, Object.keys(manifest).length);\n\n\treturn manifest;\n}\n\n/**\n * Say so when a glob was configured and found nothing.\n *\n * The glob is not a filter over declarations already known — it is *how they\n * are found*, by importing what it matches. So a file it misses is a\n * declaration that does not exist, and every symptom of that appears somewhere\n * other than the cause: no container starts, no env key is written, and the\n * application fails on first use against a resource it can see in its own\n * source.\n *\n * Nothing reported it before, because an unmatched file is indistinguishable\n * from a file nobody wrote. These two cases are the ones that are *not*\n * ambiguous — a glob was configured, so something was expected.\n *\n * Silent when no glob is configured at all: that is a project which has not\n * adopted constructs, and has nothing to be missing.\n */\nfunction warnIfNothingFound(\n\tglobs: readonly string[],\n\tmatched: number,\n\tdeclared: number,\n): void {\n\tif (globs.length === 0) return;\n\n\tif (matched === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched no files, so nothing was declared.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Nothing will be provisioned — no containers, no env keys, no ` +\n\t\t\t\t`resources.\\n` +\n\t\t\t\t`   A common cause is depth: '*.ts' matches one level, '**/*.ts' ` +\n\t\t\t\t`matches any.`,\n\t\t);\n\t\treturn;\n\t}\n\n\tif (declared === 0) {\n\t\tlogger.warn(\n\t\t\t`\\n⚠️  The constructs glob matched ${matched} file(s) but none declared ` +\n\t\t\t\t`anything.\\n` +\n\t\t\t\t`   Patterns: ${globs.join(', ')}\\n` +\n\t\t\t\t`   Discovery keeps exports with an 'id' that can 'declare()'. A ` +\n\t\t\t\t`construct that is\\n` +\n\t\t\t\t`   built but never exported is invisible to it.`,\n\t\t);\n\t}\n}\n\n/** Two constructs claiming one id. */\nexport class DuplicateConstruct extends Error {\n\t/** The id claimed twice. */\n\treadonly id: string;\n\t/** The files that claimed it. */\n\treadonly sources: readonly string[];\n\n\tconstructor(id: string, sources: readonly string[]) {\n\t\tsuper('Two constructs declare the same id');\n\t\tthis.name = 'DuplicateConstruct';\n\t\tthis.id = id;\n\t\tthis.sources = sources;\n\t}\n}\n"],"mappings":";;;;;;;AAgBA,SAAgB,oBACfA,QAC8B;AAC9B,eACQ,WAAW,YAClB,WAAW,SACV,MAAM,QAAQ,OAAO,IACtB,WAAW;AAEZ;;;;;;;;;;;;;;;;;;;AA2HD,MAAaC,gBAAoD;CAEhE,KAAK;CAGL,QAAQ;AACR;;AAGD,MAAaC,kBAAwD;CACpE,KAAK;CACL,QAAQ;AACR;;;;;;;;;AAgCD,MAAaC,gBAA8B;;;;;;;;;;;;;;;AC1K3C,SAAgB,yBAA+B;CAC9C,MAAM,WACL,WACC;AACF,KAAI,mBAAmB,SAAS,UAAU,WACzC,UAAS,OAAO;AAEjB;AAOD,IAAsB,qBAAtB,MAAwE;CAGvE,aAAa,MACZC,SACAC,WACAC,WACAC,UACAC,SACa;EACb,MAAM,aAAa,MAAM,UAAU,KAAK,SAAS;AACjD,SAAO,UAAU,MAAM,SAAS,YAAY,WAAW,QAAQ;CAC/D;CASD,MAAM,KACLD,UACA,MAAM,QAAQ,KAAK,EACnB,YAAY,OACuB;EACnC,MAAME,WAAS;EAGf,IAAIC;EACJ,IAAIC;AAEJ,MAAI,oBAAoB,SAAS,EAAE;AAClC,kBAAe,MAAM,QAAQ,SAAS,MAAM,GACzC,SAAS,QACT,CAAC,SAAS,KAAM;AACnB,iBAAc,SAAS;EACvB,MACA,gBAAe,MAAM,QAAQ,SAAS,GACnC,WACA,WACC,CAAC,QAAS,IACV,CAAE;EAIP,MAAM,QAAQ,kBAAG,OAAO,cAAc;GACrC;GACA,UAAU;EACV,EAAC;AAKF,MAAI,UACH,yBAAwB;EAIzB,MAAMC,aAAsC,CAAE;AAE9C,aAAW,MAAM,KAAK,MACrB,KAAI;GACH,MAAM,OAAO,EAAE,UAAU;GAEzB,MAAM,aAAa,aAAa,EAAE,KAAK,KAAK,KAAK,KAAK,CAAC,IAAI;GAC3D,MAAMC,WAAS,MAAM,OAAO;GAG5B,MAAM,YAAY,cAAc,YAAY,KAAK;AAGjD,QAAK,MAAM,CAAC,KAAK,UAAU,IAAI,OAAO,QAAQA,SAAO,CACpD,KAAI,KAAK,YAAY,UAAU,CAC9B,YAAW,KAAK;IACf;IACA,MAAM,8BAAU,IAAI;IACpB;IACA,MAAM;KACL,UAAU;KACV,UAAU,wBAAS,QAAQ,KAAK,EAAE,KAAK;IACvC;IACD;GACA,EAAC;EAGJ,SAAQ,OAAO;GACf,MAAM,MAAM;AACZ,YAAO,OAAO,iBAAiB,EAAE,IAAI,IAAI,QAAQ,EAAE;AACnD,OAAI,IAAI,MACP,UAAO,MAAM,IAAI,MAAM;AAExB,SAAM;EACN;AAGF,SAAO;CACP;AACD;;;;;AC3GD,MAAM,SAAS;;;;;;;;AAef,SAAgB,aAAaC,OAAqC;AACjE,YAAW,UAAU,YAAY,UAAU,KAAM,QAAO;CAExD,MAAM,YAAY;AAElB,eACQ,UAAU,OAAO,YACxB,UAAU,GAAG,SAAS,YACf,UAAU,YAAY;AAE9B;;;;;;;;;AA2CD,eAAsB,SACrBC,SAC6B;CAC7B,MAAM,EACL,UACA,MAAM,QAAQ,KAAK,EACnB,YAAY,OACZ,SAAS,KACT,GAAG;AAIJ,KAAI,UAAW,yBAAwB;CAEvC,MAAMC,WAAwC,CAAE;;CAEhD,MAAMC,UAAkC,CAAE;;;;;;;;;;;;;;CAc1C,MAAM,uBAAO,IAAI;CAEjB,MAAM,QAAQ,MAAM,QAAQ,SAAS,GAAG,CAAC,GAAG,QAAS,IAAG,CAAC,QAAmB;CAC5E,MAAM,QAAQ,kBAAG,OAAO,OAAO;EAAE;EAAK,UAAU;CAAM,EAAC;;CAGvD,IAAI,UAAU;AAEd,YAAW,MAAM,SAAS,OAAO;AAChC;EACA,MAAM,OAAO,MAAM,UAAU;EAC7B,MAAMC,WAAS,OAAa,YAoG7B,QApG0C,EAAE,KAAK,KAAK,KAAK,KAAK,CAAC,KAoGhE,OApGoE;AAEpE,OAAK,MAAM,CAAC,YAAY,SAAS,IAAI,OAAO,QAAQA,SAAO,EAAE;AAC5D,QAAK,aAAa,SAAS,CAAE;AAK7B,OAAI,KAAK,IAAI,SAAmB,CAAE;AAClC,QAAK,IAAI,SAAmB;AAE5B,QAAK,MAAM,eAAe,SAAS,SAAS,EAAE;IAG7C,MAAM,KAAK,sCAAY,YAAY,GAAG;IACtC,MAAM,SAAS,wBAAS,KAAK,KAAK;IAElC,MAAM,UAAU,QAAQ;AACxB,QAAI,sBAAyB,YAAY,OACxC,OAAM,IAAI,mBAAmB,IAAI,CAAC,SAAS,MAAO;AAGnD,aAAS,MAAM;KAAE,GAAG;KAAa;IAAI;AACrC,YAAQ,MAAM;AACd,QAAI,IAAK,KAAI,MAAM;KAAE;KAAM;IAAY;GACvC;EACD;CACD;AAID,6CAAkB,SAAS;AAE3B,oBAAmB,OAAO,SAAS,OAAO,KAAK,SAAS,CAAC,OAAO;AAEhE,QAAO;AACP;;;;;;;;;;;;;;;;;;AAmBD,SAAS,mBACRC,OACAC,SACAC,UACO;AACP,KAAI,MAAM,WAAW,EAAG;AAExB,KAAI,YAAY,GAAG;AAClB,SAAO,MACL,qFACgB,MAAM,KAAK,KAAK,CAAC,4JAKlC;AACD;CACA;AAED,KAAI,aAAa,EAChB,QAAO,MACL,oCAAoC,QAAQ,qDAE5B,MAAM,KAAK,KAAK,CAAC,sIAIlC;AAEF;;AAGD,IAAa,qBAAb,cAAwC,MAAM;;CAE7C,AAAS;;CAET,AAAS;CAET,YAAYC,IAAYC,SAA4B;AACnD,QAAM,qCAAqC;AAC3C,OAAK,OAAO;AACZ,OAAK,KAAK;AACV,OAAK,UAAU;CACf;AACD"}

package/dist/index-Ayxg_DQY.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-Ayxg_DQY.d.mts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/index-CR5urhWX.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index-CR5urhWX.d.cts","names":[],"sources":["../src/workspace/publicEnv.ts","../src/workspace/index.ts"],"sourcesContent":[],"mappings":";;;;;;AASA;AAoBA;AAoBA;;;cAxCa;AC2Hb;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;AAAwC,iBDzLxB,kBAAA,CCyLwB,SAAA,CAAA,EDzLO,SCyLP,CAAA,EAAA,MAAA;;;AAGlB;AAsEtB;AAA6B,iBD9Ob,iBAAA,CC8Oa,IAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;;;;;;;;AA3J7B;;;;;;;AAE0B;AA8B1B;;;;AAGsB;AA+CtB;;;;AAGsB;AAsEtB;;;;;AAGe;AA6Bf;AAmBA;AAwBA;AAaA;AAiBA;;;;AAGY;AAmCZ;AAmCA;;;;AAIS;AAgDO,iBAjYA,eAmYqB,CAAA,oBAnYe,UAmYT,CAAA,CAAA,MAAA,EAlYlC,cAkYkC,CAlYnB,KAkYmB,CAAA,CAAA,EAjYxC,uBAiYwC,CAjYhB,KAiYgB,CAAA;;;;iBAnW3B,kBAAA,SACP,+BAEN;;;;;iBA+Ca,wBAAA,SACP,yBAEN;;;;;iBAsEa,aAAA,SACP,YAAY,+BAElB;;;;;;;iBA6Ba,uBAAA,YACJ;;;;;;;;;;;;iBAkBI,iBAAA,YACJ;;;;;;;iBAuBI,iBAAA,YAA6B;;iBAa7B,iBAAA,SAA0B;;;;;iBAiB1B,eAAA,YACJ,uCAET;;;;;iBAmCa,gBAAA,YAA4B;;;;;;;;;;iBAmC5B,oBAAA,YACJ,2DAGT;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAgDa,mBAAA;;cAEqB"}

package/dist/setup-BWgMs4gg.mjs

@@ -1,12 +0,0 @@
-import "./discover-CAlFgYec.mjs";
-import "./config-B0L2tvvC.mjs";
-import "./workspace-DaEX7FEg.mjs";
-import "./credentials-CZrys9C5.mjs";
-import "./generator-VE2JrFlY.mjs";
-import "./keystore-TxeYM7an.mjs";
-import "./storage-B020InPW.mjs";
-import "./fullstack-secrets-METaRLS1.mjs";
-import "./sync-CzHXiR9c.mjs";
-import { createFreshWorkspaceSecrets, ensureStageSecrets, reconcileSecrets, setupCommand } from "./setup-DQo_h_yK.mjs";
-
-export { ensureStageSecrets };

package/dist/setup-DOv92pIu.cjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-DOv92pIu.cjs","names":["logger","execFile","platform: NodeJS.Platform","certificate: string","options: TrustOptions","LOCAL_CA_PATH","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tlogger.log('\\n🔧 Setting up the local environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst stage = options.stage ?? loadedConfig.workspace.stages.local;\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,yBAAUC,4BAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,wBAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,oCAAqB;CACjD,MAAM,cAAc,oBAAK,UAAU,MAAMC,kCAAc;AAEvD,MAAK,wBAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,qBAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,+BAAS,oBAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,oBAAK,MAAM,YAAY;AAEpC,OAAM,4BAAM,uBAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,gCAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAP,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaQ,UAAwB,CAAE,GAAiB;AAC7E,QAAO,IAAI,6CAA6C;CAGxD,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,oCAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,QAAQ,QAAQ,SAAS,aAAa,UAAU,OAAO;CAE7D,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,sCAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,oDAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,uCAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,6BAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iCAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kCAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,6BAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,yBAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kCAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,6CAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,yCACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,0CAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,yCAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,yDAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,qCAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,yDAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,IAAI;AAEpD,KAAI,6BAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,6BAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,qBAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,yBAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}

package/dist/setup-DQo_h_yK.mjs.map

@@ -1 +0,0 @@
-{"version":3,"file":"setup-DQo_h_yK.mjs","names":["logger","platform: NodeJS.Platform","certificate: string","options: TrustOptions","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tlogger.log('\\n🔧 Setting up the local environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst stage = options.stage ?? loadedConfig.workspace.stages.local;\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,UAAU,SAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,WAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,qBAAqB;CACjD,MAAM,cAAc,KAAK,UAAU,MAAM,cAAc;AAEvD,MAAK,WAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,QAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,KAAK,MAAM,YAAY;AAEpC,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,UAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAN,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaO,UAAwB,CAAE,GAAiB;AAC7E,QAAO,IAAI,6CAA6C;CAGxD,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,qBAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,QAAQ,QAAQ,SAAS,aAAa,UAAU,OAAO;CAE7D,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,kBAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,0BAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,mBAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,aAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kBAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,gBAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,YAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kBAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,2BAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,uBACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,wBAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,uBAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,+BAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,mBAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,+BAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,IAAI;AAEpD,KAAI,aAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,gBAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,QAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,YAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}

package/dist/setup-lCx_DcUo.cjs

@@ -1,12 +0,0 @@
-require('./discover-DTmFeloL.cjs');
-require('./config-HhDpJmLO.cjs');
-require('./workspace-C-a3G_U0.cjs');
-require('./credentials-B2Pyh3bJ.cjs');
-require('./generator-CNzBw7g5.cjs');
-require('./keystore-C9rint2E.cjs');
-require('./storage-CSNplaJn.cjs');
-require('./fullstack-secrets-D6MyHhQP.cjs');
-require('./sync-0ILCb-1S.cjs');
-const require_setup = require('./setup-DOv92pIu.cjs');
-
-exports.ensureStageSecrets = require_setup.ensureStageSecrets;

package/dist/types-CL7jPFM2.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-CL7jPFM2.d.mts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECpClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF5Fe,iBAAA,CE4Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF5FN,ME4FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFlHY,MEkHZ,CAAA,MAA0D,EFlH/B,gBEkH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF9HI,ME8HgB,CAAA,MAAA,EF9HD,ME8HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFpcE,MEocF,CAAA,MAAA,EFpciB,qBEuc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFlcxB,MEkcwB,CAAA,MAAA,EFlcT,gBEkcS,CAAA;EAAA;YFhc3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACpClE,UDiBI,cAAA,CCZf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDVrC,SCUqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDzCf,iBAAA,CCyCiB;EAAK;EAK1B,QAAA,ED5CF,aC4CE;AAoBb;;;;AAAqC,KD1DzB,WAAA,GAAc,gBC0DW,GD1DQ,cC0DR,GD1DyB,iBC0DzB;AAKrC;;;;;;;;AFlJiB,cE+CJ,sBF/CoB,EE+CE,CAAA,CAAA,OF/CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCaL,gBAAA,GAAmB,CAAA,CAAE,KDVxB,CAAA,OCUqC,sBDV5B,CAAA;AAQlB;AAQA;;AAA0B,cCDb,uBDCa,ECDU,CAAA,CAAA,ODCV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACpC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;ACuEe;AAwC/B;;AAEW,cD8ME,yBC9MF,ED8M2B,CAAA,CAAA,QC9M3B,CAAA,SAAA,CD8M2B,CAAA,CAAA,SC9M3B,CD8M2B,CAAA,CAAA,SC9M3B,ED8M2B,CAAA,CAAA,QC9M3B,CAAA,SAAA,CD8M2B,CAAA,CAAA,qBC9M3B,CAAA,CD8M2B,CAAA,CAAA,SC9M3B,CAAA;EAAY,QAEZ,ED4M2B,CAAA,CAAA,UC5M3B,CAAA,WAAA,CAAA;EAAsB,GAE1B,eAAA,YAAA,CAAA;CAAS,eAEL,CAAA,aAAA,CAAA;EAAa,QAAA,EDwMc,CAAA,CAAA,UCxMd,CAAA,SAAA,CAAA;EAmBP,MAAA,eAAY,UAAA,CAAA;IA4BZ,WAAY,EAAA,WAInB;IAgBO,WAAY,EAAA,WAAA;IAkCZ,WAAA,EAAa,WAAA;IA4CpB,WAAA,EAAa,WAAA;IAAA,YAAA,EAAA,YAAA;IA6Bb,WAAA,EAAA,WAAA;IAeI,YAAA,EAAA,YAAA;IAMJ,YAAA,EAAA,YAAA;IAMG,gBAAA,EAAA,gBAAA;IAMJ,gBAAA,EAAA,gBAAA;IAMC,gBAAA,EAAA,gBAAA;IAMA,gBAAA,EAAA,gBAAA;IAMK,gBAAA,EAAA,gBAAA;IAeF,gBAAA,EAAA,gBAAA;IAMJ,gBAAA,EAAA,gBAAA;IAMuB,cAAA,EAAA,cAAA;IAMH,cAAA,EAAA,cAAA;IAMR,cAAA,EAAA,cAAA;IAMV,WAAA,EAAA,WAAA;IAwCE,WAAA,EAAA,WAAA;IAkDH,WAAA,EAAA,WAAA;IAAe,YAAA,EAAA,YAAA;IAmCR,YAAA,EAAc,YAAA;IAAA,YAAA,EAAA,YAAA;IAGf,YAAA,EAAA,YAAA;IAFP,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EASL,CAAA,CAAA,CAAA;EAQL,OAAA,eAAQ,YAAG,CAAA;EAOX,YAAA,eAAU,YAAA,CAAA;EAAA,GAAA,eAAA,YAAA,CAAA;CAAA,eAAkB,CAAA,aAAA,CAAA;EAAQ,QAAvB,cAAA,CAAA,YAAA,CAAA;EAAM,GAAA,eAAA,YAAA,CAAA;AAM/B,CAAA,eAAY,CAAA,aAAe,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QACvC,ED3TY,CAAA,CAAA,SC2TZ,CAAA;IAAa,IAAA,EAAA,MAAA;IAAM,UAAA,ED5TlB,QC4TkB;IAAX,aAAA,ED3TJ,QC2TI;EAAI,CAAA,EACQ;IAAK,IAAA,EAAA,MAAA;IAqC1B,UAAA,EDlWE,QCkWY;IAAA,aAAA,EDjWT,QCiWS;EAAA,CAAA,CAAA;EAAyB,GAOrC,eAAA,YAAA,CAAA;CAAM,eAUI,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAK,QAArB,ED1R8B,CAAA,CAAA,UC0R9B,CAAA,WAAA,CAAA;EAAe,GAEb,eAAA,YAAA,CAAA;EAAY,MAEZ,aAAA;CAAY,eAEV,CAAA,aAAA,CAAA;EAAc,QAEjB,cAAA,CAAA,SAAA,CAAA;EAAY,MAEV,eAAA,UAAA,CAAA;IAEF,WAAA,EAAA,WAAA;IAAW,WAAA,EAAA,WAAA;IAMR,WAAA,EAAa,WAAA;IAAA,WAAA,EAAA,WAAA;IAAe,YAAA,EAAA,YAAA;IAAoB,WAAA,EAAA,WAAA;IAAK,YAAA,EAAA,YAAA;IAKrD,YAAA,EAAA,YAAuB;IAAA,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAOpC,gBAAA,EAAA,gBAAA;IAGA,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAAM,gBAAA,EAAA,gBAAA;IAAX,gBAAA,EAAA,gBAAA;IACU,cAAA,EAAA,cAAA;IAAd,cAAA,EAAA,cAAA;IAGR,cAAA,EAAA,cAAA;IACA,WAAA,EAAA,WAAA;IACE,WAAA,EAAA,WAAA;IACH,WAAA,EAAA,WAAA;IACE,YAAA,EAAA,YAAA;IACF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IA+FH,YAAA,EAAe,YAAA;IAAA,cAAA,EAAA,cAAA;IAOlB,WAAA,EAAA,WAAA;EAAM,CAAA,CAAA,CAKG;EAAS,OAAxB,eAAA,YAAA,CAAA;EAAM,YAGJ,eAAA,YAAA,CAAA;EAAY,GAGZ,eAAA,YAAA,CAAA;EAAY,MAGV,aAAA;CAAc,eAGjB,CAAA,aAAA,CAAA;EAAY,QAGV,cAAA,CAAA,YAAA,CAAA;EAAa,GAGf,eAAA,YAAA,CAAA;EAAW,MAAA,aAAA;AASpB,CAAA,eAAiB,CAAA,aAAoB,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;EAAA,MAAa,aAAA;CAAa,eAmBxC,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAItB,EDzjBY,CAAA,CAAA,SCyjBZ,CAAA;IAEH,IAAA,EAAA,MAAA;IAzBmC,UAAA,EDniB/B,QCmiB+B;IAAI,aAAA,EDliBhC,QCkiBgC;EAoChC,CAAA,EAAA;IAAmB,IAAA,EAAA,MAAA;IAWtB,UAAA,EDllBA,QCklBA;IAEQ,aAAA,EDnlBL,QCmlBK;EAAmB,CAAA,CAAA;EAA5B,GAEF,eAAA,YAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,CAAA,CAAA,CAAA;AAEA,KD9fG,SAAA,GAAY,CAAA,CAAE,KC8fjB,CAAA,OD9f8B,yBC8f9B,CAAA;;;AAIW;AAMpB;;;AAIkB,cDpgBL,mBCogBK,EDpgBc,CAAA,CAAA,SCogBd,CAAA;EAAe,IAErB,ED3fV,CAAA,CAAA,UC2fU,CAAA,IAAA,CAAA;EAAmB,OAQnB,eAAA,YAAA,CAAA;EAAiB,MAAA,WAAA,CAAA;IAeb,WAAA,EAAA,WAAiB;IAAA,WAAA,EAAA,WAAA;IACxB,WAAA,EAAA,WAAA;IAAY,WAAA,EAAA,WAAA;IACR,YAAA,EAAA,YAAA;IAAe,WAAA,EAAA,WAAA;;;;IC9jCX,gBAAiB,EAAA,gBAAA;IAKtB,gBAA6B,EAAA,gBAAiB;IAazC,gBAAc,EAAA,gBAAA;IAKd,gBAAA,EAAoB,gBAAQ;IAI5B,gBAAgB,EAAA,gBAAQ;IAIxB,gBAAgB,EAAA,gBAAA;IA4BhB,cAAa,EAAA,cAAA;IAsBlB,cAAa,EAAA,cAAA;IAmBb,cAAY,EAAA,cAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,WAAY,EAAA,WAAA;IAaZ,WAAA,EAAA,WAAkB;IASlB,YAAA,EAAA,YAAqB;IAAA,YAAA,EAAA,YAAA;IAC1B,YAAA,EAAA,YAAA;IAAgC,YAAA,EAAA,YAAA;IAAa,cAAA,EAAA,cAAA;IAGnC,WAAY,EAAA,WAAA;EAAA,CAAA,CAAA;EAAA,QAwBhB,eAAA,YAAA,CAAA;EAAqB,SAAG,eAAA,YAAA,CAAA;AAAkB,CAAA,eAAA,CAAA;AAItC,KFyUL,aAAA,GAAgB,CAAA,CAAE,KEzUA,CAAA,OFyUa,mBEzUb,CAAA;;;;AAAsB,cFygBvC,qBEzgBuC,EFygBlB,CAAA,CAAA,SEzgBkB,CAAA;EAOxC,IAAA,eAAO,CFunBhB,CAAA,CAAA,SEvnBgB,CAAA;EAEF,UAAA,eAAe,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAiBf,KAAA,YAAY,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IASZ,SAAA,aAAa,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAWb,CAAA,eAAW,CAAA,CAAA,CAAA,CAAA;EA6BX,IAAA,eAAA,YAAqB,YAAA,aAAA,CAAA;IAarB,IAAA,cAAe,cAAA,UAAA,CAAA;MAAA,OAAA,EAAA,SAAA;MAGd,GAAA,EAAA,KAAA;MACA,MAAA,EAAA,QAAA;IAGO,CAAA,CAAA,CAAA,CAAA;IACJ,IAAA,aAAA;IAGD,IAAA,aAAA;IAEC,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAAqB,MAAA,eAAA,UAAA,CAAA;MAGzB,OAAS,EAAA,SAAA;MAAA,MAAA,EAAA,QAAA;MAoBjB,UAAA,EAAA,YAAA;IAWG,CAAA,CAAA,CAAA;IAWC,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MACA,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;MAUJ,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;IAQuB,CAAA,eAAA,CAAA,CAAA,CAAA,CAAA;IAUH,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAmBR,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;MAEV,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;IA4BD,CAAA,eAAA,CAAA,CAAA,CAAA,CAAA;IAAY,SAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAa4B,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBFtBzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8LoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA+O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF32BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACpC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC/Db,iBAAA,SAA0B,kBD+DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCpTR,cAAA,CDoTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCpTM;;;;;;SA6BY;;EDsRrB,OACL,CAAA,ECjRyB,cDiRzB;EAAQ;EADH,MACL,CAAA,EC/Q8B,aD+Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC5WQ,OD4WR,CC5WgB,MD4WhB,CC7X2C,kBAAA,ED6X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAgMnC;;;;;;KCvhBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;UAgBO,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCA,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BA;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;WAMA;;;;;gBAMK;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;AD4GqB;AA2HlC;EAAuC,MAAA,CAAA,EAAA;IAErB;IAAf,MAAE,CAAA,EAAA,MAAA;IAAK;IAOM,MAAA,CAAA,EAAA,MAAA;EAA2B,CAAA;EAAA;;;AAGxB;AAYnB;;;;ACt1BA;AAcA;AA2BA;AAoDA;;;;;;;EAwDiE,MAA/C,CAAA,EAofR,eApfQ;EAAM;AAAP;AAuBjB;AAqBA;AAkCA;;;;AAc+B;EAwCd,WAAA,CAAA,EAAA,MAAY,EAAA;;;;;;AAQL;AAmBxB;AA4BA;AAoBA;AAkCA;AAOC;;;;;;;;;;;;AAgJ+B,UA+If,cA/Ie,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAgJvB,aAhJuB,CAAA;EAAe;EAMN,YAMpB,CAAA,EAsIL,SAtIK,EAAA;;;;AAgGI;AAmCzB;AAA+B,UAUd,SAAA,SAAkB,aAVJ,CAAA;EAAA;EAGN,YAFhB,CAAA,EAAA,MAAA,EAAA;AAAa;AAStB;AAQA;AAOA;AAAsB,KAPV,QAAA,GAAW,aAOD,GAAA;EAAA,YAAkB,CAAA,EAAA,SAAA,MAAA,EAAA;CAAQ;AAAjB;AAM/B;;AAA0C,KAN9B,UAAA,GAAa,MAMiB,CAAA,MAAA,EANF,QAME,CAAA;;;;;AAET,KAFrB,eAEqB,CAAA,cAFS,UAET,CAAA,GAAA,QAAK,MADzB,KACyB,GADjB,IACiB,CADZ,KACY,CADN,CACM,CAAA,EAAA,cAAA,CAAA,GAAA;EAqC1B,YAAA,CAAc,EAAA,SAAA,CAAA,MArCO,KAqCP,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;;;;;;;;;AA6BN;AAMpB;;;;AAAiE;AAKjE;;;;;;;;;;;;;;;;AAmBoB;AA+FpB;AAAgC,KA1JpB,cA0JoB,CAAA,cA1JS,UA0JT,CAAA,GAAA;EAAA;;;;;;EAqBN,UAGjB,CAAA,EA3KK,MA2KL;EAAY;EAGG,IAGf,CAAA,EAAA,MAAA;EAAW;AASpB;;;;;;EAyByB,IAzBoB,CAAA,EAhLrC,eAgLqC,CAhLrB,KAgLqB,CAAA;EAAI;EAoChC,MAAA,CAAA,EAlNP,YAkNO;EAAmB;EAAA,MAWtB,CAAA,EA3NJ,YA2NI;EAAM;EAEqB,QAAlC,CAAA,EA3NK,cA2NL;EAAM;EAEY,MAEhB,EA7NA,YA6NA;EAAY;EAEA,OAEZ,CAAA,EA/NE,aA+NF;EAAY;EAEE,KAEd,CAAA,EAjOA,WAiOA;AAAW,CAAA;AAMpB;;;AAIkB,KArON,aAqOM,CAAA,cArOsB,UAqOtB,CAAA,GAAA,MArO0C,KAqO1C,GAAA,MAAA;;;AAUW;AAeb,KAzPJ,uBAyPqB,CAAA,cAzPiB,UAyPjB,CAAA,GAAA;EAAA;;;;AAEL;;eApPd;;EC10BG,IAAA,CAAA,EAAA,QAKC,MDw0BJ,KCx0B2B,GDw0BnB,ICx0BmB,CDw0Bd,KCx0Bc,CDw0BR,CCx0BQ,CAAiB,EAAA,cAAA,CAAA,GAAA;IAazC,YAAc,CAAA,ED4zBb,aC5zBa,CD4zBC,KC5zBD,CAAA,EAAA;EAKd,CAAA,EAIA;EAIA,MAAA,CAAA,EDkzBP,YClzBuB;EA4BhB,MAAA,CAAA,EDuxBP,YCvxBoB;EAsBlB,QAAA,CAAA,EDkwBA,cClwBa;EAmBb,MAAA,EDgvBH,YChvBe;EAmBZ,OAAA,CAAA,ED8tBD,aC9tBe;EAsDd,KAAA,CAAA,EDyqBH,WCzqBe;AAaxB,CAAA;AASA;;;;AAgCoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;;AAqIkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UDqejC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;UAGH;;YAGE;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UC9jCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACpClE,UEQI,aAAA,CFHf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KErEhB,aAAA,GFqEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE9aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF8UD,UE3UrB,YAAA,CF2UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAgMtB,QAAA,CAAA,EE7gBA,qBFkoBV,GEloBkC,kBFkoBlC,EAAA;EAAA,CAAA;;UE9nBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;UAoBR;;;;;;;;;;;aAWG;;;;;;;;;;;cAWC;cACA;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}

package/dist/types-Y3fKQSAK.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types-Y3fKQSAK.d.cts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECpClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF5Fe,iBAAA,CE4Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF5FN,ME4FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFlHY,MEkHZ,CAAA,MAA0D,EFlH/B,gBEkH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF9HI,ME8HgB,CAAA,MAAA,EF9HD,ME8HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFpcE,MEocF,CAAA,MAAA,EFpciB,qBEuc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFlcxB,MEkcwB,CAAA,MAAA,EFlcT,gBEkcS,CAAA;EAAA;YFhc3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACpClE,UDiBI,cAAA,CCZf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDVrC,SCUqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDzCf,iBAAA,CCyCiB;EAAK;EAK1B,QAAA,ED5CF,aC4CE;AAoBb;;;;AAAqC,KD1DzB,WAAA,GAAc,gBC0DW,GD1DQ,cC0DR,GD1DyB,iBC0DzB;AAKrC;;;;;;;;AFlJiB,cE+CJ,sBF/CoB,EE+CE,CAAA,CAAA,OF/CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCaL,gBAAA,GAAmB,CAAA,CAAE,KDVxB,CAAA,OCUqC,sBDV5B,CAAA;AAQlB;AAQA;;AAA0B,cCDb,uBDCa,ECDU,CAAA,CAAA,ODCV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACpC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;ACuEe;AAwC/B;;AAEW,cD8ME,yBC9MF,ED8M2B,CAAA,CAAA,QC9M3B,CAAA,SAAA,CD8M2B,CAAA,CAAA,SC9M3B,CD8M2B,CAAA,CAAA,SC9M3B,ED8M2B,CAAA,CAAA,QC9M3B,CAAA,SAAA,CD8M2B,CAAA,CAAA,qBC9M3B,CAAA,CD8M2B,CAAA,CAAA,SC9M3B,CAAA;EAAY,QAEZ,ED4M2B,CAAA,CAAA,UC5M3B,CAAA,WAAA,CAAA;EAAsB,GAE1B,eAAA,YAAA,CAAA;CAAS,eAEL,CAAA,aAAA,CAAA;EAAa,QAAA,EDwMc,CAAA,CAAA,UCxMd,CAAA,SAAA,CAAA;EAmBP,MAAA,eAAY,UAAA,CAAA;IA4BZ,WAAY,EAAA,WAInB;IAgBO,WAAY,EAAA,WAAA;IAkCZ,WAAA,EAAa,WAAA;IA4CpB,WAAA,EAAa,WAAA;IAAA,YAAA,EAAA,YAAA;IA6Bb,WAAA,EAAA,WAAA;IAeI,YAAA,EAAA,YAAA;IAMJ,YAAA,EAAA,YAAA;IAMG,gBAAA,EAAA,gBAAA;IAMJ,gBAAA,EAAA,gBAAA;IAMC,gBAAA,EAAA,gBAAA;IAMA,gBAAA,EAAA,gBAAA;IAMK,gBAAA,EAAA,gBAAA;IAeF,gBAAA,EAAA,gBAAA;IAMJ,gBAAA,EAAA,gBAAA;IAMuB,cAAA,EAAA,cAAA;IAMH,cAAA,EAAA,cAAA;IAMR,cAAA,EAAA,cAAA;IAMV,WAAA,EAAA,WAAA;IAwCE,WAAA,EAAA,WAAA;IAkDH,WAAA,EAAA,WAAA;IAAe,YAAA,EAAA,YAAA;IAmCR,YAAA,EAAc,YAAA;IAAA,YAAA,EAAA,YAAA;IAGf,YAAA,EAAA,YAAA;IAFP,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EASL,CAAA,CAAA,CAAA;EAQL,OAAA,eAAQ,YAAG,CAAA;EAOX,YAAA,eAAU,YAAA,CAAA;EAAA,GAAA,eAAA,YAAA,CAAA;CAAA,eAAkB,CAAA,aAAA,CAAA;EAAQ,QAAvB,cAAA,CAAA,YAAA,CAAA;EAAM,GAAA,eAAA,YAAA,CAAA;AAM/B,CAAA,eAAY,CAAA,aAAe,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QACvC,ED3TY,CAAA,CAAA,SC2TZ,CAAA;IAAa,IAAA,EAAA,MAAA;IAAM,UAAA,ED5TlB,QC4TkB;IAAX,aAAA,ED3TJ,QC2TI;EAAI,CAAA,EACQ;IAAK,IAAA,EAAA,MAAA;IAqC1B,UAAA,EDlWE,QCkWY;IAAA,aAAA,EDjWT,QCiWS;EAAA,CAAA,CAAA;EAAyB,GAOrC,eAAA,YAAA,CAAA;CAAM,eAUI,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAK,QAArB,ED1R8B,CAAA,CAAA,UC0R9B,CAAA,WAAA,CAAA;EAAe,GAEb,eAAA,YAAA,CAAA;EAAY,MAEZ,aAAA;CAAY,eAEV,CAAA,aAAA,CAAA;EAAc,QAEjB,cAAA,CAAA,SAAA,CAAA;EAAY,MAEV,eAAA,UAAA,CAAA;IAEF,WAAA,EAAA,WAAA;IAAW,WAAA,EAAA,WAAA;IAMR,WAAA,EAAa,WAAA;IAAA,WAAA,EAAA,WAAA;IAAe,YAAA,EAAA,YAAA;IAAoB,WAAA,EAAA,WAAA;IAAK,YAAA,EAAA,YAAA;IAKrD,YAAA,EAAA,YAAuB;IAAA,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAOpC,gBAAA,EAAA,gBAAA;IAGA,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAAM,gBAAA,EAAA,gBAAA;IAAX,gBAAA,EAAA,gBAAA;IACU,cAAA,EAAA,cAAA;IAAd,cAAA,EAAA,cAAA;IAGR,cAAA,EAAA,cAAA;IACA,WAAA,EAAA,WAAA;IACE,WAAA,EAAA,WAAA;IACH,WAAA,EAAA,WAAA;IACE,YAAA,EAAA,YAAA;IACF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IA+FH,YAAA,EAAe,YAAA;IAAA,cAAA,EAAA,cAAA;IAOlB,WAAA,EAAA,WAAA;EAAM,CAAA,CAAA,CAKG;EAAS,OAAxB,eAAA,YAAA,CAAA;EAAM,YAGJ,eAAA,YAAA,CAAA;EAAY,GAGZ,eAAA,YAAA,CAAA;EAAY,MAGV,aAAA;CAAc,eAGjB,CAAA,aAAA,CAAA;EAAY,QAGV,cAAA,CAAA,YAAA,CAAA;EAAa,GAGf,eAAA,YAAA,CAAA;EAAW,MAAA,aAAA;AASpB,CAAA,eAAiB,CAAA,aAAoB,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;EAAA,MAAa,aAAA;CAAa,eAmBxC,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAItB,EDzjBY,CAAA,CAAA,SCyjBZ,CAAA;IAEH,IAAA,EAAA,MAAA;IAzBmC,UAAA,EDniB/B,QCmiB+B;IAAI,aAAA,EDliBhC,QCkiBgC;EAoChC,CAAA,EAAA;IAAmB,IAAA,EAAA,MAAA;IAWtB,UAAA,EDllBA,QCklBA;IAEQ,aAAA,EDnlBL,QCmlBK;EAAmB,CAAA,CAAA;EAA5B,GAEF,eAAA,YAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,CAAA,CAAA,CAAA;AAEA,KD9fG,SAAA,GAAY,CAAA,CAAE,KC8fjB,CAAA,OD9f8B,yBC8f9B,CAAA;;;AAIW;AAMpB;;;AAIkB,cDpgBL,mBCogBK,EDpgBc,CAAA,CAAA,SCogBd,CAAA;EAAe,IAErB,ED3fV,CAAA,CAAA,UC2fU,CAAA,IAAA,CAAA;EAAmB,OAQnB,eAAA,YAAA,CAAA;EAAiB,MAAA,WAAA,CAAA;IAeb,WAAA,EAAA,WAAiB;IAAA,WAAA,EAAA,WAAA;IACxB,WAAA,EAAA,WAAA;IAAY,WAAA,EAAA,WAAA;IACR,YAAA,EAAA,YAAA;IAAe,WAAA,EAAA,WAAA;;;;IC9jCX,gBAAiB,EAAA,gBAAA;IAKtB,gBAA6B,EAAA,gBAAiB;IAazC,gBAAc,EAAA,gBAAA;IAKd,gBAAA,EAAoB,gBAAQ;IAI5B,gBAAgB,EAAA,gBAAQ;IAIxB,gBAAgB,EAAA,gBAAA;IA4BhB,cAAa,EAAA,cAAA;IAsBlB,cAAa,EAAA,cAAA;IAmBb,cAAY,EAAA,cAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,WAAY,EAAA,WAAA;IAaZ,WAAA,EAAA,WAAkB;IASlB,YAAA,EAAA,YAAqB;IAAA,YAAA,EAAA,YAAA;IAC1B,YAAA,EAAA,YAAA;IAAgC,YAAA,EAAA,YAAA;IAAa,cAAA,EAAA,cAAA;IAGnC,WAAY,EAAA,WAAA;EAAA,CAAA,CAAA;EAAA,QAwBhB,eAAA,YAAA,CAAA;EAAqB,SAAG,eAAA,YAAA,CAAA;AAAkB,CAAA,eAAA,CAAA;AAItC,KFyUL,aAAA,GAAgB,CAAA,CAAE,KEzUA,CAAA,OFyUa,mBEzUb,CAAA;;;;AAAsB,cFygBvC,qBEzgBuC,EFygBlB,CAAA,CAAA,SEzgBkB,CAAA;EAOxC,IAAA,eAAO,CFunBhB,CAAA,CAAA,SEvnBgB,CAAA;EAEF,UAAA,eAAe,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAiBf,KAAA,YAAY,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IASZ,SAAA,aAAa,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAWb,CAAA,eAAW,CAAA,CAAA,CAAA,CAAA;EA6BX,IAAA,eAAA,YAAqB,YAAA,aAAA,CAAA;IAarB,IAAA,cAAe,cAAA,UAAA,CAAA;MAAA,OAAA,EAAA,SAAA;MAGd,GAAA,EAAA,KAAA;MACA,MAAA,EAAA,QAAA;IAGO,CAAA,CAAA,CAAA,CAAA;IACJ,IAAA,aAAA;IAGD,IAAA,aAAA;IAEC,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAAqB,MAAA,eAAA,UAAA,CAAA;MAGzB,OAAS,EAAA,SAAA;MAAA,MAAA,EAAA,QAAA;MAoBjB,UAAA,EAAA,YAAA;IAWG,CAAA,CAAA,CAAA;IAWC,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MACA,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;MAUJ,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;IAQuB,CAAA,eAAA,CAAA,CAAA,CAAA,CAAA;IAUH,MAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAmBR,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;MAEV,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;IA4BD,CAAA,eAAA,CAAA,CAAA,CAAA,CAAA;IAAY,SAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAa4B,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBFtBzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cA8LoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA+O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF32BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACpC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC/Db,iBAAA,SAA0B,kBD+DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCpTR,cAAA,CDoTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCpTM;;;;;;SA6BY;;EDsRrB,OACL,CAAA,ECjRyB,cDiRzB;EAAQ;EADH,MACL,CAAA,EC/Q8B,aD+Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC5WQ,OD4WR,CC5WgB,MD4WhB,CC7X2C,kBAAA,ED6X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAgMnC;;;;;;KCvhBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;UAgBO,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCA,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;WA6BA;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;WAMA;;;;;gBAMK;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;AD4GqB;AA2HlC;EAAuC,MAAA,CAAA,EAAA;IAErB;IAAf,MAAE,CAAA,EAAA,MAAA;IAAK;IAOM,MAAA,CAAA,EAAA,MAAA;EAA2B,CAAA;EAAA;;;AAGxB;AAYnB;;;;ACt1BA;AAcA;AA2BA;AAoDA;;;;;;;EAwDiE,MAA/C,CAAA,EAofR,eApfQ;EAAM;AAAP;AAuBjB;AAqBA;AAkCA;;;;AAc+B;EAwCd,WAAA,CAAA,EAAA,MAAY,EAAA;;;;;;AAQL;AAmBxB;AA4BA;AAoBA;AAkCA;AAOC;;;;;;;;;;;;AAgJ+B,UA+If,cA/Ie,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAgJvB,aAhJuB,CAAA;EAAe;EAMN,YAMpB,CAAA,EAsIL,SAtIK,EAAA;;;;AAgGI;AAmCzB;AAA+B,UAUd,SAAA,SAAkB,aAVJ,CAAA;EAAA;EAGN,YAFhB,CAAA,EAAA,MAAA,EAAA;AAAa;AAStB;AAQA;AAOA;AAAsB,KAPV,QAAA,GAAW,aAOD,GAAA;EAAA,YAAkB,CAAA,EAAA,SAAA,MAAA,EAAA;CAAQ;AAAjB;AAM/B;;AAA0C,KAN9B,UAAA,GAAa,MAMiB,CAAA,MAAA,EANF,QAME,CAAA;;;;;AAET,KAFrB,eAEqB,CAAA,cAFS,UAET,CAAA,GAAA,QAAK,MADzB,KACyB,GADjB,IACiB,CADZ,KACY,CADN,CACM,CAAA,EAAA,cAAA,CAAA,GAAA;EAqC1B,YAAA,CAAc,EAAA,SAAA,CAAA,MArCO,KAqCP,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;;;;;;;;;AA6BN;AAMpB;;;;AAAiE;AAKjE;;;;;;;;;;;;;;;;AAmBoB;AA+FpB;AAAgC,KA1JpB,cA0JoB,CAAA,cA1JS,UA0JT,CAAA,GAAA;EAAA;;;;;;EAqBN,UAGjB,CAAA,EA3KK,MA2KL;EAAY;EAGG,IAGf,CAAA,EAAA,MAAA;EAAW;AASpB;;;;;;EAyByB,IAzBoB,CAAA,EAhLrC,eAgLqC,CAhLrB,KAgLqB,CAAA;EAAI;EAoChC,MAAA,CAAA,EAlNP,YAkNO;EAAmB;EAAA,MAWtB,CAAA,EA3NJ,YA2NI;EAAM;EAEqB,QAAlC,CAAA,EA3NK,cA2NL;EAAM;EAEY,MAEhB,EA7NA,YA6NA;EAAY;EAEA,OAEZ,CAAA,EA/NE,aA+NF;EAAY;EAEE,KAEd,CAAA,EAjOA,WAiOA;AAAW,CAAA;AAMpB;;;AAIkB,KArON,aAqOM,CAAA,cArOsB,UAqOtB,CAAA,GAAA,MArO0C,KAqO1C,GAAA,MAAA;;;AAUW;AAeb,KAzPJ,uBAyPqB,CAAA,cAzPiB,UAyPjB,CAAA,GAAA;EAAA;;;;AAEL;;eApPd;;EC10BG,IAAA,CAAA,EAAA,QAKC,MDw0BJ,KCx0B2B,GDw0BnB,ICx0BmB,CDw0Bd,KCx0Bc,CDw0BR,CCx0BQ,CAAiB,EAAA,cAAA,CAAA,GAAA;IAazC,YAAc,CAAA,ED4zBb,aC5zBa,CD4zBC,KC5zBD,CAAA,EAAA;EAKd,CAAA,EAIA;EAIA,MAAA,CAAA,EDkzBP,YClzBuB;EA4BhB,MAAA,CAAA,EDuxBP,YCvxBoB;EAsBlB,QAAA,CAAA,EDkwBA,cClwBa;EAmBb,MAAA,EDgvBH,YChvBe;EAmBZ,OAAA,CAAA,ED8tBD,aC9tBe;EAsDd,KAAA,CAAA,EDyqBH,WCzqBe;AAaxB,CAAA;AASA;;;;AAgCoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;;AAqIkD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UDqejC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;UAGH;;YAGE;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UC9jCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACpClE,UEQI,aAAA,CFHf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KErEhB,aAAA,GFqEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE9aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF8UD,UE3UrB,YAAA,CF2UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAgMtB,QAAA,CAAA,EE7gBA,qBFkoBV,GEloBkC,kBFkoBlC,EAAA;EAAA,CAAA;;UE9nBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;UAoBR;;;;;;;;;;;aAWG;;;;;;;;;;;cAWC;cACA;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}