@geekmidas/cli 9.0.2 → 10.0.0-alpha.1

package/dist/emit-CiZS_5Ub.mjs

@@ -0,0 +1,206 @@
+import { dirname, join } from "node:path";
+import { canonicalId, provideKey } from "@geekmidas/manifest";
+import { mkdir, writeFile } from "node:fs/promises";
+
+//#region src/reconcile/emit.ts
+/** Where the build writes it, relative to the app root. */
+const MANIFEST_PATH = ".gkm/manifest.ts";
+/**
+* Fold the build's generated routes into the surface that serves them.
+*
+* The routes already exist: `gkm build` generates one handler per endpoint and
+* records its path, method and environment. What was missing is that the
+* *construct* manifest never learned about them, so a `rest-api` node said
+* `endpoints: []` while five handlers sat in `.gkm/`. Two documents describing
+* the same routes, one of them wrong.
+*
+* Merging here rather than making the construct name a glob or import its
+* endpoints: the build is the thing that already walked the filesystem and
+* already knows where it wrote each handler. Asking the declaration to restate
+* any of that is how the two come to disagree.
+*
+* Attribution is by exclusion — routes go to the surface that declared none of
+* its own. A surface with static endpoints (an auth server's single wildcard)
+* keeps them. That is exact while an app has one API of its own, and needs a
+* real answer the day it has two; the alternative today would be inventing one
+* before anything needs it.
+*
+* **Only from a provider that generates one handler per route.** The `server`
+* provider generates a single catch-all — `ALL *` pointing at the Hono app that
+* routes in-process — which is a true description of that build and a false
+* description of the application. Merging it wrote `endpoints: [{ method:
+* 'ALL', path: '*' }]` into a manifest for an app with five routes, and made the
+* document's contents depend on which `--provider` ran last. A manifest must not
+* do that.
+*/
+function withRoutes(manifest, routes, options) {
+	if (routes.length === 0 || !options.perRoute) return manifest;
+	const target = Object.entries(manifest).find(([, declaration$1]) => declaration$1.kind === "rest-api" && declaration$1.endpoints.length === 0);
+	if (!target) return manifest;
+	const [id, declaration] = target;
+	if (declaration.kind !== "rest-api") return manifest;
+	return {
+		...manifest,
+		[id]: {
+			...declaration,
+			endpoints: routes.map((route) => asEndpoint(manifest, id, route))
+		}
+	};
+}
+/**
+* Fold in the compute the build generated: functions, crons, queue workers and
+* topic subscribers.
+*
+* All four are named by their *export*, the same way an endpoint's handler is —
+* `CronGenerator` uses the export key as the name — so none of them can declare
+* themselves and all of them are the build's to add. That is why a `Function`
+* has no `declare()` and never will.
+*
+* A worker and a subscriber **nest** inside the queue or topic that triggers
+* them, because position carries the trigger. A function and a cron are
+* top-level, because nothing triggers them but a caller or a clock.
+*/
+function withCompute(manifest, compute) {
+	const next = { ...manifest };
+	for (const fn of compute.functions ?? []) next[fn.name] = {
+		kind: "function",
+		id: fn.name,
+		handler: fn.handler,
+		dependencies: edgesTo(manifest, fn.dependencies),
+		provides: [provideKey(fn.name, "url")]
+	};
+	for (const cron of compute.crons ?? []) next[cron.name] = {
+		kind: "cron",
+		id: cron.name,
+		handler: cron.handler,
+		schedule: cron.schedule,
+		dependencies: edgesTo(manifest, cron.dependencies)
+	};
+	for (const worker of compute.queues ?? []) {
+		const queue = next[canonicalId(worker.name)];
+		if (queue?.kind !== "queue") continue;
+		next[queue.id] = {
+			...queue,
+			worker: {
+				id: `${queue.id}Worker`,
+				handler: worker.handler,
+				dependencies: edgesTo(manifest, worker.dependencies)
+			}
+		};
+	}
+	for (const subscriber of compute.subscribers ?? []) {
+		const topicId = subscriber.topic && canonicalId(subscriber.topic);
+		const topic = topicId ? next[topicId] : void 0;
+		if (topic?.kind !== "topic") continue;
+		next[topic.id] = {
+			...topic,
+			subscribers: [...topic.subscribers, {
+				id: subscriber.name,
+				handler: subscriber.handler,
+				events: subscriber.subscribedEvents,
+				dependencies: edgesTo(manifest, subscriber.dependencies)
+			}]
+		};
+	}
+	return next;
+}
+/**
+* Construct ids as manifest edges.
+*
+* A `Dependency` carries the target's kind as well as its id, and the kind is
+* read off the manifest rather than recorded beside the edge — the same rule
+* `edgeTo` follows, for the same reason: a hand-written kind is one fact stated
+* twice, and the copy is what goes stale.
+*
+* An id that names nothing is dropped rather than thrown on. A handler can
+* depend on a construct that declares no node of its own — a lifted `Service`
+* is exactly that — and a build is the wrong place to refuse it; what a target
+* needs from this list is the subset it can actually grant.
+*/
+function edgesTo(manifest, ids = []) {
+	return ids.flatMap((target) => {
+		const declaration = manifest[target];
+		return declaration ? [{
+			target,
+			kind: declaration.kind
+		}] : [];
+	});
+}
+/** One generated route as the manifest's shape. */
+function asEndpoint(manifest, surface, route) {
+	return {
+		id: `${surface}${route.method}${route.path}`,
+		handler: route.handler,
+		method: route.method,
+		path: route.path,
+		dependencies: edgesTo(manifest, route.dependencies),
+		...route.authorizer ? { authorizer: route.authorizer } : {}
+	};
+}
+/**
+* The manifest as TypeScript source.
+*
+* Pure, so what gets written can be asserted without touching a filesystem.
+*/
+function manifestModule(manifest, backends = {}) {
+	return `${HEADER}
+export const manifest = ${serialise(manifest)} as const satisfies ConstructManifest;
+
+/**
+ * Where the backends that are *config* rather than declaration resolved to.
+ *
+ * Recorded because they were being answered twice: once by the build, which
+ * registers exactly one cache driver, and once by a deploy config, which told
+ * the provisioner something else. The result was a deployed URL the running code
+ * had no driver for — two documents disagreeing about one fact, which is what
+ * this manifest exists to stop.
+ */
+export const backends = ${serialise(backends)} as const;
+
+// Derived types
+export type Ids = IdsOf<typeof manifest>;
+export type Construct<Id extends Ids> = DeclarationOf<typeof manifest, Id>;
+export type Kind = Construct<Ids>['kind'];
+
+// Useful union types
+export type ProvidedKeys = AllProvidedKeys<typeof manifest>;
+export type Surfaces = IdsOfKind<typeof manifest, 'rest-api'>;
+export type CacheBackend = (typeof backends)['cache'];
+export type EmailBackend = (typeof backends)['email'];
+`;
+}
+/** Write it where the deploy config expects to import it from. */
+async function writeManifestModule(manifest, appRoot, backends = {}) {
+	const path = join(appRoot, MANIFEST_PATH);
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, manifestModule(manifest, backends), "utf8");
+	return path;
+}
+const HEADER = `// Generated by \`gkm build\`. Do not edit.
+//
+// Discovery imports application code, so it runs once here rather than in every
+// consumer — a deploy config that discovered for itself would evaluate the whole
+// runtime graph inside its own toolchain. This is the result, as literals.
+
+import type {
+	AllProvidedKeys,
+	ConstructManifest,
+	DeclarationOf,
+	IdsOf,
+	IdsOfKind,
+} from '@geekmidas/manifest';
+`;
+/**
+* JSON, re-indented with tabs and with keys left unquoted where they can be.
+*
+* Cosmetic, and worth it: this file is read by people trying to work out what
+* their app declares, and a wall of quoted keys reads as output rather than as
+* something anyone is expected to understand.
+*/
+function serialise(value) {
+	return JSON.stringify(value, null, "	").replace(/^(\t*)"([A-Za-z_$][\w$]*)":/gm, "$1$2:").replace(/"/g, "'");
+}
+
+//#endregion
+export { MANIFEST_PATH, manifestModule, withCompute, withRoutes, writeManifestModule };
+//# sourceMappingURL=emit-CiZS_5Ub.mjs.map

package/dist/emit-CiZS_5Ub.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit-CiZS_5Ub.mjs","names":["manifest: ConstructManifest","routes: readonly RouteInfo[]","options: { perRoute: boolean }","declaration","compute: {\n\t\tfunctions?: readonly FunctionInfo[];\n\t\tcrons?: readonly CronInfo[];\n\t\tqueues?: readonly QueueInfo[];\n\t\tsubscribers?: readonly SubscriberInfo[];\n\t}","next: Record<string, Declaration>","ids: readonly string[]","surface: string","route: RouteInfo","backends: Backends","appRoot: string","value: object"],"sources":["../src/reconcile/emit.ts"],"sourcesContent":["/**\n * The manifest, written out as a module.\n *\n * Discovery imports the application's own code — that is how it finds\n * constructs — so anything calling it evaluates the whole runtime graph: React\n * email templates, database clients, modules that read env at import time. That\n * is fine inside `gkm dev`, which is already running the app. It is not fine\n * inside a deploy config, where it fails on the first thing the deploy toolchain\n * does not expect and would keep failing on the next.\n *\n * So discovery happens once, in the build, and everything downstream reads what\n * it wrote. The same split `RestApi` makes by naming a routes glob rather than\n * importing route modules.\n *\n * A module rather than JSON, because a manifest is not just data to this\n * codebase — `as const satisfies ConstructManifest` is what keeps every id,\n * kind and provided key a *literal*, so `IdsOf`, `ProvidedKeys` and the rest\n * can select out of it. `JSON.parse` returns `any` and gives all of that up.\n */\n\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport type {\n\tConstructManifest,\n\tCronInfo,\n\tDeclaration,\n\tDependency,\n\tFunctionInfo,\n\tQueueInfo,\n\tRestApiEndpoint,\n\tRouteInfo,\n\tSubscriberInfo,\n} from '@geekmidas/manifest';\nimport { canonicalId, provideKey } from '@geekmidas/manifest';\nimport type { CacheBackend, EmailBackend } from '../types.js';\n\n/** Where the build writes it, relative to the app root. */\nexport const MANIFEST_PATH = '.gkm/manifest.ts';\n\n/**\n * Fold the build's generated routes into the surface that serves them.\n *\n * The routes already exist: `gkm build` generates one handler per endpoint and\n * records its path, method and environment. What was missing is that the\n * *construct* manifest never learned about them, so a `rest-api` node said\n * `endpoints: []` while five handlers sat in `.gkm/`. Two documents describing\n * the same routes, one of them wrong.\n *\n * Merging here rather than making the construct name a glob or import its\n * endpoints: the build is the thing that already walked the filesystem and\n * already knows where it wrote each handler. Asking the declaration to restate\n * any of that is how the two come to disagree.\n *\n * Attribution is by exclusion — routes go to the surface that declared none of\n * its own. A surface with static endpoints (an auth server's single wildcard)\n * keeps them. That is exact while an app has one API of its own, and needs a\n * real answer the day it has two; the alternative today would be inventing one\n * before anything needs it.\n *\n * **Only from a provider that generates one handler per route.** The `server`\n * provider generates a single catch-all — `ALL *` pointing at the Hono app that\n * routes in-process — which is a true description of that build and a false\n * description of the application. Merging it wrote `endpoints: [{ method:\n * 'ALL', path: '*' }]` into a manifest for an app with five routes, and made the\n * document's contents depend on which `--provider` ran last. A manifest must not\n * do that.\n */\nexport function withRoutes(\n\tmanifest: ConstructManifest,\n\troutes: readonly RouteInfo[],\n\toptions: { perRoute: boolean },\n): ConstructManifest {\n\tif (routes.length === 0 || !options.perRoute) return manifest;\n\n\tconst target = Object.entries(manifest).find(\n\t\t([, declaration]) =>\n\t\t\tdeclaration.kind === 'rest-api' && declaration.endpoints.length === 0,\n\t);\n\n\tif (!target) return manifest;\n\n\tconst [id, declaration] = target;\n\tif (declaration.kind !== 'rest-api') return manifest;\n\n\treturn {\n\t\t...manifest,\n\t\t[id]: {\n\t\t\t...declaration,\n\t\t\tendpoints: routes.map((route) => asEndpoint(manifest, id, route)),\n\t\t},\n\t};\n}\n\n/**\n * Fold in the compute the build generated: functions, crons, queue workers and\n * topic subscribers.\n *\n * All four are named by their *export*, the same way an endpoint's handler is —\n * `CronGenerator` uses the export key as the name — so none of them can declare\n * themselves and all of them are the build's to add. That is why a `Function`\n * has no `declare()` and never will.\n *\n * A worker and a subscriber **nest** inside the queue or topic that triggers\n * them, because position carries the trigger. A function and a cron are\n * top-level, because nothing triggers them but a caller or a clock.\n */\nexport function withCompute(\n\tmanifest: ConstructManifest,\n\tcompute: {\n\t\tfunctions?: readonly FunctionInfo[];\n\t\tcrons?: readonly CronInfo[];\n\t\tqueues?: readonly QueueInfo[];\n\t\tsubscribers?: readonly SubscriberInfo[];\n\t},\n): ConstructManifest {\n\tconst next: Record<string, Declaration> = { ...manifest };\n\n\tfor (const fn of compute.functions ?? []) {\n\t\tnext[fn.name] = {\n\t\t\tkind: 'function',\n\t\t\tid: fn.name,\n\t\t\thandler: fn.handler,\n\t\t\tdependencies: edgesTo(manifest, fn.dependencies),\n\t\t\tprovides: [provideKey(fn.name, 'url')],\n\t\t};\n\t}\n\n\tfor (const cron of compute.crons ?? []) {\n\t\tnext[cron.name] = {\n\t\t\tkind: 'cron',\n\t\t\tid: cron.name,\n\t\t\thandler: cron.handler,\n\t\t\tschedule: cron.schedule,\n\t\t\tdependencies: edgesTo(manifest, cron.dependencies),\n\t\t};\n\t}\n\n\t// A worker drains exactly one queue, so it is matched by the queue it names\n\t// rather than by anything about the handler.\n\tfor (const worker of compute.queues ?? []) {\n\t\tconst queue = next[canonicalId(worker.name)];\n\t\tif (queue?.kind !== 'queue') continue;\n\n\t\tnext[queue.id] = {\n\t\t\t...queue,\n\t\t\tworker: {\n\t\t\t\tid: `${queue.id}Worker`,\n\t\t\t\thandler: worker.handler,\n\t\t\t\tdependencies: edgesTo(manifest, worker.dependencies),\n\t\t\t},\n\t\t};\n\t}\n\n\tfor (const subscriber of compute.subscribers ?? []) {\n\t\tconst topicId = subscriber.topic && canonicalId(subscriber.topic);\n\t\tconst topic = topicId ? next[topicId] : undefined;\n\t\tif (topic?.kind !== 'topic') continue;\n\n\t\tnext[topic.id] = {\n\t\t\t...topic,\n\t\t\tsubscribers: [\n\t\t\t\t...topic.subscribers,\n\t\t\t\t{\n\t\t\t\t\tid: subscriber.name,\n\t\t\t\t\thandler: subscriber.handler,\n\t\t\t\t\tevents: subscriber.subscribedEvents,\n\t\t\t\t\tdependencies: edgesTo(manifest, subscriber.dependencies),\n\t\t\t\t},\n\t\t\t],\n\t\t};\n\t}\n\n\treturn next;\n}\n\n/**\n * Construct ids as manifest edges.\n *\n * A `Dependency` carries the target's kind as well as its id, and the kind is\n * read off the manifest rather than recorded beside the edge — the same rule\n * `edgeTo` follows, for the same reason: a hand-written kind is one fact stated\n * twice, and the copy is what goes stale.\n *\n * An id that names nothing is dropped rather than thrown on. A handler can\n * depend on a construct that declares no node of its own — a lifted `Service`\n * is exactly that — and a build is the wrong place to refuse it; what a target\n * needs from this list is the subset it can actually grant.\n */\nfunction edgesTo(\n\tmanifest: ConstructManifest,\n\tids: readonly string[] = [],\n): Dependency[] {\n\treturn ids.flatMap((target) => {\n\t\tconst declaration = manifest[target];\n\n\t\treturn declaration ? [{ target, kind: declaration.kind }] : [];\n\t});\n}\n\n/** One generated route as the manifest's shape. */\nfunction asEndpoint(\n\tmanifest: ConstructManifest,\n\tsurface: string,\n\troute: RouteInfo,\n): RestApiEndpoint {\n\treturn {\n\t\t// The handler path is already unique per route and is what a target needs\n\t\t// to point a function at, so it is also the natural id.\n\t\tid: `${surface}${route.method}${route.path}`,\n\t\thandler: route.handler,\n\t\tmethod: route.method,\n\t\tpath: route.path,\n\t\t// The edges the handler declared, which is what a target reads to grant\n\t\t// this one function access to exactly those constructs. `environment` is\n\t\t// the same edges' shadow — the keys read — and cannot be turned back into\n\t\t// them, which is why the ids are carried rather than inferred.\n\t\tdependencies: edgesTo(manifest, route.dependencies),\n\t\t...(route.authorizer ? { authorizer: route.authorizer } : {}),\n\t};\n}\n\n/**\n * The manifest as TypeScript source.\n *\n * Pure, so what gets written can be asserted without touching a filesystem.\n */\nexport function manifestModule(\n\tmanifest: ConstructManifest,\n\tbackends: Backends = {},\n): string {\n\treturn `${HEADER}\nexport const manifest = ${serialise(manifest)} as const satisfies ConstructManifest;\n\n/**\n * Where the backends that are *config* rather than declaration resolved to.\n *\n * Recorded because they were being answered twice: once by the build, which\n * registers exactly one cache driver, and once by a deploy config, which told\n * the provisioner something else. The result was a deployed URL the running code\n * had no driver for — two documents disagreeing about one fact, which is what\n * this manifest exists to stop.\n */\nexport const backends = ${serialise(backends)} as const;\n\n// Derived types\nexport type Ids = IdsOf<typeof manifest>;\nexport type Construct<Id extends Ids> = DeclarationOf<typeof manifest, Id>;\nexport type Kind = Construct<Ids>['kind'];\n\n// Useful union types\nexport type ProvidedKeys = AllProvidedKeys<typeof manifest>;\nexport type Surfaces = IdsOfKind<typeof manifest, 'rest-api'>;\nexport type CacheBackend = (typeof backends)['cache'];\nexport type EmailBackend = (typeof backends)['email'];\n`;\n}\n\n/** Write it where the deploy config expects to import it from. */\nexport async function writeManifestModule(\n\tmanifest: ConstructManifest,\n\tappRoot: string,\n\tbackends: Backends = {},\n): Promise<string> {\n\tconst path = join(appRoot, MANIFEST_PATH);\n\n\tawait mkdir(dirname(path), { recursive: true });\n\tawait writeFile(path, manifestModule(manifest, backends), 'utf8');\n\n\treturn path;\n}\n\n/** The choices that are deployment config rather than declaration. */\nexport interface Backends {\n\tcache?: CacheBackend;\n\temail?: EmailBackend;\n}\n\nconst HEADER = `// Generated by \\`gkm build\\`. Do not edit.\n//\n// Discovery imports application code, so it runs once here rather than in every\n// consumer — a deploy config that discovered for itself would evaluate the whole\n// runtime graph inside its own toolchain. This is the result, as literals.\n\nimport type {\n\tAllProvidedKeys,\n\tConstructManifest,\n\tDeclarationOf,\n\tIdsOf,\n\tIdsOfKind,\n} from '@geekmidas/manifest';\n`;\n\n/**\n * JSON, re-indented with tabs and with keys left unquoted where they can be.\n *\n * Cosmetic, and worth it: this file is read by people trying to work out what\n * their app declares, and a wall of quoted keys reads as output rather than as\n * something anyone is expected to understand.\n */\nfunction serialise(value: object): string {\n\treturn JSON.stringify(value, null, '\\t')\n\t\t.replace(/^(\\t*)\"([A-Za-z_$][\\w$]*)\":/gm, '$1$2:')\n\t\t.replace(/\"/g, \"'\");\n}\n"],"mappings":";;;;;;AAqCA,MAAa,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8B7B,SAAgB,WACfA,UACAC,QACAC,SACoB;AACpB,KAAI,OAAO,WAAW,MAAM,QAAQ,SAAU,QAAO;CAErD,MAAM,SAAS,OAAO,QAAQ,SAAS,CAAC,KACvC,CAAC,GAAGC,cAAY,KACfA,cAAY,SAAS,cAAcA,cAAY,UAAU,WAAW,EACrE;AAED,MAAK,OAAQ,QAAO;CAEpB,MAAM,CAAC,IAAI,YAAY,GAAG;AAC1B,KAAI,YAAY,SAAS,WAAY,QAAO;AAE5C,QAAO;EACN,GAAG;GACF,KAAK;GACL,GAAG;GACH,WAAW,OAAO,IAAI,CAAC,UAAU,WAAW,UAAU,IAAI,MAAM,CAAC;EACjE;CACD;AACD;;;;;;;;;;;;;;AAeD,SAAgB,YACfH,UACAI,SAMoB;CACpB,MAAMC,OAAoC,EAAE,GAAG,SAAU;AAEzD,MAAK,MAAM,MAAM,QAAQ,aAAa,CAAE,EACvC,MAAK,GAAG,QAAQ;EACf,MAAM;EACN,IAAI,GAAG;EACP,SAAS,GAAG;EACZ,cAAc,QAAQ,UAAU,GAAG,aAAa;EAChD,UAAU,CAAC,WAAW,GAAG,MAAM,MAAM,AAAC;CACtC;AAGF,MAAK,MAAM,QAAQ,QAAQ,SAAS,CAAE,EACrC,MAAK,KAAK,QAAQ;EACjB,MAAM;EACN,IAAI,KAAK;EACT,SAAS,KAAK;EACd,UAAU,KAAK;EACf,cAAc,QAAQ,UAAU,KAAK,aAAa;CAClD;AAKF,MAAK,MAAM,UAAU,QAAQ,UAAU,CAAE,GAAE;EAC1C,MAAM,QAAQ,KAAK,YAAY,OAAO,KAAK;AAC3C,MAAI,OAAO,SAAS,QAAS;AAE7B,OAAK,MAAM,MAAM;GAChB,GAAG;GACH,QAAQ;IACP,KAAK,EAAE,MAAM,GAAG;IAChB,SAAS,OAAO;IAChB,cAAc,QAAQ,UAAU,OAAO,aAAa;GACpD;EACD;CACD;AAED,MAAK,MAAM,cAAc,QAAQ,eAAe,CAAE,GAAE;EACnD,MAAM,UAAU,WAAW,SAAS,YAAY,WAAW,MAAM;EACjE,MAAM,QAAQ,UAAU,KAAK;AAC7B,MAAI,OAAO,SAAS,QAAS;AAE7B,OAAK,MAAM,MAAM;GAChB,GAAG;GACH,aAAa,CACZ,GAAG,MAAM,aACT;IACC,IAAI,WAAW;IACf,SAAS,WAAW;IACpB,QAAQ,WAAW;IACnB,cAAc,QAAQ,UAAU,WAAW,aAAa;GACxD,CACD;EACD;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;AAeD,SAAS,QACRL,UACAM,MAAyB,CAAE,GACZ;AACf,QAAO,IAAI,QAAQ,CAAC,WAAW;EAC9B,MAAM,cAAc,SAAS;AAE7B,SAAO,cAAc,CAAC;GAAE;GAAQ,MAAM,YAAY;EAAM,CAAC,IAAG,CAAE;CAC9D,EAAC;AACF;;AAGD,SAAS,WACRN,UACAO,SACAC,OACkB;AAClB,QAAO;EAGN,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,EAAE,MAAM,KAAK;EAC3C,SAAS,MAAM;EACf,QAAQ,MAAM;EACd,MAAM,MAAM;EAKZ,cAAc,QAAQ,UAAU,MAAM,aAAa;EACnD,GAAI,MAAM,aAAa,EAAE,YAAY,MAAM,WAAY,IAAG,CAAE;CAC5D;AACD;;;;;;AAOD,SAAgB,eACfR,UACAS,WAAqB,CAAE,GACd;AACT,SAAQ,EAAE,OAAO;0BACQ,UAAU,SAAS,CAAC;;;;;;;;;;;0BAWpB,UAAU,SAAS,CAAC;;;;;;;;;;;;;AAa7C;;AAGD,eAAsB,oBACrBT,UACAU,SACAD,WAAqB,CAAE,GACL;CAClB,MAAM,OAAO,KAAK,SAAS,cAAc;AAEzC,OAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,KAAM,EAAC;AAC/C,OAAM,UAAU,MAAM,eAAe,UAAU,SAAS,EAAE,OAAO;AAEjE,QAAO;AACP;AAQD,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;AAsBhB,SAAS,UAAUE,OAAuB;AACzC,QAAO,KAAK,UAAU,OAAO,MAAM,IAAK,CACtC,QAAQ,iCAAiC,QAAQ,CACjD,QAAQ,MAAM,IAAI;AACpB"}

package/dist/{encryption-MfXAiFTm.cjs → encryption-C6jaU0hE.cjs}

@@ -51,4 +51,4 @@ Object.defineProperty(exports, 'generateDefineOptions', {
     return generateDefineOptions;
   }
 });
-//# sourceMappingURL=encryption-MfXAiFTm.cjs.map
+//# sourceMappingURL=encryption-C6jaU0hE.cjs.map

package/dist/{encryption-MfXAiFTm.cjs.map → encryption-C6jaU0hE.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"encryption-MfXAiFTm.cjs","names":["secrets: EmbeddableSecrets","payload: EncryptedPayload"],"sources":["../src/secrets/encryption.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { EmbeddableSecrets, EncryptedPayload } from './types';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst KEY_LENGTH = 32; // 256 bits\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/**\n * Encrypt secrets for embedding in a bundle.\n * Uses AES-256-GCM with a randomly generated ephemeral key.\n *\n * @param secrets - Key-value pairs to encrypt\n * @returns Encrypted payload with ephemeral master key\n */\nexport function encryptSecrets(secrets: EmbeddableSecrets): EncryptedPayload {\n\t// Generate ephemeral key and IV\n\tconst masterKey = randomBytes(KEY_LENGTH);\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, masterKey, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t\tmasterKey: masterKey.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets from an encrypted payload.\n * Used at runtime to decrypt embedded credentials.\n *\n * @param encrypted - Base64 encoded ciphertext + auth tag\n * @param iv - Hex encoded IV\n * @param masterKey - Hex encoded master key\n * @returns Decrypted secrets\n */\nexport function decryptSecrets(\n\tencrypted: string,\n\tiv: string,\n\tmasterKey: string,\n): EmbeddableSecrets {\n\t// Decode inputs\n\tconst key = Buffer.from(masterKey, 'hex');\n\tconst ivBuffer = Buffer.from(iv, 'hex');\n\tconst combined = Buffer.from(encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as EmbeddableSecrets;\n}\n\n/**\n * Generate the define options for tsdown/esbuild.\n * These will be injected at build time.\n */\nexport function generateDefineOptions(\n\tpayload: EncryptedPayload,\n): Record<string, string> {\n\treturn {\n\t\t__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),\n\t\t__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,YAAY;;;;;;;;AAUlB,SAAgB,eAAeA,SAA8C;CAE5E,MAAM,YAAY,6BAAY,WAAW;CACzC,MAAM,KAAK,6BAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,gCAAe,WAAW,WAAW,GAAG;CACvD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;EACtB,WAAW,UAAU,SAAS,MAAM;CACpC;AACD;;;;;AAyCD,SAAgB,sBACfC,SACyB;AACzB,QAAO;EACN,+BAA+B,KAAK,UAAU,QAAQ,UAAU;EAChE,wBAAwB,KAAK,UAAU,QAAQ,GAAG;CAClD;AACD"}
+{"version":3,"file":"encryption-C6jaU0hE.cjs","names":["secrets: EmbeddableSecrets","payload: EncryptedPayload"],"sources":["../src/secrets/encryption.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { EmbeddableSecrets, EncryptedPayload } from './types';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst KEY_LENGTH = 32; // 256 bits\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/**\n * Encrypt secrets for embedding in a bundle.\n * Uses AES-256-GCM with a randomly generated ephemeral key.\n *\n * @param secrets - Key-value pairs to encrypt\n * @returns Encrypted payload with ephemeral master key\n */\nexport function encryptSecrets(secrets: EmbeddableSecrets): EncryptedPayload {\n\t// Generate ephemeral key and IV\n\tconst masterKey = randomBytes(KEY_LENGTH);\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, masterKey, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t\tmasterKey: masterKey.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets from an encrypted payload.\n * Used at runtime to decrypt embedded credentials.\n *\n * @param encrypted - Base64 encoded ciphertext + auth tag\n * @param iv - Hex encoded IV\n * @param masterKey - Hex encoded master key\n * @returns Decrypted secrets\n */\nexport function decryptSecrets(\n\tencrypted: string,\n\tiv: string,\n\tmasterKey: string,\n): EmbeddableSecrets {\n\t// Decode inputs\n\tconst key = Buffer.from(masterKey, 'hex');\n\tconst ivBuffer = Buffer.from(iv, 'hex');\n\tconst combined = Buffer.from(encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as EmbeddableSecrets;\n}\n\n/**\n * Generate the define options for tsdown/esbuild.\n * These will be injected at build time.\n */\nexport function generateDefineOptions(\n\tpayload: EncryptedPayload,\n): Record<string, string> {\n\treturn {\n\t\t__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),\n\t\t__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv),\n\t};\n}\n"],"mappings":";;;;;AAIA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,YAAY;;;;;;;;AAUlB,SAAgB,eAAeA,SAA8C;CAE5E,MAAM,YAAY,6BAAY,WAAW;CACzC,MAAM,KAAK,6BAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,gCAAe,WAAW,WAAW,GAAG;CACvD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;EACtB,WAAW,UAAU,SAAS,MAAM;CACpC;AACD;;;;;AAyCD,SAAgB,sBACfC,SACyB;AACzB,QAAO;EACN,+BAA+B,KAAK,UAAU,QAAQ,UAAU;EAChE,wBAAwB,KAAK,UAAU,QAAQ,GAAG;CAClD;AACD"}

package/dist/{encryption-BVS7Vmzs.cjs → encryption-CHzzeR8a.cjs}

@@ -1,4 +1,4 @@
-const require_encryption = require('./encryption-MfXAiFTm.cjs');
+const require_encryption = require('./encryption-C6jaU0hE.cjs');
 
 exports.encryptSecrets = require_encryption.encryptSecrets;
 exports.generateDefineOptions = require_encryption.generateDefineOptions;

package/dist/encryption-CQUncu7v.mjs

@@ -0,0 +1,3 @@
+import { encryptSecrets, generateDefineOptions } from "./encryption-D-abyhZx.mjs";
+
+export { encryptSecrets, generateDefineOptions };

package/dist/{encryption-CO5Q4Bhf.mjs → encryption-D-abyhZx.mjs}

@@ -39,4 +39,4 @@ function generateDefineOptions(payload) {
 
 //#endregion
 export { encryptSecrets, generateDefineOptions };
-//# sourceMappingURL=encryption-CO5Q4Bhf.mjs.map
+//# sourceMappingURL=encryption-D-abyhZx.mjs.map

package/dist/{encryption-CO5Q4Bhf.mjs.map → encryption-D-abyhZx.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"encryption-CO5Q4Bhf.mjs","names":["secrets: EmbeddableSecrets","payload: EncryptedPayload"],"sources":["../src/secrets/encryption.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { EmbeddableSecrets, EncryptedPayload } from './types';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst KEY_LENGTH = 32; // 256 bits\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/**\n * Encrypt secrets for embedding in a bundle.\n * Uses AES-256-GCM with a randomly generated ephemeral key.\n *\n * @param secrets - Key-value pairs to encrypt\n * @returns Encrypted payload with ephemeral master key\n */\nexport function encryptSecrets(secrets: EmbeddableSecrets): EncryptedPayload {\n\t// Generate ephemeral key and IV\n\tconst masterKey = randomBytes(KEY_LENGTH);\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, masterKey, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t\tmasterKey: masterKey.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets from an encrypted payload.\n * Used at runtime to decrypt embedded credentials.\n *\n * @param encrypted - Base64 encoded ciphertext + auth tag\n * @param iv - Hex encoded IV\n * @param masterKey - Hex encoded master key\n * @returns Decrypted secrets\n */\nexport function decryptSecrets(\n\tencrypted: string,\n\tiv: string,\n\tmasterKey: string,\n): EmbeddableSecrets {\n\t// Decode inputs\n\tconst key = Buffer.from(masterKey, 'hex');\n\tconst ivBuffer = Buffer.from(iv, 'hex');\n\tconst combined = Buffer.from(encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as EmbeddableSecrets;\n}\n\n/**\n * Generate the define options for tsdown/esbuild.\n * These will be injected at build time.\n */\nexport function generateDefineOptions(\n\tpayload: EncryptedPayload,\n): Record<string, string> {\n\treturn {\n\t\t__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),\n\t\t__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv),\n\t};\n}\n"],"mappings":";;;;AAIA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,YAAY;;;;;;;;AAUlB,SAAgB,eAAeA,SAA8C;CAE5E,MAAM,YAAY,YAAY,WAAW;CACzC,MAAM,KAAK,YAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,eAAe,WAAW,WAAW,GAAG;CACvD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;EACtB,WAAW,UAAU,SAAS,MAAM;CACpC;AACD;;;;;AAyCD,SAAgB,sBACfC,SACyB;AACzB,QAAO;EACN,+BAA+B,KAAK,UAAU,QAAQ,UAAU;EAChE,wBAAwB,KAAK,UAAU,QAAQ,GAAG;CAClD;AACD"}
+{"version":3,"file":"encryption-D-abyhZx.mjs","names":["secrets: EmbeddableSecrets","payload: EncryptedPayload"],"sources":["../src/secrets/encryption.ts"],"sourcesContent":["import { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { EmbeddableSecrets, EncryptedPayload } from './types';\n\n/** AES-256-GCM configuration */\nconst ALGORITHM = 'aes-256-gcm';\nconst KEY_LENGTH = 32; // 256 bits\nconst IV_LENGTH = 12; // 96 bits for GCM\nconst AUTH_TAG_LENGTH = 16; // 128 bits\n\n/**\n * Encrypt secrets for embedding in a bundle.\n * Uses AES-256-GCM with a randomly generated ephemeral key.\n *\n * @param secrets - Key-value pairs to encrypt\n * @returns Encrypted payload with ephemeral master key\n */\nexport function encryptSecrets(secrets: EmbeddableSecrets): EncryptedPayload {\n\t// Generate ephemeral key and IV\n\tconst masterKey = randomBytes(KEY_LENGTH);\n\tconst iv = randomBytes(IV_LENGTH);\n\n\t// Serialize secrets to JSON\n\tconst plaintext = JSON.stringify(secrets);\n\n\t// Encrypt\n\tconst cipher = createCipheriv(ALGORITHM, masterKey, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, 'utf-8'),\n\t\tcipher.final(),\n\t]);\n\n\t// Get auth tag\n\tconst authTag = cipher.getAuthTag();\n\n\t// Combine ciphertext + auth tag\n\tconst combined = Buffer.concat([ciphertext, authTag]);\n\n\treturn {\n\t\tencrypted: combined.toString('base64'),\n\t\tiv: iv.toString('hex'),\n\t\tmasterKey: masterKey.toString('hex'),\n\t};\n}\n\n/**\n * Decrypt secrets from an encrypted payload.\n * Used at runtime to decrypt embedded credentials.\n *\n * @param encrypted - Base64 encoded ciphertext + auth tag\n * @param iv - Hex encoded IV\n * @param masterKey - Hex encoded master key\n * @returns Decrypted secrets\n */\nexport function decryptSecrets(\n\tencrypted: string,\n\tiv: string,\n\tmasterKey: string,\n): EmbeddableSecrets {\n\t// Decode inputs\n\tconst key = Buffer.from(masterKey, 'hex');\n\tconst ivBuffer = Buffer.from(iv, 'hex');\n\tconst combined = Buffer.from(encrypted, 'base64');\n\n\t// Split ciphertext and auth tag\n\tconst ciphertext = combined.subarray(0, -AUTH_TAG_LENGTH);\n\tconst authTag = combined.subarray(-AUTH_TAG_LENGTH);\n\n\t// Decrypt\n\tconst decipher = createDecipheriv(ALGORITHM, key, ivBuffer);\n\tdecipher.setAuthTag(authTag);\n\n\tconst plaintext = Buffer.concat([\n\t\tdecipher.update(ciphertext),\n\t\tdecipher.final(),\n\t]);\n\n\treturn JSON.parse(plaintext.toString('utf-8')) as EmbeddableSecrets;\n}\n\n/**\n * Generate the define options for tsdown/esbuild.\n * These will be injected at build time.\n */\nexport function generateDefineOptions(\n\tpayload: EncryptedPayload,\n): Record<string, string> {\n\treturn {\n\t\t__GKM_ENCRYPTED_CREDENTIALS__: JSON.stringify(payload.encrypted),\n\t\t__GKM_CREDENTIALS_IV__: JSON.stringify(payload.iv),\n\t};\n}\n"],"mappings":";;;;AAIA,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,YAAY;;;;;;;;AAUlB,SAAgB,eAAeA,SAA8C;CAE5E,MAAM,YAAY,YAAY,WAAW;CACzC,MAAM,KAAK,YAAY,UAAU;CAGjC,MAAM,YAAY,KAAK,UAAU,QAAQ;CAGzC,MAAM,SAAS,eAAe,WAAW,WAAW,GAAG;CACvD,MAAM,aAAa,OAAO,OAAO,CAChC,OAAO,OAAO,WAAW,QAAQ,EACjC,OAAO,OAAO,AACd,EAAC;CAGF,MAAM,UAAU,OAAO,YAAY;CAGnC,MAAM,WAAW,OAAO,OAAO,CAAC,YAAY,OAAQ,EAAC;AAErD,QAAO;EACN,WAAW,SAAS,SAAS,SAAS;EACtC,IAAI,GAAG,SAAS,MAAM;EACtB,WAAW,UAAU,SAAS,MAAM;CACpC;AACD;;;;;AAyCD,SAAgB,sBACfC,SACyB;AACzB,QAAO;EACN,+BAA+B,KAAK,UAAU,QAAQ,UAAU;EAChE,wBAAwB,KAAK,UAAU,QAAQ,GAAG;CAClD;AACD"}

package/dist/fullstack-secrets-C-GGohke.cjs

@@ -0,0 +1,111 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const require_generator = require('./generator-CNzBw7g5.cjs');
+const node_path = require_chunk.__toESM(require("node:path"));
+const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
+
+//#region src/setup/fullstack-secrets.ts
+/**
+* Generate a secure random password for database users.
+* Uses a combination of timestamp and random bytes for uniqueness.
+*/
+function generateDbPassword() {
+	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+}
+/**
+* Generate database URL for an app.
+* All apps connect to the same database, but use different users/schemas.
+*/
+function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
+	const userName = appName.replace(/-/g, "_");
+	const dbName = `${projectName.replace(/-/g, "_")}_dev`;
+	return `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;
+}
+/**
+* Generate fullstack-aware custom secrets for a workspace.
+*
+* Generates:
+* - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET
+* - Per-app database passwords and URLs for backend apps with db service
+* - Better-auth secrets for apps using the better-auth framework
+*/
+function generateFullstackCustomSecrets(workspace, containers = []) {
+	const hasDb = containers.includes("postgres");
+	const customs = {
+		NODE_ENV: "development",
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	if (!hasDb) return customs;
+	const frontendPorts = [];
+	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
+		if (appConfig.type === "web") {
+			frontendPorts.push(appConfig.port);
+			const upperName$1 = appName.toUpperCase();
+			customs[`${upperName$1}_URL`] = `http://localhost:${appConfig.port}`;
+			continue;
+		}
+		if (appConfig.type === "mobile") continue;
+		const password = generateDbPassword();
+		const upperName = appName.toUpperCase();
+		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
+		customs[`${upperName}_DB_PASSWORD`] = password;
+		if (appConfig.framework === "better-auth") {
+			customs.AUTH_PORT = String(appConfig.port);
+			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
+			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${require_generator.generateSecurePassword(16)}`;
+			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
+		}
+	}
+	if (customs.BETTER_AUTH_SECRET) {
+		const allPorts = Object.values(workspace.apps).map((a) => a.port);
+		customs.BETTER_AUTH_TRUSTED_ORIGINS = allPorts.map((p) => `http://localhost:${p}`).join(",");
+	}
+	return customs;
+}
+/**
+* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
+*
+* The docker/.env file contains database passwords that the PostgreSQL
+* init script reads to create per-app database users.
+*/
+async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
+	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
+	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
+	if (dbPasswordEntries.length === 0) return;
+	const envContent = `# Auto-generated docker environment file
+# Contains database passwords for docker-compose postgres init
+# This file is gitignored - do not commit to version control
+${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
+`;
+	const envPath = (0, node_path.join)(workspaceRoot, "docker", ".env");
+	await (0, node_fs_promises.mkdir)((0, node_path.dirname)(envPath), { recursive: true });
+	await (0, node_fs_promises.writeFile)(envPath, envContent);
+}
+
+//#endregion
+Object.defineProperty(exports, 'generateDbPassword', {
+  enumerable: true,
+  get: function () {
+    return generateDbPassword;
+  }
+});
+Object.defineProperty(exports, 'generateDbUrl', {
+  enumerable: true,
+  get: function () {
+    return generateDbUrl;
+  }
+});
+Object.defineProperty(exports, 'generateFullstackCustomSecrets', {
+  enumerable: true,
+  get: function () {
+    return generateFullstackCustomSecrets;
+  }
+});
+Object.defineProperty(exports, 'writeDockerEnvFromSecrets', {
+  enumerable: true,
+  get: function () {
+    return writeDockerEnvFromSecrets;
+  }
+});
+//# sourceMappingURL=fullstack-secrets-C-GGohke.cjs.map

package/dist/fullstack-secrets-C-GGohke.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fullstack-secrets-C-GGohke.cjs","names":["appName: string","password: string","projectName: string","workspace: NormalizedWorkspace","containers: readonly string[]","customs: Record<string, string>","frontendPorts: number[]","upperName","secrets: StageSecrets","workspaceRoot: string"],"sources":["../src/setup/fullstack-secrets.ts"],"sourcesContent":["import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { generateSecurePassword } from '../secrets/generator.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/**\n * Generate a secure random password for database users.\n * Uses a combination of timestamp and random bytes for uniqueness.\n */\nexport function generateDbPassword(): string {\n\treturn `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/**\n * Generate database URL for an app.\n * All apps connect to the same database, but use different users/schemas.\n */\nexport function generateDbUrl(\n\tappName: string,\n\tpassword: string,\n\tprojectName: string,\n\thost = 'localhost',\n\tport = 5432,\n): string {\n\tconst userName = appName.replace(/-/g, '_');\n\tconst dbName = `${projectName.replace(/-/g, '_')}_dev`;\n\treturn `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;\n}\n\n/**\n * Generate fullstack-aware custom secrets for a workspace.\n *\n * Generates:\n * - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET\n * - Per-app database passwords and URLs for backend apps with db service\n * - Better-auth secrets for apps using the better-auth framework\n */\nexport function generateFullstackCustomSecrets(\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): Record<string, string> {\n\t// A Postgres exists because something declared a database, not because\n\t// config carried a flag saying so.\n\tconst hasDb = containers.includes('postgres');\n\tconst customs: Record<string, string> = {\n\t\tNODE_ENV: 'development',\n\t\tPORT: '3000',\n\t\tLOG_LEVEL: 'debug',\n\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t};\n\n\tif (!hasDb) {\n\t\treturn customs;\n\t}\n\n\t// Collect all frontend ports for trusted origins\n\tconst frontendPorts: number[] = [];\n\n\tfor (const [appName, appConfig] of Object.entries(workspace.apps)) {\n\t\tif (appConfig.type === 'web') {\n\t\t\tfrontendPorts.push(appConfig.port);\n\t\t\tconst upperName = appName.toUpperCase();\n\t\t\tcustoms[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Mobile apps (Expo, etc.) don't run on a host port the backend\n\t\t// cares about for CORS, and don't need DB credentials.\n\t\tif (appConfig.type === 'mobile') {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Backend apps with database: generate per-app DB passwords and URLs\n\t\tconst password = generateDbPassword();\n\t\tconst upperName = appName.toUpperCase();\n\n\t\tcustoms[`${upperName}_DATABASE_URL`] = generateDbUrl(\n\t\t\tappName,\n\t\t\tpassword,\n\t\t\tworkspace.name,\n\t\t);\n\t\tcustoms[`${upperName}_DB_PASSWORD`] = password;\n\n\t\t// Better-auth framework secrets\n\t\tif (appConfig.framework === 'better-auth') {\n\t\t\tcustoms.AUTH_PORT = String(appConfig.port);\n\t\t\tcustoms.AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t\tcustoms.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;\n\t\t\tcustoms.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t}\n\t}\n\n\t// Generate trusted origins for better-auth (all app ports)\n\tif (customs.BETTER_AUTH_SECRET) {\n\t\tconst allPorts = Object.values(workspace.apps).map((a) => a.port);\n\t\tcustoms.BETTER_AUTH_TRUSTED_ORIGINS = allPorts\n\t\t\t.map((p) => `http://localhost:${p}`)\n\t\t\t.join(',');\n\t}\n\n\treturn customs;\n}\n\n/**\n * Extract *_DB_PASSWORD keys from secrets and write docker/.env.\n *\n * The docker/.env file contains database passwords that the PostgreSQL\n * init script reads to create per-app database users.\n */\nexport async function writeDockerEnvFromSecrets(\n\tsecrets: StageSecrets,\n\tworkspaceRoot: string,\n): Promise<void> {\n\tconst dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) =>\n\t\tkey.endsWith('_DB_PASSWORD'),\n\t);\n\n\t// Always include pgboss password when pgboss credentials exist\n\tif (\n\t\tsecrets.services.pgboss &&\n\t\t!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')\n\t) {\n\t\tdbPasswordEntries.push([\n\t\t\t'PGBOSS_DB_PASSWORD',\n\t\t\tsecrets.services.pgboss.password,\n\t\t]);\n\t}\n\n\tif (dbPasswordEntries.length === 0) {\n\t\treturn;\n\t}\n\n\tconst envContent = `# Auto-generated docker environment file\n# Contains database passwords for docker-compose postgres init\n# This file is gitignored - do not commit to version control\n${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join('\\n')}\n`;\n\n\tconst envPath = join(workspaceRoot, 'docker', '.env');\n\tawait mkdir(dirname(envPath), { recursive: true });\n\tawait writeFile(envPath, envContent);\n}\n"],"mappings":";;;;;;;;;;AAUA,SAAgB,qBAA6B;AAC5C,SAAQ,EAAE,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9G;;;;;AAMD,SAAgB,cACfA,SACAC,UACAC,aACA,OAAO,aACP,OAAO,MACE;CACT,MAAM,WAAW,QAAQ,QAAQ,MAAM,IAAI;CAC3C,MAAM,UAAU,EAAE,YAAY,QAAQ,MAAM,IAAI,CAAC;AACjD,SAAQ,eAAe,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO;AACtE;;;;;;;;;AAUD,SAAgB,+BACfC,WACAC,aAAgC,CAAE,GACT;CAGzB,MAAM,QAAQ,WAAW,SAAS,WAAW;CAC7C,MAAMC,UAAkC;EACvC,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAED,MAAK,MACJ,QAAO;CAIR,MAAMC,gBAA0B,CAAE;AAElC,MAAK,MAAM,CAAC,SAAS,UAAU,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;AAClE,MAAI,UAAU,SAAS,OAAO;AAC7B,iBAAc,KAAK,UAAU,KAAK;GAClC,MAAMC,cAAY,QAAQ,aAAa;AACvC,YAAS,EAAEA,YAAU,UAAU,mBAAmB,UAAU,KAAK;AACjE;EACA;AAID,MAAI,UAAU,SAAS,SACtB;EAID,MAAM,WAAW,oBAAoB;EACrC,MAAM,YAAY,QAAQ,aAAa;AAEvC,WAAS,EAAE,UAAU,kBAAkB,cACtC,SACA,UACA,UAAU,KACV;AACD,WAAS,EAAE,UAAU,iBAAiB;AAGtC,MAAI,UAAU,cAAc,eAAe;AAC1C,WAAQ,YAAY,OAAO,UAAU,KAAK;AAC1C,WAAQ,YAAY,mBAAmB,UAAU,KAAK;AACtD,WAAQ,sBAAsB,cAAc,KAAK,KAAK,CAAC,GAAG,yCAAuB,GAAG,CAAC;AACrF,WAAQ,mBAAmB,mBAAmB,UAAU,KAAK;EAC7D;CACD;AAGD,KAAI,QAAQ,oBAAoB;EAC/B,MAAM,WAAW,OAAO,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK;AACjE,UAAQ,8BAA8B,SACpC,IAAI,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACnC,KAAK,IAAI;CACX;AAED,QAAO;AACP;;;;;;;AAQD,eAAsB,0BACrBC,SACAC,eACgB;CAChB,MAAM,oBAAoB,OAAO,QAAQ,QAAQ,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KACrE,IAAI,SAAS,eAAe,CAC5B;AAGD,KACC,QAAQ,SAAS,WAChB,kBAAkB,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ,qBAAqB,CAEhE,mBAAkB,KAAK,CACtB,sBACA,QAAQ,SAAS,OAAO,QACxB,EAAC;AAGH,KAAI,kBAAkB,WAAW,EAChC;CAGD,MAAM,cAAc;;;EAGnB,kBAAkB,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,KAAK,CAAC;;CAGvE,MAAM,UAAU,oBAAK,eAAe,UAAU,OAAO;AACrD,OAAM,4BAAM,uBAAQ,QAAQ,EAAE,EAAE,WAAW,KAAM,EAAC;AAClD,OAAM,gCAAU,SAAS,WAAW;AACpC"}

package/dist/fullstack-secrets-D1o9-G5l.mjs

@@ -0,0 +1,87 @@
+import { generateSecurePassword } from "./generator-VE2JrFlY.mjs";
+import { dirname, join } from "node:path";
+import { mkdir, writeFile } from "node:fs/promises";
+
+//#region src/setup/fullstack-secrets.ts
+/**
+* Generate a secure random password for database users.
+* Uses a combination of timestamp and random bytes for uniqueness.
+*/
+function generateDbPassword() {
+	return `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+}
+/**
+* Generate database URL for an app.
+* All apps connect to the same database, but use different users/schemas.
+*/
+function generateDbUrl(appName, password, projectName, host = "localhost", port = 5432) {
+	const userName = appName.replace(/-/g, "_");
+	const dbName = `${projectName.replace(/-/g, "_")}_dev`;
+	return `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;
+}
+/**
+* Generate fullstack-aware custom secrets for a workspace.
+*
+* Generates:
+* - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET
+* - Per-app database passwords and URLs for backend apps with db service
+* - Better-auth secrets for apps using the better-auth framework
+*/
+function generateFullstackCustomSecrets(workspace, containers = []) {
+	const hasDb = containers.includes("postgres");
+	const customs = {
+		NODE_ENV: "development",
+		PORT: "3000",
+		LOG_LEVEL: "debug",
+		JWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`
+	};
+	if (!hasDb) return customs;
+	const frontendPorts = [];
+	for (const [appName, appConfig] of Object.entries(workspace.apps)) {
+		if (appConfig.type === "web") {
+			frontendPorts.push(appConfig.port);
+			const upperName$1 = appName.toUpperCase();
+			customs[`${upperName$1}_URL`] = `http://localhost:${appConfig.port}`;
+			continue;
+		}
+		if (appConfig.type === "mobile") continue;
+		const password = generateDbPassword();
+		const upperName = appName.toUpperCase();
+		customs[`${upperName}_DATABASE_URL`] = generateDbUrl(appName, password, workspace.name);
+		customs[`${upperName}_DB_PASSWORD`] = password;
+		if (appConfig.framework === "better-auth") {
+			customs.AUTH_PORT = String(appConfig.port);
+			customs.AUTH_URL = `http://localhost:${appConfig.port}`;
+			customs.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;
+			customs.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;
+		}
+	}
+	if (customs.BETTER_AUTH_SECRET) {
+		const allPorts = Object.values(workspace.apps).map((a) => a.port);
+		customs.BETTER_AUTH_TRUSTED_ORIGINS = allPorts.map((p) => `http://localhost:${p}`).join(",");
+	}
+	return customs;
+}
+/**
+* Extract *_DB_PASSWORD keys from secrets and write docker/.env.
+*
+* The docker/.env file contains database passwords that the PostgreSQL
+* init script reads to create per-app database users.
+*/
+async function writeDockerEnvFromSecrets(secrets, workspaceRoot) {
+	const dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) => key.endsWith("_DB_PASSWORD"));
+	if (secrets.services.pgboss && !dbPasswordEntries.some(([key]) => key === "PGBOSS_DB_PASSWORD")) dbPasswordEntries.push(["PGBOSS_DB_PASSWORD", secrets.services.pgboss.password]);
+	if (dbPasswordEntries.length === 0) return;
+	const envContent = `# Auto-generated docker environment file
+# Contains database passwords for docker-compose postgres init
+# This file is gitignored - do not commit to version control
+${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join("\n")}
+`;
+	const envPath = join(workspaceRoot, "docker", ".env");
+	await mkdir(dirname(envPath), { recursive: true });
+	await writeFile(envPath, envContent);
+}
+
+//#endregion
+export { generateDbPassword, generateDbUrl, generateFullstackCustomSecrets, writeDockerEnvFromSecrets };
+//# sourceMappingURL=fullstack-secrets-D1o9-G5l.mjs.map

package/dist/fullstack-secrets-D1o9-G5l.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"fullstack-secrets-D1o9-G5l.mjs","names":["appName: string","password: string","projectName: string","workspace: NormalizedWorkspace","containers: readonly string[]","customs: Record<string, string>","frontendPorts: number[]","upperName","secrets: StageSecrets","workspaceRoot: string"],"sources":["../src/setup/fullstack-secrets.ts"],"sourcesContent":["import { mkdir, writeFile } from 'node:fs/promises';\nimport { dirname, join } from 'node:path';\nimport { generateSecurePassword } from '../secrets/generator.js';\nimport type { StageSecrets } from '../secrets/types.js';\nimport type { NormalizedWorkspace } from '../workspace/types.js';\n\n/**\n * Generate a secure random password for database users.\n * Uses a combination of timestamp and random bytes for uniqueness.\n */\nexport function generateDbPassword(): string {\n\treturn `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/**\n * Generate database URL for an app.\n * All apps connect to the same database, but use different users/schemas.\n */\nexport function generateDbUrl(\n\tappName: string,\n\tpassword: string,\n\tprojectName: string,\n\thost = 'localhost',\n\tport = 5432,\n): string {\n\tconst userName = appName.replace(/-/g, '_');\n\tconst dbName = `${projectName.replace(/-/g, '_')}_dev`;\n\treturn `postgresql://${userName}:${password}@${host}:${port}/${dbName}`;\n}\n\n/**\n * Generate fullstack-aware custom secrets for a workspace.\n *\n * Generates:\n * - Common secrets: NODE_ENV, PORT, LOG_LEVEL, JWT_SECRET\n * - Per-app database passwords and URLs for backend apps with db service\n * - Better-auth secrets for apps using the better-auth framework\n */\nexport function generateFullstackCustomSecrets(\n\tworkspace: NormalizedWorkspace,\n\tcontainers: readonly string[] = [],\n): Record<string, string> {\n\t// A Postgres exists because something declared a database, not because\n\t// config carried a flag saying so.\n\tconst hasDb = containers.includes('postgres');\n\tconst customs: Record<string, string> = {\n\t\tNODE_ENV: 'development',\n\t\tPORT: '3000',\n\t\tLOG_LEVEL: 'debug',\n\t\tJWT_SECRET: `dev-${Date.now()}-${Math.random().toString(36).slice(2)}`,\n\t};\n\n\tif (!hasDb) {\n\t\treturn customs;\n\t}\n\n\t// Collect all frontend ports for trusted origins\n\tconst frontendPorts: number[] = [];\n\n\tfor (const [appName, appConfig] of Object.entries(workspace.apps)) {\n\t\tif (appConfig.type === 'web') {\n\t\t\tfrontendPorts.push(appConfig.port);\n\t\t\tconst upperName = appName.toUpperCase();\n\t\t\tcustoms[`${upperName}_URL`] = `http://localhost:${appConfig.port}`;\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Mobile apps (Expo, etc.) don't run on a host port the backend\n\t\t// cares about for CORS, and don't need DB credentials.\n\t\tif (appConfig.type === 'mobile') {\n\t\t\tcontinue;\n\t\t}\n\n\t\t// Backend apps with database: generate per-app DB passwords and URLs\n\t\tconst password = generateDbPassword();\n\t\tconst upperName = appName.toUpperCase();\n\n\t\tcustoms[`${upperName}_DATABASE_URL`] = generateDbUrl(\n\t\t\tappName,\n\t\t\tpassword,\n\t\t\tworkspace.name,\n\t\t);\n\t\tcustoms[`${upperName}_DB_PASSWORD`] = password;\n\n\t\t// Better-auth framework secrets\n\t\tif (appConfig.framework === 'better-auth') {\n\t\t\tcustoms.AUTH_PORT = String(appConfig.port);\n\t\t\tcustoms.AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t\tcustoms.BETTER_AUTH_SECRET = `better-auth-${Date.now()}-${generateSecurePassword(16)}`;\n\t\t\tcustoms.BETTER_AUTH_URL = `http://localhost:${appConfig.port}`;\n\t\t}\n\t}\n\n\t// Generate trusted origins for better-auth (all app ports)\n\tif (customs.BETTER_AUTH_SECRET) {\n\t\tconst allPorts = Object.values(workspace.apps).map((a) => a.port);\n\t\tcustoms.BETTER_AUTH_TRUSTED_ORIGINS = allPorts\n\t\t\t.map((p) => `http://localhost:${p}`)\n\t\t\t.join(',');\n\t}\n\n\treturn customs;\n}\n\n/**\n * Extract *_DB_PASSWORD keys from secrets and write docker/.env.\n *\n * The docker/.env file contains database passwords that the PostgreSQL\n * init script reads to create per-app database users.\n */\nexport async function writeDockerEnvFromSecrets(\n\tsecrets: StageSecrets,\n\tworkspaceRoot: string,\n): Promise<void> {\n\tconst dbPasswordEntries = Object.entries(secrets.custom).filter(([key]) =>\n\t\tkey.endsWith('_DB_PASSWORD'),\n\t);\n\n\t// Always include pgboss password when pgboss credentials exist\n\tif (\n\t\tsecrets.services.pgboss &&\n\t\t!dbPasswordEntries.some(([key]) => key === 'PGBOSS_DB_PASSWORD')\n\t) {\n\t\tdbPasswordEntries.push([\n\t\t\t'PGBOSS_DB_PASSWORD',\n\t\t\tsecrets.services.pgboss.password,\n\t\t]);\n\t}\n\n\tif (dbPasswordEntries.length === 0) {\n\t\treturn;\n\t}\n\n\tconst envContent = `# Auto-generated docker environment file\n# Contains database passwords for docker-compose postgres init\n# This file is gitignored - do not commit to version control\n${dbPasswordEntries.map(([key, value]) => `${key}=${value}`).join('\\n')}\n`;\n\n\tconst envPath = join(workspaceRoot, 'docker', '.env');\n\tawait mkdir(dirname(envPath), { recursive: true });\n\tawait writeFile(envPath, envContent);\n}\n"],"mappings":";;;;;;;;;AAUA,SAAgB,qBAA6B;AAC5C,SAAQ,EAAE,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9G;;;;;AAMD,SAAgB,cACfA,SACAC,UACAC,aACA,OAAO,aACP,OAAO,MACE;CACT,MAAM,WAAW,QAAQ,QAAQ,MAAM,IAAI;CAC3C,MAAM,UAAU,EAAE,YAAY,QAAQ,MAAM,IAAI,CAAC;AACjD,SAAQ,eAAe,SAAS,GAAG,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,OAAO;AACtE;;;;;;;;;AAUD,SAAgB,+BACfC,WACAC,aAAgC,CAAE,GACT;CAGzB,MAAM,QAAQ,WAAW,SAAS,WAAW;CAC7C,MAAMC,UAAkC;EACvC,UAAU;EACV,MAAM;EACN,WAAW;EACX,aAAa,MAAM,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,EAAE,CAAC;CACrE;AAED,MAAK,MACJ,QAAO;CAIR,MAAMC,gBAA0B,CAAE;AAElC,MAAK,MAAM,CAAC,SAAS,UAAU,IAAI,OAAO,QAAQ,UAAU,KAAK,EAAE;AAClE,MAAI,UAAU,SAAS,OAAO;AAC7B,iBAAc,KAAK,UAAU,KAAK;GAClC,MAAMC,cAAY,QAAQ,aAAa;AACvC,YAAS,EAAEA,YAAU,UAAU,mBAAmB,UAAU,KAAK;AACjE;EACA;AAID,MAAI,UAAU,SAAS,SACtB;EAID,MAAM,WAAW,oBAAoB;EACrC,MAAM,YAAY,QAAQ,aAAa;AAEvC,WAAS,EAAE,UAAU,kBAAkB,cACtC,SACA,UACA,UAAU,KACV;AACD,WAAS,EAAE,UAAU,iBAAiB;AAGtC,MAAI,UAAU,cAAc,eAAe;AAC1C,WAAQ,YAAY,OAAO,UAAU,KAAK;AAC1C,WAAQ,YAAY,mBAAmB,UAAU,KAAK;AACtD,WAAQ,sBAAsB,cAAc,KAAK,KAAK,CAAC,GAAG,uBAAuB,GAAG,CAAC;AACrF,WAAQ,mBAAmB,mBAAmB,UAAU,KAAK;EAC7D;CACD;AAGD,KAAI,QAAQ,oBAAoB;EAC/B,MAAM,WAAW,OAAO,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK;AACjE,UAAQ,8BAA8B,SACpC,IAAI,CAAC,OAAO,mBAAmB,EAAE,EAAE,CACnC,KAAK,IAAI;CACX;AAED,QAAO;AACP;;;;;;;AAQD,eAAsB,0BACrBC,SACAC,eACgB;CAChB,MAAM,oBAAoB,OAAO,QAAQ,QAAQ,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,KACrE,IAAI,SAAS,eAAe,CAC5B;AAGD,KACC,QAAQ,SAAS,WAChB,kBAAkB,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ,qBAAqB,CAEhE,mBAAkB,KAAK,CACtB,sBACA,QAAQ,SAAS,OAAO,QACxB,EAAC;AAGH,KAAI,kBAAkB,WAAW,EAChC;CAGD,MAAM,cAAc;;;EAGnB,kBAAkB,IAAI,CAAC,CAAC,KAAK,MAAM,MAAM,EAAE,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,KAAK,CAAC;;CAGvE,MAAM,UAAU,KAAK,eAAe,UAAU,OAAO;AACrD,OAAM,MAAM,QAAQ,QAAQ,EAAE,EAAE,WAAW,KAAM,EAAC;AAClD,OAAM,UAAU,SAAS,WAAW;AACpC"}