@neetru/cli 2.28.10 → 2.31.0

package/dist/lib/public-secret-scan.js

@@ -0,0 +1,446 @@
+/**
+ * Varredura de segredo no pacote PÚBLICO antes do `neetru deploy` (2.30.0).
+ *
+ * Decisão do dono (2026-10-03): a credencial `nrt_` do produto é SÓ DE
+ * SERVIDOR. Hoje produtos carregam a chave no bundle do navegador
+ * (`NEXT_PUBLIC_NEETRU_API_KEY`, `NEXT_PUBLIC_NEETRU_PUBLIC_KEY`) — qualquer
+ * visitante abre o DevTools e copia. Este gate impede que um segredo saia no
+ * artefato servido ao público.
+ *
+ * O que é "público" (servido ao navegador): `.next/static/**`, `public/**`,
+ * `out/**`, `dist/**`, `build/**` — e, na stack `static`, o pacote inteiro.
+ * `node_modules/**` nunca entra (código de terceiros, não servido como asset).
+ *
+ * O que procuramos:
+ *   1. `nrt_[A-Za-z0-9_-]{20,}` — credencial de API do produto (Neetru).
+ *   2. `npk_[A-Za-z0-9_-]{20,}` — chave de produto Neetru.
+ *   3. `-----BEGIN … PRIVATE KEY-----` + material base64 — chave privada PEM
+ *      (RSA/EC/OPENSSH/PKCS8). Só o cabeçalho (código de lib) não conta.
+ *   4. VALOR literal de env pública (`NEXT_PUBLIC_*`, `EXPO_PUBLIC_*`,
+ *      `VITE_*`, `REACT_APP_*`, `PUBLIC_*`) cujo NOME contém KEY/SECRET/TOKEN —
+ *      é exatamente o que o bundler injeta no JS do navegador.
+ *      Exceção por FORMATO de valor sabidamente público: Stripe publishable
+ *      (`pk_live_`/`pk_test_`), chave web Google/Firebase (`AIza…`), reCAPTCHA
+ *      site key (`6L…`). Nome não isenta nada (`NEXT_PUBLIC_NEETRU_PUBLIC_KEY`
+ *      é justamente a chave `nrt_` no navegador).
+ *
+ * Saída: NUNCA imprime o segredo. Mostra no máximo os 8 primeiros caracteres
+ * (e nunca mais que 1/4 do valor), seguidos de máscara.
+ *
+ * Sem dependências: o .tar.gz é lido em streaming (zlib + parser ustar/GNU/pax).
+ */
+import fs from 'node:fs';
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import zlib from 'node:zlib';
+export const PUBLIC_SECRET_PATTERNS = [
+    { id: 'nrt_key', label: 'credencial nrt_ do produto (só de servidor)', re: /nrt_[A-Za-z0-9_-]{20,}/g },
+    { id: 'npk_key', label: 'chave npk_ do produto', re: /npk_[A-Za-z0-9_-]{20,}/g },
+    {
+        id: 'private_key',
+        label: 'chave privada PEM',
+        // Exige MATERIAL de chave depois do cabeçalho (base64, com quebra real ou
+        // `\n` escapado de string JS) — o cabeçalho sozinho aparece em código de
+        // biblioteca (ex.: validação de PEM do `jose`) e não é segredo.
+        re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY-----(?:\\[nr]|\s)*[A-Za-z0-9+/=]{40,}/g,
+    },
+];
+/** Prefixos de env que os bundlers injetam no código do navegador/app. */
+export const PUBLIC_ENV_PREFIXES = ['NEXT_PUBLIC_', 'EXPO_PUBLIC_', 'VITE_', 'REACT_APP_', 'PUBLIC_'];
+const SENSITIVE_ENV_NAME_RE = /KEY|SECRET|TOKEN/i;
+/** Valores curtos demais geram falso positivo em massa (ex.: "true", "1"). */
+const MIN_ENV_VALUE_LENGTH = 12;
+/** Formatos de valor que são públicos POR DESENHO do provedor. */
+const KNOWN_PUBLIC_VALUE_SHAPES = [
+    /^pk_(live|test)_[A-Za-z0-9]+$/, // Stripe publishable key
+    /^AIza[0-9A-Za-z_-]{35}$/, // Google/Firebase web API key (restrita por domínio)
+    /^6L[0-9A-Za-z_-]{38}$/, // reCAPTCHA site key
+];
+export function isKnownPublicValue(value) {
+    return KNOWN_PUBLIC_VALUE_SHAPES.some((re) => re.test(value));
+}
+export function isPublicSensitiveEnvName(name) {
+    return PUBLIC_ENV_PREFIXES.some((p) => name.startsWith(p)) && SENSITIVE_ENV_NAME_RE.test(name);
+}
+// ─── Máscara ────────────────────────────────────────────────────────────────
+/** Até 8 caracteres iniciais (nunca mais que 1/4 do valor) + máscara. */
+export function maskSecret(value) {
+    const shown = Math.min(8, Math.floor(value.length / 4));
+    return `${value.slice(0, shown)}…[mascarado, ${value.length} caracteres]`;
+}
+// ─── Caminhos públicos ──────────────────────────────────────────────────────
+const PUBLIC_TOP_DIRS = new Set(['public', 'out', 'dist', 'build']);
+/** Normaliza o nome de membro do tar: `\` → `/`, sem `./` nem `/` iniciais. */
+export function normalizeEntryPath(p) {
+    let s = p.replace(/\\/g, '/');
+    while (s.startsWith('./'))
+        s = s.slice(2);
+    s = s.replace(/^\/+/, '');
+    return s;
+}
+export function isPublicArtifactPath(relPath, stack) {
+    const p = normalizeEntryPath(relPath);
+    if (!p)
+        return false;
+    const segs = p.split('/');
+    if (segs.includes('node_modules'))
+        return false;
+    if (stack === 'static')
+        return true;
+    // `.next/static/**` em qualquer profundidade (monorepo: apps/web/.next/static).
+    for (let i = 0; i < segs.length - 1; i++) {
+        if (segs[i] === '.next' && segs[i + 1] === 'static')
+            return true;
+    }
+    return PUBLIC_TOP_DIRS.has(segs[0]) && segs.length > 1;
+}
+const BINARY_EXT = new Set([
+    '.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.ico', '.bmp', '.tif', '.tiff',
+    '.woff', '.woff2', '.ttf', '.otf', '.eot',
+    '.mp4', '.webm', '.mov', '.mp3', '.wav', '.ogg', '.m4a',
+    '.pdf', '.zip', '.gz', '.br', '.zst', '.7z', '.wasm',
+]);
+/** Arquivos maiores que isso não são varridos (e são reportados como não varridos). */
+export const MAX_SCAN_FILE_BYTES = 25 * 1024 * 1024;
+export function isScannableFile(relPath) {
+    return !BINARY_EXT.has(path.extname(relPath).toLowerCase());
+}
+/** Varre um conteúdo de arquivo. Dedup por (arquivo, padrão). */
+export function scanContent(file, content, envSecrets) {
+    const text = typeof content === 'string' ? content : content.toString('latin1');
+    const out = [];
+    for (const pat of PUBLIC_SECRET_PATTERNS) {
+        pat.re.lastIndex = 0;
+        const m = pat.re.exec(text);
+        if (m)
+            out.push({ file, pattern: pat.id, label: pat.label, preview: maskSecret(m[0]) });
+    }
+    for (const env of envSecrets) {
+        if (text.includes(env.value)) {
+            out.push({
+                file,
+                pattern: `public_env:${env.name}`,
+                label: `valor da env pública ${env.name} (nome com KEY/SECRET/TOKEN vai pro navegador)`,
+                preview: maskSecret(env.value),
+            });
+        }
+    }
+    return out;
+}
+// ─── Env pública com cara de segredo ────────────────────────────────────────
+/** Parser mínimo de .env (KEY=VALUE, aspas simples/duplas, comentários). */
+export function parseDotenv(content) {
+    const out = {};
+    for (const line of content.split(/\r?\n/)) {
+        const t = line.trim();
+        if (!t || t.startsWith('#'))
+            continue;
+        const body = t.startsWith('export ') ? t.slice(7) : t;
+        const eq = body.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const k = body.slice(0, eq).trim();
+        let v = body.slice(eq + 1).trim();
+        if (v.length >= 2 && ((v[0] === '"' && v.endsWith('"')) || (v[0] === "'" && v.endsWith("'")))) {
+            v = v.slice(1, -1);
+        }
+        out[k] = v;
+    }
+    return out;
+}
+/** Arquivos .env que o bundler lê num build de produção (o `.env*` NÃO viaja no tarball). */
+export const BUILD_ENV_FILES = ['.env', '.env.production', '.env.local', '.env.production.local'];
+/**
+ * Coleta envs públicas com nome sensível a partir do ambiente do build:
+ * `.env*` do projeto, `--env-file` e `process.env` do CLI (o build roda com ele).
+ */
+export async function collectPublicEnvSecrets(cwd, envFile, processEnv = process.env) {
+    const merged = {};
+    const files = BUILD_ENV_FILES.map((f) => path.join(cwd, f));
+    if (envFile)
+        files.push(path.resolve(cwd, envFile));
+    for (const f of files) {
+        try {
+            Object.assign(merged, parseDotenv(await fsp.readFile(f, 'utf8')));
+        }
+        catch {
+            /* arquivo ausente/ilegível — ignora */
+        }
+    }
+    for (const [k, v] of Object.entries(processEnv)) {
+        if (typeof v === 'string')
+            merged[k] = v;
+    }
+    const seen = new Set();
+    const out = [];
+    for (const [name, value] of Object.entries(merged)) {
+        if (!isPublicSensitiveEnvName(name))
+            continue;
+        if (value.length < MIN_ENV_VALUE_LENGTH || isKnownPublicValue(value))
+            continue;
+        const key = `${name}\u0000${value}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push({ name, value });
+    }
+    return out;
+}
+function readString(buf, start, len) {
+    const slice = buf.subarray(start, start + len);
+    const nul = slice.indexOf(0);
+    return slice.subarray(0, nul < 0 ? slice.length : nul).toString('utf8');
+}
+function readSize(buf) {
+    const field = buf.subarray(124, 136);
+    if (field[0] & 0x80) {
+        // base-256 (GNU, arquivos > 8 GiB)
+        let n = 0;
+        for (let i = 1; i < field.length; i++)
+            n = n * 256 + field[i];
+        return n;
+    }
+    const s = readString(buf, 124, 12).trim();
+    return s ? parseInt(s, 8) : 0;
+}
+function parseHeader(block) {
+    const name = readString(block, 0, 100);
+    const type = String.fromCharCode(block[156] || 48); // '\0' → '0'
+    const magic = readString(block, 257, 6);
+    const prefix = magic.startsWith('ustar') ? readString(block, 345, 155) : '';
+    return { name: prefix ? `${prefix}/${name}` : name, size: readSize(block), type };
+}
+function parsePaxPath(data) {
+    const text = data.toString('utf8');
+    let i = 0;
+    while (i < text.length) {
+        const sp = text.indexOf(' ', i);
+        if (sp < 0)
+            break;
+        const len = parseInt(text.slice(i, sp), 10);
+        if (!Number.isFinite(len) || len <= 0)
+            break;
+        const record = text.slice(sp + 1, i + len - 1); // sem o '\n' final
+        const eq = record.indexOf('=');
+        if (eq > 0 && record.slice(0, eq) === 'path')
+            return record.slice(eq + 1);
+        i += len;
+    }
+    return null;
+}
+const META_MAX_BYTES = 1024 * 1024;
+/**
+ * Lê um .tar.gz em streaming e chama `onFile` para cada arquivo regular que
+ * `want(nome, tamanho)` aceitar. Arquivos não desejados são pulados sem buffer.
+ */
+export async function walkTarGz(tarPath, want, onFile) {
+    let buf = Buffer.alloc(0);
+    let state = 'header';
+    let remaining = 0;
+    let pad = 0;
+    let cur = null;
+    let longName = null;
+    let paxPath = null;
+    let ended = false;
+    const finish = () => {
+        if (!cur)
+            return;
+        const data = cur.chunks ? Buffer.concat(cur.chunks) : null;
+        if (cur.type === 'L' && data) {
+            longName = readString(data, 0, data.length);
+        }
+        else if (cur.type === 'x' && data) {
+            paxPath = parsePaxPath(data) ?? paxPath;
+        }
+        else if ((cur.type === '0' || cur.type === '7') && data) {
+            onFile(cur.name, data);
+        }
+        cur = null;
+    };
+    const consume = () => {
+        let off = 0;
+        for (;;) {
+            if (ended) {
+                off = buf.length;
+                break;
+            }
+            if (state === 'header') {
+                if (buf.length - off < 512)
+                    break;
+                const block = buf.subarray(off, off + 512);
+                off += 512;
+                if (block.every((b) => b === 0))
+                    continue; // bloco zero (fim/padding)
+                const h = parseHeader(block);
+                let name = h.name;
+                const isMeta = h.type === 'L' || h.type === 'x' || h.type === 'g' || h.type === 'K';
+                if (!isMeta) {
+                    name = paxPath ?? longName ?? name;
+                    paxPath = null;
+                    longName = null;
+                }
+                const regular = h.type === '0' || h.type === '7';
+                let collect = false;
+                if (h.type === 'L' || h.type === 'x')
+                    collect = h.size <= META_MAX_BYTES;
+                else if (regular)
+                    collect = want(name, h.size);
+                cur = { name, type: h.type, chunks: collect ? [] : null };
+                remaining = h.size;
+                pad = (512 - (h.size % 512)) % 512;
+                if (remaining === 0) {
+                    finish();
+                    state = pad ? 'pad' : 'header';
+                }
+                else {
+                    state = 'data';
+                }
+            }
+            else if (state === 'data') {
+                const avail = buf.length - off;
+                if (avail === 0)
+                    break;
+                const take = Math.min(avail, remaining);
+                if (cur?.chunks)
+                    cur.chunks.push(Buffer.from(buf.subarray(off, off + take)));
+                off += take;
+                remaining -= take;
+                if (remaining === 0) {
+                    finish();
+                    state = pad ? 'pad' : 'header';
+                }
+            }
+            else {
+                const avail = buf.length - off;
+                if (avail === 0)
+                    break;
+                const take = Math.min(avail, pad);
+                off += take;
+                pad -= take;
+                if (pad === 0)
+                    state = 'header';
+            }
+        }
+        buf = buf.subarray(off);
+    };
+    await new Promise((resolve, reject) => {
+        const input = fs.createReadStream(tarPath);
+        const gunzip = zlib.createGunzip();
+        input.on('error', reject);
+        gunzip.on('error', (e) => reject(new Error(`pacote .tar.gz ilegível: ${e.message}`)));
+        gunzip.on('data', (chunk) => {
+            buf = buf.length ? Buffer.concat([buf, chunk]) : chunk;
+            try {
+                consume();
+            }
+            catch (e) {
+                ended = true;
+                reject(e);
+            }
+        });
+        gunzip.on('end', () => resolve());
+        input.pipe(gunzip);
+    });
+}
+/** Varre o tarball de deploy (o que de fato vai pro GCS). */
+export async function scanTarballForPublicSecrets(tarPath, ctx) {
+    const findings = [];
+    const skippedLarge = [];
+    let scannedFiles = 0;
+    await walkTarGz(tarPath, (name, size) => {
+        if (!isPublicArtifactPath(name, ctx.stack) || !isScannableFile(name))
+            return false;
+        if (size > MAX_SCAN_FILE_BYTES) {
+            skippedLarge.push(normalizeEntryPath(name));
+            return false;
+        }
+        return true;
+    }, (name, data) => {
+        scannedFiles++;
+        findings.push(...scanContent(normalizeEntryPath(name), data, ctx.envSecrets));
+    });
+    return { findings, scannedFiles, skippedLarge };
+}
+/** Varre as pastas públicas no disco (target=cloud-run, onde não há tarball). */
+export async function scanDirectoryForPublicSecrets(root, ctx) {
+    const findings = [];
+    const skippedLarge = [];
+    let scannedFiles = 0;
+    const starts = ctx.stack === 'static'
+        ? ['.']
+        : ['.next/static', ...PUBLIC_TOP_DIRS].filter((d) => {
+            try {
+                return fs.statSync(path.join(root, d)).isDirectory();
+            }
+            catch {
+                return false;
+            }
+        });
+    async function walk(rel) {
+        let entries;
+        try {
+            entries = await fsp.readdir(path.join(root, rel), { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const e of entries) {
+            const childRel = rel === '.' ? e.name : `${rel}/${e.name}`;
+            if (e.isSymbolicLink())
+                continue;
+            if (e.isDirectory()) {
+                if (e.name === 'node_modules' || e.name === '.git')
+                    continue;
+                await walk(childRel);
+            }
+            else if (e.isFile()) {
+                if (!isPublicArtifactPath(childRel, ctx.stack) || !isScannableFile(childRel))
+                    continue;
+                const abs = path.join(root, childRel);
+                const st = await fsp.stat(abs);
+                if (st.size > MAX_SCAN_FILE_BYTES) {
+                    skippedLarge.push(childRel);
+                    continue;
+                }
+                scannedFiles++;
+                findings.push(...scanContent(childRel, await fsp.readFile(abs), ctx.envSecrets));
+            }
+        }
+    }
+    for (const s of starts)
+        await walk(s);
+    return { findings, scannedFiles, skippedLarge };
+}
+// ─── Mensagens ──────────────────────────────────────────────────────────────
+export const ALLOW_PUBLIC_SECRET_FLAG = '--allow-public-secret';
+/** Motivo mínimo do override (evita `--allow-public-secret x`). */
+export const MIN_OVERRIDE_REASON_LENGTH = 10;
+export function formatFindingsMessage(findings) {
+    const lines = findings
+        .slice(0, 20)
+        .map((f) => `  - ${f.file} — ${f.label} (${f.preview})`);
+    const more = findings.length > 20 ? [`  … e mais ${findings.length - 20} achado(s).`] : [];
+    return [
+        `Segredo no pacote PÚBLICO (servido ao navegador): ${findings.length} achado(s). Deploy BLOQUEADO.`,
+        ...lines,
+        ...more,
+        '',
+        'Por quê: tudo em .next/static, public, out, dist e build é baixado por qualquer visitante — ',
+        'a chave vira pública na hora. A credencial nrt_ do produto é SÓ DE SERVIDOR.',
+        'Como corrigir:',
+        '  1. Tire a chave do código do navegador/app: nada de NEXT_PUBLIC_*_KEY/EXPO_PUBLIC_*_KEY com segredo.',
+        '  2. O navegador/app chama a API do SEU produto (/api/v1/...) com o token do usuário;',
+        '     o backend usa @neetru/sdk com NEETRU_API_KEY (injetada no servidor pelo Core).',
+        '  3. Rode `neetru build` de novo e repita o deploy.',
+        `Emergência (fica registrado no deploy): ${ALLOW_PUBLIC_SECRET_FLAG} "<motivo>"`,
+    ].join('\n');
+}
+/** Registro do override — só caminho e tipo de padrão, NUNCA o valor. */
+export function buildOverrideRecord(reason, findings, now = new Date()) {
+    return {
+        reason,
+        findings: findings.map((f) => ({ file: f.file, pattern: f.pattern })),
+        at: now.toISOString(),
+    };
+}
+//# sourceMappingURL=public-secret-scan.js.map

package/dist/lib/public-secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-secret-scan.js","sourceRoot":"","sources":["../../src/lib/public-secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,kBAAkB,CAAC;AACnC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,CAAC,MAAM,sBAAsB,GAA6B;IAC9D,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,6CAA6C,EAAE,EAAE,EAAE,yBAAyB,EAAE;IACtG,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,EAAE,yBAAyB,EAAE;IAChF;QACE,EAAE,EAAE,aAAa;QACjB,KAAK,EAAE,mBAAmB;QAC1B,0EAA0E;QAC1E,yEAAyE;QACzE,gEAAgE;QAChE,EAAE,EAAE,8EAA8E;KACnF;CACF,CAAC;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,cAAc,EAAE,cAAc,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS,CAAU,CAAC;AAC/G,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAClD,8EAA8E;AAC9E,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,kEAAkE;AAClE,MAAM,yBAAyB,GAAsB;IACnD,+BAA+B,EAAE,yBAAyB;IAC1D,yBAAyB,EAAE,qDAAqD;IAChF,uBAAuB,EAAE,qBAAqB;CAC/C,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,yBAAyB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACjG,CAAC;AAED,+EAA+E;AAE/E,yEAAyE;AACzE,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,gBAAgB,KAAK,CAAC,MAAM,cAAc,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAE/E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,KAAc;IAClE,MAAM,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,gFAAgF;IAChF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;IACnE,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACzC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IACvD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CACrD,CAAC,CAAC;AAEH,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAEpD,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAgCD,iEAAiE;AACjE,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,OAAwB,EAAE,UAAsC;IACxG,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChF,MAAM,GAAG,GAA0B,EAAE,CAAC;IACtC,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,GAAG,CAAC,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;QACrB,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC;gBACP,IAAI;gBACJ,OAAO,EAAE,cAAc,GAAG,CAAC,IAAI,EAAE;gBACjC,KAAK,EAAE,wBAAwB,GAAG,CAAC,IAAI,gDAAgD;gBACvF,OAAO,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9F,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,uBAAuB,CAAU,CAAC;AAE3G;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAW,EACX,OAAgB,EAChB,aAAgC,OAAO,CAAC,GAAG;IAE3C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAa,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC;YAAE,SAAS;QAC9C,IAAI,KAAK,CAAC,MAAM,GAAG,oBAAoB,IAAI,kBAAkB,CAAC,KAAK,CAAC;YAAE,SAAS;QAC/E,MAAM,GAAG,GAAG,GAAG,IAAI,SAAS,KAAK,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,SAAS,UAAU,CAAC,GAAW,EAAE,KAAa,EAAE,GAAW;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC;QACpB,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,aAAa;IACjE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAChC,IAAI,EAAE,GAAG,CAAC;YAAE,MAAM;QAClB,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;YAAE,MAAM;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB;QACnE,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,MAAM;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC1E,CAAC,IAAI,GAAG,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA6C,EAC7C,MAA4C;IAE5C,IAAI,GAAG,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,KAAK,GAA8B,QAAQ,CAAC;IAChD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,GAAG,GAAmE,IAAI,CAAC;IAC/E,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;YAC7B,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;YACpC,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;QAC1C,CAAC;aAAM,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,CAAC;QACD,GAAG,GAAG,IAAI,CAAC;IACb,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,SAAS,CAAC;YACR,IAAI,KAAK,EAAE,CAAC;gBACV,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;gBACjB,MAAM;YACR,CAAC;YACD,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,GAAG,GAAG;oBAAE,MAAM;gBAClC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;gBAC3C,GAAG,IAAI,GAAG,CAAC;gBACX,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;oBAAE,SAAS,CAAC,2BAA2B;gBACtE,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;gBAC7B,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;gBAClB,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;gBACpF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,IAAI,GAAG,OAAO,IAAI,QAAQ,IAAI,IAAI,CAAC;oBACnC,OAAO,GAAG,IAAI,CAAC;oBACf,QAAQ,GAAG,IAAI,CAAC;gBAClB,CAAC;gBACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC;gBACjD,IAAI,OAAO,GAAG,KAAK,CAAC;gBACpB,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG;oBAAE,OAAO,GAAG,CAAC,CAAC,IAAI,IAAI,cAAc,CAAC;qBACpE,IAAI,OAAO;oBAAE,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC/C,GAAG,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1D,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;gBACnC,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;oBACpB,MAAM,EAAE,CAAC;oBACT,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,KAAK,GAAG,MAAM,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBAC/B,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;gBACxC,IAAI,GAAG,EAAE,MAAM;oBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC7E,GAAG,IAAI,IAAI,CAAC;gBACZ,SAAS,IAAI,IAAI,CAAC;gBAClB,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;oBACpB,MAAM,EAAE,CAAC;oBACT,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACjC,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC;gBAC/B,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAM;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAClC,GAAG,IAAI,IAAI,CAAC;gBACZ,GAAG,IAAI,IAAI,CAAC;gBACZ,IAAI,GAAG,KAAK,CAAC;oBAAE,KAAK,GAAG,QAAQ,CAAC;YAClC,CAAC;QACH,CAAC;QACD,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACtF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAClC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACvD,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC;YACZ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,KAAK,GAAG,IAAI,CAAC;gBACb,MAAM,CAAC,CAAC,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAe,EAAE,GAAgB;IACjF,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,SAAS,CACb,OAAO,EACP,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACnF,IAAI,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAC/B,YAAY,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,EACD,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QACb,YAAY,EAAE,CAAC;QACf,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IAChF,CAAC,CACF,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,IAAY,EAAE,GAAgB;IAChF,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,MAAM,MAAM,GACV,GAAG,CAAC,KAAK,KAAK,QAAQ;QACpB,CAAC,CAAC,CAAC,GAAG,CAAC;QACP,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;YAChD,IAAI,CAAC;gBACH,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IAET,KAAK,UAAU,IAAI,CAAC,GAAW;QAC7B,IAAI,OAAoB,CAAC;QACzB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,SAAS;YACjC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;oBAAE,SAAS;gBAC7D,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;gBACtB,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,EAAE,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;oBAClC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBACD,YAAY,EAAE,CAAC;gBACf,QAAQ,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAClD,CAAC;AAED,+EAA+E;AAE/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,uBAAuB,CAAC;AAChE,mEAAmE;AACnE,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,UAAU,qBAAqB,CAAC,QAAwC;IAC5E,MAAM,KAAK,GAAG,QAAQ;SACnB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAO;QACL,qDAAqD,QAAQ,CAAC,MAAM,+BAA+B;QACnG,GAAG,KAAK;QACR,GAAG,IAAI;QACP,EAAE;QACF,8FAA8F;QAC9F,8EAA8E;QAC9E,gBAAgB;QAChB,wGAAwG;QACxG,uFAAuF;QACvF,qFAAqF;QACrF,qDAAqD;QACrD,2CAA2C,wBAAwB,aAAa;KACjF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAQD,yEAAyE;AACzE,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,QAAwC,EACxC,MAAY,IAAI,IAAI,EAAE;IAEtB,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE;KACtB,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neetru/cli",
-  "version": "2.28.10",
+  "version": "2.31.0",
   "type": "module",
   "description": "Neetru Developer Kit — scaffold, AI assistant, publish, build e deploy de produtos SaaS Neetru via Core (VM-based agents)",
   "keywords": [
@@ -37,6 +37,7 @@
     "start": "node dist/index.js",
     "test": "vitest run",
     "test:watch": "vitest",
+    "prepare": "node -e \"try{if(require('fs').existsSync('.git'))require('child_process').execFileSync('git',['config','core.hooksPath','.githooks'],{stdio:'ignore'})}catch{}\"",
     "prepublishOnly": "npm run build"
   },
   "dependencies": {

package/templates/dev/Dockerfile.agent

@@ -1,39 +0,0 @@
-# Neetru Agent — modo dev (Docker container, sem systemd)
-# 
-# Em produção, o agente roda como systemd service na VM.
-# Em dev-local, roda como processo Node direto no container.
-# O deploy do app SaaS é feito como child process (não systemd unit).
-#
-# Build:
-#   docker build -f Dockerfile.agent -t neetru-agent-dev .
-
-FROM node:22-slim
-
-# Dependências do agente em produção (apt, certbot, etc.)
-RUN apt-get update && apt-get install -y --no-install-recommends \
-    curl ca-certificates systemctl \
-    && rm -rf /var/lib/apt/lists/*
-
-# Diretório do agente
-WORKDIR /opt/neetru
-
-# Baixa o agente mais recente do Core
-ARG CORE_URL=https://core.neetru.com
-ENV NEETRU_CORE_URL=${CORE_URL}
-
-# Download do binário (fallback: usa curl se GCS não disponível)
-RUN ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/') && \
-    curl -fsSL -o /usr/local/bin/neetru-agent \
-    "${NEETRU_CORE_URL}/releases/latest/neetru-agent-linux-${ARCH}" || \
-    echo "Agente não encontrado no Core — será montado via volume" && \
-    chmod +x /usr/local/bin/neetru-agent || true
-
-# Entrypoint: agente em modo dev
-# - NEETRU_DEV_MODE=true desabilita systemd, usa child_process direto
-# - NEETRU_APP_PORT define a porta onde o app SaaS vai rodar
-COPY templates/dev/agent-entrypoint.sh /usr/local/bin/neetru-agent-entrypoint
-RUN chmod +x /usr/local/bin/neetru-agent-entrypoint
-
-EXPOSE 3000
-
-ENTRYPOINT ["/usr/local/bin/neetru-agent-entrypoint"]

package/templates/dev/agent-entrypoint.sh

@@ -1,41 +0,0 @@
-#!/bin/bash
-# Neetru Agent — entrypoint modo dev (Docker container)
-#
-# Em modo dev, o agente NAO usa systemd. Em vez disso:
-#   - Deploy = child process (npm install + node server)
-#   - Funções = child process (neetru-functions)
-#   - Healthcheck = /health endpoint no próprio agente
-#
-# Env vars obrigatórias:
-#   NEETRU_SERVER_ID       — id do servidor (ex: dev-local-meuproduto)
-#   NEETRU_CORE_URL        — URL do Core (ex: https://core.neetru.com)
-#   NEETRU_FIREBASE_PROJECT — projeto Firebase
-#   NEETRU_DEV_MODE        — "true" ativa modo dev
-
-set -e
-
-echo "═══════════════════════════════════════════"
-echo "  Neetru Agent — Dev Mode"
-echo "  Server: ${NEETRU_SERVER_ID}"
-echo "  Core:   ${NEETRU_CORE_URL}"
-echo "═══════════════════════════════════════════"
-
-# Verifica binário
-if [ ! -f /usr/local/bin/neetru-agent ]; then
-  echo "[AGENT] Binário não encontrado. Montando via volume..."
-  echo "[AGENT] Certifique-se de que o agente está em /opt/neetru/neetru-agent"
-  ls -la /opt/neetru/ || true
-fi
-
-# Cria diretórios necessários
-mkdir -p /var/cache/neetru /opt/neetru/deploys
-
-# Inicia o agente
-echo "[AGENT] Iniciando agente Neetru..."
-exec node /usr/local/bin/neetru-agent 2>&1 || exec node /opt/neetru/neetru-agent 2>&1 || {
-  echo "[AGENT] ERRO: Não foi possível iniciar o agente."
-  echo "[AGENT] Verifique se o binário existe em /usr/local/bin/neetru-agent"
-  echo "[AGENT] ou monte o binário via volume em /opt/neetru/neetru-agent"
-  sleep 10
-  exit 1
-}

package/templates/dev/docker-compose.dev.yml

@@ -1,63 +0,0 @@
-# Neetru Dev Local — emulador de VM ({{ENGINE}})
-# Gerado por `neetru dev up`. Modifique o neetru.config.json e rode novamente.
-#
-# Este compose simula uma VM de produção Neetru:
-#   1. Banco de dados ({{ENGINE}}) = mesmo engine que vai pra produção
-#   2. Agente Neetru = recebe comandos do Core, faz deploy, npm install, healthcheck
-#   3. App SaaS = deployado pelo agente, acessível em http://localhost:{{APP_PORT}}
-#
-# Uso:
-#   neetru dev up          # gera este compose + sobe tudo
-#   docker compose -f neetru-compose.dev.yml up -d   # manual
-#   docker compose -f neetru-compose.dev.yml down    # desliga
-
-services:
-  # ── Banco de dados ({{ENGINE}}) ────────────────────────────────────────────
-  database:
-    image: {{DB_IMAGE}}
-    container_name: neetru-dev-db
-    environment:
-{{DB_ENV}}
-    ports:
-      - "{{DB_PORT}}:{{DB_INTERNAL_PORT}}"
-    volumes:
-      - neetru-db-data:{{DB_DATA_DIR}}
-    healthcheck:
-{{DB_HEALTHCHECK}}
-    restart: unless-stopped
-    networks:
-      - neetru-dev-net
-
-  # ── Agente Neetru (modo dev — sem systemd) ────────────────────────────────
-  agent:
-    build:
-      context: .
-      dockerfile: Dockerfile.agent
-    container_name: neetru-dev-agent
-    environment:
-      - NEETRU_SERVER_ID=dev-local-{{PRODUCT_SLUG}}
-      - NEETRU_CORE_URL={{CORE_URL}}
-      - NEETRU_FIREBASE_PROJECT={{FIREBASE_PROJECT}}
-      - NEETRU_FIREBASE_API_KEY={{FIREBASE_API_KEY}}
-      - NEETRU_DEV_MODE=true
-      - NEETRU_APP_PORT={{APP_PORT}}
-    ports:
-      - "{{APP_PORT}}:{{APP_PORT}}"
-    volumes:
-      - /var/run/docker.sock:/var/run/docker.sock
-      - neetru-agent-data:/var/cache/neetru
-      - .:/app/product:cached
-    depends_on:
-      database:
-        condition: service_healthy
-    restart: unless-stopped
-    networks:
-      - neetru-dev-net
-
-volumes:
-  neetru-db-data:
-  neetru-agent-data:
-
-networks:
-  neetru-dev-net:
-    driver: bridge