@geekmidas/cli 10.0.0-alpha.5 → 10.0.0-alpha.6

package/dist/{setup-DXvRLTZN.mjs → setup-BWMhbW-p.mjs}

@@ -1,5 +1,5 @@
-import { loadWorkspaceConfig } from "./config-WRdsQYZK.mjs";
-import { LOCAL_CA_PATH, derivedContainers, reconcileWorkspace } from "./credentials-BBIRJVp4.mjs";
+import { loadWorkspaceConfig } from "./config-CxP7P-qG.mjs";
+import { LOCAL_CA_PATH, derivedContainers, reconcileWorkspace } from "./credentials-BK3Z93MX.mjs";
 import { createStageSecrets, generateConnectionUrls, generateSecurePassword, generateServiceCredentials } from "./generator-VE2JrFlY.mjs";
 import { readStageSecrets, secretsExist, writeStageSecrets } from "./storage-Bi24WfoW.mjs";
 import { generateFullstackCustomSecrets, writeDockerEnvFromSecrets } from "./fullstack-secrets-D1o9-G5l.mjs";
@@ -440,4 +440,4 @@ function printSummary(workspace, stage) {
 
 //#endregion
 export { createFreshWorkspaceSecrets, ensureStageSecrets, reconcileSecrets, setupCommand, trustCommand };
-//# sourceMappingURL=setup-DXvRLTZN.mjs.map
+//# sourceMappingURL=setup-BWMhbW-p.mjs.map

package/dist/{setup-DXvRLTZN.mjs.map → setup-BWMhbW-p.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-DXvRLTZN.mjs","names":["logger","platform: NodeJS.Platform","certificate: string","options: TrustOptions","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tconst stage = options.stage ?? 'development';\n\n\tlogger.log('\\n🔧 Setting up development environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,UAAU,SAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,WAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,qBAAqB;CACjD,MAAM,cAAc,KAAK,UAAU,MAAM,cAAc;AAEvD,MAAK,WAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,QAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,KAAK,MAAM,YAAY;AAEpC,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,UAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAN,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaO,UAAwB,CAAE,GAAiB;CAC7E,MAAM,QAAQ,QAAQ,SAAS;AAE/B,QAAO,IAAI,+CAA+C;CAG1D,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,qBAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,kBAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,0BAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,mBAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,aAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kBAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,gBAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,YAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kBAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,2BAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,uBACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,wBAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,uBAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,+BAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,mBAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,+BAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,IAAI;AAEpD,KAAI,aAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,gBAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,QAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,YAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}
+{"version":3,"file":"setup-BWMhbW-p.mjs","names":["logger","platform: NodeJS.Platform","certificate: string","options: TrustOptions","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tconst stage = options.stage ?? 'development';\n\n\tlogger.log('\\n🔧 Setting up development environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,UAAU,SAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,WAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,qBAAqB;CACjD,MAAM,cAAc,KAAK,UAAU,MAAM,cAAc;AAEvD,MAAK,WAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,QAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,SAAS,KAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,KAAK,MAAM,YAAY;AAEpC,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,UAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAN,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaO,UAAwB,CAAE,GAAiB;CAC7E,MAAM,QAAQ,QAAQ,SAAS;AAE/B,QAAO,IAAI,+CAA+C;CAG1D,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,qBAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,kBAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,0BAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,mBAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,aAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iBAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kBAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,gBAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,YAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kBAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,2BAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,uBACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,wBAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,uBAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,+BAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,mBAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,+BAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,oBAAoB,IAAI;AAEpD,KAAI,aAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,kBAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kBAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,gBAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,QAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,YAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}

package/dist/{setup-Cm2UnAdh.cjs → setup-D7L4BgBT.cjs}

@@ -1,6 +1,6 @@
 const require_chunk = require('./chunk-CUT6urMc.cjs');
-const require_config = require('./config-C21ocYNd.cjs');
-const require_credentials = require('./credentials-G1JwBoXH.cjs');
+const require_config = require('./config-CNz5KaSR.cjs');
+const require_credentials = require('./credentials-DzsXZzkx.cjs');
 const require_generator = require('./generator-CNzBw7g5.cjs');
 const require_storage = require('./storage-BJmzYxt8.cjs');
 const require_fullstack_secrets = require('./fullstack-secrets-C-GGohke.cjs');
@@ -470,4 +470,4 @@ Object.defineProperty(exports, 'trustCommand', {
     return trustCommand;
   }
 });
-//# sourceMappingURL=setup-Cm2UnAdh.cjs.map
+//# sourceMappingURL=setup-D7L4BgBT.cjs.map

package/dist/{setup-Cm2UnAdh.cjs.map → setup-D7L4BgBT.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"setup-Cm2UnAdh.cjs","names":["logger","execFile","platform: NodeJS.Platform","certificate: string","options: TrustOptions","LOCAL_CA_PATH","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tconst stage = options.stage ?? 'development';\n\n\tlogger.log('\\n🔧 Setting up development environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,yBAAUC,4BAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,wBAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,oCAAqB;CACjD,MAAM,cAAc,oBAAK,UAAU,MAAMC,kCAAc;AAEvD,MAAK,wBAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,qBAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,+BAAS,oBAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,oBAAK,MAAM,YAAY;AAEpC,OAAM,4BAAM,uBAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,gCAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAP,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaQ,UAAwB,CAAE,GAAiB;CAC7E,MAAM,QAAQ,QAAQ,SAAS;AAE/B,QAAO,IAAI,+CAA+C;CAG1D,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,oCAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,sCAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,oDAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,uCAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,6BAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iCAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kCAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,6BAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,yBAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kCAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,6CAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,yCACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,0CAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,yCAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,yDAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,qCAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,yDAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,IAAI;AAEpD,KAAI,6BAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,6BAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,qBAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,yBAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}
+{"version":3,"file":"setup-D7L4BgBT.cjs","names":["logger","execFile","platform: NodeJS.Platform","certificate: string","options: TrustOptions","LOCAL_CA_PATH","root: string","url: string","options: { configured?: boolean; assumeYes?: boolean }","path: string","platform: string","options: SetupOptions","loadedConfig: LoadedConfig","workspace: NormalizedWorkspace","stage: string","containers: readonly string[]","byContainer: Readonly<Record<string, ComposeServiceName>>","secrets: StageSecrets","missing: Record<string, string>","cwd: string"],"sources":["../src/trust/index.ts","../src/setup/index.ts"],"sourcesContent":["/**\n * Installing the local edge's certificate authority into the OS trust store.\n *\n * `NODE_EXTRA_CA_CERTS` covers everything gkm starts — the dev server, the test\n * suite, anything under `gkm exec` — because reconcile injects it. A browser\n * reads none of that: it asks the operating system, so until the root is in the\n * system store a local `https://` address is \"not secure\", which is true and\n * unhelpful.\n *\n * A separate command rather than part of `gkm setup`, for one reason: this\n * needs `sudo`, and a setup that silently escalates on every run is a worse\n * trade than one that tells you what to type. Caddy's own `caddy trust` draws\n * the line in the same place.\n */\n\nimport { execFile } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { promisify } from 'node:util';\nimport prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport { LOCAL_CA_PATH } from '../reconcile/index.js';\n\nconst logger = console;\n\nconst run = promisify(execFile);\n\nexport interface TrustOptions {\n\t/** Print the commands rather than running them. */\n\tdryRun?: boolean;\n}\n\n/**\n * How each platform is told about a new authority.\n *\n * Separate rather than shelled through one script because the failure modes\n * differ and the message should name the real one: macOS refuses without an\n * admin password, Debian needs the file in a specific directory before its\n * updater will look at it.\n */\nfunction installation(\n\tplatform: NodeJS.Platform,\n\tcertificate: string,\n): { describe: string; steps: [string, string[]][] } {\n\tif (platform === 'darwin') {\n\t\treturn {\n\t\t\tdescribe: 'the System keychain',\n\t\t\tsteps: [\n\t\t\t\t[\n\t\t\t\t\t'sudo',\n\t\t\t\t\t[\n\t\t\t\t\t\t'security',\n\t\t\t\t\t\t'add-trusted-cert',\n\t\t\t\t\t\t'-d',\n\t\t\t\t\t\t'-r',\n\t\t\t\t\t\t'trustRoot',\n\t\t\t\t\t\t'-k',\n\t\t\t\t\t\t'/Library/Keychains/System.keychain',\n\t\t\t\t\t\tcertificate,\n\t\t\t\t\t],\n\t\t\t\t],\n\t\t\t],\n\t\t};\n\t}\n\n\tif (platform === 'linux') {\n\t\t// Debian and Fedora keep anchors in different places and run different\n\t\t// updaters. Whichever directory exists is the one this system uses.\n\t\tconst debian = existsSync('/usr/local/share/ca-certificates');\n\n\t\treturn {\n\t\t\tdescribe: debian ? 'the system CA bundle' : 'the system trust anchors',\n\t\t\tsteps: debian\n\t\t\t\t? [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/usr/local/share/ca-certificates/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-certificates']],\n\t\t\t\t\t]\n\t\t\t\t: [\n\t\t\t\t\t\t[\n\t\t\t\t\t\t\t'sudo',\n\t\t\t\t\t\t\t[\n\t\t\t\t\t\t\t\t'cp',\n\t\t\t\t\t\t\t\tcertificate,\n\t\t\t\t\t\t\t\t'/etc/pki/ca-trust/source/anchors/gkm-local-ca.crt',\n\t\t\t\t\t\t\t],\n\t\t\t\t\t\t],\n\t\t\t\t\t\t['sudo', ['update-ca-trust']],\n\t\t\t\t\t],\n\t\t};\n\t}\n\n\tthrow new UnsupportedPlatform(platform, certificate);\n}\n\n/**\n * Trust the certificate authority this project's edge issues from.\n *\n * Idempotent in effect: installing a root that is already trusted replaces the\n * same entry, so running it twice is not an error.\n */\nexport async function trustCommand(options: TrustOptions = {}): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) {\n\t\tthrow new NoLocalAuthority(certificate);\n\t}\n\n\tconst { describe, steps } = installation(process.platform, certificate);\n\n\tlogger.log(`\\n🔐 Trusting the local authority in ${describe}`);\n\tlogger.log(`   ${certificate}\\n`);\n\n\tif (options.dryRun) {\n\t\tfor (const [command, args] of steps) {\n\t\t\tlogger.log(`   ${command} ${args.join(' ')}`);\n\t\t}\n\t\treturn;\n\t}\n\n\tlogger.log('   This needs an admin password.\\n');\n\n\tfor (const [command, args] of steps) {\n\t\t// Inherited stdio, because sudo prompts on the terminal and a captured\n\t\t// prompt is a command that appears to hang.\n\t\tawait run(command, args, { stdio: 'inherit' } as never);\n\t}\n\n\tlogger.log('\\n✅ Local https addresses are trusted. Restart your browser.\\n');\n}\n\n/**\n * Trust the authority if this project wants that and this machine lacks it.\n *\n * The decision, in order: what the project configured, then what a person\n * previously answered, then a prompt. Never a silent `sudo` — that is the one\n * thing a setup command should not do on somebody's behalf.\n *\n * Silent and free when the machine already trusts it, which is what makes it\n * acceptable to call on every `gkm setup`.\n */\nexport async function ensureTrusted(\n\troot: string,\n\turl: string,\n\toptions: { configured?: boolean; assumeYes?: boolean } = {},\n): Promise<void> {\n\tif (options.configured === false) return;\n\tif (await isTrusted(url)) return;\n\n\tif (options.configured !== true && !options.assumeYes) {\n\t\t// Nothing to answer a prompt in CI, a hook, or a piped shell — and a\n\t\t// setup that stops there waiting is worse than one that leaves the\n\t\t// authority untrusted. Not recorded as declined, because nobody\n\t\t// declined: the next interactive run should still ask.\n\t\tif (!process.stdin.isTTY) {\n\t\t\tlogger.log(\n\t\t\t\t'   Local https addresses are not trusted here. Run \"gkm trust\", ' +\n\t\t\t\t\t'or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\t// A recorded \"no\" is why this asks once rather than every start. There is\n\t\t// no recorded \"yes\": trusting is checked directly above, so a yes that\n\t\t// worked answers itself and a yes that did not should ask again.\n\t\tif (await declined(root)) return;\n\n\t\tconst { install } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'install',\n\t\t\tmessage:\n\t\t\t\t\"Trust this project's local certificate authority, so a browser \" +\n\t\t\t\t'accepts its https addresses? (needs sudo)',\n\t\t\tinitial: false,\n\t\t});\n\n\t\tif (!install) {\n\t\t\tawait recordDeclined(root);\n\t\t\tlogger.log(\n\t\t\t\t'   Skipped. Run \"gkm trust\" later, or set services.trustLocalCa.',\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tawait trustCommand();\n}\n\n/** Where a declined answer is remembered, so setup asks once and not again. */\nconst TRUST_STATE = '.gkm/trust.json';\n\nasync function declined(root: string): Promise<boolean> {\n\ttry {\n\t\tconst raw = await readFile(join(root, TRUST_STATE), 'utf-8');\n\n\t\treturn (JSON.parse(raw) as { declined?: boolean }).declined === true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\nasync function recordDeclined(root: string): Promise<void> {\n\tconst path = join(root, TRUST_STATE);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, `${JSON.stringify({ declined: true }, null, 2)}\\n`);\n}\n\n/**\n * Whether this machine already trusts the local authority.\n *\n * Asked by connecting rather than by reading a keychain: what matters is\n * whether a client with no special configuration verifies the edge, and that is\n * one platform-neutral question instead of three platform-specific ones. It is\n * also the exact thing a browser is about to do.\n *\n * A child process, because `NODE_EXTRA_CA_CERTS` is read once at startup and\n * this process almost certainly has it set — asking in-process would answer\n * \"yes\" for everyone.\n */\nexport async function isTrusted(url: string): Promise<boolean> {\n\tconst { NODE_EXTRA_CA_CERTS: _ignored, ...env } = process.env;\n\n\ttry {\n\t\tawait run(\n\t\t\tprocess.execPath,\n\t\t\t['-e', `fetch(${JSON.stringify(url)}).then(()=>0,()=>process.exit(1))`],\n\t\t\t{ env, timeout: 15_000 },\n\t\t);\n\n\t\treturn true;\n\t} catch {\n\t\treturn false;\n\t}\n}\n\n/**\n * Copy the root somewhere a tool that wants a file can read it.\n *\n * For anything that takes a CA bundle rather than reading the system store —\n * another language's HTTP client, a container, a CI job.\n */\nexport async function exportLocalAuthority(to: string): Promise<void> {\n\tconst { workspace } = await loadWorkspaceConfig();\n\tconst certificate = join(workspace.root, LOCAL_CA_PATH);\n\n\tif (!existsSync(certificate)) throw new NoLocalAuthority(certificate);\n\n\tawait copyFile(certificate, to);\n}\n\n/** The edge has not run, so there is no authority to trust yet. */\nexport class NoLocalAuthority extends Error {\n\tconstructor(readonly path: string) {\n\t\tsuper(\n\t\t\t`No local certificate authority at ${path}. It is generated the first ` +\n\t\t\t\t`time the edge starts, so run \"gkm setup\" (or \"gkm dev\") once — and ` +\n\t\t\t\t`if this project declares no file server, nothing needs one.`,\n\t\t);\n\t\tthis.name = 'NoLocalAuthority';\n\t}\n}\n\n/** A platform with no trust store this knows how to write to. */\nexport class UnsupportedPlatform extends Error {\n\tconstructor(\n\t\treadonly platform: string,\n\t\treadonly certificate: string,\n\t) {\n\t\tsuper(\n\t\t\t`gkm does not know how to install a certificate authority on ` +\n\t\t\t\t`${platform}. The root is at ${certificate} — add it to the trust ` +\n\t\t\t\t`store by hand, or point a client at it with NODE_EXTRA_CA_CERTS.`,\n\t\t);\n\t\tthis.name = 'UnsupportedPlatform';\n\t}\n}\n","import prompts from 'prompts';\nimport { loadWorkspaceConfig } from '../config.js';\nimport {\n\tderivedContainers,\n\treconcileWorkspace,\n} from '../reconcile/workspace.js';\nimport {\n\tcreateStageSecrets,\n\tgenerateConnectionUrls,\n\tgenerateSecurePassword,\n\tgenerateServiceCredentials,\n} from '../secrets/generator.js';\nimport {\n\treadStageSecrets,\n\tsecretsExist,\n\twriteStageSecrets,\n} from '../secrets/storage.js';\nimport { isSSMConfigured, pullSecrets, pushSecrets } from '../secrets/sync.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport { ensureTrusted } from '../trust/index.js';\nimport type { ComposeServiceName } from '../types.js';\nimport type { LoadedConfig, NormalizedWorkspace } from '../workspace/types.js';\nimport {\n\tgenerateFullstackCustomSecrets,\n\twriteDockerEnvFromSecrets,\n} from './fullstack-secrets.js';\n\nconst logger = console;\n\nexport interface SetupOptions {\n\tstage?: string;\n\tforce?: boolean;\n\tskipDocker?: boolean;\n\tyes?: boolean;\n}\n\n/**\n * Setup development environment.\n *\n * Orchestrates:\n * 1. Load workspace config\n * 2. Resolve secrets (local → SSM → generate fresh)\n * 3. Write docker/.env from secrets\n * 4. Start Docker services\n */\nexport async function setupCommand(options: SetupOptions = {}): Promise<void> {\n\tconst stage = options.stage ?? 'development';\n\n\tlogger.log('\\n🔧 Setting up development environment...\\n');\n\n\t// 1. Load workspace config\n\tlet loadedConfig: LoadedConfig;\n\ttry {\n\t\tloadedConfig = await loadWorkspaceConfig();\n\t} catch {\n\t\tlogger.error(\n\t\t\t'❌ No gkm.config.ts found. Run this command from a workspace root.',\n\t\t);\n\t\tprocess.exit(1);\n\t}\n\n\tconst { workspace } = loadedConfig;\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\n\tlogger.log(`📦 Workspace: ${workspace.name}`);\n\tlogger.log(`📱 Apps: ${Object.keys(workspace.apps).join(', ')}`);\n\tlogger.log(`🔑 Stage: ${stage}\\n`);\n\n\t// 2. Resolve secrets\n\tconst secrets = await resolveSecrets(stage, workspace, options);\n\n\tif (!secrets) {\n\t\tlogger.error('❌ Failed to resolve secrets. Exiting.');\n\t\tprocess.exit(1);\n\t}\n\n\t// 3. Write docker/.env from secrets (always regenerated as derived file)\n\tconst containers = await derivedContainers(workspace, stage);\n\n\tif (isMultiApp && containers.includes('postgres')) {\n\t\tawait writeDockerEnvFromSecrets(secrets, workspace.root);\n\t\tlogger.log('📄 Generated docker/.env with database passwords');\n\t}\n\n\t// 4. Reconcile the local target: derive containers, allocate ports, start.\n\tif (!options.skipDocker) {\n\t\tlogger.log('');\n\n\t\tawait reconcileLocal(workspace, stage, options);\n\t}\n\n\t// Print summary\n\tprintSummary(workspace, stage);\n}\n\n/**\n * Converge this machine on what the manifest declares.\n *\n * Says what it did in one line and stays silent when it did nothing, because\n * reconciling on every start is only tolerable if the converged case is both\n * free and quiet.\n */\nasync function reconcileLocal(\n\tworkspace: NormalizedWorkspace,\n\tstage: string,\n\toptions: SetupOptions,\n): Promise<void> {\n\tconst result = await reconcileWorkspace(workspace, { stage });\n\n\tif (result.plan.containers.length === 0) {\n\t\tlogger.log('🐳 No containers declared');\n\t\treturn;\n\t}\n\n\tif (!result.changed) {\n\t\tlogger.log('🐳 Services already up to date');\n\t\treturn;\n\t}\n\n\tlogger.log(`🐳 Services: ${result.plan.containers.join(', ')}`);\n\tfor (const [container, address] of Object.entries(result.addresses)) {\n\t\tlogger.log(`   ${container}: ${address}`);\n\t}\n\n\t// Only where something actually answers on https. A project with no edge has\n\t// no authority to trust and should never be asked about one.\n\tconst served = result.plan.resources.find((r) => r.kind === 'file-server');\n\tconst url = served ? result.env[served.envKey] : undefined;\n\n\tif (url) {\n\t\tawait ensureTrusted(workspace.root, url, {\n\t\t\t...(workspace.services.trustLocalCa === undefined\n\t\t\t\t? {}\n\t\t\t\t: { configured: workspace.services.trustLocalCa }),\n\t\t\t...(options.yes ? { assumeYes: true } : {}),\n\t\t});\n\t}\n}\n\n/**\n * Resolve secrets with priority:\n * 1. Local secrets exist → use them (preserves manual additions)\n * 2. SSM configured and has secrets → pull and use\n * 3. Neither → generate fresh secrets\n *\n * --force skips checks 1 and 2 and always regenerates.\n */\nasync function resolveSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\t// Force regeneration\n\tif (options.force) {\n\t\tlogger.log('🔐 Generating fresh secrets (--force)...');\n\t\treturn generateFreshSecrets(stage, workspace, options);\n\t}\n\n\t// Check local secrets first\n\tif (secretsExist(stage, workspace.root)) {\n\t\tlogger.log('🔐 Using existing local secrets');\n\t\tconst secrets = await readStageSecrets(stage, workspace.root);\n\t\tif (secrets) {\n\t\t\t// Reconcile: add any missing workspace-derived keys without overwriting\n\t\t\tconst reconciled = reconcileSecrets(\n\t\t\t\tsecrets,\n\t\t\t\tworkspace,\n\t\t\t\tawait derivedContainers(workspace, stage),\n\t\t\t);\n\t\t\tif (reconciled) {\n\t\t\t\tawait writeStageSecrets(reconciled, workspace.root);\n\t\t\t}\n\t\t\treturn reconciled ?? secrets;\n\t\t}\n\t}\n\n\t// Try SSM pull if configured\n\tif (isSSMConfigured(workspace)) {\n\t\tlogger.log('☁️  Checking for remote secrets in SSM...');\n\t\ttry {\n\t\t\tconst remoteSecrets = await pullSecrets(stage, workspace);\n\t\t\tif (remoteSecrets) {\n\t\t\t\tlogger.log('✅ Pulled secrets from SSM');\n\t\t\t\tawait writeStageSecrets(remoteSecrets, workspace.root);\n\t\t\t\treturn remoteSecrets;\n\t\t\t}\n\t\t\tlogger.log('   No remote secrets found');\n\t\t} catch (error) {\n\t\t\tlogger.warn(`⚠️  Failed to pull from SSM: ${(error as Error).message}`);\n\t\t}\n\t}\n\n\t// Generate fresh secrets\n\tlogger.log('🔐 Generating fresh development secrets...');\n\treturn generateFreshSecrets(stage, workspace, options);\n}\n\n/**\n * Reconcile existing secrets with expected workspace-derived keys.\n * Adds missing keys (e.g. BETTER_AUTH_*) without overwriting existing values.\n * Returns the updated secrets if changes were made, or null if no changes needed.\n * @internal Exported for testing\n */\n/**\n * Which containers hold a credential worth generating.\n *\n * Reconcile's container names, mapped to the service a credential is stored\n * under. `redis-http` is the Upstash-protocol proxy in front of Redis and holds\n * no credential of its own — its token is derived — so it maps to nothing, and\n * `caddy` is an edge with nothing to log into.\n */\nfunction credentialedServices(\n\tcontainers: readonly string[],\n): ComposeServiceName[] {\n\tconst byContainer: Readonly<Record<string, ComposeServiceName>> = {\n\t\tpostgres: 'postgres',\n\t\tredis: 'redis',\n\t\tminio: 'minio',\n\t\tmailpit: 'mailpit',\n\t\tlocalstack: 'localstack',\n\t\trabbitmq: 'rabbitmq',\n\t};\n\n\treturn [\n\t\t...new Set(\n\t\t\tcontainers\n\t\t\t\t.map((container) => byContainer[container])\n\t\t\t\t.filter((name): name is ComposeServiceName => Boolean(name)),\n\t\t),\n\t];\n}\n\nexport function reconcileSecrets(\n\tsecrets: StageSecrets,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets | null {\n\tlet changed = false;\n\tlet result = { ...secrets };\n\n\t// Reconcile service credentials: add missing services\n\tfor (const name of credentialedServices(containers)) {\n\t\tif (!result.services[name]) {\n\t\t\tconst creds = generateServiceCredentials(name);\n\t\t\t// Override defaults with project-derived names\n\t\t\tif (name === 'minio') {\n\t\t\t\tcreds.bucket = workspace.name;\n\t\t\t\tcreds.username = workspace.name;\n\t\t\t}\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tservices: { ...result.services, [name]: creds },\n\t\t\t};\n\t\t\tresult.urls = generateConnectionUrls(\n\t\t\t\tresult.services,\n\t\t\t\tresult.eventsBackend,\n\t\t\t);\n\t\t\tlogger.log(`   🔄 Adding missing service credentials: ${name}`);\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\t// Always add pgboss credentials when postgres is available\n\tif (result.services.postgres && !result.services.pgboss) {\n\t\tresult = {\n\t\t\t...result,\n\t\t\tservices: {\n\t\t\t\t...result.services,\n\t\t\t\tpgboss: {\n\t\t\t\t\thost: result.services.postgres.host,\n\t\t\t\t\tport: result.services.postgres.port,\n\t\t\t\t\tusername: 'pgboss',\n\t\t\t\t\tpassword: generateSecurePassword(),\n\t\t\t\t\tdatabase: result.services.postgres.database ?? 'app',\n\t\t\t\t},\n\t\t\t},\n\t\t};\n\t\tresult.urls = generateConnectionUrls(result.services, result.eventsBackend);\n\t\tlogger.log('   🔄 Adding missing service credentials: pgboss');\n\t\tchanged = true;\n\t}\n\n\t// Reconcile custom secrets for multi-app workspaces\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tconst expected = generateFullstackCustomSecrets(workspace, containers);\n\t\tconst missing: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(expected)) {\n\t\t\tif (!(key in result.custom)) {\n\t\t\t\tmissing[key] = value;\n\t\t\t}\n\t\t}\n\n\t\tif (Object.keys(missing).length > 0) {\n\t\t\tlogger.log(\n\t\t\t\t`   🔄 Adding missing secrets: ${Object.keys(missing).join(', ')}`,\n\t\t\t);\n\t\t\tresult = {\n\t\t\t\t...result,\n\t\t\t\tcustom: { ...result.custom, ...missing },\n\t\t\t};\n\t\t\tchanged = true;\n\t\t}\n\t}\n\n\tif (!changed) {\n\t\treturn null;\n\t}\n\n\treturn {\n\t\t...result,\n\t\tupdatedAt: new Date().toISOString(),\n\t};\n}\n\n/**\n * Build a fresh StageSecrets object for a workspace: service credentials,\n * connection URLs, and custom secrets. Pure — does not write to disk or touch\n * SSM. Service passwords are freshly randomized, so the result must be the same\n * one used to start the matching Docker containers.\n * @internal Exported for reuse by `gkm test` auto-setup.\n */\nexport function createFreshWorkspaceSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): StageSecrets {\n\t// Which services need a credential is which containers exist, and that is\n\t// the manifest's answer. It used to be a boolean per service read from\n\t// config, which generated a Postgres password for a project with no\n\t// database and none for a project that declared one and set no flag.\n\tconst serviceNames = credentialedServices(containers);\n\n\t// Create base secrets with service credentials\n\tconst secrets = createStageSecrets(stage, serviceNames, {\n\t\tprojectName: workspace.name,\n\t\teventsBackend: workspace.services.events,\n\t});\n\n\t// Generate fullstack-aware custom secrets\n\tconst isMultiApp = Object.keys(workspace.apps).length > 1;\n\tif (isMultiApp) {\n\t\tsecrets.custom = generateFullstackCustomSecrets(workspace, containers);\n\t} else {\n\t\tsecrets.custom = {\n\t\t\tNODE_ENV: 'development',\n\t\t\tPORT: '3000',\n\t\t\tLOG_LEVEL: 'debug',\n\t\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t\t};\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Ensure a usable secret set exists for a stage, generating a fresh one from the\n * workspace config when none is present. No-op if secrets already exist.\n *\n * Powers `gkm test --auto-setup` / `GKM_AUTO_SETUP`: CI can run without a\n * committed secrets file or a shared encryption key — the stage is regenerated\n * from the committed `gkm.config.ts`, and `writeStageSecrets` mints a local key.\n *\n * @returns true if fresh secrets were generated, false if existing ones were kept\n */\nexport async function ensureStageSecrets(\n\tstage: string,\n\tcwd: string = process.cwd(),\n): Promise<boolean> {\n\tconst { workspace } = await loadWorkspaceConfig(cwd);\n\n\tif (secretsExist(stage, workspace.root)) {\n\t\treturn false;\n\t}\n\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\tawait writeStageSecrets(secrets, workspace.root);\n\treturn true;\n}\n\n/**\n * Generate fresh secrets for the workspace.\n */\nasync function generateFreshSecrets(\n\tstage: string,\n\tworkspace: NormalizedWorkspace,\n\toptions: SetupOptions,\n) {\n\tconst secrets = createFreshWorkspaceSecrets(\n\t\tstage,\n\t\tworkspace,\n\t\tawait derivedContainers(workspace, stage),\n\t);\n\n\t// Write secrets\n\tawait writeStageSecrets(secrets, workspace.root);\n\tlogger.log(`   Secrets written to .gkm/secrets/${stage}.json`);\n\n\t// Offer to push to SSM if configured\n\tif (isSSMConfigured(workspace) && !options.yes) {\n\t\tconst { shouldPush } = await prompts({\n\t\t\ttype: 'confirm',\n\t\t\tname: 'shouldPush',\n\t\t\tmessage: 'Push secrets to SSM for team sharing?',\n\t\t\tinitial: true,\n\t\t});\n\n\t\tif (shouldPush) {\n\t\t\ttry {\n\t\t\t\tawait pushSecrets(stage, workspace);\n\t\t\t\tlogger.log('☁️  Secrets pushed to SSM');\n\t\t\t} catch (error) {\n\t\t\t\tlogger.warn(`⚠️  Failed to push to SSM: ${(error as Error).message}`);\n\t\t\t}\n\t\t}\n\t}\n\n\treturn secrets;\n}\n\n/**\n * Print setup summary with next steps.\n */\nfunction printSummary(workspace: NormalizedWorkspace, stage: string): void {\n\tlogger.log(`\\n${'─'.repeat(50)}`);\n\tlogger.log('\\n✅ Development environment ready!\\n');\n\n\tlogger.log('📋 Apps:');\n\tfor (const [name, app] of Object.entries(workspace.apps)) {\n\t\tconst icon =\n\t\t\tapp.type === 'web' ? '🌐' : app.type === 'mobile' ? '📱' : '🔧';\n\t\tlogger.log(`   ${icon} ${name} → http://localhost:${app.port}`);\n\t}\n\n\tlogger.log('\\n🚀 Next steps:');\n\tlogger.log('   gkm dev                    # Start all apps');\n\tlogger.log(`   gkm secrets:show --stage ${stage}  # View secrets`);\n\tlogger.log('');\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBA,MAAMA,WAAS;AAEf,MAAM,MAAM,yBAAUC,4BAAS;;;;;;;;;AAe/B,SAAS,aACRC,UACAC,aACoD;AACpD,KAAI,aAAa,SAChB,QAAO;EACN,UAAU;EACV,OAAO,CACN,CACC,QACA;GACC;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACA,CACD,CACD;CACD;AAGF,KAAI,aAAa,SAAS;EAGzB,MAAM,SAAS,wBAAW,mCAAmC;AAE7D,SAAO;GACN,UAAU,SAAS,yBAAyB;GAC5C,OAAO,SACJ,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,wBAAyB,CAAC,CACpC,IACA,CACA,CACC,QACA;IACC;IACA;IACA;GACA,CACD,GACD,CAAC,QAAQ,CAAC,iBAAkB,CAAC,CAC7B;EACH;CACD;AAED,OAAM,IAAI,oBAAoB,UAAU;AACxC;;;;;;;AAQD,eAAsB,aAAaC,UAAwB,CAAE,GAAiB;CAC7E,MAAM,EAAE,WAAW,GAAG,MAAM,oCAAqB;CACjD,MAAM,cAAc,oBAAK,UAAU,MAAMC,kCAAc;AAEvD,MAAK,wBAAW,YAAY,CAC3B,OAAM,IAAI,iBAAiB;CAG5B,MAAM,EAAE,UAAU,OAAO,GAAG,aAAa,QAAQ,UAAU,YAAY;AAEvE,UAAO,KAAK,uCAAuC,SAAS,EAAE;AAC9D,UAAO,KAAK,KAAK,YAAY,IAAI;AAEjC,KAAI,QAAQ,QAAQ;AACnB,OAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAC7B,UAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,KAAK,IAAI,CAAC,EAAE;AAE9C;CACA;AAED,UAAO,IAAI,qCAAqC;AAEhD,MAAK,MAAM,CAAC,SAAS,KAAK,IAAI,MAG7B,OAAM,IAAI,SAAS,MAAM,EAAE,OAAO,UAAW,EAAU;AAGxD,UAAO,IAAI,iEAAiE;AAC5E;;;;;;;;;;;AAYD,eAAsB,cACrBC,MACAC,KACAC,UAAyD,CAAE,GAC3C;AAChB,KAAI,QAAQ,eAAe,MAAO;AAClC,KAAI,MAAM,UAAU,IAAI,CAAE;AAE1B,KAAI,QAAQ,eAAe,SAAS,QAAQ,WAAW;AAKtD,OAAK,QAAQ,MAAM,OAAO;AACzB,YAAO,IACN,kGAEA;AACD;EACA;AAKD,MAAI,MAAM,SAAS,KAAK,CAAE;EAE1B,MAAM,EAAE,SAAS,GAAG,MAAM,qBAAQ;GACjC,MAAM;GACN,MAAM;GACN,SACC;GAED,SAAS;EACT,EAAC;AAEF,OAAK,SAAS;AACb,SAAM,eAAe,KAAK;AAC1B,YAAO,IACN,qEACA;AACD;EACA;CACD;AAED,OAAM,cAAc;AACpB;;AAGD,MAAM,cAAc;AAEpB,eAAe,SAASF,MAAgC;AACvD,KAAI;EACH,MAAM,MAAM,MAAM,+BAAS,oBAAK,MAAM,YAAY,EAAE,QAAQ;AAE5D,SAAQ,KAAK,MAAM,IAAI,CAA4B,aAAa;CAChE,QAAO;AACP,SAAO;CACP;AACD;AAED,eAAe,eAAeA,MAA6B;CAC1D,MAAM,OAAO,oBAAK,MAAM,YAAY;AAEpC,OAAM,4BAAM,uBAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,gCAAU,OAAO,EAAE,KAAK,UAAU,EAAE,UAAU,KAAM,GAAE,MAAM,EAAE,CAAC,IAAI;AACzE;;;;;;;;;;;;;AAcD,eAAsB,UAAUC,KAA+B;CAC9D,MAAM,EAAE,qBAAqB,SAAU,GAAG,KAAK,GAAG,QAAQ;AAE1D,KAAI;AACH,QAAM,IACL,QAAQ,UACR,CAAC,OAAO,QAAQ,KAAK,UAAU,IAAI,CAAC,kCAAmC,GACvE;GAAE;GAAK,SAAS;EAAQ,EACxB;AAED,SAAO;CACP,QAAO;AACP,SAAO;CACP;AACD;;AAkBD,IAAa,mBAAb,cAAsC,MAAM;CAC3C,YAAqBE,MAAc;AAClC,SACE,oCAAoC,KAAK,4JAG1C;EALmB;AAMpB,OAAK,OAAO;CACZ;AACD;;AAGD,IAAa,sBAAb,cAAyC,MAAM;CAC9C,YACUC,UACAP,aACR;AACD,SACE,8DACG,SAAS,mBAAmB,YAAY,yFAE5C;EAPQ;EACA;AAOT,OAAK,OAAO;CACZ;AACD;;;;ACjQD,MAAM,SAAS;;;;;;;;;;AAkBf,eAAsB,aAAaQ,UAAwB,CAAE,GAAiB;CAC7E,MAAM,QAAQ,QAAQ,SAAS;AAE/B,QAAO,IAAI,+CAA+C;CAG1D,IAAIC;AACJ,KAAI;AACH,iBAAe,MAAM,oCAAqB;CAC1C,QAAO;AACP,SAAO,MACN,oEACA;AACD,UAAQ,KAAK,EAAE;CACf;CAED,MAAM,EAAE,WAAW,GAAG;CACtB,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AAExD,QAAO,KAAK,gBAAgB,UAAU,KAAK,EAAE;AAC7C,QAAO,KAAK,WAAW,OAAO,KAAK,UAAU,KAAK,CAAC,KAAK,KAAK,CAAC,EAAE;AAChE,QAAO,KAAK,YAAY,MAAM,IAAI;CAGlC,MAAM,UAAU,MAAM,eAAe,OAAO,WAAW,QAAQ;AAE/D,MAAK,SAAS;AACb,SAAO,MAAM,wCAAwC;AACrD,UAAQ,KAAK,EAAE;CACf;CAGD,MAAM,aAAa,MAAM,sCAAkB,WAAW,MAAM;AAE5D,KAAI,cAAc,WAAW,SAAS,WAAW,EAAE;AAClD,QAAM,oDAA0B,SAAS,UAAU,KAAK;AACxD,SAAO,IAAI,mDAAmD;CAC9D;AAGD,MAAK,QAAQ,YAAY;AACxB,SAAO,IAAI,GAAG;AAEd,QAAM,eAAe,WAAW,OAAO,QAAQ;CAC/C;AAGD,cAAa,WAAW,MAAM;AAC9B;;;;;;;;AASD,eAAe,eACdC,WACAC,OACAH,SACgB;CAChB,MAAM,SAAS,MAAM,uCAAmB,WAAW,EAAE,MAAO,EAAC;AAE7D,KAAI,OAAO,KAAK,WAAW,WAAW,GAAG;AACxC,SAAO,IAAI,4BAA4B;AACvC;CACA;AAED,MAAK,OAAO,SAAS;AACpB,SAAO,IAAI,iCAAiC;AAC5C;CACA;AAED,QAAO,KAAK,eAAe,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,EAAE;AAC/D,MAAK,MAAM,CAAC,WAAW,QAAQ,IAAI,OAAO,QAAQ,OAAO,UAAU,CAClE,QAAO,KAAK,KAAK,UAAU,IAAI,QAAQ,EAAE;CAK1C,MAAM,SAAS,OAAO,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc;CAC1E,MAAM,MAAM,SAAS,OAAO,IAAI,OAAO;AAEvC,KAAI,IACH,OAAM,cAAc,UAAU,MAAM,KAAK;EACxC,GAAI,UAAU,SAAS,0BACpB,CAAE,IACF,EAAE,YAAY,UAAU,SAAS,aAAc;EAClD,GAAI,QAAQ,MAAM,EAAE,WAAW,KAAM,IAAG,CAAE;CAC1C,EAAC;AAEH;;;;;;;;;AAUD,eAAe,eACdG,OACAD,WACAF,SACC;AAED,KAAI,QAAQ,OAAO;AAClB,SAAO,IAAI,2CAA2C;AACtD,SAAO,qBAAqB,OAAO,WAAW,QAAQ;CACtD;AAGD,KAAI,6BAAa,OAAO,UAAU,KAAK,EAAE;AACxC,SAAO,IAAI,kCAAkC;EAC7C,MAAM,UAAU,MAAM,iCAAiB,OAAO,UAAU,KAAK;AAC7D,MAAI,SAAS;GAEZ,MAAM,aAAa,iBAClB,SACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAI,WACH,OAAM,kCAAkB,YAAY,UAAU,KAAK;AAEpD,UAAO,cAAc;EACrB;CACD;AAGD,KAAI,6BAAgB,UAAU,EAAE;AAC/B,SAAO,IAAI,4CAA4C;AACvD,MAAI;GACH,MAAM,gBAAgB,MAAM,yBAAY,OAAO,UAAU;AACzD,OAAI,eAAe;AAClB,WAAO,IAAI,4BAA4B;AACvC,UAAM,kCAAkB,eAAe,UAAU,KAAK;AACtD,WAAO;GACP;AACD,UAAO,IAAI,6BAA6B;EACxC,SAAQ,OAAO;AACf,UAAO,MAAM,+BAAgC,MAAgB,QAAQ,EAAE;EACvE;CACD;AAGD,QAAO,IAAI,6CAA6C;AACxD,QAAO,qBAAqB,OAAO,WAAW,QAAQ;AACtD;;;;;;;;;;;;;;;AAgBD,SAAS,qBACRI,YACuB;CACvB,MAAMC,cAA4D;EACjE,UAAU;EACV,OAAO;EACP,OAAO;EACP,SAAS;EACT,YAAY;EACZ,UAAU;CACV;AAED,QAAO,CACN,GAAG,IAAI,IACN,WACE,IAAI,CAAC,cAAc,YAAY,WAAW,CAC1C,OAAO,CAAC,SAAqC,QAAQ,KAAK,CAAC,CAE9D;AACD;AAED,SAAgB,iBACfC,SACAJ,WACAE,aAAgC,CAAE,GACZ;CACtB,IAAI,UAAU;CACd,IAAI,SAAS,EAAE,GAAG,QAAS;AAG3B,MAAK,MAAM,QAAQ,qBAAqB,WAAW,CAClD,MAAK,OAAO,SAAS,OAAO;EAC3B,MAAM,QAAQ,6CAA2B,KAAK;AAE9C,MAAI,SAAS,SAAS;AACrB,SAAM,SAAS,UAAU;AACzB,SAAM,WAAW,UAAU;EAC3B;AACD,WAAS;GACR,GAAG;GACH,UAAU;IAAE,GAAG,OAAO;KAAW,OAAO;GAAO;EAC/C;AACD,SAAO,OAAO,yCACb,OAAO,UACP,OAAO,cACP;AACD,SAAO,KAAK,4CAA4C,KAAK,EAAE;AAC/D,YAAU;CACV;AAIF,KAAI,OAAO,SAAS,aAAa,OAAO,SAAS,QAAQ;AACxD,WAAS;GACR,GAAG;GACH,UAAU;IACT,GAAG,OAAO;IACV,QAAQ;KACP,MAAM,OAAO,SAAS,SAAS;KAC/B,MAAM,OAAO,SAAS,SAAS;KAC/B,UAAU;KACV,UAAU,0CAAwB;KAClC,UAAU,OAAO,SAAS,SAAS,YAAY;IAC/C;GACD;EACD;AACD,SAAO,OAAO,yCAAuB,OAAO,UAAU,OAAO,cAAc;AAC3E,SAAO,IAAI,mDAAmD;AAC9D,YAAU;CACV;CAGD,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,YAAY;EACf,MAAM,WAAW,yDAA+B,WAAW,WAAW;EACtE,MAAMG,UAAkC,CAAE;AAE1C,OAAK,MAAM,CAAC,KAAK,MAAM,IAAI,OAAO,QAAQ,SAAS,CAClD,OAAM,OAAO,OAAO,QACnB,SAAQ,OAAO;AAIjB,MAAI,OAAO,KAAK,QAAQ,CAAC,SAAS,GAAG;AACpC,UAAO,KACL,gCAAgC,OAAO,KAAK,QAAQ,CAAC,KAAK,KAAK,CAAC,EACjE;AACD,YAAS;IACR,GAAG;IACH,QAAQ;KAAE,GAAG,OAAO;KAAQ,GAAG;IAAS;GACxC;AACD,aAAU;EACV;CACD;AAED,MAAK,QACJ,QAAO;AAGR,QAAO;EACN,GAAG;EACH,WAAW,qBAAI,QAAO,aAAa;CACnC;AACD;;;;;;;;AASD,SAAgB,4BACfJ,OACAD,WACAE,aAAgC,CAAE,GACnB;CAKf,MAAM,eAAe,qBAAqB,WAAW;CAGrD,MAAM,UAAU,qCAAmB,OAAO,cAAc;EACvD,aAAa,UAAU;EACvB,eAAe,UAAU,SAAS;CAClC,EAAC;CAGF,MAAM,aAAa,OAAO,KAAK,UAAU,KAAK,CAAC,SAAS;AACxD,KAAI,WACH,SAAQ,SAAS,yDAA+B,WAAW,WAAW;KAEtE,SAAQ,SAAS;EAChB,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAGF,QAAO;AACP;;;;;;;;;;;AAYD,eAAsB,mBACrBD,OACAK,MAAc,QAAQ,KAAK,EACR;CACnB,MAAM,EAAE,WAAW,GAAG,MAAM,mCAAoB,IAAI;AAEpD,KAAI,6BAAa,OAAO,UAAU,KAAK,CACtC,QAAO;CAGR,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AACD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO;AACP;;;;AAKD,eAAe,qBACdL,OACAD,WACAF,SACC;CACD,MAAM,UAAU,4BACf,OACA,WACA,MAAM,sCAAkB,WAAW,MAAM,CACzC;AAGD,OAAM,kCAAkB,SAAS,UAAU,KAAK;AAChD,QAAO,KAAK,qCAAqC,MAAM,OAAO;AAG9D,KAAI,6BAAgB,UAAU,KAAK,QAAQ,KAAK;EAC/C,MAAM,EAAE,YAAY,GAAG,MAAM,qBAAQ;GACpC,MAAM;GACN,MAAM;GACN,SAAS;GACT,SAAS;EACT,EAAC;AAEF,MAAI,WACH,KAAI;AACH,SAAM,yBAAY,OAAO,UAAU;AACnC,UAAO,IAAI,4BAA4B;EACvC,SAAQ,OAAO;AACf,UAAO,MAAM,6BAA8B,MAAgB,QAAQ,EAAE;EACrE;CAEF;AAED,QAAO;AACP;;;;AAKD,SAAS,aAAaE,WAAgCC,OAAqB;AAC1E,QAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE;AACjC,QAAO,IAAI,uCAAuC;AAElD,QAAO,IAAI,WAAW;AACtB,MAAK,MAAM,CAAC,MAAM,IAAI,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;EACzD,MAAM,OACL,IAAI,SAAS,QAAQ,OAAO,IAAI,SAAS,WAAW,OAAO;AAC5D,SAAO,KAAK,KAAK,KAAK,GAAG,KAAK,sBAAsB,IAAI,KAAK,EAAE;CAC/D;AAED,QAAO,IAAI,mBAAmB;AAC9B,QAAO,IAAI,iDAAiD;AAC5D,QAAO,KAAK,8BAA8B,MAAM,kBAAkB;AAClE,QAAO,IAAI,GAAG;AACd"}

package/dist/{setup-ZijS4qeC.mjs → setup-DGIPd2fh.mjs}

@@ -1,11 +1,11 @@
 import "./discover-CAlFgYec.mjs";
-import "./config-WRdsQYZK.mjs";
-import "./workspace-BFMrAKqI.mjs";
-import "./credentials-BBIRJVp4.mjs";
+import "./config-CxP7P-qG.mjs";
+import "./workspace-DIuZx-cc.mjs";
+import "./credentials-BK3Z93MX.mjs";
 import "./generator-VE2JrFlY.mjs";
 import "./storage-Bi24WfoW.mjs";
 import "./fullstack-secrets-D1o9-G5l.mjs";
 import "./sync-CmEuNZsB.mjs";
-import { createFreshWorkspaceSecrets, ensureStageSecrets, reconcileSecrets, setupCommand } from "./setup-DXvRLTZN.mjs";
+import { createFreshWorkspaceSecrets, ensureStageSecrets, reconcileSecrets, setupCommand } from "./setup-BWMhbW-p.mjs";
 
 export { ensureStageSecrets };

package/dist/{types-C-arnQ1r.d.mts → types-BLSNdrk0.d.cts}

@@ -731,9 +731,9 @@ declare const WorkspaceConfigSchema: z.ZodObject<{
       version: z.ZodOptional<z.ZodString>;
       image: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodEnum<{
+      db: "db";
       upstash: "upstash";
       elasticache: "elasticache";
-      db: "db";
     }>]>>;
     mail: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
       version: z.ZodOptional<z.ZodString>;
@@ -745,16 +745,16 @@ declare const WorkspaceConfigSchema: z.ZodObject<{
         pass: z.ZodOptional<z.ZodString>;
       }, z.core.$strip>>;
     }, z.core.$strip>, z.ZodEnum<{
+      smtp: "smtp";
       resend: "resend";
       ses: "ses";
-      smtp: "smtp";
     }>]>>;
     storage: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodObject<{
       version: z.ZodOptional<z.ZodString>;
       image: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>, z.ZodEnum<{
-      minio: "minio";
       s3: "s3";
+      minio: "minio";
       r2: "r2";
     }>]>>;
     events: z.ZodOptional<z.ZodEnum<{
@@ -2078,15 +2078,7 @@ interface GkmConfig {
    *
    * @example './src/**\/*.ts'
    */
-  constructs?: Routes;
-  routes: Routes;
-  functions?: Routes;
-  crons?: Routes;
-  subscribers?: Routes;
-  queues?: Routes;
-  topics?: Routes;
-  envParser: string;
-  logger: string;
+  constructs: Routes;
   providers?: ProvidersConfig;
   /**
    * Server lifecycle hooks for customizing the Hono app.
@@ -2181,4 +2173,4 @@ interface GkmConfig {
 }
 //#endregion
 export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, CacheBackend, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, EmailBackend, Framework, FrontendFramework, GkmConfig, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, OpenApiConfig, PHASE_2_DEPLOY_TARGETS, Routes, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, formatValidationErrors, getDeployTargetError, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig };
-//# sourceMappingURL=types-C-arnQ1r.d.mts.map
+//# sourceMappingURL=types-BLSNdrk0.d.cts.map

package/dist/{types-C-arnQ1r.d.mts.map → types-BLSNdrk0.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-C-arnQ1r.d.mts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECrClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF3Fe,iBAAA,CE2Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF3FN,ME2FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFjHY,MEiHZ,CAAA,MAA0D,EFjH/B,gBEiH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF7HI,ME6HgB,CAAA,MAAA,EF7HD,ME6HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFncE,MEmcF,CAAA,MAAA,EFnciB,qBEsc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFjcxB,MEicwB,CAAA,MAAA,EFjcT,gBEicS,CAAA;EAAA;YF/b3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACrClE,UDkBI,cAAA,CCbf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDTrC,SCSqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDxCf,iBAAA,CCwCiB;EAAK;EAK1B,QAAA,ED3CF,aC2CE;AAoBb;;;;AAAqC,KDzDzB,WAAA,GAAc,gBCyDW,GDzDQ,cCyDR,GDzDyB,iBCyDzB;AAKrC;;;;;;;;AFjJiB,cE8CJ,sBF9CoB,EE8CE,CAAA,CAAA,OF9CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCYL,gBAAA,GAAmB,CAAA,CAAE,KDTxB,CAAA,OCSqC,sBDT5B,CAAA;AAQlB;AAQA;;AAA0B,cCFb,uBDEa,ECFU,CAAA,CAAA,ODEV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;AC2IhB;AA4BA;AAuBA;AA4CU,cDqFG,yBCrFU,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,SCrFf,CDqFe,CAAA,CAAA,SCrFf,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,qBCrFf,CAAA,CDqFe,CAAA,CAAA,SCrFf,CAAA;EAAA,QAAA,EDqFe,CAAA,CAAA,UCrFf,CAAA,WAAA,CAAA;EAAA,GA6Bb,eAAA,YAAA,CAAA;CAAY,eAeR,CAAA,aAAA,CAAA;EAAM,QAMV,EDmC4B,CAAA,CAAA,UCnC5B,CAAA,SAAA,CAAA;EAAM,MAMH,eAAA,UAAA,CAAA;IAMJ,WAAA,EAAA,WAAA;IAMC,WAAA,EAAA,WAAA;IAMA,WAAA,EAAA,WAAA;IAMK,WAAA,EAAA,WAAA;IAeF,YAAA,EAAA,YAAA;IAMJ,WAAA,EAAA,WAAA;IAMuB,YAAA,EAAA,YAAA;IAMH,YAAA,EAAA,YAAA;IAMR,gBAAA,EAAA,gBAAA;IAMV,gBAAA,EAAA,gBAAA;IAwCE,gBAAA,EAAA,gBAAA;IAkDH,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAmCR,gBAAc,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAGf,cAAA,EAAA,cAAA;IAFP,cAAA,EAAA,cAAA;IAAa,cAAA,EAAA,cAAA;IASL,WAAU,EAAA,WAAQ;IAQvB,WAAQ,EAAA,WAAG;IAOX,WAAU,EAAA,WAAA;IAAA,YAAA,EAAA,YAAA;IAAkB,YAAA,EAAA,YAAA;IAAf,YAAA,EAAA,YAAA;IAAM,YAAA,EAAA,YAAA;IAMnB,cAAe,EAAA,cAAA;IAAA,WAAA,EAAA,WAAA;EAAA,CAAA,CAAA,CAAe;EAAU,OACvC,eAAA,YAAA,CAAA;EAAK,YAAQ,eAAA,YAAA,CAAA;EAAK,GAAC,eAAA,YAAA,CAAA;CAAC,eAAZ,CAAA,aAAA,CAAA;EAAI,QACQ,cAAA,CAAA,YAAA,CAAA;EAAK,GAAA,eAAA,YAAA,CAAA;AAqCtC,CAAA,eAAY,CAAA,aAAc,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QAOrC,ED1UW,CAAA,CAAA,SC0UX,CAAA;IAUU,IAAA,EAAA,MAAA;IAAhB,UAAA,EDrVM,QCqVN;IAEE,aAAA,EDtVO,QCsVP;EAAY,CAAA,EAEZ;IAEE,IAAA,EAAA,MAAA;IAED,UAAA,ED7VG,QC6VH;IAEF,aAAA,ED9VQ,QC8VR;EAAW,CAAA,CAAA;EAMR,GAAA,eAAa,YAAA,CAAA;CAAA,eAAA,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAA,QAAe,ED5QF,CAAA,CAAA,UC4QE,CAAA,WAAA,CAAA;EAAU,GAAU,eAAA,YAAA,CAAA;EAAK,MAAA,aAAA;AAKjE,CAAA,eAAY,CAAA,aAAuB,CAAA;EAAA,QAAA,cAAA,CAAA,SAAA,CAAA;EAAA,MAAe,eAAA,UAAA,CAAA;IAOpC,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAAa,WAAA,EAAA,WAAA;IAAM,WAAA,EAAA,WAAA;IAAX,YAAA,EAAA,YAAA;IACU,WAAA,EAAA,WAAA;IAAd,YAAA,EAAA,YAAA;IAGR,YAAA,EAAA,YAAA;IACA,gBAAA,EAAA,gBAAA;IACE,gBAAA,EAAA,gBAAA;IACD,gBAAA,EAAA,gBAAA;IACF,gBAAA,EAAA,gBAAA;IAAW,gBAAA,EAAA,gBAAA;IA+FH,gBAAe,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAOlB,cAAA,EAAA,cAAA;IAKS,cAAA,EAAA,cAAA;IAAf,cAAA,EAAA,cAAA;IAGE,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAGE,WAAA,EAAA,WAAA;IAGD,YAAA,EAAA,YAAA;IAGF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IASH,YAAA,EAAA,YAAoB;IAAA,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EAAa,CAAA,CAAA,CAmBxC;EAAY,OAItB,eAAA,YAAA,CAAA;EAAS,YAEZ,eAAA,YAAA,CAAA;EAAe,GAzBoB,eAAA,YAAA,CAAA;EAAI,MAAA,aAAA;AAoCjD,CAAA,eAAiB,CAAA,aAAmB,CAAA;EAAA,QAAA,cAAA,CAAA,YAAA,CAAA;EAAA,GAWtB,eAAA,YAAA,CAAA;EAAM,MAEE,aAAA;CAAmB,eAAlC,CAAA,aAAA,CAAA;EAAM,QAEF,cAAA,CAAA,QAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAEX,EDvjBe,CAAA,CAAA,SCujBf,CAAA;IAED,IAAA,EAAA,MAAA;IAAW,UAAA,ED1jBN,QC0jBM;IAMH,aAAY,ED/jBZ,QC+jBY;EAAA,CAAA,EAAA;IAIvB,IAAA,EAAA,MAAA;IAAY,UAAA,EDpkBJ,QCokBI;IAEN,aAAA,EDrkBK,QCqkBL;EAAmB,CAAA,CAAA;EAQF,GAAA,eAAA,YAAA,CAAA;EAeb,MAAA,aAAA;CAAiB,eAAA,CAAA,CAAA,CAAA,CAAA,CAAA;AACxB,KDhgBG,SAAA,GAAY,CAAA,CAAE,KCggBjB,CAAA,ODhgB8B,yBCggB9B,CAAA;;;AACmB;;;;ACvhCX,cF8hBJ,mBE9hBqB,EF8hBF,CAAA,CAAA,SE9hBE,CAAA;EAKtB,IAAA,EFoiBV,CAAA,CAAA,UEpiBgB,CAAA,IAAuB,CAAA;EAaxB,OAAA,eAAc,YAAA,CAAA;EAKd,MAAA,WAAA,CAAA;IAIA,WAAA,EAAA,WAAgB;IAIhB,WAAA,EAAA,WAAgB;IA4BhB,WAAA,EAAa,WAAA;IAsBlB,WAAA,EAAa,WAAA;IAmBb,YAAY,EAAA,YAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,YAAY,EAAA,YAAA;IAaZ,YAAA,EAAA,YAAkB;IASlB,gBAAA,EAAA,gBAAqB;IAAA,gBAAA,EAAA,gBAAA;IAC1B,gBAAA,EAAA,gBAAA;IAAgC,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAGnC,gBAAY,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAwBhB,cAAA,EAAA,cAAA;IAAwB,cAAA,EAAA,cAAA;IAAkB,cAAA,EAAA,cAAA;IAItC,WAAa,EAAA,WAAA;IAAA,WAAA,EAAA,WAAA;IAIhB,WAAA,EAAA,WAAA;IAJwB,YAAA,EAAA,YAAA;IAAc,YAAA,EAAA,YAAA;IAOxC,YAAO,EAAA,YAAA;IAEF,YAAA,EAAe,YAAA;IAiBf,cAAY,EAAA,cAAA;IASZ,WAAA,EAAa,WAAA;EAWb,CAAA,CAAA;EA6BA,QAAA,eAAA,YAAqB,CAAA;EAarB,SAAA,eAAe,YAAA,CAAA;CAAA,eAAA,CAAA;AAGd,KF6ON,aAAA,GAAgB,CAAA,CAAE,KE7OZ,CAAA,OF6OyB,mBE7OzB,CAAA;;;;AAQE,cFyZP,qBEzZO,EFyZc,CAAA,CAAA,SEzZd,CAAA;EAAY,IAEX,eAAA,CF2gBlB,CAAA,CAAA,SE3gBkB,CAAA;EAAqB,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAGzB,KAAA,YAAS,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IAAA,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAAA,CAAA,eA6Bd,CAAA,CAAA,CAAA,CAAA;EAAc,IAWZ,eAAA,YAAA,YAAA,aAAA,CAAA;IACL,IAAA,cAAA,cAAA,UAAA,CAAA;MACI,OAAA,EAAA,SAAA;MACJ,GAAA,EAAA,KAAA;MACM,MAAA,EAAA,QAAA;IACL,CAAA,CAAA,CAAA,CAAA;IACA,IAAA,aAAA;IAGG,IAAA,aAAA;IAUJ,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAQuB,MAAA,eAAA,UAAA,CAAA;MAUH,OAAA,EAAA,SAAA;MAmBR,MAAA,EAAA,QAAA;MAEV,UAAA,EAAA,YAAA;IA4BD,CAAA,CAAA,CAAA;IAAY,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAa4B,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBF7BzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkLoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA8O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF71BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC9Db,iBAAA,SAA0B,kBD8DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCnTR,cAAA,CDmTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCnTM;;;;;;SA6BY;;EDqRrB,OACL,CAAA,EChRyB,cDgRzB;EAAQ;EADH,MACL,CAAA,EC9Q8B,aD8Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC3WQ,OD2WR,CC3WgB,MD2WhB,CC5X2C,kBAAA,ED4X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAoLnC;;;;;;KC1gBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;;;;UAmBO,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;MDJI,EAAA,MAAA;EAAQ;;;;;WCiCZ;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;EDxEY,MACL,CAAA,EC6EP,MD7EO;EAAQ;;;;gBCmFV;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AD8HqB;AA0HlC;;;EAEuC,MAAlC,CAAA,ECxMK,eDwML;EAAK;AAOV;;;;;AAGmB;AAYnB;;;;ACx0BA;AAcA;AA2BA;AAoDA;;;;;;;;;AAwDiB;AAuBjB;AAqBA;AAkCA;;;;AAc+B;AAwC/B;AAA6B,UAoXZ,cApXY,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAqXpB,aArXoB,CAAA;EAAA;EAEN,YAEZ,CAAA,EAmXK,SAnXL,EAAA;;;AAIa;AAmBxB;AA4BA;AAuBiB,UAgTA,SAAA,SAAkB,aAhTL,CAAA;EA4CpB;EAAa,YAAA,CAAA,EAAA,MAAA,EAAA;;;;;AA8Dd,KA8MG,QAAA,GAAW,aA9Md,GAAA;EAAM,YAML,CAAA,EAAA,SAAA,MAAA,EAAA;CAAM;;;;AAuCgB,KAwKpB,UAAA,GAAa,MAxKO,CAAA,MAAA,EAwKQ,QAxKR,CAAA;;;;;AA4GtB,KAkEE,eAlEF,CAAA,cAkEgC,UAlEhC,CAAA,GAAA,QAAe,MAmEZ,KAnEY,GAmEJ,IAnEI,CAmEC,KAnED,CAmEO,CAnEP,CAAA,EAAA,cAAA,CAAA,GAAA;EAmCR,YAAA,CAAc,EAAA,SAAA,CAAA,MAiCE,KAjCF,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;AACT;AAStB;AAQA;AAOA;;;;AAA+B;AAM/B;;;;;;;;AAEsC;AAqCtC;;;;;;;;;;;AA2BoB;AAMpB;;;AAA4D,KAjChD,cAiCgD,CAAA,cAjCnB,UAiCmB,CAAA,GAAA;EAAK;AAKjE;;;;;EAUmB,UAAQ,CAAA,EAzCb,MAyCa;EAAK;EAAE,IAAZ,CAAA,EAAA,MAAA;EAAI;;;;;;;EAQN,IAAA,CAAA,EAvCZ,eAuCY,CAvCI,KAuCJ,CAAA;EA+FH;EAAe,MAAA,CAAA,EApItB,YAoIsB;EAAA;EAOZ,MAKG,CAAA,EA9Ib,YA8Ia;EAAS;EAAlB,QAGJ,CAAA,EA/IE,cA+IF;EAAY;EAGA,OAGV,CAAA,EAnJD,aAmJC;EAAc;EAGF,KAGf,CAAA,EAvJA,WAuJA;AAAW,CAAA;AASpB;;;AAmBuB,KA7KX,aA6KW,CAAA,cA7KiB,UA6KjB,CAAA,GAAA,MA7KqC,KA6KrC,GAAA,MAAA;;;;AAnB0B,KArJrC,uBAqJqC,CAAA,cArJC,UAqJD,CAAA,GAAA;EAoChC;;;;;;EAeQ,UAEhB,CAAA,EAnMK,MAmML;EAAY,IAEZ,CAAA,EAAA,MAAA;EAAY,IAEX,CAAA,EAAA,QAED,MAtMK,KAsML,GAtMa,IAsMb,CAtMkB,KAsMlB,CAtMwB,CAsMxB,CAAA,EAAA,cAAA,CAAA,GAAA;IAAW,YAAA,CAAA,EArMF,aAqME,CArMY,KAqMZ,CAAA,EAAA;EAMH,CAAA,EAAY;EAAA,MAIvB,CAAA,EA5MI,YA4MJ;EAAS,MAAG,CAAA,EA3MR,YA2MQ;EAAe,QAErB,CAAA,EA5MA,cA4MA;EAAmB,OAQnB,CAAA,EAnND,aAmNC;EAAiB,KAAA,CAAA,EAlNpB,WAkNoB;AAe7B,CAAA;;;AC1/BA;AAIA;AA4BA;AAsBA;AAmBA;AAmBA;AAsDA;AAaA;AASA;;;;AACoD;AAGpD;;;;AAwBuD;AAIvD;;;;AAAoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;;;;;;;AA2IkD;;;;;;;;;;;;;;;;;;;UD6bjC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;YAGD;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UCvhCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACrClE,UESI,aAAA,CFJf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KEpEhB,aAAA,GFoEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE7aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF6UD,UE1UrB,YAAA,CF0UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAoLtB,QAAA,CAAA,EEhgBA,qBFonBV,GEpnBkC,kBFonBlC,EAAA;EAAA,CAAA;;UEhnBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA6BL;;;;;;;;;;;eAWE;UACL;cACI;UACJ;gBACM;WACL;WACA;;;cAGG;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}
+{"version":3,"file":"types-BLSNdrk0.d.cts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECrClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF3Fe,iBAAA,CE2Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF3FN,ME2FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFjHY,MEiHZ,CAAA,MAA0D,EFjH/B,gBEiH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF7HI,ME6HgB,CAAA,MAAA,EF7HD,ME6HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFncE,MEmcF,CAAA,MAAA,EFnciB,qBEsc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFjcxB,MEicwB,CAAA,MAAA,EFjcT,gBEicS,CAAA;EAAA;YF/b3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACrClE,UDkBI,cAAA,CCbf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDTrC,SCSqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDxCf,iBAAA,CCwCiB;EAAK;EAK1B,QAAA,ED3CF,aC2CE;AAoBb;;;;AAAqC,KDzDzB,WAAA,GAAc,gBCyDW,GDzDQ,cCyDR,GDzDyB,iBCyDzB;AAKrC;;;;;;;;AFjJiB,cE8CJ,sBF9CoB,EE8CE,CAAA,CAAA,OF9CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCYL,gBAAA,GAAmB,CAAA,CAAE,KDTxB,CAAA,OCSqC,sBDT5B,CAAA;AAQlB;AAQA;;AAA0B,cCFb,uBDEa,ECFU,CAAA,CAAA,ODEV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;AC2IhB;AA4BA;AAuBA;AA4CU,cDqFG,yBCrFU,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,SCrFf,CDqFe,CAAA,CAAA,SCrFf,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,qBCrFf,CAAA,CDqFe,CAAA,CAAA,SCrFf,CAAA;EAAA,QAAA,EDqFe,CAAA,CAAA,UCrFf,CAAA,WAAA,CAAA;EAAA,GA6Bb,eAAA,YAAA,CAAA;CAAY,eAeR,CAAA,aAAA,CAAA;EAAM,QAMV,EDmC4B,CAAA,CAAA,UCnC5B,CAAA,SAAA,CAAA;EAAM,MAMH,eAAA,UAAA,CAAA;IAMJ,WAAA,EAAA,WAAA;IAMC,WAAA,EAAA,WAAA;IAMA,WAAA,EAAA,WAAA;IAMK,WAAA,EAAA,WAAA;IAeF,YAAA,EAAA,YAAA;IAMJ,WAAA,EAAA,WAAA;IAMuB,YAAA,EAAA,YAAA;IAMH,YAAA,EAAA,YAAA;IAMR,gBAAA,EAAA,gBAAA;IAMV,gBAAA,EAAA,gBAAA;IAwCE,gBAAA,EAAA,gBAAA;IAkDH,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAmCR,gBAAc,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAGf,cAAA,EAAA,cAAA;IAFP,cAAA,EAAA,cAAA;IAAa,cAAA,EAAA,cAAA;IASL,WAAU,EAAA,WAAQ;IAQvB,WAAQ,EAAA,WAAG;IAOX,WAAU,EAAA,WAAA;IAAA,YAAA,EAAA,YAAA;IAAkB,YAAA,EAAA,YAAA;IAAf,YAAA,EAAA,YAAA;IAAM,YAAA,EAAA,YAAA;IAMnB,cAAe,EAAA,cAAA;IAAA,WAAA,EAAA,WAAA;EAAA,CAAA,CAAA,CAAe;EAAU,OACvC,eAAA,YAAA,CAAA;EAAK,YAAQ,eAAA,YAAA,CAAA;EAAK,GAAC,eAAA,YAAA,CAAA;CAAC,eAAZ,CAAA,aAAA,CAAA;EAAI,QACQ,cAAA,CAAA,YAAA,CAAA;EAAK,GAAA,eAAA,YAAA,CAAA;AAqCtC,CAAA,eAAY,CAAA,aAAc,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QAOrC,ED1UW,CAAA,CAAA,SC0UX,CAAA;IAUU,IAAA,EAAA,MAAA;IAAhB,UAAA,EDrVM,QCqVN;IAEE,aAAA,EDtVO,QCsVP;EAAY,CAAA,EAEZ;IAEE,IAAA,EAAA,MAAA;IAED,UAAA,ED7VG,QC6VH;IAEF,aAAA,ED9VQ,QC8VR;EAAW,CAAA,CAAA;EAMR,GAAA,eAAa,YAAA,CAAA;CAAA,eAAA,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAA,QAAe,ED5QF,CAAA,CAAA,UC4QE,CAAA,WAAA,CAAA;EAAU,GAAU,eAAA,YAAA,CAAA;EAAK,MAAA,aAAA;AAKjE,CAAA,eAAY,CAAA,aAAuB,CAAA;EAAA,QAAA,cAAA,CAAA,SAAA,CAAA;EAAA,MAAe,eAAA,UAAA,CAAA;IAOpC,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAAa,WAAA,EAAA,WAAA;IAAM,WAAA,EAAA,WAAA;IAAX,YAAA,EAAA,YAAA;IACU,WAAA,EAAA,WAAA;IAAd,YAAA,EAAA,YAAA;IAGR,YAAA,EAAA,YAAA;IACA,gBAAA,EAAA,gBAAA;IACE,gBAAA,EAAA,gBAAA;IACD,gBAAA,EAAA,gBAAA;IACF,gBAAA,EAAA,gBAAA;IAAW,gBAAA,EAAA,gBAAA;IA+FH,gBAAe,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAOlB,cAAA,EAAA,cAAA;IAKS,cAAA,EAAA,cAAA;IAAf,cAAA,EAAA,cAAA;IAGE,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAGE,WAAA,EAAA,WAAA;IAGD,YAAA,EAAA,YAAA;IAGF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IASH,YAAA,EAAA,YAAoB;IAAA,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EAAa,CAAA,CAAA,CAmBxC;EAAY,OAItB,eAAA,YAAA,CAAA;EAAS,YAEZ,eAAA,YAAA,CAAA;EAAe,GAzBoB,eAAA,YAAA,CAAA;EAAI,MAAA,aAAA;AAoCjD,CAAA,eAAiB,CAAA,aAAmB,CAAA;EAAA,QAAA,cAAA,CAAA,YAAA,CAAA;EAAA,GAWtB,eAAA,YAAA,CAAA;EAAM,MAEE,aAAA;CAAmB,eAAlC,CAAA,aAAA,CAAA;EAAM,QAEF,cAAA,CAAA,QAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAEX,EDvjBe,CAAA,CAAA,SCujBf,CAAA;IAED,IAAA,EAAA,MAAA;IAAW,UAAA,ED1jBN,QC0jBM;IAMH,aAAY,ED/jBZ,QC+jBY;EAAA,CAAA,EAAA;IAIvB,IAAA,EAAA,MAAA;IAAY,UAAA,EDpkBJ,QCokBI;IAEN,aAAA,EDrkBK,QCqkBL;EAAmB,CAAA,CAAA;EAQF,GAAA,eAAA,YAAA,CAAA;EAeb,MAAA,aAAA;CAAiB,eAAA,CAAA,CAAA,CAAA,CAAA,CAAA;AACxB,KDhgBG,SAAA,GAAY,CAAA,CAAE,KCggBjB,CAAA,ODhgB8B,yBCggB9B,CAAA;;;AACmB;;;;ACvhCX,cF8hBJ,mBE9hBqB,EF8hBF,CAAA,CAAA,SE9hBE,CAAA;EAKtB,IAAA,EFoiBV,CAAA,CAAA,UEpiBgB,CAAA,IAAuB,CAAA;EAaxB,OAAA,eAAc,YAAA,CAAA;EAKd,MAAA,WAAA,CAAA;IAIA,WAAA,EAAA,WAAgB;IAIhB,WAAA,EAAA,WAAgB;IA4BhB,WAAA,EAAa,WAAA;IAsBlB,WAAA,EAAa,WAAA;IAmBb,YAAY,EAAA,YAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,YAAY,EAAA,YAAA;IAaZ,YAAA,EAAA,YAAkB;IASlB,gBAAA,EAAA,gBAAqB;IAAA,gBAAA,EAAA,gBAAA;IAC1B,gBAAA,EAAA,gBAAA;IAAgC,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAGnC,gBAAY,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAwBhB,cAAA,EAAA,cAAA;IAAwB,cAAA,EAAA,cAAA;IAAkB,cAAA,EAAA,cAAA;IAItC,WAAa,EAAA,WAAA;IAAA,WAAA,EAAA,WAAA;IAIhB,WAAA,EAAA,WAAA;IAJwB,YAAA,EAAA,YAAA;IAAc,YAAA,EAAA,YAAA;IAOxC,YAAO,EAAA,YAAA;IAEF,YAAA,EAAe,YAAA;IAiBf,cAAY,EAAA,cAAA;IASZ,WAAA,EAAa,WAAA;EAWb,CAAA,CAAA;EA6BA,QAAA,eAAA,YAAqB,CAAA;EAarB,SAAA,eAAe,YAAA,CAAA;CAAA,eAAA,CAAA;AAGd,KF6ON,aAAA,GAAgB,CAAA,CAAE,KE7OZ,CAAA,OF6OyB,mBE7OzB,CAAA;;;;AAQE,cFyZP,qBEzZO,EFyZc,CAAA,CAAA,SEzZd,CAAA;EAAY,IAEX,eAAA,CF2gBlB,CAAA,CAAA,SE3gBkB,CAAA;EAAqB,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAGzB,KAAA,YAAS,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IAAA,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAAA,CAAA,eA6Bd,CAAA,CAAA,CAAA,CAAA;EAAc,IAWb,eAAA,YAAA,YAAA,aAAA,CAAA;IACA,IAAA,cAAA,cAAA,UAAA,CAAA;MAUJ,OAAA,EAAA,SAAA;MAQuB,GAAA,EAAA,KAAA;MAUH,MAAA,EAAA,QAAA;IAmBR,CAAA,CAAA,CAAA,CAAA;IAEV,IAAA,aAAA;IA4BD,IAAA,aAAA;IAAY,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAa4B,MAAA,eAAA,UAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBFrBzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkLoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA8O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF71BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC9Db,iBAAA,SAA0B,kBD8DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCnTR,cAAA,CDmTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCnTM;;;;;;SA6BY;;EDqRrB,OACL,CAAA,EChRyB,cDgRzB;EAAQ;EADH,MACL,CAAA,EC9Q8B,aD8Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC3WQ,OD2WR,CC3WgB,MD2WhB,CC5X2C,kBAAA,ED4X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAoLnC;;;;;;KC1gBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;;;;UAmBO,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;MDJI,EAAA,MAAA;EAAQ;;;;;WCiCZ;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;EDxEY,MACL,CAAA,EC6EP,MD7EO;EAAQ;;;;gBCmFV;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AD8HqB;AA0HlC;;;EAEuC,MAAlC,CAAA,ECxMK,eDwML;EAAK;AAOV;;;;;AAGmB;AAYnB;;;;ACx0BA;AAcA;AA2BA;AAoDA;;;;;;;;;AAwDiB;AAuBjB;AAqBA;AAkCA;;;;AAc+B;AAwC/B;AAA6B,UAoXZ,cApXY,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAqXpB,aArXoB,CAAA;EAAA;EAEN,YAEZ,CAAA,EAmXK,SAnXL,EAAA;;;AAIa;AAmBxB;AA4BA;AAuBiB,UAgTA,SAAA,SAAkB,aAhTL,CAAA;EA4CpB;EAAa,YAAA,CAAA,EAAA,MAAA,EAAA;;;;;AA8Dd,KA8MG,QAAA,GAAW,aA9Md,GAAA;EAAM,YAML,CAAA,EAAA,SAAA,MAAA,EAAA;CAAM;;;;AAuCgB,KAwKpB,UAAA,GAAa,MAxKO,CAAA,MAAA,EAwKQ,QAxKR,CAAA;;;;;AA4GtB,KAkEE,eAlEF,CAAA,cAkEgC,UAlEhC,CAAA,GAAA,QAAe,MAmEZ,KAnEY,GAmEJ,IAnEI,CAmEC,KAnED,CAmEO,CAnEP,CAAA,EAAA,cAAA,CAAA,GAAA;EAmCR,YAAA,CAAc,EAAA,SAAA,CAAA,MAiCE,KAjCF,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;AACT;AAStB;AAQA;AAOA;;;;AAA+B;AAM/B;;;;;;;;AAEsC;AAqCtC;;;;;;;;;;;AA2BoB;AAMpB;;;AAA4D,KAjChD,cAiCgD,CAAA,cAjCnB,UAiCmB,CAAA,GAAA;EAAK;AAKjE;;;;;EAUmB,UAAQ,CAAA,EAzCb,MAyCa;EAAK;EAAE,IAAZ,CAAA,EAAA,MAAA;EAAI;;;;;;;EAQN,IAAA,CAAA,EAvCZ,eAuCY,CAvCI,KAuCJ,CAAA;EA+FH;EAAe,MAAA,CAAA,EApItB,YAoIsB;EAAA;EAOZ,MAKG,CAAA,EA9Ib,YA8Ia;EAAS;EAAlB,QAGJ,CAAA,EA/IE,cA+IF;EAAY;EAGA,OAGV,CAAA,EAnJD,aAmJC;EAAc;EAGF,KAGf,CAAA,EAvJA,WAuJA;AAAW,CAAA;AASpB;;;AAmBuB,KA7KX,aA6KW,CAAA,cA7KiB,UA6KjB,CAAA,GAAA,MA7KqC,KA6KrC,GAAA,MAAA;;;;AAnB0B,KArJrC,uBAqJqC,CAAA,cArJC,UAqJD,CAAA,GAAA;EAoChC;;;;;;EAeQ,UAEhB,CAAA,EAnMK,MAmML;EAAY,IAEZ,CAAA,EAAA,MAAA;EAAY,IAEX,CAAA,EAAA,QAED,MAtMK,KAsML,GAtMa,IAsMb,CAtMkB,KAsMlB,CAtMwB,CAsMxB,CAAA,EAAA,cAAA,CAAA,GAAA;IAAW,YAAA,CAAA,EArMF,aAqME,CArMY,KAqMZ,CAAA,EAAA;EAMH,CAAA,EAAY;EAAA,MAIvB,CAAA,EA5MI,YA4MJ;EAAS,MAAG,CAAA,EA3MR,YA2MQ;EAAe,QAErB,CAAA,EA5MA,cA4MA;EAAmB,OAQnB,CAAA,EAnND,aAmNC;EAAiB,KAAA,CAAA,EAlNpB,WAkNoB;AAe7B,CAAA;;;AC1/BA;AAIA;AA4BA;AAsBA;AAmBA;AAmBA;AAsDA;AAaA;AASA;;;;AACoD;AAGpD;;;;AAwBuD;AAIvD;;;;AAAoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;AAmIkD;;;;;;;;;;;;;;;;;;;;;;;;;UDqcjC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;YAGD;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UCvhCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACrClE,UESI,aAAA,CFJf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KEpEhB,aAAA,GFoEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE7aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF6UD,UE1UrB,YAAA,CF0UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAoLtB,QAAA,CAAA,EEhgBA,qBFonBV,GEpnBkC,kBFonBlC,EAAA;EAAA,CAAA;;UEhnBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA6BL;;;;;;;;;;;cAWC;cACA;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}

package/dist/{types-abJQuk7m.d.cts → types-C3POXhw3.d.mts}

@@ -2078,15 +2078,7 @@ interface GkmConfig {
    *
    * @example './src/**\/*.ts'
    */
-  constructs?: Routes;
-  routes: Routes;
-  functions?: Routes;
-  crons?: Routes;
-  subscribers?: Routes;
-  queues?: Routes;
-  topics?: Routes;
-  envParser: string;
-  logger: string;
+  constructs: Routes;
   providers?: ProvidersConfig;
   /**
    * Server lifecycle hooks for customizing the Hono app.
@@ -2181,4 +2173,4 @@ interface GkmConfig {
 }
 //#endregion
 export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, CacheBackend, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, EmailBackend, Framework, FrontendFramework, GkmConfig, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, OpenApiConfig, PHASE_2_DEPLOY_TARGETS, Routes, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, formatValidationErrors, getDeployTargetError, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig };
-//# sourceMappingURL=types-abJQuk7m.d.cts.map
+//# sourceMappingURL=types-C3POXhw3.d.mts.map

package/dist/{types-abJQuk7m.d.cts.map → types-C3POXhw3.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"types-abJQuk7m.d.cts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECrClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF3Fe,iBAAA,CE2Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF3FN,ME2FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFjHY,MEiHZ,CAAA,MAA0D,EFjH/B,gBEiH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF7HI,ME6HgB,CAAA,MAAA,EF7HD,ME6HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFncE,MEmcF,CAAA,MAAA,EFnciB,qBEsc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFjcxB,MEicwB,CAAA,MAAA,EFjcT,gBEicS,CAAA;EAAA;YF/b3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACrClE,UDkBI,cAAA,CCbf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDTrC,SCSqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDxCf,iBAAA,CCwCiB;EAAK;EAK1B,QAAA,ED3CF,aC2CE;AAoBb;;;;AAAqC,KDzDzB,WAAA,GAAc,gBCyDW,GDzDQ,cCyDR,GDzDyB,iBCyDzB;AAKrC;;;;;;;;AFjJiB,cE8CJ,sBF9CoB,EE8CE,CAAA,CAAA,OF9CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCYL,gBAAA,GAAmB,CAAA,CAAE,KDTxB,CAAA,OCSqC,sBDT5B,CAAA;AAQlB;AAQA;;AAA0B,cCFb,uBDEa,ECFU,CAAA,CAAA,ODEV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;AC2IhB;AA4BA;AAuBA;AA4CU,cDqFG,yBCrFU,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,SCrFf,CDqFe,CAAA,CAAA,SCrFf,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,qBCrFf,CAAA,CDqFe,CAAA,CAAA,SCrFf,CAAA;EAAA,QAAA,EDqFe,CAAA,CAAA,UCrFf,CAAA,WAAA,CAAA;EAAA,GA6Bb,eAAA,YAAA,CAAA;CAAY,eAeR,CAAA,aAAA,CAAA;EAAM,QAMV,EDmC4B,CAAA,CAAA,UCnC5B,CAAA,SAAA,CAAA;EAAM,MAMH,eAAA,UAAA,CAAA;IAMJ,WAAA,EAAA,WAAA;IAMC,WAAA,EAAA,WAAA;IAMA,WAAA,EAAA,WAAA;IAMK,WAAA,EAAA,WAAA;IAeF,YAAA,EAAA,YAAA;IAMJ,WAAA,EAAA,WAAA;IAMuB,YAAA,EAAA,YAAA;IAMH,YAAA,EAAA,YAAA;IAMR,gBAAA,EAAA,gBAAA;IAMV,gBAAA,EAAA,gBAAA;IAwCE,gBAAA,EAAA,gBAAA;IAkDH,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAmCR,gBAAc,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAGf,cAAA,EAAA,cAAA;IAFP,cAAA,EAAA,cAAA;IAAa,cAAA,EAAA,cAAA;IASL,WAAU,EAAA,WAAQ;IAQvB,WAAQ,EAAA,WAAG;IAOX,WAAU,EAAA,WAAA;IAAA,YAAA,EAAA,YAAA;IAAkB,YAAA,EAAA,YAAA;IAAf,YAAA,EAAA,YAAA;IAAM,YAAA,EAAA,YAAA;IAMnB,cAAe,EAAA,cAAA;IAAA,WAAA,EAAA,WAAA;EAAA,CAAA,CAAA,CAAe;EAAU,OACvC,eAAA,YAAA,CAAA;EAAK,YAAQ,eAAA,YAAA,CAAA;EAAK,GAAC,eAAA,YAAA,CAAA;CAAC,eAAZ,CAAA,aAAA,CAAA;EAAI,QACQ,cAAA,CAAA,YAAA,CAAA;EAAK,GAAA,eAAA,YAAA,CAAA;AAqCtC,CAAA,eAAY,CAAA,aAAc,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QAOrC,ED1UW,CAAA,CAAA,SC0UX,CAAA;IAUU,IAAA,EAAA,MAAA;IAAhB,UAAA,EDrVM,QCqVN;IAEE,aAAA,EDtVO,QCsVP;EAAY,CAAA,EAEZ;IAEE,IAAA,EAAA,MAAA;IAED,UAAA,ED7VG,QC6VH;IAEF,aAAA,ED9VQ,QC8VR;EAAW,CAAA,CAAA;EAMR,GAAA,eAAa,YAAA,CAAA;CAAA,eAAA,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAA,QAAe,ED5QF,CAAA,CAAA,UC4QE,CAAA,WAAA,CAAA;EAAU,GAAU,eAAA,YAAA,CAAA;EAAK,MAAA,aAAA;AAKjE,CAAA,eAAY,CAAA,aAAuB,CAAA;EAAA,QAAA,cAAA,CAAA,SAAA,CAAA;EAAA,MAAe,eAAA,UAAA,CAAA;IAOpC,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAAa,WAAA,EAAA,WAAA;IAAM,WAAA,EAAA,WAAA;IAAX,YAAA,EAAA,YAAA;IACU,WAAA,EAAA,WAAA;IAAd,YAAA,EAAA,YAAA;IAGR,YAAA,EAAA,YAAA;IACA,gBAAA,EAAA,gBAAA;IACE,gBAAA,EAAA,gBAAA;IACD,gBAAA,EAAA,gBAAA;IACF,gBAAA,EAAA,gBAAA;IAAW,gBAAA,EAAA,gBAAA;IA+FH,gBAAe,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAOlB,cAAA,EAAA,cAAA;IAKS,cAAA,EAAA,cAAA;IAAf,cAAA,EAAA,cAAA;IAGE,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAGE,WAAA,EAAA,WAAA;IAGD,YAAA,EAAA,YAAA;IAGF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IASH,YAAA,EAAA,YAAoB;IAAA,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EAAa,CAAA,CAAA,CAmBxC;EAAY,OAItB,eAAA,YAAA,CAAA;EAAS,YAEZ,eAAA,YAAA,CAAA;EAAe,GAzBoB,eAAA,YAAA,CAAA;EAAI,MAAA,aAAA;AAoCjD,CAAA,eAAiB,CAAA,aAAmB,CAAA;EAAA,QAAA,cAAA,CAAA,YAAA,CAAA;EAAA,GAWtB,eAAA,YAAA,CAAA;EAAM,MAEE,aAAA;CAAmB,eAAlC,CAAA,aAAA,CAAA;EAAM,QAEF,cAAA,CAAA,QAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAEX,EDvjBe,CAAA,CAAA,SCujBf,CAAA;IAED,IAAA,EAAA,MAAA;IAAW,UAAA,ED1jBN,QC0jBM;IAMH,aAAY,ED/jBZ,QC+jBY;EAAA,CAAA,EAAA;IAIvB,IAAA,EAAA,MAAA;IAAY,UAAA,EDpkBJ,QCokBI;IAEN,aAAA,EDrkBK,QCqkBL;EAAmB,CAAA,CAAA;EAQF,GAAA,eAAA,YAAA,CAAA;EAeb,MAAA,aAAA;CAAiB,eAAA,CAAA,CAAA,CAAA,CAAA,CAAA;AACxB,KDhgBG,SAAA,GAAY,CAAA,CAAE,KCggBjB,CAAA,ODhgB8B,yBCggB9B,CAAA;;;AACmB;;;;ACvhCX,cF8hBJ,mBE9hBqB,EF8hBF,CAAA,CAAA,SE9hBE,CAAA;EAKtB,IAAA,EFoiBV,CAAA,CAAA,UEpiBgB,CAAA,IAAuB,CAAA;EAaxB,OAAA,eAAc,YAAA,CAAA;EAKd,MAAA,WAAA,CAAA;IAIA,WAAA,EAAA,WAAgB;IAIhB,WAAA,EAAA,WAAgB;IA4BhB,WAAA,EAAa,WAAA;IAsBlB,WAAA,EAAa,WAAA;IAmBb,YAAY,EAAA,YAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,YAAY,EAAA,YAAA;IAaZ,YAAA,EAAA,YAAkB;IASlB,gBAAA,EAAA,gBAAqB;IAAA,gBAAA,EAAA,gBAAA;IAC1B,gBAAA,EAAA,gBAAA;IAAgC,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAGnC,gBAAY,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAwBhB,cAAA,EAAA,cAAA;IAAwB,cAAA,EAAA,cAAA;IAAkB,cAAA,EAAA,cAAA;IAItC,WAAa,EAAA,WAAA;IAAA,WAAA,EAAA,WAAA;IAIhB,WAAA,EAAA,WAAA;IAJwB,YAAA,EAAA,YAAA;IAAc,YAAA,EAAA,YAAA;IAOxC,YAAO,EAAA,YAAA;IAEF,YAAA,EAAe,YAAA;IAiBf,cAAY,EAAA,cAAA;IASZ,WAAA,EAAa,WAAA;EAWb,CAAA,CAAA;EA6BA,QAAA,eAAA,YAAqB,CAAA;EAarB,SAAA,eAAe,YAAA,CAAA;CAAA,eAAA,CAAA;AAGd,KF6ON,aAAA,GAAgB,CAAA,CAAE,KE7OZ,CAAA,OF6OyB,mBE7OzB,CAAA;;;;AAQE,cFyZP,qBEzZO,EFyZc,CAAA,CAAA,SEzZd,CAAA;EAAY,IAEX,eAAA,CF2gBlB,CAAA,CAAA,SE3gBkB,CAAA;EAAqB,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAGzB,KAAA,YAAS,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IAAA,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAAA,CAAA,eA6Bd,CAAA,CAAA,CAAA,CAAA;EAAc,IAWZ,eAAA,YAAA,YAAA,aAAA,CAAA;IACL,IAAA,cAAA,cAAA,UAAA,CAAA;MACI,OAAA,EAAA,SAAA;MACJ,GAAA,EAAA,KAAA;MACM,MAAA,EAAA,QAAA;IACL,CAAA,CAAA,CAAA,CAAA;IACA,IAAA,aAAA;IAGG,IAAA,aAAA;IAUJ,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAQuB,MAAA,eAAA,UAAA,CAAA;MAUH,OAAA,EAAA,SAAA;MAmBR,MAAA,EAAA,QAAA;MAEV,UAAA,EAAA,YAAA;IA4BD,CAAA,CAAA,CAAA;IAAY,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;MAa4B,KAAA,YAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBF7BzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkLoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA8O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF71BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC9Db,iBAAA,SAA0B,kBD8DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCnTR,cAAA,CDmTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCnTM;;;;;;SA6BY;;EDqRrB,OACL,CAAA,EChRyB,cDgRzB;EAAQ;EADH,MACL,CAAA,EC9Q8B,aD8Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC3WQ,OD2WR,CC3WgB,MD2WhB,CC5X2C,kBAAA,ED4X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAoLnC;;;;;;KC1gBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;;;;UAmBO,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;MDJI,EAAA,MAAA;EAAQ;;;;;WCiCZ;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;EDxEY,MACL,CAAA,EC6EP,MD7EO;EAAQ;;;;gBCmFV;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AD8HqB;AA0HlC;;;EAEuC,MAAlC,CAAA,ECxMK,eDwML;EAAK;AAOV;;;;;AAGmB;AAYnB;;;;ACx0BA;AAcA;AA2BA;AAoDA;;;;;;;;;AAwDiB;AAuBjB;AAqBA;AAkCA;;;;AAc+B;AAwC/B;AAA6B,UAoXZ,cApXY,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAqXpB,aArXoB,CAAA;EAAA;EAEN,YAEZ,CAAA,EAmXK,SAnXL,EAAA;;;AAIa;AAmBxB;AA4BA;AAuBiB,UAgTA,SAAA,SAAkB,aAhTL,CAAA;EA4CpB;EAAa,YAAA,CAAA,EAAA,MAAA,EAAA;;;;;AA8Dd,KA8MG,QAAA,GAAW,aA9Md,GAAA;EAAM,YAML,CAAA,EAAA,SAAA,MAAA,EAAA;CAAM;;;;AAuCgB,KAwKpB,UAAA,GAAa,MAxKO,CAAA,MAAA,EAwKQ,QAxKR,CAAA;;;;;AA4GtB,KAkEE,eAlEF,CAAA,cAkEgC,UAlEhC,CAAA,GAAA,QAAe,MAmEZ,KAnEY,GAmEJ,IAnEI,CAmEC,KAnED,CAmEO,CAnEP,CAAA,EAAA,cAAA,CAAA,GAAA;EAmCR,YAAA,CAAc,EAAA,SAAA,CAAA,MAiCE,KAjCF,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;AACT;AAStB;AAQA;AAOA;;;;AAA+B;AAM/B;;;;;;;;AAEsC;AAqCtC;;;;;;;;;;;AA2BoB;AAMpB;;;AAA4D,KAjChD,cAiCgD,CAAA,cAjCnB,UAiCmB,CAAA,GAAA;EAAK;AAKjE;;;;;EAUmB,UAAQ,CAAA,EAzCb,MAyCa;EAAK;EAAE,IAAZ,CAAA,EAAA,MAAA;EAAI;;;;;;;EAQN,IAAA,CAAA,EAvCZ,eAuCY,CAvCI,KAuCJ,CAAA;EA+FH;EAAe,MAAA,CAAA,EApItB,YAoIsB;EAAA;EAOZ,MAKG,CAAA,EA9Ib,YA8Ia;EAAS;EAAlB,QAGJ,CAAA,EA/IE,cA+IF;EAAY;EAGA,OAGV,CAAA,EAnJD,aAmJC;EAAc;EAGF,KAGf,CAAA,EAvJA,WAuJA;AAAW,CAAA;AASpB;;;AAmBuB,KA7KX,aA6KW,CAAA,cA7KiB,UA6KjB,CAAA,GAAA,MA7KqC,KA6KrC,GAAA,MAAA;;;;AAnB0B,KArJrC,uBAqJqC,CAAA,cArJC,UAqJD,CAAA,GAAA;EAoChC;;;;;;EAeQ,UAEhB,CAAA,EAnMK,MAmML;EAAY,IAEZ,CAAA,EAAA,MAAA;EAAY,IAEX,CAAA,EAAA,QAED,MAtMK,KAsML,GAtMa,IAsMb,CAtMkB,KAsMlB,CAtMwB,CAsMxB,CAAA,EAAA,cAAA,CAAA,GAAA;IAAW,YAAA,CAAA,EArMF,aAqME,CArMY,KAqMZ,CAAA,EAAA;EAMH,CAAA,EAAY;EAAA,MAIvB,CAAA,EA5MI,YA4MJ;EAAS,MAAG,CAAA,EA3MR,YA2MQ;EAAe,QAErB,CAAA,EA5MA,cA4MA;EAAmB,OAQnB,CAAA,EAnND,aAmNC;EAAiB,KAAA,CAAA,EAlNpB,WAkNoB;AAe7B,CAAA;;;AC1/BA;AAIA;AA4BA;AAsBA;AAmBA;AAmBA;AAsDA;AAaA;AASA;;;;AACoD;AAGpD;;;;AAwBuD;AAIvD;;;;AAAoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;;;;;;;AA2IkD;;;;;;;;;;;;;;;;;;;UD6bjC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;YAGD;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UCvhCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACrClE,UESI,aAAA,CFJf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KEpEhB,aAAA,GFoEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE7aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF6UD,UE1UrB,YAAA,CF0UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAoLtB,QAAA,CAAA,EEhgBA,qBFonBV,GEpnBkC,kBFonBlC,EAAA;EAAA,CAAA;;UEhnBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA6BL;;;;;;;;;;;eAWE;UACL;cACI;UACJ;gBACM;WACL;WACA;;;cAGG;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}
+{"version":3,"file":"types-C3POXhw3.d.mts","names":[],"sources":["../src/deploy/state.ts","../src/deploy/StateProvider.ts","../src/workspace/schema.ts","../src/workspace/types.ts","../src/types.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAaA;AAQA;AAQA;AAkBA;AAwBA;AAAkC,UA1DjB,gBAAA,CA0DiB;EAAA,MAMnB,EAAA,MAAA;EAAM,UAMY,EAAA,MAAA;;;;;AAIlB,UAlEE,qBAAA,CAkEF;EAAM,QAEQ,EAAA,MAAA;EAAgB,UAA/B,EAAA,MAAA;;AAEQ;;;UA9DL,gBAAA;ECZA;EAAa,MAAA,EAAA,MAAA;EAAA;EAOiB,IAAzB,EAAA,MAAA;EAAO;EAQiB,IAAG,EAAA,MAAA;EAAO;EAM5C,KAAA,EAAA,MAAS;EAgCJ;EAOA,GAAA,EAAA,MAAA;EAWA;EAQL,SAAA,EAAA,MAAW;;;;;AAAwD,UDjD9D,WAAA,CCiD8D;;;;ECrClE,SAAA,EAAA,MAAA;EA8BD;EAAgB,WAAA,EAAA,MAAA;EAAA;EAAwC,cAAnC,EAAA,MAAA;EAAK;EAKzB,kBAAA,EAAA,MAKX;EA6BU;EAAiB,aAAA,EAAA,MAAA;EAAA;EAAyC,gBAApC,CAAA,EAAA,MAAA;EAAK;EAK1B,MAAA,EAAA,MAAA;EAoBD;EAAe,SAAA,EAAA,MAAA;;;AAAU;AAKrC;AAIE,UF3Fe,iBAAA,CE2Ff;EAAA,QAJ0B,EAAA,SAAA;EAAA,KAAA,EAAA,MAAA;;WAAA,EAAA,MAAA;EAAA,aAAA,EAAA,MAAA;EAUhB,YAAS,EF3FN,ME2FM,CAAA,MAAA,EAAA,MAAA,CAAA;EAAA,QAAA,EAAA;IAAkB,UAAA,CAAA,EAAA,MAAA;IAAf,OAAE,CAAA,EAAA,MAAA;EAAK,CAAA;EAuBzB;EAKA,cAAA,CAAA,EFjHY,MEiHZ,CAAA,MAA0D,EFjH/B,gBEiH+B,CAAA;EAKhD;EASA,gBAAA,CAAA,EF7HI,ME6HgB,CAAA,MAAA,EF7HD,ME6HC,CAAA,MAAA,EAAA,MAAA,CAAA,CAAA;EASpB;EA+TH,WAAA,CAAA,EFncE,MEmcF,CAAA,MAAA,EFnciB,qBEsc5B,CAAA;EAAA;EAAA,UAHoC,CAAA,EFjcxB,MEicwB,CAAA,MAAA,EFjcT,gBEicS,CAAA;EAAA;YF/b3B;;;;;;;;;AApBX;;;;;;;AAgB8B,UCtEb,aAAA,CDsEa;EAAqB;;;;AAI7B;;uBCnEA,QAAQ;;AAP9B;;;;;EAe8C,KAAG,CAAA,KAAA,EAAA,MAAA,EAAA,KAAA,EAApB,iBAAoB,CAAA,EAAA,OAAA,CAAA,IAAA,CAAA;AAAO;AAMxD;AAgCA;AAOA;AAWiB,KAlDL,SAAA,GAkDsB,WAAA,GAEvB,WAAa,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,gBAAA,GAAA,cAAA,GAAA,cAAA,GAAA,cAAA,GAAA,WAAA,GAAA,WAAA,GAAA,WAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,YAAA,GAAA,cAAA,GAAA,WAAA;AAMxB;;;AAA6C,UA1B5B,gBAAA,CA0B4B;EAAc,QAAG,EAAA,OAAA;AAAiB;;;;ACrClE,UDkBI,cAAA,CCbf;EAyBU,QAAA,EAAA,KAAA;EAAgB;EAAA,MAAkB,EDTrC,SCSqC;EAAsB;EAA9B,OAAA,CAAA,EAAA,MAAA;AAKtC;AAkCA;;;AAAgC,UDxCf,iBAAA,CCwCiB;EAAK;EAK1B,QAAA,ED3CF,aC2CE;AAoBb;;;;AAAqC,KDzDzB,WAAA,GAAc,gBCyDW,GDzDQ,cCyDR,GDzDyB,iBCyDzB;AAKrC;;;;;;;;AFjJiB,cE8CJ,sBF9CoB,EE8CE,CAAA,CAAA,OF9CF,CAAA;EAQhB,IAAA,EAAA,MAAA;EAQA,aAAA,EAAA,aAAgB;EAkBhB,OAAA,EAAA,SAAW;EAwBX,OAAA,EAAA,SAAA;CAAiB,CAAA;;;;;;;;;;;AAoBZ;;;;AC1EtB;;;;;;AAewD;AAMxD;AAgCA;AAOiB,KCYL,gBAAA,GAAmB,CAAA,CAAE,KDTxB,CAAA,OCSqC,sBDT5B,CAAA;AAQlB;AAQA;;AAA0B,cCFb,uBDEa,ECFU,CAAA,CAAA,ODEV,CAAA;EAAgB,MAAG,EAAA,QAAA;EAAc,KAAG,EAAA,OAAA;EAAiB,IAAA,EAAA,MAAA;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;;;;AAA4B;AAU5B;AAAqB,KAxCT,iBAAA,GAAoB,CAAA,CAAE,KAwCb,CAAA,OAxC0B,uBAwC1B,CAAA;;;AAAU;AAuBzB,cA1DO,qBA0DwC,EA1DnB,CAAA,CAAA,OA0DmB,CAAA;EAK/C,IAAA,EAAA,MAAA;AAKN,CAAA,CAAA;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;KAjYY,eAAA,GAAkB,CAAA,CAAE,aAAa;;;;cAKhC,iBAAe,CAAA,CAAA,mBAAA,CAAA,CAAA;;;;;IAAA,CAAA,CAAA;;OA4XU,EAAA,OAAA;EAAA,IAzFxB,EAAA,MAAA;EAAQ,gBACL,EAAA,gBAAA;CAAQ,CAAA,WADX,CAAA;EAAQ,IACL,EAAA,MAAA;CAAQ,CAAA,CAAA,CAAA;;;;;AAwFa,KAlX1B,SAAA,GAAY,CAAA,CAAE,KAkXY,CAAA,OAlXC,eAkXD,CAAA;;;;cA3VhC;;;;cAKA;;;;iBAKU,uBAAA;;;;iBASA,oBAAA;;;;iBASA,oBAAA;;;;;AC2IhB;AA4BA;AAuBA;AA4CU,cDqFG,yBCrFU,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,SCrFf,CDqFe,CAAA,CAAA,SCrFf,EDqFe,CAAA,CAAA,QCrFf,CAAA,SAAA,CDqFe,CAAA,CAAA,qBCrFf,CAAA,CDqFe,CAAA,CAAA,SCrFf,CAAA;EAAA,QAAA,EDqFe,CAAA,CAAA,UCrFf,CAAA,WAAA,CAAA;EAAA,GA6Bb,eAAA,YAAA,CAAA;CAAY,eAeR,CAAA,aAAA,CAAA;EAAM,QAMV,EDmC4B,CAAA,CAAA,UCnC5B,CAAA,SAAA,CAAA;EAAM,MAMH,eAAA,UAAA,CAAA;IAMJ,WAAA,EAAA,WAAA;IAMC,WAAA,EAAA,WAAA;IAMA,WAAA,EAAA,WAAA;IAMK,WAAA,EAAA,WAAA;IAeF,YAAA,EAAA,YAAA;IAMJ,WAAA,EAAA,WAAA;IAMuB,YAAA,EAAA,YAAA;IAMH,YAAA,EAAA,YAAA;IAMR,gBAAA,EAAA,gBAAA;IAMV,gBAAA,EAAA,gBAAA;IAwCE,gBAAA,EAAA,gBAAA;IAkDH,gBAAA,EAAA,gBAAA;IAAe,gBAAA,EAAA,gBAAA;IAmCR,gBAAc,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAGf,cAAA,EAAA,cAAA;IAFP,cAAA,EAAA,cAAA;IAAa,cAAA,EAAA,cAAA;IASL,WAAU,EAAA,WAAQ;IAQvB,WAAQ,EAAA,WAAG;IAOX,WAAU,EAAA,WAAA;IAAA,YAAA,EAAA,YAAA;IAAkB,YAAA,EAAA,YAAA;IAAf,YAAA,EAAA,YAAA;IAAM,YAAA,EAAA,YAAA;IAMnB,cAAe,EAAA,cAAA;IAAA,WAAA,EAAA,WAAA;EAAA,CAAA,CAAA,CAAe;EAAU,OACvC,eAAA,YAAA,CAAA;EAAK,YAAQ,eAAA,YAAA,CAAA;EAAK,GAAC,eAAA,YAAA,CAAA;CAAC,eAAZ,CAAA,aAAA,CAAA;EAAI,QACQ,cAAA,CAAA,YAAA,CAAA;EAAK,GAAA,eAAA,YAAA,CAAA;AAqCtC,CAAA,eAAY,CAAA,aAAc,CAAA;EAAA,QAAA,cAAA,CAAA,QAAA,CAAA;CAAA,eAAe,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAU,QAOrC,ED1UW,CAAA,CAAA,SC0UX,CAAA;IAUU,IAAA,EAAA,MAAA;IAAhB,UAAA,EDrVM,QCqVN;IAEE,aAAA,EDtVO,QCsVP;EAAY,CAAA,EAEZ;IAEE,IAAA,EAAA,MAAA;IAED,UAAA,ED7VG,QC6VH;IAEF,aAAA,ED9VQ,QC8VR;EAAW,CAAA,CAAA;EAMR,GAAA,eAAa,YAAA,CAAA;CAAA,eAAA,CAAA,CAAA,CAAA,CAAA,YAAA,CAAA,SAAA,wBAAA,CAAA,YAAA,CAAA;EAAA,QAAe,ED5QF,CAAA,CAAA,UC4QE,CAAA,WAAA,CAAA;EAAU,GAAU,eAAA,YAAA,CAAA;EAAK,MAAA,aAAA;AAKjE,CAAA,eAAY,CAAA,aAAuB,CAAA;EAAA,QAAA,cAAA,CAAA,SAAA,CAAA;EAAA,MAAe,eAAA,UAAA,CAAA;IAOpC,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAAa,WAAA,EAAA,WAAA;IAAM,WAAA,EAAA,WAAA;IAAX,YAAA,EAAA,YAAA;IACU,WAAA,EAAA,WAAA;IAAd,YAAA,EAAA,YAAA;IAGR,YAAA,EAAA,YAAA;IACA,gBAAA,EAAA,gBAAA;IACE,gBAAA,EAAA,gBAAA;IACD,gBAAA,EAAA,gBAAA;IACF,gBAAA,EAAA,gBAAA;IAAW,gBAAA,EAAA,gBAAA;IA+FH,gBAAe,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAOlB,cAAA,EAAA,cAAA;IAKS,cAAA,EAAA,cAAA;IAAf,cAAA,EAAA,cAAA;IAGE,WAAA,EAAA,WAAA;IAGA,WAAA,EAAA,WAAA;IAGE,WAAA,EAAA,WAAA;IAGD,YAAA,EAAA,YAAA;IAGF,YAAA,EAAA,YAAA;IAAW,YAAA,EAAA,YAAA;IASH,YAAA,EAAA,YAAoB;IAAA,cAAA,EAAA,cAAA;IAAa,WAAA,EAAA,WAAA;EAAa,CAAA,CAAA,CAmBxC;EAAY,OAItB,eAAA,YAAA,CAAA;EAAS,YAEZ,eAAA,YAAA,CAAA;EAAe,GAzBoB,eAAA,YAAA,CAAA;EAAI,MAAA,aAAA;AAoCjD,CAAA,eAAiB,CAAA,aAAmB,CAAA;EAAA,QAAA,cAAA,CAAA,YAAA,CAAA;EAAA,GAWtB,eAAA,YAAA,CAAA;EAAM,MAEE,aAAA;CAAmB,eAAlC,CAAA,aAAA,CAAA;EAAM,QAEF,cAAA,CAAA,QAAA,CAAA;EAAc,MAEhB,aAAA;CAAY,eAEZ,CAAA,CAAA,EAAA,UAAA,CAAA,aAAA,CAAA;EAAY,QAEX,EDvjBe,CAAA,CAAA,SCujBf,CAAA;IAED,IAAA,EAAA,MAAA;IAAW,UAAA,ED1jBN,QC0jBM;IAMH,aAAY,ED/jBZ,QC+jBY;EAAA,CAAA,EAAA;IAIvB,IAAA,EAAA,MAAA;IAAY,UAAA,EDpkBJ,QCokBI;IAEN,aAAA,EDrkBK,QCqkBL;EAAmB,CAAA,CAAA;EAQF,GAAA,eAAA,YAAA,CAAA;EAeb,MAAA,aAAA;CAAiB,eAAA,CAAA,CAAA,CAAA,CAAA,CAAA;AACxB,KDhgBG,SAAA,GAAY,CAAA,CAAE,KCggBjB,CAAA,ODhgB8B,yBCggB9B,CAAA;;;AACmB;;;;ACvhCX,cF8hBJ,mBE9hBqB,EF8hBF,CAAA,CAAA,SE9hBE,CAAA;EAKtB,IAAA,EFoiBV,CAAA,CAAA,UEpiBgB,CAAA,IAAuB,CAAA;EAaxB,OAAA,eAAc,YAAA,CAAA;EAKd,MAAA,WAAA,CAAA;IAIA,WAAA,EAAA,WAAgB;IAIhB,WAAA,EAAA,WAAgB;IA4BhB,WAAA,EAAa,WAAA;IAsBlB,WAAA,EAAa,WAAA;IAmBb,YAAY,EAAA,YAAA;IAmBZ,WAAA,EAAc,WAAA;IAsDd,YAAY,EAAA,YAAA;IAaZ,YAAA,EAAA,YAAkB;IASlB,gBAAA,EAAA,gBAAqB;IAAA,gBAAA,EAAA,gBAAA;IAC1B,gBAAA,EAAA,gBAAA;IAAgC,gBAAA,EAAA,gBAAA;IAAa,gBAAA,EAAA,gBAAA;IAGnC,gBAAY,EAAA,gBAAA;IAAA,gBAAA,EAAA,gBAAA;IAwBhB,cAAA,EAAA,cAAA;IAAwB,cAAA,EAAA,cAAA;IAAkB,cAAA,EAAA,cAAA;IAItC,WAAa,EAAA,WAAA;IAAA,WAAA,EAAA,WAAA;IAIhB,WAAA,EAAA,WAAA;IAJwB,YAAA,EAAA,YAAA;IAAc,YAAA,EAAA,YAAA;IAOxC,YAAO,EAAA,YAAA;IAEF,YAAA,EAAe,YAAA;IAiBf,cAAY,EAAA,cAAA;IASZ,WAAA,EAAa,WAAA;EAWb,CAAA,CAAA;EA6BA,QAAA,eAAA,YAAqB,CAAA;EAarB,SAAA,eAAe,YAAA,CAAA;CAAA,eAAA,CAAA;AAGd,KF6ON,aAAA,GAAgB,CAAA,CAAE,KE7OZ,CAAA,OF6OyB,mBE7OzB,CAAA;;;;AAQE,cFyZP,qBEzZO,EFyZc,CAAA,CAAA,SEzZd,CAAA;EAAY,IAEX,eAAA,CF2gBlB,CAAA,CAAA,SE3gBkB,CAAA;EAAqB,UAAA,eAAA,WAAA,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,aAAA,CAAA;IAGzB,KAAA,YAAS,CAAA,SAAA,YAAA,YAAA,YAAA,CAAA,CAAA,CAAA;IAAA,SAAA,aAAA,CAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,EAAA,CAAA,QAAA,EAAA,MAAA,EAAA,GAAA,MAAA,CAAA;EAAA,CAAA,eA6Bd,CAAA,CAAA,CAAA,CAAA;EAAc,IAWb,eAAA,YAAA,YAAA,aAAA,CAAA;IACA,IAAA,cAAA,cAAA,UAAA,CAAA;MAUJ,OAAA,EAAA,SAAA;MAQuB,GAAA,EAAA,KAAA;MAUH,MAAA,EAAA,QAAA;IAmBR,CAAA,CAAA,CAAA,CAAA;IAEV,IAAA,aAAA;IA4BD,IAAA,aAAA;IAAY,YAAA,eAAA,WAAA,YAAA,CAAA,CAAA;IAa4B,MAAA,eAAA,UAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBFrBzB,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gBAAQ,CAAA,CAAA;;oBADX;uBACG;;;oBADH;uBACG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkLoC,CAAA,CAAA;YAAzB;aAAiB;;YAAjB;aAAiB;;;;;;;;iBA8O7B,uBAAA,mBAEb,CAAA,CAAE,aAAa;;;;iBAOF,2BAAA;;SAER,CAAA,CAAE,aAAa;UACd,CAAA,CAAE;;;;;iBAYK,sBAAA,QAA8B,CAAA,CAAE;;;AF71BhD;AAkBA;AAwBA;;;;;;;;;;;;AAoBsB;KGzCV,YAAA;;;AFjCZ;;;;;;AAewD;AAMxD;AAgCA;AAOA;AAWiB,UExBA,kBAAA,CF0BN;EAMC;EAAW,OAAA,CAAA,EAAA,MAAA;EAAA;EAAmB,KAAG,CAAA,EAAA,MAAA;;AAAkC;;;;ACrC/E;AA8BA;;;;AAAsC;AAKtC;AAkCA;;;;AAAuC;AAKvC;AAoBA;;;AAA8B,UC9Db,iBAAA,SAA0B,kBD8DX,CAAA;EAAK;EAKxB,IAAA,CAAA,EAAA;IAIX,IAAA,EAAA,MAAA;IAJ0B,IAAA,EAAA,MAAA;IAAA,IAAA,CAAA,EAAA,MAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAxFyB,UCnTR,cAAA,CDmTQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UCnTM;;;;;;SA6BY;;EDqRrB,OACL,CAAA,EChRyB,cDgRzB;EAAQ;EADH,MACL,CAAA,EC9Q8B,aD8Q9B;EAAQ;;;;;;;;AAwFa;AAKtC;;;;AAA+B;AAQ/B;;EAWE,MAAA,CAAA,EC3WQ,OD2WR,CC3WgB,MD2WhB,CC5X2C,kBAAA,ED4X3C,MAAA,CAAA,CAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;AAoLnC;;;;;;KC1gBY,oBAAA,GAAuB;;;;;;;;;;;;;;;;;;;;KAqBvB,eAAA,YAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkCtB,sBAAA;;;;cAIJ;;;;;;;;;;YAUF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAwCM,YAAA;;YAEN;;YAEA;;QAEJ;;YAEI;;;;;;;;;;;;;;;;;;UAmBM,YAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4BA,YAAA;;;;WAIP;;;;;;;;;;;;;;;;;;UAmBO,aAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA4CP,aAAA;;;;;;;;;;;;;;;;;;;;MDJI,EAAA,MAAA;EAAQ;;;;;WCiCZ;;;;;;;;;;eAeI;;;;;WAMJ;;;;;cAMG;;;;;UAMJ;;;;;WAMC;;;;;EDxEY,MACL,CAAA,EC6EP,MD7EO;EAAQ;;;;gBCmFV;;;;;;;;;;;;cAeF;;;;;UAMJ;;;;;iCAMuB;;;;;8BAMH;;;;;sBAMR;;;;;YAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AD8HqB;AA0HlC;;;EAEuC,MAAlC,CAAA,ECxMK,eDwML;EAAK;AAOV;;;;;AAGmB;AAYnB;;;;ACx0BA;AAcA;AA2BA;AAoDA;;;;;;;;;AAwDiB;AAuBjB;AAqBA;AAkCA;;;;AAc+B;AAwC/B;AAA6B,UAoXZ,cApXY,CAAA,kBAAA,MAAA,GAAA,MAAA,CAAA,SAqXpB,aArXoB,CAAA;EAAA;EAEN,YAEZ,CAAA,EAmXK,SAnXL,EAAA;;;AAIa;AAmBxB;AA4BA;AAuBiB,UAgTA,SAAA,SAAkB,aAhTL,CAAA;EA4CpB;EAAa,YAAA,CAAA,EAAA,MAAA,EAAA;;;;;AA8Dd,KA8MG,QAAA,GAAW,aA9Md,GAAA;EAAM,YAML,CAAA,EAAA,SAAA,MAAA,EAAA;CAAM;;;;AAuCgB,KAwKpB,UAAA,GAAa,MAxKO,CAAA,MAAA,EAwKQ,QAxKR,CAAA;;;;;AA4GtB,KAkEE,eAlEF,CAAA,cAkEgC,UAlEhC,CAAA,GAAA,QAAe,MAmEZ,KAnEY,GAmEJ,IAnEI,CAmEC,KAnED,CAmEO,CAnEP,CAAA,EAAA,cAAA,CAAA,GAAA;EAmCR,YAAA,CAAc,EAAA,SAAA,CAAA,MAiCE,KAjCF,GAAA,MAAA,CAAA,EAAA;AAAA,CAAA,EAAA;;AACT;AAStB;AAQA;AAOA;;;;AAA+B;AAM/B;;;;;;;;AAEsC;AAqCtC;;;;;;;;;;;AA2BoB;AAMpB;;;AAA4D,KAjChD,cAiCgD,CAAA,cAjCnB,UAiCmB,CAAA,GAAA;EAAK;AAKjE;;;;;EAUmB,UAAQ,CAAA,EAzCb,MAyCa;EAAK;EAAE,IAAZ,CAAA,EAAA,MAAA;EAAI;;;;;;;EAQN,IAAA,CAAA,EAvCZ,eAuCY,CAvCI,KAuCJ,CAAA;EA+FH;EAAe,MAAA,CAAA,EApItB,YAoIsB;EAAA;EAOZ,MAKG,CAAA,EA9Ib,YA8Ia;EAAS;EAAlB,QAGJ,CAAA,EA/IE,cA+IF;EAAY;EAGA,OAGV,CAAA,EAnJD,aAmJC;EAAc;EAGF,KAGf,CAAA,EAvJA,WAuJA;AAAW,CAAA;AASpB;;;AAmBuB,KA7KX,aA6KW,CAAA,cA7KiB,UA6KjB,CAAA,GAAA,MA7KqC,KA6KrC,GAAA,MAAA;;;;AAnB0B,KArJrC,uBAqJqC,CAAA,cArJC,UAqJD,CAAA,GAAA;EAoChC;;;;;;EAeQ,UAEhB,CAAA,EAnMK,MAmML;EAAY,IAEZ,CAAA,EAAA,MAAA;EAAY,IAEX,CAAA,EAAA,QAED,MAtMK,KAsML,GAtMa,IAsMb,CAtMkB,KAsMlB,CAtMwB,CAsMxB,CAAA,EAAA,cAAA,CAAA,GAAA;IAAW,YAAA,CAAA,EArMF,aAqME,CArMY,KAqMZ,CAAA,EAAA;EAMH,CAAA,EAAY;EAAA,MAIvB,CAAA,EA5MI,YA4MJ;EAAS,MAAG,CAAA,EA3MR,YA2MQ;EAAe,QAErB,CAAA,EA5MA,cA4MA;EAAmB,OAQnB,CAAA,EAnND,aAmNC;EAAiB,KAAA,CAAA,EAlNpB,WAkNoB;AAe7B,CAAA;;;AC1/BA;AAIA;AA4BA;AAsBA;AAmBA;AAmBA;AAsDA;AAaA;AASA;;;;AACoD;AAGpD;;;;AAwBuD;AAIvD;;;;AAAoD;AAOpD;AAEA;AAiBA;AASA;AAWA;AA6BA;AAaA;;;;;;;;AAa0C;AAG1C;;;;;;;;;;;;AAmIkD;;;;;;;;;;;;;;;;;;;;;;;;;UDqcjC,eAAA;;;;;;;eAOH;;;;SAKN,eAAe;;WAGb;;WAGA;;aAGE;;YAGD;;UAGF;;;;;;;;UASQ,mBAAA,SAA4B,KAAK;;;;;;;;;;;;;;;;;;wBAmB3B;;;;cAIV;;WAEH;;;;;;;;;;UAWO,mBAAA;;;;;;;;;;;eAWH;;QAEP,eAAe;;YAEX;;UAEF;;UAEA;;WAEC;;UAED;;;;;UAMQ,YAAA;;;;OAIX,YAAY;;aAEN;;;;;;;;aAQA;;;;;;;;;;;;;;iBAeI,iBAAA,SACP,YAAY,4BACR;;;;UCvhCI,iBAAA;EJIA,KAAA,EAAA,MAAA,GAAA,MAAgB,EAAA;EAQhB,SAAA,EAAA,CAAA,QAAA,EAAA,MAAqB,EAAA,GAAA,MAAA;AAQtC;AAkBiB,KIjCL,MAAA,GJiCgB,MAAA,GAAA,MAAA,EAAA,GIjCa,iBJiCb;AAwBM,UI5CjB,cAAA,CJ4CiB;EAAA,OAMnB,CAAA,EAAA,OAAA;EAAM,SAMY,CAAA,EAAA,MAAA;;AAEE,UIrDlB,mBAAA,SAA4B,cJqDV,CAAA;AAEL,UInDb,eAAA,SAAwB,cJmDX,CAAA;AAED,UIjDZ,gBAAA,CJiDY;EAAgB;EAAzB,OAET,CAAA,EAAA,OAAA;EAAW;;;;EC1EL;EAAa,WAAA,CAAA,EAAA,MAAA;EAAA;EAOiB,gBAAzB,CAAA,EAAA,OAAA;EAAO;EAQiB,QAAG,CAAA,EAAA,MAAA,EAAA;EAAO;EAM5C,WAAA,CAAS,EAAA,SAAA,GAAA,SAAA;EAgCJ;EAOA,OAAA,CAAA,EAAA,OAAc;EAWd;AAQjB;;;;;AAA+E;;;;ACrClE,UESI,aAAA,CFJf;EAyBU;;;;EAA0B,KAAA,CAAA,EAAA,MAAA;EAKzB;AAkCb;;;EAAsE,OAApC,CAAA,EAAA,MAAA;AAAK;AAKvC;AAoBA;;;;AAAqC;AAKrC;;;AAA4B,KEpEhB,aAAA,GFoEgB,QAAA,GAAA,KAAA,GAAA,UAAA;;;AAAA;AAU5B;;;;AAA+B;AAAyB;AAuBH;AAUrD;AASA;AASA;AA+TA;;;;KE7aY,YAAA;;;;;;;;;;;;;;;;;;KAmBA,cAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAsDA,YAAA;;;;;;;;;;;KAaA,kBAAA;;KASA,qBAAA,WACL,gCAAgC;AF6UD,UE1UrB,YAAA,CF0UqB;EAK1B;EAAS,QAAA,CAAA,EAAA,MAAA;EAAA;EAA2C,SAAtC,CAAA,EAAA,MAAA;EAAK;EAQlB,SAAA,CAAA,EAAA,MAAA;EAWX;EAAA,IAAA,CAAA,EAAA,MAAA;;;;;;;;;;AAX8B;AAahC;;;;AAAmC;IAoLtB,QAAA,CAAA,EEhgBA,qBFonBV,GEpnBkC,kBFonBlC,EAAA;EAAA,CAAA;;UEhnBc,YAAA,SAAqB;;;;eAIxB;;KAGF,OAAA;UAEK,eAAA;;;;;;;;;;;;;;;;UAiBA,YAAA;;;;;;;;UASA,aAAA;;;;;;;;;;UAWA,WAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6BA,qBAAA;;;;;;;;;;;;UAaA,eAAA;;;qBAGC;qBACA;;;4BAGO;wBACJ;;;qBAGD;;sBAEC;;UAGJ,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aA6BL;;;;;;;;;;;cAWC;cACA;;;;;;;;;;UAUJ;;;;;;;;iCAQuB;;;;;;;;;;8BAUH;;;;;;;;;;;;;;;;;;;sBAmBR;;YAEV;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA4BD;;;;;;;;;;;;;WAAY"}

package/dist/workspace/index.cjs

@@ -1,4 +1,4 @@
-const require_workspace = require('../workspace-BcucjwvA.cjs');
+const require_workspace = require('../workspace-LKiNyaDy.cjs');
 
 exports.PHASE_2_DEPLOY_TARGETS = require_workspace.PHASE_2_DEPLOY_TARGETS;
 exports.PUBLIC_ENV_PREFIXES = require_workspace.PUBLIC_ENV_PREFIXES;

package/dist/workspace/index.d.cts

@@ -1,3 +1,3 @@
-import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, formatValidationErrors, getDeployTargetError, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig } from "../types-abJQuk7m.cjs";
-import { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace } from "../index-CHB4tSzX.cjs";
+import { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, formatValidationErrors, getDeployTargetError, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, safeValidateWorkspaceConfig, validateWorkspaceConfig } from "../types-BLSNdrk0.cjs";
+import { PUBLIC_ENV_PREFIXES, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getEndpointForStage, getPublicEnvPrefix, normalizeWorkspace, processConfig, stripPublicPrefix, workspaceConstructGlobs, wrapSingleAppAsWorkspace } from "../index-BGGdjueF.cjs";
 export { AppConfig, AppConfigInput, AppInput, AppsRecord, BackendFramework, ConstrainedApps, DeployConfig, DeployTarget, DokployWorkspaceConfig, FrontendFramework, InferAppNames, InferredWorkspaceConfig, LoadedConfig, MailServiceConfig, MobileFramework, ModelsConfig, NormalizedAppConfig, NormalizedWorkspace, PHASE_2_DEPLOY_TARGETS, PUBLIC_ENV_PREFIXES, SUPPORTED_DEPLOY_TARGETS, SecretsConfig, ServiceImageConfig, ServicesConfig, SharedConfig, WorkspaceConfig, WorkspaceConfigSchema, WorkspaceInput, allConstructGlobs, appConstructGlobs, constructPatterns, defineWorkspace, formatValidationErrors, getAppBuildOrder, getAppGkmConfig, getDependencyEnvVars, getDeployTargetError, getEndpointForStage, getPublicEnvPrefix, isDeployTargetSupported, isPhase2DeployTarget, isWorkspaceConfig, normalizeWorkspace, processConfig, safeValidateWorkspaceConfig, stripPublicPrefix, validateWorkspaceConfig, workspaceConstructGlobs, wrapSingleAppAsWorkspace };