@oktis-works/cms 0.2.0 → 0.3.0

package/dist/assets.d.ts

@@ -12,28 +12,38 @@ export declare const ASSET_MIRROR: {
  * processo escolhido pelo `command` do compose. Quatro Dockerfiles seriam
  * quatro builds idênticos consumindo o mesmo node_modules.
  */
-export declare const DOCKERFILE = "# syntax=docker/dockerfile:1\n# @oktis-works - Imagem \u00FAnica do OkCMS (entrypoints: api | admin | web | worker)\n#\n# Gerada pelo scaffold da CLI. Can\u00F4nica em\n# infrastructure/docker/Dockerfile neste monorepo.\n#\n# SEGURAN\u00C7A: a ferramenta de linha de comando N\u00C3O entra nesta imagem. O\n# container exp\u00F5e apenas os processos da aplica\u00E7\u00E3o \u2014 sem instalador de\n# pacotes, sem acesso ao socket do Docker, sem capacidade de alterar o\n# pr\u00F3prio estado. Deploy e configura\u00E7\u00E3o sempre rodam no host.\nFROM oven/bun:1-alpine AS base\nWORKDIR /app\nENV NODE_ENV=production\n\n# --- depend\u00EAncias -----------------------------------------------------------\n# Manifest + lock primeiro: trocar s\u00F3 o c\u00F3digo n\u00E3o invalida este `install`.\nFROM base AS deps\nCOPY package.json bun.lock* package-lock.json* yarn.lock* pnpm-lock.yaml* ./\n# Fallbacks: lock ausente/divergente (npm/yarn) ou bun antigo sem --production\nRUN bun install --production --frozen-lockfile \\\n || bun install --production \\\n || bun install\n\n# --- runtime ----------------------------------------------------------------\nFROM base AS runtime\n# 1. c\u00F3digo do projeto (.dockerignore remove .env, node_modules e .data)\nCOPY . .\n# 2. node_modules limpo do est\u00E1gio de deps, por cima \u2014 nunca o do host\nCOPY --from=deps /app/node_modules ./node_modules\n\nRUN mkdir -p /app/.data/storage /app/.data/cache /app/logs\n\nEXPOSE 3000 3001 3011\n\n# `docker compose ... command: api` escolhe o papel; ver docker/entrypoint.sh\nENTRYPOINT [\"/app/docker/entrypoint.sh\"]\nCMD [\"api\"]\n";
+export declare const DOCKERFILE = "# syntax=docker/dockerfile:1\n# @oktis-works - Single OkCMS image (entrypoints: api | admin | web | worker)\n#\n# Generated by the CLI scaffold. Canonical at\n# infrastructure/docker/Dockerfile in this monorepo.\n#\n# SECURITY: the command-line tool never enters this image. The container\n# exposes only the application processes \u2014 no package installer, no Docker\n# socket access, no way to change its own state. Deploy and configuration\n# always run on the host.\nFROM oven/bun:1-alpine AS base\nWORKDIR /app\nENV NODE_ENV=production\n\n# --- dependencies -----------------------------------------------------------\n# Manifest + lock first: changing just the code does not invalidate\n# this `install`.\nFROM base AS deps\nCOPY package.json bun.lock* package-lock.json* yarn.lock* pnpm-lock.yaml* ./\n# Fallbacks: missing/divergent lock (npm/yarn) or old bun without --production\nRUN bun install --production --frozen-lockfile \\\n || bun install --production \\\n || bun install\n\n# --- runtime ----------------------------------------------------------------\nFROM base AS runtime\n# 1. project code (.dockerignore drops .env, node_modules and .data)\nCOPY . .\n# 2. clean node_modules from the deps stage, on top \u2014 never the host's\nCOPY --from=deps /app/node_modules ./node_modules\n\nRUN mkdir -p /app/.data/storage /app/.data/cache /app/logs\n\nEXPOSE 3000 3001 3011\n\n# `docker compose ... command: api` picks the role; see docker/entrypoint.sh\nENTRYPOINT [\"/app/docker/entrypoint.sh\"]\nCMD [\"api\"]\n";
 /** Dispatcher de papéis. Fora da lista, executa o comando literal. */
-export declare const ENTRYPOINT_SH = "#!/bin/sh\n# @oktis-works - Entrada \u00FAnica da imagem okcms/app\n#\n# O compose escolhe o papel com `command: api|web|admin|worker`. Qualquer\n# outro valor \u00E9 repassado literalmente (`docker run okcms/app sh`), o que\n# mantem o container inspecion\u00E1vel sem reescrever a imagem.\nset -eu\n\napi_entry=\"node_modules/@oktis-works/api/dist/index.js\"\nweb_entry=\"node_modules/@oktis-works/web/dist/index.js\"\nadmin_entry=\"node_modules/@oktis-works/admin/bin/admin.js\"\nworker_entry=\"node_modules/@oktis-works/worker/dist/index.js\"\n\ncase \"${1:-api}\" in\n  api)\n    shift\n    exec bun \"$api_entry\" \"$@\"\n    ;;\n  web)\n    shift\n    exec bun \"$web_entry\" \"$@\"\n    ;;\n  admin)\n    shift\n    exec bun \"$admin_entry\" \"$@\"\n    ;;\n  worker)\n    shift\n    exec bun \"$worker_entry\" \"$@\"\n    ;;\n  *)\n    exec \"$@\"\n    ;;\nesac\n";
+export declare const ENTRYPOINT_SH = "#!/bin/sh\n# @oktis-works - Single entrypoint of the okcms/app image\n#\n# Compose picks the role with `command: api|web|admin|worker`. Any other\n# value is passed through literally (`docker run okcms/app sh`), which keeps\n# the container inspectable without rewriting the image.\nset -eu\n\napi_entry=\"node_modules/@oktis-works/api/dist/index.js\"\nweb_entry=\"node_modules/@oktis-works/web/dist/index.js\"\nadmin_entry=\"node_modules/@oktis-works/admin/bin/admin.js\"\nworker_entry=\"node_modules/@oktis-works/worker/dist/index.js\"\n\ncase \"${1:-api}\" in\n  api)\n    shift\n    exec bun \"$api_entry\" \"$@\"\n    ;;\n  web)\n    shift\n    exec bun \"$web_entry\" \"$@\"\n    ;;\n  admin)\n    shift\n    exec bun \"$admin_entry\" \"$@\"\n    ;;\n  worker)\n    shift\n    exec bun \"$worker_entry\" \"$@\"\n    ;;\n  *)\n    exec \"$@\"\n    ;;\nesac\n";
 /**
  * Camada de segurança do build: além do ganho de cache, impede dois acidentes
  * caros — assinar a imagem com o `.env` real e instalar `node_modules` do host
  * (arquitetura diferente / código não auditado).
  */
-export declare const DOCKERIGNORE = "# @oktis-works - build context da imagem okcms/app\n# .env NUNCA entra na imagem: ele carrega senha de banco e JWT_SECRET e a\n# imagem \u00E9 distribu\u00EDda/copiada. Em runtime ele vem do host via env_file.\n\n.env\n.env.*\n!.env.example\n\n# depend\u00EAncias do host (a imagem instala as suas)\nnode_modules\n**/node_modules\n.tsbuildinfo\n**/*.tsbuildinfo\n# NB: N\u00C3O ignorar dist/ \u2014 plugins instalados em plugins/*/dist s\u00E3o runtime.\n\n# dados e estado local\n.data\n**/.data\nlogs\n**/logs\n*.log\ncoverage\n**/coverage\n\n# montado em runtime, n\u00E3o copiado\ndeploy/\n\n# VCS e tooling \u2014 n\u00E3o \u00E9 c\u00F3digo de runtime\n.git\n.github\n.gitignore\n.sdd\n.vscode\n.idea\n.claude\n*.md\n!README.md\n\n# infraestrutura montada em runtime, n\u00E3o copiada para dentro\ndocker-compose*.yml\ndeploy/nginx/certs\n";
+export declare const DOCKERIGNORE = "# @oktis-works - build context of the okcms/app image\n# .env NEVER enters the image: it carries the database password and\n# JWT_SECRET, and the image is distributed/copied. At runtime it comes\n# from the host via env_file.\n\n.env\n.env.*\n!.env.example\n\n# host dependencies (the image installs its own)\nnode_modules\n**/node_modules\n.tsbuildinfo\n**/*.tsbuildinfo\n# NB: do NOT ignore dist/ \u2014 plugins installed in plugins/*/dist are runtime.\n\n# local data and state\n.data\n**/.data\nlogs\n**/logs\n*.log\ncoverage\n**/coverage\n\n# mounted at runtime, not copied\ndeploy/\n\n# VCS and tooling \u2014 not runtime code\n.git\n.github\n.gitignore\n.sdd\n.vscode\n.idea\n.claude\n*.md\n!README.md\n\n# infrastructure mounted at runtime, not copied inside\ndocker-compose*.yml\ndeploy/nginx/certs\n";
 /**
  * Banco, cache e proxy — únicos e estáveis por toda a vida do site. Moram num
  * projeto PRÓPRIO para que `docker compose -p okcms-blue down` não derrube o
  * banco junto com a lane antiga.
  */
-export declare const COMPOSE_INFRA = "# @oktis-works - Infraestrutura compartilhada do deploy em produ\u00E7\u00E3o\n# Gerada pela CLI. Can\u00F4nica em infrastructure/compose/docker-compose.infra.yml\n#\n# Projeto Docker PR\u00D3PRIO (okcms): postgres, redis e proxy \u00FAnicos. As lanes\n# blue/green s\u00E3o projetos separados (okcms-blue / okcms-green) que entram\n# nesta rede como externa \u2014 por isso `down` numa lane nunca toca no banco.\n#\n#   docker compose -p okcms -f docker-compose.infra.yml up -d\nname: okcms\n\nservices:\n  postgres:\n    image: postgres:16-alpine\n    container_name: okcms-postgres\n    restart: unless-stopped\n    environment:\n      POSTGRES_DB: ${DB_NAME:-okcms}\n      POSTGRES_USER: ${DB_USER:-postgres}\n      POSTGRES_PASSWORD: ${DB_PASSWORD:?defina DB_PASSWORD no .env}\n    volumes:\n      - postgres-data:/var/lib/postgresql/data\n    ports:\n      # Somente loopback: o host consegue rodar `okcms db:migrate` e\n      # `db:backup` sem expor o Postgres para a rede. Em produ\u00E7\u00E3o gerenciada\n      # remova este bloco e aponte DB_HOST/DATABASE_URL para o provedor.\n      - \"127.0.0.1:${DB_HOST_PORT:-5432}:5432\"\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}\"]\n      interval: 10s\n      timeout: 5s\n      retries: 10\n    labels:\n      # classifica\u00E7\u00E3o lida pelo `okcms update`: data = intoc\u00E1vel\n      okcms.role: data\n    networks: [okcms]\n\n  redis:\n    image: redis:7-alpine\n    container_name: okcms-redis\n    restart: unless-stopped\n    environment:\n      REDIS_PASSWORD: ${REDIS_PASSWORD:-}\n    command:\n      - sh\n      - -c\n      - |\n        if [ -n \"$${REDIS_PASSWORD:-}\" ]; then\n          exec redis-server --appendonly yes --requirepass \"$$REDIS_PASSWORD\"\n        else\n          exec redis-server --appendonly yes\n        fi\n    # Nenhuma porta publicada: s\u00F3 quem est\u00E1 em okcms-net alcan\u00E7a o Redis.\n    volumes:\n      - redis-data:/data\n    healthcheck:\n      test: [\"CMD\", \"redis-cli\", \"ping\"]\n      interval: 10s\n      timeout: 5s\n      retries: 10\n    labels:\n      okcms.role: data\n    networks: [okcms]\n\n  proxy:\n    image: nginx:1.27-alpine\n    container_name: okcms-proxy\n    restart: unless-stopped\n    ports:\n      - \"80:80\"\n      - \"8080:8080\"\n    environment:\n      # entram no envsubst nativo do nginx \u2192 gravam conf.d/default.conf\n      SERVER_NAME: ${SERVER_NAME:-_}\n      ADMIN_SERVER_NAME: ${ADMIN_SERVER_NAME:-admin.localhost}\n    volumes:\n      - ./deploy/nginx/templates:/etc/nginx/templates:ro\n      # conf.d precisa ser grav\u00E1vel: a CLI reescreve 00-upstreams.conf no swap\n      - ./deploy/nginx/conf.d:/etc/nginx/conf.d:rw\n    labels:\n      okcms.role: proxy\n    networks: [okcms]\n\nnetworks:\n  okcms:\n    # nome fixo \u2014 as lanes o declaram como external\n    name: okcms-net\n\nvolumes:\n  postgres-data:\n    name: okcms-postgres-data\n  redis-data:\n    name: okcms-redis-data\n";
+export declare const COMPOSE_INFRA = "# @oktis-works - Shared infrastructure of the production deploy\n# Generated by the CLI. Canonical at\n# infrastructure/compose/docker-compose.infra.yml\n#\n# OWN Docker project (okcms): single postgres, redis and proxy. The\n# blue/green lanes are separate projects (okcms-blue / okcms-green) that\n# join this network as external \u2014 so `down` of a lane never touches the\n# database.\n#\n#   docker compose -p okcms -f docker-compose.infra.yml up -d\nname: okcms\n\nservices:\n  postgres:\n    image: postgres:16-alpine\n    container_name: okcms-postgres\n    restart: unless-stopped\n    environment:\n      POSTGRES_DB: ${DB_NAME:-okcms}\n      POSTGRES_USER: ${DB_USER:-postgres}\n      POSTGRES_PASSWORD: ${DB_PASSWORD:?set DB_PASSWORD in .env}\n    volumes:\n      - postgres-data:/var/lib/postgresql/data\n    ports:\n      # Loopback only: the host can run `okcms db:migrate` and\n      # `db:backup` without exposing Postgres to the network. On managed\n      # production remove this block and point DB_HOST/DATABASE_URL at the\n      # provider.\n      - \"127.0.0.1:${DB_HOST_PORT:-5432}:5432\"\n    healthcheck:\n      test: [\"CMD-SHELL\", \"pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}\"]\n      interval: 10s\n      timeout: 5s\n      retries: 10\n    labels:\n      # classification read by `okcms update`: data = untouchable\n      okcms.role: data\n    networks: [okcms]\n\n  redis:\n    image: redis:7-alpine\n    container_name: okcms-redis\n    restart: unless-stopped\n    environment:\n      REDIS_PASSWORD: ${REDIS_PASSWORD:-}\n    command:\n      - sh\n      - -c\n      - |\n        if [ -n \"$${REDIS_PASSWORD:-}\" ]; then\n          exec redis-server --appendonly yes --requirepass \"$$REDIS_PASSWORD\"\n        else\n          exec redis-server --appendonly yes\n        fi\n    # no published port: only what is on okcms-net can reach Redis\n    volumes:\n      - redis-data:/data\n    healthcheck:\n      test: [\"CMD\", \"redis-cli\", \"ping\"]\n      interval: 10s\n      timeout: 5s\n      retries: 10\n    labels:\n      okcms.role: data\n    networks: [okcms]\n\n  proxy:\n    image: nginx:1.27-alpine\n    container_name: okcms-proxy\n    restart: unless-stopped\n    ports:\n      - \"80:80\"\n      - \"8080:8080\"\n    environment:\n      # fed to the native nginx envsubst \u2192 writes conf.d/default.conf\n      SERVER_NAME: ${SERVER_NAME:-_}\n      ADMIN_SERVER_NAME: ${ADMIN_SERVER_NAME:-admin.localhost}\n    volumes:\n      - ./deploy/nginx/templates:/etc/nginx/templates:ro\n      # conf.d must be writable: the CLI rewrites 00-upstreams.conf on swap\n      - ./deploy/nginx/conf.d:/etc/nginx/conf.d:rw\n    labels:\n      okcms.role: proxy\n    networks: [okcms]\n\nnetworks:\n  okcms:\n    # fixed name \u2014 the lanes declare it as external\n    name: okcms-net\n\nvolumes:\n  postgres-data:\n    name: okcms-postgres-data\n  redis-data:\n    name: okcms-redis-data\n";
 /**
  * Um arquivo, dois projetos Docker. O "lane" é o NOME DO PROJETO — não há
  * serviço repetido por perfil nem perfil a ativar manualmente; basta
  * `-p okcms-blue` ou `-p okcms-green`. Os containers herdam o prefixo
  * `okcms-<lane>-`, que é exatamente o que os upstreams do nginx apontam.
  */
-export declare const COMPOSE_DEPLOY = "# @oktis-works - Lanes blue/green do OkCMS\n# Gerada pela CLI. Can\u00F4nica em infrastructure/compose/docker-compose.deploy.yml\n#\n# Um ARQUIVO, DOIS projetos Docker. O lane \u00E9 o nome do projeto:\n#\n#   docker compose -p okcms-blue  -f docker-compose.deploy.yml up -d --build\n#   docker compose -p okcms-green -f docker-compose.deploy.yml up -d --build\n#\n# Containers ficam okcms-<lane>-<servi\u00E7o> \u2014 os upstreams do nginx apontam\n# para esses nomes (gerados em deploy/nginx/conf.d/00-upstreams.conf).\n#\n# A rede okcms-net \u00E9 EXTERNA (criada pelo docker-compose.infra.yml) e os\n# servi\u00E7os de infra N\u00C3O aparecem aqui de prop\u00F3sito: sem isso, `down` de uma\n# lane derrubaria o banco junto com a lane antiga.\n#\n# Pap\u00E9is (label okcms.role, lida pelo `okcms update`):\n#   edge   api/web/admin \u2192 trocados por completo a cada deploy (blue/green)\n#   worker fila BullMQ   \u2192 NUNCA blue/green; drenado com SIGTERM no swap\n#   data   postgres/redis\u2192 intoc\u00E1veis; moram no docker-compose.infra.yml\n#\n# NB: o `down` de lane derruba CONTAINERS e REDES, mas nunca passa de\n# ``` -v ```: o volume okcms-storage \u00E9 compartilhado entre blue e green,\n# \u00E9 ele que mant\u00E9m a m\u00EDdia viva atrav\u00E9s dos deploys.\n\nx-app: &app\n  image: okcms/app:${OKCMS_VERSION:-latest}\n  build:\n    context: .\n    dockerfile: docker/Dockerfile\n  env_file:\n    # .env primeiro (portas do operador) \u2014 o environment abaixo sobrescreve\n    - .env\n  restart: unless-stopped\n  networks: [okcms]\n  environment:\n    NODE_ENV: production\n    DB_HOST: postgres\n    REDIS_HOST: redis\n  volumes:\n    - ./plugins:/app/plugins\n    - ./themes:/app/themes\n    # m\u00EDdia compartilhada entre as duas lanes: deploy n\u00E3o perde arquivo\n    - storage-data:/app/.data/storage\n    - cache-data:/app/.data/cache\n\nx-api-health: &api-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-web-health: &web-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.WEB_PORT||3001)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-admin-health: &admin-health\n  # o admin \u00E9 Astro standalone: serve / e n\u00E3o tem /health dedicado\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3011)+'/').then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 30s\n\nservices:\n  # ---------------------------------------------------------------- api\n  api-blue:\n    <<: *app\n    container_name: okcms-api-blue\n    command: [\"api\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: api\n    healthcheck: *api-health\n\n  api-green:\n    <<: *app\n    container_name: okcms-api-green\n    command: [\"api\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: api\n    healthcheck: *api-health\n\n  # ---------------------------------------------------------------- web\n  web-blue:\n    <<: *app\n    container_name: okcms-web-blue\n    command: [\"web\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: web\n    healthcheck: *web-health\n\n  web-green:\n    <<: *app\n    container_name: okcms-web-green\n    command: [\"web\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: web\n    healthcheck: *web-health\n\n  # -------------------------------------------------------------- admin\n  # admin l\u00EA `PORT` (astro standalone) e n\u00E3o `ADMIN_PORT`: o environment do\n  # service substitui o do anchor `<<`, ent\u00E3o os tr\u00EAs comuns s\u00E3o repetidos.\n  admin-blue:\n    <<: *app\n    container_name: okcms-admin-blue\n    command: [\"admin\"]\n    environment:\n      NODE_ENV: production\n      DB_HOST: postgres\n      REDIS_HOST: redis\n      PORT: ${ADMIN_PORT:-3011}\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: admin\n    healthcheck: *admin-health\n\n  admin-green:\n    <<: *app\n    container_name: okcms-admin-green\n    command: [\"admin\"]\n    environment:\n      NODE_ENV: production\n      DB_HOST: postgres\n      REDIS_HOST: redis\n      PORT: ${ADMIN_PORT:-3011}\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: admin\n    healthcheck: *admin-health\n\n  # ------------------------------------------------------------- worker\n  # Uma fila n\u00E3o suporta duas inst\u00E2ncias \"fantasma\": o worker s\u00F3 sobe depois\n  # do swap e o da lane antiga drena com SIGTERM (stop_grace_period) antes.\n  worker-blue:\n    <<: *app\n    container_name: okcms-worker-blue\n    command: [\"worker\"]\n    stop_grace_period: 30s\n    labels:\n      okcms.role: worker\n      okcms.lane: blue\n      okcms.service: worker\n\n  worker-green:\n    <<: *app\n    container_name: okcms-worker-green\n    command: [\"worker\"]\n    stop_grace_period: 30s\n    labels:\n      okcms.role: worker\n      okcms.lane: green\n      okcms.service: worker\n\nnetworks:\n  okcms:\n    name: okcms-net\n    external: true\n\nvolumes:\n  # compartilhado entre blue e green de prop\u00F3sito: m\u00EDdia sobrevive ao deploy\n  storage-data:\n    name: okcms-storage\n  cache-data:\n    name: okcms-cache\n";
+export declare const COMPOSE_DEPLOY = "# @oktis-works - OkCMS blue/green lanes\n# Generated by the CLI. Canonical at\n# infrastructure/compose/docker-compose.deploy.yml\n#\n# ONE FILE, TWO Docker projects. The lane is the project name:\n#\n#   docker compose -p okcms-blue  -f docker-compose.deploy.yml up -d --build\n#   docker compose -p okcms-green -f docker-compose.deploy.yml up -d --build\n#\n# Containers are okcms-<lane>-<service> \u2014 the nginx upstreams point at\n# those names (generated in deploy/nginx/conf.d/00-upstreams.conf).\n#\n# The okcms-net network is EXTERNAL (created by docker-compose.infra.yml)\n# and the infra services are NOT listed here on purpose: without that,\n# `down` of a lane would take the database down with the old lane.\n#\n# Roles (label okcms.role, read by `okcms update`):\n#   edge   api/web/admin \u2192 fully replaced on each deploy (blue/green)\n#   worker BullMQ queue  \u2192 NEVER blue/green; drained with SIGTERM on swap\n#   data   postgres/redis\u2192 untouchable; they live in docker-compose.infra.yml\n#\n# NB: a lane `down` removes CONTAINERS and NETWORKS, but never passes -v\n# (`-v` would wipe the okcms-storage volume shared by blue and green, the\n# one that keeps media alive across deploys).\n\nx-app: &app\n  image: okcms/app:${OKCMS_VERSION:-latest}\n  build:\n    context: .\n    dockerfile: docker/Dockerfile\n  env_file:\n    # .env first (operator ports) \u2014 the environment below overrides\n    - .env\n  restart: unless-stopped\n  networks: [okcms]\n  environment:\n    NODE_ENV: production\n    DB_HOST: postgres\n    REDIS_HOST: redis\n  volumes:\n    - ./plugins:/app/plugins\n    - ./themes:/app/themes\n    # media shared by both lanes: a deploy never loses files\n    - storage-data:/app/.data/storage\n    - cache-data:/app/.data/cache\n\nx-api-health: &api-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-web-health: &web-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.WEB_PORT||3001)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-admin-health: &admin-health\n  # the admin is an Astro standalone: it serves / and has no /health endpoint\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3011)+'/').then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 30s\n\nservices:\n  # ---------------------------------------------------------------- api\n  api-blue:\n    <<: *app\n    container_name: okcms-api-blue\n    command: [\"api\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: api\n    healthcheck: *api-health\n\n  api-green:\n    <<: *app\n    container_name: okcms-api-green\n    command: [\"api\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: api\n    healthcheck: *api-health\n\n  # ---------------------------------------------------------------- web\n  web-blue:\n    <<: *app\n    container_name: okcms-web-blue\n    command: [\"web\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: web\n    healthcheck: *web-health\n\n  web-green:\n    <<: *app\n    container_name: okcms-web-green\n    command: [\"web\"]\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: web\n    healthcheck: *web-health\n\n  # -------------------------------------------------------------- admin\n  # admin reads `PORT` (astro standalone), not `ADMIN_PORT`: a service\n  # level environment replaces the merged anchor one, so the three shared\n  # ones are repeated.\n  admin-blue:\n    <<: *app\n    container_name: okcms-admin-blue\n    command: [\"admin\"]\n    environment:\n      NODE_ENV: production\n      DB_HOST: postgres\n      REDIS_HOST: redis\n      PORT: ${ADMIN_PORT:-3011}\n    labels:\n      okcms.role: edge\n      okcms.lane: blue\n      okcms.service: admin\n    healthcheck: *admin-health\n\n  admin-green:\n    <<: *app\n    container_name: okcms-admin-green\n    command: [\"admin\"]\n    environment:\n      NODE_ENV: production\n      DB_HOST: postgres\n      REDIS_HOST: redis\n      PORT: ${ADMIN_PORT:-3011}\n    labels:\n      okcms.role: edge\n      okcms.lane: green\n      okcms.service: admin\n    healthcheck: *admin-health\n\n  # ------------------------------------------------------------- worker\n  # a queue cannot take two \"ghost\" instances: the worker starts only after\n  # the swap and the old lane's worker drains with SIGTERM\n  # (stop_grace_period) first.\n  worker-blue:\n    <<: *app\n    container_name: okcms-worker-blue\n    command: [\"worker\"]\n    stop_grace_period: 30s\n    labels:\n      okcms.role: worker\n      okcms.lane: blue\n      okcms.service: worker\n\n  worker-green:\n    <<: *app\n    container_name: okcms-worker-green\n    command: [\"worker\"]\n    stop_grace_period: 30s\n    labels:\n      okcms.role: worker\n      okcms.lane: green\n      okcms.service: worker\n\nnetworks:\n  okcms:\n    name: okcms-net\n    external: true\n\nvolumes:\n  # shared between blue and green on purpose: media survives the deploy\n  storage-data:\n    name: okcms-storage\n  cache-data:\n    name: okcms-cache\n";
+/**
+ * The non-blue/green path: one Docker project (`okcms-app`) holding api, web,
+ * admin and worker without lane suffixes. `up -d --build` recreates only what
+ * changed, there is no second lane to keep warm and no proxy swap — the nginx
+ * upstreams simply point at `okcms-api` / `okcms-web` / `okcms-admin`.
+ *
+ * Network and volumes are the same ones the lanes use, so storage (media)
+ * survives a switch between simple mode and blue/green.
+ */
+export declare const COMPOSE_APP = "# @oktis-works - Simple container stack of OkCMS\n# Generated by the CLI.\n#\n# One Docker project, no lanes, no swap:\n#\n#   docker compose -p okcms-app -f docker-compose.app.yml up -d --build\n#\n# Containers are okcms-api / okcms-web / okcms-admin / okcms-worker \u2014 the\n# nginx upstreams (deploy/nginx/conf.d/00-upstreams.conf) point at them.\n# Use `okcms deploy` to pick this mode, or blue/green for zero-downtime.\n#\n# Network okcms-net is EXTERNAL (created by docker-compose.infra.yml), so\n# `down` of this stack never touches postgres, redis or the proxy.\n\nx-app: &app\n  image: okcms/app:${OKCMS_VERSION:-latest}\n  build:\n    context: .\n    dockerfile: docker/Dockerfile\n  env_file:\n    - .env\n  restart: unless-stopped\n  networks: [okcms]\n  environment:\n    NODE_ENV: production\n    DB_HOST: postgres\n    REDIS_HOST: redis\n  volumes:\n    - ./plugins:/app/plugins\n    - ./themes:/app/themes\n    - storage-data:/app/.data/storage\n    - cache-data:/app/.data/cache\n\nx-api-health: &api-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3000)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-web-health: &web-health\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.WEB_PORT||3001)+'/health').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 25s\n\nx-admin-health: &admin-health\n  # the admin is an Astro standalone: it serves / and has no /health endpoint\n  test:\n    - CMD\n    - bun\n    - -e\n    - \"fetch('http://127.0.0.1:'+(process.env.PORT||3011)+'/').then(r=>process.exit(r.status<500?0:1)).catch(()=>process.exit(1))\"\n  interval: 10s\n  timeout: 5s\n  retries: 12\n  start_period: 30s\n\nservices:\n  api:\n    <<: *app\n    container_name: okcms-api\n    command: [\"api\"]\n    labels:\n      okcms.role: edge\n      okcms.service: api\n    healthcheck: *api-health\n\n  web:\n    <<: *app\n    container_name: okcms-web\n    command: [\"web\"]\n    labels:\n      okcms.role: edge\n      okcms.service: web\n    healthcheck: *web-health\n\n  # the admin reads `PORT` (astro standalone), not `ADMIN_PORT`: a service\n  # level environment replaces the merged anchor one, so it is repeated here.\n  admin:\n    <<: *app\n    container_name: okcms-admin\n    command: [\"admin\"]\n    environment:\n      NODE_ENV: production\n      DB_HOST: postgres\n      REDIS_HOST: redis\n      PORT: ${ADMIN_PORT:-3011}\n    labels:\n      okcms.role: edge\n      okcms.service: admin\n    healthcheck: *admin-health\n\n  worker:\n    <<: *app\n    container_name: okcms-worker\n    command: [\"worker\"]\n    stop_grace_period: 30s\n    labels:\n      okcms.role: worker\n      okcms.service: worker\n\nnetworks:\n  okcms:\n    name: okcms-net\n    external: true\n\nvolumes:\n  # same names as the lanes: media survives switching deploy modes\n  storage-data:\n    name: okcms-storage\n  cache-data:\n    name: okcms-cache\n";
 /**
  * Roteamento production. Os upstreams ficam em arquivo SEPARADO
  * (`00-upstreams.conf`) justamente para que o swap seja uma reescrita de um
@@ -44,7 +54,7 @@ export declare const COMPOSE_DEPLOY = "# @oktis-works - Lanes blue/green do OkCM
  * as variáveis em `$host`/`$upstream_*` são do nginx e ficam intactas porque
  * o envsubst só substitui a lista de variáveis definidas no ambiente.
  */
-export declare const NGINX_TEMPLATE = "# @oktis-works - Roteamento do proxy OkCMS (template)\n# Gerado pela CLI. Can\u00F4nica em infrastructure/nginx/templates/default.conf.template\n#\n# O nginx oficial processa /etc/nginx/templates/*.template no start, com\n# envsubst limitado \u00E0s vari\u00E1veis definidas no ambiente (SERVER_NAME e\n# ADMIN_SERVER_NAME, vindas do .env). Tudo que for $host, $remote_addr ou\n# $upstream_* \u00E9 do nginx e N\u00C3O \u00E9 substitu\u00EDdo.\n#\n# Os upstreams moram em conf.d/00-upstreams.conf: a CLI os reescreve no swap\n# e recarrega com `nginx -s reload` \u2014 troca de lane sem derrubar conex\u00E3o.\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  ''      close;\n}\n\n# ---------------------------------------------------------------- admin ----\n# O admin \u00E9 um Astro standalone servido na RAIZ (n\u00E3o em /admin): ele gera\n# URLs /_astro/... e n\u00E3o tem base path configurado, ent\u00E3o public\u00E1-lo em\n# /admin/ quebraria os assets. Ele precisa de host pr\u00F3prio.\nserver {\n  listen 80;\n  server_name ${ADMIN_SERVER_NAME};\n\n  location / {\n    proxy_pass $upstream_admin;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n\n# admin por porta \u2014 funciona sem DNS nenhum (http://<host>:8080/)\nserver {\n  listen 8080 default_server;\n  server_name _;\n\n  location / {\n    proxy_pass $upstream_admin;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n\n# ---------------------------------------------------------- site p\u00FAblico ---\nserver {\n  listen 80 default_server;\n  server_name ${SERVER_NAME};\n\n  client_max_body_size 100m;\n  gzip on;\n  gzip_types text/plain text/css application/json application/javascript\n             image/svg+xml;\n\n  # healthcheck do edge: sempre no api (\u00E9 quem fala com o banco)\n  location = /health {\n    access_log off;\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n  }\n\n  # API + m\u00EDdia (/api/v1/media/file/<tenant>/<arquivo>)\n  location /api/ {\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n\n  # STORAGE_PUBLIC_BASE=/storage \u2192 rota o mesmo arquivo para a API.\n  # O local driver publica <base>/<tenant>/<arquivo>, que \u00E9 exatamente o\n  # formato de /api/v1/media/file/<tenant>/<arquivo>.\n  location /storage/ {\n    rewrite ^/storage/(.*)$ /api/v1/media/file/$1 break;\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_cache_valid 200 30d;\n    expires 30d;\n  }\n\n  # assets de tema servidos pelo web (resolver de path do Theme SDK)\n  location /themes/ {\n    proxy_pass $upstream_web;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Forwarded-Proto $scheme;\n  }\n\n  # SSR do site p\u00FAblico\n  location / {\n    proxy_pass $upstream_web;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n";
+export declare const NGINX_TEMPLATE = "# @oktis-works - OkCMS proxy routing (template)\n# Generated by the CLI. Canonical at\n# infrastructure/nginx/templates/default.conf.template\n#\n# The official nginx image runs /etc/nginx/templates/*.template on start,\n# with envsubst limited to the variables defined in the environment\n# (SERVER_NAME and ADMIN_SERVER_NAME, coming from the .env). Anything that\n# is $host, $remote_addr or $upstream_* belongs to nginx and is NOT\n# substituted.\n#\n# The upstreams live in conf.d/00-upstreams.conf: the CLI rewrites them on\n# swap and reloads with `nginx -s reload` \u2014 lane switch without dropping\n# connections.\n\nmap $http_upgrade $connection_upgrade {\n  default upgrade;\n  ''      close;\n}\n\n# ---------------------------------------------------------------- admin ----\n# The admin is an Astro standalone served at the ROOT (not /admin): it emits\n# /_astro/... URLs and has no configured base path, so publishing it under\n# /admin/ would break the assets. It needs its own host.\nserver {\n  listen 80;\n  server_name ${ADMIN_SERVER_NAME};\n\n  location / {\n    proxy_pass $upstream_admin;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n\n# admin by port \u2014 works without any DNS (http://<host>:8080/)\nserver {\n  listen 8080 default_server;\n  server_name _;\n\n  location / {\n    proxy_pass $upstream_admin;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n\n# ----------------------------------------------------------- public site ---\nserver {\n  listen 80 default_server;\n  server_name ${SERVER_NAME};\n\n  client_max_body_size 100m;\n  gzip on;\n  gzip_types text/plain text/css application/json application/javascript\n             image/svg+xml;\n\n  # edge healthcheck: always on the api (it is the one talking to the database)\n  location = /health {\n    access_log off;\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n  }\n\n  # API + media (/api/v1/media/file/<tenant>/<file>)\n  location /api/ {\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n\n  # STORAGE_PUBLIC_BASE=/storage \u2192 routes the same file to the API.\n  # The local driver publishes <base>/<tenant>/<file>, which is exactly the\n  # format of /api/v1/media/file/<tenant>/<file>.\n  location /storage/ {\n    rewrite ^/storage/(.*)$ /api/v1/media/file/$1 break;\n    proxy_pass $upstream_api;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_cache_valid 200 30d;\n    expires 30d;\n  }\n\n  # theme assets served by the web (Theme SDK path resolver)\n  location /themes/ {\n    proxy_pass $upstream_web;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Forwarded-Proto $scheme;\n  }\n\n  # SSR of the public site\n  location / {\n    proxy_pass $upstream_web;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Real-IP $remote_addr;\n    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-Host $host;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 120s;\n  }\n}\n";
 export type Lane = 'blue' | 'green';
 export interface UpstreamPorts {
     api: number;
@@ -60,12 +70,19 @@ export declare const DEFAULT_UPSTREAM_PORTS: UpstreamPorts;
  * fechar conexão estabelecida.
  */
 export declare function renderUpstreams(lane: Lane, ports?: UpstreamPorts): string;
+/**
+ * Upstreams for the SIMPLE stack (`okcms deploy --target simple`): the same
+ * nginx config, pointing at the lane-less containers. Switching modes is a
+ * rewrite of this file plus `nginx -s reload`.
+ */
+export declare function renderSimpleUpstreams(ports?: UpstreamPorts): string;
 export declare const DEPLOY_PATHS: {
     readonly dockerignore: ".dockerignore";
     readonly dockerfile: "docker/Dockerfile";
     readonly entrypoint: "docker/entrypoint.sh";
     readonly composeInfra: "docker-compose.infra.yml";
     readonly composeDeploy: "docker-compose.deploy.yml";
+    readonly composeApp: "docker-compose.app.yml";
     readonly nginxTemplate: "deploy/nginx/templates/default.conf.template";
     readonly nginxUpstreams: "deploy/nginx/conf.d/00-upstreams.conf";
 };

package/dist/assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../src/assets.ts"],"names":[],"mappings":"AAaA,2DAA2D;AAC3D,eAAO,MAAM,YAAY;;;;;;;CAOf,CAAC;AAMX;;;;GAIG;AACH,eAAO,MAAM,UAAU,mmDAqCtB,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,aAAa,62BAkCzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,k1BAyCxB,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,aAAa,g8FA4FzB,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,0gLA6L1B,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,svIA2H1B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,sBAAsB,EAAE,aAAqD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAE,aAAsC,GAAG,MAAM,CAoBjG;AAMD,eAAO,MAAM,YAAY;;;;;;;;CAQf,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,eAAe,qCAAqC,CAAC;AAElE,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,UAM5B,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa,CAU1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAa,EACnB,KAAK,GAAE,aAAsC,GAC5C,YAAY,EAAE,CAUhB"}
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../src/assets.ts"],"names":[],"mappings":"AAaA,2DAA2D;AAC3D,eAAO,MAAM,YAAY;;;;;;;CAOf,CAAC;AAMX;;;;GAIG;AACH,eAAO,MAAM,UAAU,+/CAsCtB,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,aAAa,o2BAkCzB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,YAAY,8yBA0CxB,CAAC;AAMF;;;;GAIG;AACH,eAAO,MAAM,aAAa,y3FA+FzB,CAAC;AAMF;;;;;GAKG;AACH,eAAO,MAAM,cAAc,q5KAgM1B,CAAC;AAMF;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,4jGA0HvB,CAAC;AAMF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,ktIA8H1B,CAAC;AAEF,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpC,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,sBAAsB,EAAE,aAAqD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAE,aAAsC,GAAG,MAAM,CAqBjG;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,GAAE,aAAsC,GAAG,MAAM,CAoB3F;AAMD,eAAO,MAAM,YAAY;;;;;;;;;CASf,CAAC;AAEX,yEAAyE;AACzE,eAAO,MAAM,eAAe,qCAAqC,CAAC;AAElE,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,UAM5B,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,aAAa,CAU1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,IAAI,GAAE,IAAa,EACnB,KAAK,GAAE,aAAsC,GAC5C,YAAY,EAAE,CAWhB"}