@rebasepro/cli 0.25.0 → 0.26.0

package/dist/bundle-C6yEtMJ-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundle-C6yEtMJ-.js","names":[],"sources":["../src/utils/tool-stdio.ts","../src/precompress.ts","../src/bundle.ts"],"sourcesContent":["/**\n * The stdio a build tool the CLI runs in the foreground gets: a static app's\n * build command, `tsc`, `tar`.\n *\n * Inherited, so its output streams as it happens. With `quietStdout` its stdout\n * goes to stderr instead, for a command whose own stdout carries a result:\n * `rebase cloud deploy --json` owes stdout exactly one\n * JSON value, and a `vite v6 building…` line in front of it is a result no\n * parser can read. The tool's output still reaches the person watching.\n */\nexport function toolStdio(quietStdout: boolean | undefined): \"inherit\" | [\"ignore\", 2, \"inherit\"] {\n    return quietStdout ? [\"ignore\", 2, \"inherit\"] : \"inherit\";\n}\n","/**\n * `.br` and `.gz` beside a static build's content-hashed assets, written when\n * the build is folded into a bundle.\n *\n * The runtime serves a sibling when the browser accepts its encoding\n * (`serveSPA` turns `precompressed` on at mount when the build holds any), so a\n * hashed chunk costs no compression CPU at all, on any request — including the\n * first one after a deploy, which otherwise gzips every chunk once per process\n * — and the browsers that accept brotli get it. Without siblings the runtime\n * only ever sends gzip.\n *\n * Which files: the ones the runtime caches as `immutable` — a content hash in\n * the name, by the rule the runtime reads it with (`isContentHashedFileName`) — of a type worth\n * compressing, and 1 KB or more (the runtime's own compression threshold). An\n * unhashed file (`index.html`) is left to on-the-fly compression, where a\n * rewrite of it can never be served stale from a sibling. A sibling is written\n * only when it is smaller, and never over one the build already emitted.\n *\n * Brotli at quality 9, not 11. On the example app's 5.6 MB of JavaScript,\n * quality 11 is 1.30 MB and took 20 s (8.7 s across the thread pool); quality\n * 9 is 1.41 MB in 0.9 s. gzip at level 9 is 1.57 MB in 0.3 s. A deploy runs\n * this every time, and a CI runner has fewer cores than a laptop.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport zlib from \"zlib\";\nimport { isContentHashedFileName } from \"@rebasepro/types\";\n\n/** Below this a compressed response saves less than its headers cost — the runtime's threshold. */\nconst MIN_BYTES = 1024;\n\n/**\n * Extensions whose content type the runtime compresses (`COMPRESSIBLE_CONTENT_TYPE_REGEX`).\n * All of them, because a build with any sibling switches the runtime's cache of\n * gzipped hashed files off: a hashed type left out here would be compressed on\n * every request instead of once.\n */\nconst COMPRESSIBLE = new Set([\n    \"js\", \"mjs\", \"cjs\", \"css\", \"html\", \"htm\", \"txt\", \"csv\", \"md\", \"xml\", \"json\", \"webmanifest\",\n    \"svg\", \"wasm\", \"ttf\", \"otf\", \"eot\", \"ico\", \"bmp\"\n]);\n\nexport interface PrecompressOutcome {\n    /** Files that got at least one sibling. */\n    files: number;\n    /** Their total size, and their siblings'. */\n    bytes: number;\n    brotliBytes: number;\n    gzipBytes: number;\n}\n\n/** Write `.br` and `.gz` siblings for every hashed, compressible asset under `dir`. */\nexport function precompressStaticAssets(dir: string): PrecompressOutcome {\n    const outcome: PrecompressOutcome = { files: 0, bytes: 0, brotliBytes: 0, gzipBytes: 0 };\n    const pending = [dir];\n    while (pending.length > 0) {\n        const current = pending.pop() as string;\n        for (const entry of fs.readdirSync(current, { withFileTypes: true })) {\n            // Not build output, as the runtime's own scan has it.\n            if (entry.name.startsWith(\".\") || entry.name === \"node_modules\") continue;\n            const file = path.join(current, entry.name);\n            if (entry.isDirectory()) {\n                pending.push(file);\n                continue;\n            }\n            if (!entry.isFile() || !worthCompressing(entry.name)) continue;\n            const source = fs.readFileSync(file);\n            if (source.byteLength < MIN_BYTES) continue;\n\n            const brotli = writeSibling(`${file}.br`, source, () => zlib.brotliCompressSync(source, {\n                params: {\n                    [zlib.constants.BROTLI_PARAM_QUALITY]: 9,\n                    [zlib.constants.BROTLI_PARAM_MODE]: zlib.constants.BROTLI_MODE_TEXT,\n                    [zlib.constants.BROTLI_PARAM_SIZE_HINT]: source.byteLength\n                }\n            }));\n            const gzip = writeSibling(`${file}.gz`, source, () => zlib.gzipSync(source, { level: 9 }));\n            if (brotli === 0 && gzip === 0) continue;\n            outcome.files++;\n            outcome.bytes += source.byteLength;\n            outcome.brotliBytes += brotli;\n            outcome.gzipBytes += gzip;\n        }\n    }\n    return outcome;\n}\n\nfunction worthCompressing(fileName: string): boolean {\n    const extension = fileName.slice(fileName.lastIndexOf(\".\") + 1).toLowerCase();\n    return COMPRESSIBLE.has(extension) && isContentHashedFileName(fileName);\n}\n\n/** The sibling's size, or 0 when there already was one or it would not be smaller. */\nfunction writeSibling(target: string, source: Buffer, compress: () => Buffer): number {\n    if (fs.existsSync(target)) return 0;\n    const compressed = compress();\n    if (compressed.byteLength >= source.byteLength) return 0;\n    fs.writeFileSync(target, compressed);\n    return compressed.byteLength;\n}\n","/**\n * Building a project bundle.\n *\n * A bundle is the deployable form of a project: compiled collections, functions,\n * crons and schema, plus a generated manifest describing exactly what it needs\n * to run. It contains no Dockerfile and no repository — the runtime is supplied\n * separately, which is what allows a project to be moved onto a patched runtime\n * without being rebuilt.\n *\n * Compilation runs through a generated tsconfig rooted at the project directory,\n * so the output mirrors the source layout (`config/…`, `backend/functions/…`)\n * and every path in the manifest is predictable. Letting each workspace package\n * emit into its own `dist/` would have meant guessing at three different\n * layouts, since `rootDir` differs between the template flavours.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport { createRequire } from \"module\";\nimport { spawnSync } from \"child_process\";\nimport chalk from \"chalk\";\nimport {\n    BUNDLE_FORMAT_VERSION,\n    RUNTIME_CONTRACT_VERSION,\n    computeSchemaVersion,\n    findStorageSuffixCollision,\n    parseEnvBoolean,\n    type CollectionConfig,\n    type ResourceGraph,\n    type NativeDependency,\n    type RebaseBundleManifest,\n    type RebaseBundleFunction,\n    type RebaseBackendAppConfig\n} from \"@rebasepro/types\";\nimport { compareMountOrder, resolveBackendPaths } from \"./manifest\";\nimport { cliVersion } from \"./utils/version\";\nimport { toolStdio } from \"./utils/tool-stdio\";\nimport { analyseFunctionsDirectory, summarisePortability } from \"./function-portability\";\nimport { precompressStaticAssets } from \"./precompress\";\nimport {\n    getActiveBackendPlugin,\n    resolveLocalBin,\n    resolvePluginCliScript,\n    resolveTsx\n} from \"./utils/project\";\n\nexport const DEFAULT_BUNDLE_DIR = \"dist-bundle\";\n\nexport interface BuildBundleOptions {\n    projectRoot: string;\n    appName: string;\n    app: RebaseBackendAppConfig;\n    /** Output directory, absolute or relative to the project root. */\n    outDir?: string;\n    /** Runtime range from the manifest, recorded for compatibility checks. */\n    runtimeRange: string;\n    /**\n     * The `storage` block of `rebase.json` — which buckets this project uses.\n     *\n     * Passed in rather than re-read here so `rebase.json` is parsed and validated\n     * once, by the command that owns it.\n     */\n    /**\n     * The project's resource graph, derived from its config.\n     *\n     * Recorded in the bundle manifest so a host can read what the project needs\n     * without running it — which is what lets a console show \"wants a `media`\n     * bucket, has none\" before a first deploy has produced anything.\n     */\n    resources?: ResourceGraph;\n    /**\n     * Install the declared dependencies into the bundle at build time.\n     *\n     * Omitted means \"when it is safe to\" — which is every bundle whose closure\n     * has no native code. `false` is the escape hatch for a build that must not\n     * shell out to npm at all (an air-gapped CI, a offline reproducibility\n     * check); the bundle still works, it simply installs at boot as before.\n     */\n    vendor?: boolean;\n    /** Skip type checking. Faster, and strictly worse — for iteration only. */\n    skipTypeCheck?: boolean;\n    /** Skip regenerating the Drizzle schema from the collections. */\n    skipSchema?: boolean;\n    /** Emit progress. */\n    log?: (message: string) => void;\n    /**\n     * Keep stdout for the caller's result: the compiler's output, and every\n     * warning the build prints, go to stderr. See `toolStdio`.\n     */\n    quietStdout?: boolean;\n}\n\nexport interface BuildBundleResult {\n    outDir: string;\n    manifest: RebaseBundleManifest;\n    collectionCount: number;\n    /**\n     * Whether the dependency tree was installed into the bundle, and why not\n     * when it was not. Reported rather than silent: \"your pods will take a\n     * minute to start\" is a consequence a developer should hear at build time,\n     * not discover during an incident.\n     */\n    vendor: VendorResult;\n}\n\n/** Packages whose presence means the bundle cannot run on a stock runtime image. */\nconst KNOWN_NATIVE_PACKAGES = new Set([\n    \"sharp\",\n    \"canvas\",\n    \"bcrypt\",\n    \"argon2\",\n    \"node-sass\",\n    \"sqlite3\",\n    \"better-sqlite3\",\n    \"grpc\",\n    \"@grpc/grpc-js-native\",\n    \"re2\",\n    \"sodium-native\",\n    \"libpq\",\n    \"pg-native\"\n]);\n\n/** Dependencies supplied by the runtime image itself, not by the bundle. */\nconst RUNTIME_PROVIDED = new Set([\n    \"@rebasepro/server\",\n    \"@rebasepro/types\",\n    \"@rebasepro/client\",\n    \"@rebasepro/common\",\n    \"@rebasepro/utils\",\n    \"hono\",\n    \"@hono/node-server\",\n    \"typescript\",\n    \"tsx\",\n    // See entrypoint.mjs: a second zod makes `loadEnv({ extend })` reject every\n    // value carrying a `.default()`, and the deploy reports success with no\n    // crons running.\n    \"zod\"\n]);\n\nfunction log(options: BuildBundleOptions, message: string): void {\n    (options.log ?? ((m: string) => console.log(m)))(message);\n}\n\n/**\n * A line the build says to the person running it — a warning, or what it left\n * out — which progress callbacks may drop and this does not: stdout, or stderr\n * when stdout carries the caller's result.\n */\nfunction say(options: BuildBundleOptions, line: string): void {\n    if (options.quietStdout) console.error(line);\n    else console.log(line);\n}\n\n/**\n * Every `node_modules/@types` directory the project can see.\n *\n * Type roots normally resolve by walking up from the tsconfig's own directory,\n * which breaks here for two reasons: the generated config lives in `.rebase/`,\n * and a pnpm workspace puts `@types/node` inside the *package* that depends on\n * it (`config/node_modules/@types`) rather than at the project root. Listing them\n * explicitly, as absolute paths, sidesteps both.\n */\nfunction discoverTypeRoots(projectRoot: string): string[] {\n    const candidates: string[] = [];\n\n    for (const relative of [\".\", \"config\", \"backend\", \"frontend\"]) {\n        candidates.push(path.join(projectRoot, relative, \"node_modules\", \"@types\"));\n    }\n\n    // Walk up as well, for a project nested inside a larger workspace.\n    let dir = projectRoot;\n    for (let i = 0; i < 4; i++) {\n        const parent = path.dirname(dir);\n        if (parent === dir) break;\n        candidates.push(path.join(parent, \"node_modules\", \"@types\"));\n        dir = parent;\n    }\n\n    return candidates.filter(candidate => fs.existsSync(candidate));\n}\n\n/**\n * Read a tsconfig's own `compilerOptions`.\n *\n * Parsed with the project's own TypeScript, because a tsconfig is not JSON: it\n * permits comments and trailing commas. Hand-rolled comment stripping gets this\n * wrong in a way that is easy to miss — a `paths` entry like\n * `\"@acme/types/*\": [\"src/*\"]` contains the character sequence that opens a\n * block comment, so a regex happily eats the rest of the file and the result\n * parses as *something*, just not the config the developer wrote.\n *\n * One level only, and only `paths` is used from it.\n */\nasync function readCompilerOptions(\n    projectRoot: string,\n    file: string\n): Promise<Record<string, unknown> | undefined> {\n    if (!fs.existsSync(file)) return undefined;\n\n    const text = fs.readFileSync(file, \"utf8\");\n\n    try {\n        const require = createRequire(path.join(projectRoot, \"package.json\"));\n        const ts = require(\"typescript\") as {\n            parseConfigFileTextToJson(fileName: string, text: string): {\n                config?: { compilerOptions?: Record<string, unknown> };\n                error?: unknown;\n            };\n        };\n        const { config } = ts.parseConfigFileTextToJson(file, text);\n        return config?.compilerOptions;\n    } catch {\n        // TypeScript is not resolvable from the project root. Fall back to\n        // stripping whole-line comments only — never block comments, for the\n        // reason above — and give up quietly if that still is not valid JSON.\n        try {\n            const parsed = JSON.parse(text.replace(/^\\s*\\/\\/.*$/gm, \"\")) as {\n                compilerOptions?: Record<string, unknown>;\n            };\n            return parsed.compilerOptions;\n        } catch {\n            return undefined;\n        }\n    }\n}\n\n/**\n * Drop path aliases that resolve outside the project.\n *\n * A monorepo commonly aliases its workspace packages to their **source**\n * (`\"@acme/types\": [\"packages/types/src/index.ts\"]`) so editors jump to real\n * files. That is right for developing the monorepo and wrong for building a\n * bundle: it drags foreign `.ts` files into the program, none of which are under\n * the project's `rootDir`, and the compile fails on files the developer never\n * asked to build.\n *\n * A bundle is built against *installed packages*. Aliases pointing inside the\n * project are kept, because those are the project's own code.\n */\nfunction filterProjectPaths(\n    baseDir: string,\n    projectRoot: string,\n    paths: Record<string, string[]>,\n    baseUrl: string\n): { kept: Record<string, string[]>; dropped: string[] } {\n    const kept: Record<string, string[]> = {};\n    const dropped: string[] = [];\n\n    for (const [alias, targets] of Object.entries(paths)) {\n        if (!Array.isArray(targets)) continue;\n        const resolved = targets.map(target => path.resolve(baseUrl, target));\n        const allInside = resolved.every(target => {\n            const relative = path.relative(projectRoot, target);\n            return relative === \"\" || (!relative.startsWith(\"..\") && !path.isAbsolute(relative));\n        });\n        if (allInside) {\n            kept[alias] = resolved.map(target => {\n                const relative = path.relative(baseDir, target);\n                return relative.split(path.sep).join(\"/\");\n            });\n        } else {\n            dropped.push(alias);\n        }\n    }\n\n    return { kept,\ndropped };\n}\n\n/**\n * Compose the tsconfig used to compile the bundle.\n *\n * Extends the config package's own tsconfig when there is one, so the project's\n * choices about target, JSX and strictness are respected. It has to be `extends`\n * rather than a copy of `compilerOptions`: TypeScript resolves relative paths\n * against the file they were written in, so copying a value like\n * `baseUrl: \"../../\"` into a config in a different directory silently repoints\n * it at the wrong place.\n */\nasync function writeBundleTsconfig(\n    projectRoot: string,\n    outDir: string,\n    includes: string[],\n    options: BuildBundleOptions\n): Promise<string> {\n    const skipTypeCheck = options.skipTypeCheck === true;\n    // Paths written *here* resolve against this file's directory. Posix\n    // separators, because tsconfig wants them on every platform.\n    const tsconfigDir = path.join(projectRoot, \".rebase\");\n    const fromTsconfig = (target: string): string => {\n        const relative = path.relative(tsconfigDir, path.resolve(projectRoot, target));\n        return relative.split(path.sep).join(\"/\");\n    };\n\n    const configTsconfigPath = path.join(projectRoot, \"config\", \"tsconfig.json\");\n    const extendsFrom = fs.existsSync(configTsconfigPath)\n        ? fromTsconfig(path.join(\"config\", \"tsconfig.json\"))\n        : undefined;\n\n    // Neutralize aliases that escape the project (see `filterProjectPaths`).\n    let pathOverrides: Record<string, unknown> = {};\n    const baseOptions = await readCompilerOptions(projectRoot, configTsconfigPath);\n    if (baseOptions?.paths && typeof baseOptions.paths === \"object\") {\n        const baseDir = path.dirname(configTsconfigPath);\n        const baseUrl = path.resolve(\n            baseDir,\n            typeof baseOptions.baseUrl === \"string\" ? baseOptions.baseUrl : \".\"\n        );\n        const { kept, dropped } = filterProjectPaths(\n            tsconfigDir,\n            projectRoot,\n            baseOptions.paths as Record<string, string[]>,\n            baseUrl\n        );\n        pathOverrides = { baseUrl: fromTsconfig(\".\"),\npaths: kept };\n        if (dropped.length > 0) {\n            say(options, chalk.dim(\n                `    ignoring ${dropped.length} path alias(es) pointing outside the project ` +\n                `(${dropped.join(\", \")}) — resolving those from node_modules instead`\n            ));\n        }\n    }\n\n    const compilerOptions: Record<string, unknown> = {\n        // Defaults, used when there is no project tsconfig to extend. When there\n        // is one, its values win over these and are overridden only by the block\n        // below.\n        target: \"ES2022\",\n        module: \"ESNext\",\n        moduleResolution: \"bundler\",\n        lib: [\"ES2022\"],\n        jsx: \"react-jsx\",\n        allowSyntheticDefaultImports: true,\n        esModuleInterop: true,\n        resolveJsonModule: true,\n        forceConsistentCasingInFileNames: true,\n\n        // Everything below is the bundle's contract and is not negotiable.\n        rootDir: fromTsconfig(\".\"),\n        outDir: fromTsconfig(path.relative(projectRoot, outDir) || \".\"),\n        typeRoots: discoverTypeRoots(projectRoot),\n        ...pathOverrides,\n        declaration: false,\n        declarationMap: false,\n        sourceMap: true,\n        noEmit: false,\n        skipLibCheck: true,\n        // The runtime imports the emitted files directly with Node's ESM loader,\n        // so they stay ES modules regardless of what the project targets for its\n        // own builds.\n        allowJs: true,\n        ...(skipTypeCheck ? { noCheck: true } : {})\n    };\n\n    const tsconfig = {\n        ...(extendsFrom ? { extends: extendsFrom } : {}),\n        compilerOptions,\n        include: includes.map(fromTsconfig),\n        exclude: [\n            \"node_modules\",\n            \"**/*.test.ts\",\n            \"**/*.spec.ts\",\n            \"**/dist/**\",\n            DEFAULT_BUNDLE_DIR\n        ].map(pattern => (pattern.startsWith(\"**\") ? pattern : fromTsconfig(pattern)))\n    };\n\n    fs.mkdirSync(tsconfigDir, { recursive: true });\n    const tsconfigPath = path.join(tsconfigDir, \"tsconfig.bundle.json\");\n    fs.writeFileSync(tsconfigPath, JSON.stringify(tsconfig, null, 2), \"utf8\");\n    return tsconfigPath;\n}\n\n/**\n * Whether the compiled config package exports a `storageAuthorize` hook.\n *\n * Recorded in the manifest so a host can refuse a deploy that would enable file\n * storage with no access model, rather than let the runtime's boot guard turn it\n * into a crash loop the developer cannot read.\n *\n * Read from the *compiled* index, deliberately: that is the exact module the\n * runtime imports and reads the export off, so this cannot disagree with what\n * actually happens at boot. It is a textual check rather than an import because\n * a freshly built bundle cannot resolve its own dependencies until it is\n * deployed — the same reason schema hashing reads source.\n *\n * Errs toward `false`: a missed detection costs a deploy rejection whose message\n * says exactly how to proceed, while a false positive would hand back the crash\n * loop this exists to prevent.\n */\nexport function detectStorageAuthorize(compiledConfigDir: string, depth = 0): boolean {\n    const indexPath = [\".js\", \".mjs\", \".ts\"]\n        .map(ext => path.join(compiledConfigDir, `index${ext}`))\n        .find(candidate => fs.existsSync(candidate));\n    if (!indexPath) return false;\n    return moduleExportsStorageAuthorize(indexPath, depth);\n}\n\n/**\n * Whether one compiled module re-exports or defines `storageAuthorize`.\n *\n * Split out from {@link detectStorageAuthorize} so a wildcard re-export can be\n * followed. `export * from \"./storage.js\"` is an ordinary way to write a config\n * barrel, and treating it as \"no hook\" rejected deploys that were correct — with\n * a message telling the developer to add a hook they had already written.\n */\nfunction moduleExportsStorageAuthorize(modulePath: string, depth: number): boolean {\n    let source: string;\n    try {\n        source = fs.readFileSync(modulePath, \"utf8\");\n    } catch {\n        return false;\n    }\n\n    // `export const/let/var/function/async function storageAuthorize`\n    if (/\\bexport\\s+(?:async\\s+)?(?:const|let|var|function)\\s+storageAuthorize\\b/.test(source)) {\n        return true;\n    }\n    // `export { storageAuthorize }` / `export { x as storageAuthorize }`,\n    // including re-export forms (`export { storageAuthorize } from \"./storage\"`).\n    for (const clause of source.matchAll(/\\bexport\\s*\\{([^}]*)\\}/g)) {\n        const names = clause[1].split(\",\").map(entry => {\n            const parts = entry.split(/\\bas\\b/);\n            return parts[parts.length - 1].trim();\n        });\n        if (names.includes(\"storageAuthorize\")) return true;\n    }\n\n    // `export * from \"./storage.js\"` — follow it. Bounded to a few levels: a\n    // barrel of barrels is realistic, an infinite chain is not, and the cost of\n    // giving up is a rejection message rather than a wrong answer.\n    if (depth < 3) {\n        for (const clause of source.matchAll(/\\bexport\\s*\\*\\s*from\\s*[\"']([^\"']+)[\"']/g)) {\n            const specifier = clause[1];\n            if (!specifier.startsWith(\".\")) continue;\n            const resolved = resolveRelativeModule(path.dirname(modulePath), specifier);\n            if (resolved && moduleExportsStorageAuthorize(resolved, depth + 1)) return true;\n        }\n    }\n    return false;\n}\n\n/**\n * Resolve a relative ESM specifier to a file on disk.\n *\n * Compiled output carries explicit `.js` extensions, but the same function reads\n * TypeScript sources during a source boot, where the specifier may be\n * extensionless or point at a directory index.\n */\nfunction resolveRelativeModule(fromDir: string, specifier: string): string | null {\n    const base = path.resolve(fromDir, specifier);\n    const candidates = [\n        base,\n        `${base}.js`,\n        `${base}.mjs`,\n        `${base}.ts`,\n        path.join(base, \"index.js\"),\n        path.join(base, \"index.mjs\"),\n        path.join(base, \"index.ts\")\n    ];\n    for (const candidate of candidates) {\n        try {\n            if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;\n        } catch {\n            continue;\n        }\n    }\n    // A `.js` specifier that only exists as `.ts` — the shape every compiled-from-\n    // TypeScript barrel has when this runs against sources rather than output.\n    if (/\\.js$/.test(base)) {\n        const asTs = base.replace(/\\.js$/, \".ts\");\n        try {\n            if (fs.existsSync(asTs) && fs.statSync(asTs).isFile()) return asTs;\n        } catch {\n            return null;\n        }\n    }\n    return null;\n}\n\n/**\n * Detect native code in the dependency closure.\n *\n * Walks declared runtime dependencies breadth-first through `node_modules`,\n * flagging anything with a `binding.gyp`, a prebuilt `.node` binary, or an\n * install script that builds one. The managed runtime cannot run these: a\n * binary compiled for one image will not load in another, and finding that out\n * at deploy time is far better than in a crash loop.\n *\n * The walk is bounded. A dependency graph can be enormous, and this is a\n * heuristic gate whose false negatives are caught at deploy time anyway.\n */\nexport function detectNativeDependencies(\n    projectRoot: string,\n    declared: Record<string, string>,\n    limit = 2000\n): NativeDependency[] {\n    const found: NativeDependency[] = [];\n    const seen = new Set<string>();\n    const queue = Object.keys(declared);\n    let visited = 0;\n\n    const searchRoots = [\n        path.join(projectRoot, \"node_modules\"),\n        path.join(projectRoot, \"backend\", \"node_modules\"),\n        path.join(projectRoot, \"config\", \"node_modules\")\n    ].filter(dir => fs.existsSync(dir));\n\n    while (queue.length > 0 && visited < limit) {\n        const name = queue.shift()!;\n        if (seen.has(name)) continue;\n        seen.add(name);\n        visited++;\n\n        if (KNOWN_NATIVE_PACKAGES.has(name)) {\n            found.push({ name,\nreason: \"known native module\" });\n            continue;\n        }\n\n        const packageDir = searchRoots\n            .map(root => path.join(root, ...name.split(\"/\")))\n            .find(dir => fs.existsSync(path.join(dir, \"package.json\")));\n\n        if (!packageDir) continue;\n\n        let pkg: {\n            dependencies?: Record<string, string>;\n            scripts?: Record<string, string>;\n            gypfile?: boolean;\n        };\n        try {\n            pkg = JSON.parse(fs.readFileSync(path.join(packageDir, \"package.json\"), \"utf8\"));\n        } catch {\n            continue;\n        }\n\n        if (pkg.gypfile || fs.existsSync(path.join(packageDir, \"binding.gyp\"))) {\n            found.push({ name,\nreason: \"builds a native addon (binding.gyp)\" });\n            continue;\n        }\n\n        const install = `${pkg.scripts?.install ?? \"\"} ${pkg.scripts?.preinstall ?? \"\"} ${pkg.scripts?.postinstall ?? \"\"}`;\n        if (/node-gyp|prebuild|node-pre-gyp|cmake-js/.test(install)) {\n            found.push({ name,\nreason: \"install script compiles native code\" });\n            continue;\n        }\n\n        if (hasNodeBinary(packageDir)) {\n            found.push({ name,\nreason: \"ships a prebuilt .node binary\" });\n            continue;\n        }\n\n        for (const dep of Object.keys(pkg.dependencies ?? {})) {\n            if (!seen.has(dep)) queue.push(dep);\n        }\n    }\n\n    return found;\n}\n\n/** Shallow scan for `.node` binaries — deep enough for the usual `build/Release`. */\nfunction hasNodeBinary(dir: string, depth = 0): boolean {\n    if (depth > 3) return false;\n    let entries: fs.Dirent[];\n    try {\n        entries = fs.readdirSync(dir, { withFileTypes: true });\n    } catch {\n        return false;\n    }\n    for (const entry of entries) {\n        if (entry.isFile() && entry.name.endsWith(\".node\")) return true;\n        if (entry.isDirectory() && entry.name !== \"node_modules\" && entry.name !== \".bin\") {\n            if (hasNodeBinary(path.join(dir, entry.name), depth + 1)) return true;\n        }\n    }\n    return false;\n}\n\n/**\n * Whether a dependency name resolves to a package *inside this repository* — a\n * workspace package rather than a registry one.\n *\n * The bundle's declared deps are installed with `npm install` from the public\n * registry beside the bundle at boot. A workspace package is not there, so\n * declaring it guarantees a boot-time install failure. The most common case is\n * the standard `config` package: the backend depends on it by name, but it is\n * *carried in the bundle* (as `entry.config`), so it must never also be an npm\n * dependency. Projects often express this as a `workspace:` range — caught\n * separately — but a plain `\"*\"` against a workspace symlink is just as common\n * and looks like a registry range, so the symlink is what actually settles it.\n *\n * Detection: the installed `node_modules/<name>` is a symlink whose real path is\n * inside the project and not within a pnpm virtual store (`.pnpm`). That is\n * exactly a workspace link and nothing else.\n */\nfunction resolvesToWorkspacePackage(projectRoot: string, name: string): boolean {\n    // Resolve the root's own symlinks too: on macOS a temp/checkout path under\n    // `/var/...` realpaths to `/private/var/...`, so comparing a realpath'd link\n    // target against a non-realpath'd root would never match.\n    let realRoot: string;\n    try {\n        realRoot = fs.realpathSync(projectRoot);\n    } catch {\n        realRoot = projectRoot;\n    }\n\n    for (const base of [projectRoot, path.join(projectRoot, \"backend\"), path.join(projectRoot, \"config\")]) {\n        const link = path.join(base, \"node_modules\", name);\n        try {\n            // A workspace link is a *symlink*; a normal (non-pnpm) registry\n            // install is a real directory inside node_modules, which would also\n            // sit \"inside the repo\" — so the symlink is what separates the two.\n            if (!fs.lstatSync(link).isSymbolicLink()) continue;\n            const real = fs.realpathSync(link);\n            const insideRepo = real.startsWith(realRoot + path.sep);\n            // pnpm links registry packages into its virtual store; those live\n            // under node_modules/.pnpm and are not workspace packages.\n            const inStore = real.includes(`${path.sep}.pnpm${path.sep}`)\n                || real.includes(`${path.sep}node_modules${path.sep}`);\n            if (insideRepo && !inStore) return true;\n        } catch {\n            // No such entry, broken link, or race: let it be declared.\n        }\n    }\n    return false;\n}\n\n/**\n * The manifests a bundle's declared dependencies come from, least specific first.\n *\n * Order is the whole point. `collectDeclaredDependencies` lets a later manifest\n * win, and the app — `backend/` — is the one whose code was written and\n * typechecked against the range it names. The project root is a workspace root:\n * it exists to hold scripts and the tooling every workspace shares, and its\n * ranges were never exercised by the code that ends up in the bundle. It used to\n * be read last, so a scaffold declaring `dotenv ^16` at the root and `^17.4.2`\n * in the backend shipped a manifest telling the managed runtime to install 16.\n */\nconst BUNDLE_DEP_MANIFESTS = [\"package.json\", \"config/package.json\", \"backend/package.json\"];\n\n/**\n * Where a project's npm configuration may live, in the order they are joined.\n * npm reads the last value of a repeated key, so the backend's own file wins.\n */\nconst BUNDLE_NPMRC_FILES = [\".npmrc\", \"backend/.npmrc\"];\n\n/** npm keys whose value is a credential, bare or scoped to a registry (`//host/:_authToken`). */\nconst NPMRC_CREDENTIAL_KEY = /(^|:)(_authToken|_auth|_password|password|username|email|certfile|keyfile)$/;\n\n/** A value npm expands from the environment at install time: `${NPM_TOKEN}`. */\nconst NPMRC_ENV_REFERENCE = /^\\$\\{[A-Za-z_][A-Za-z0-9_]*\\}$/;\n\n/**\n * The npm configuration a bundle carries, so the runtime's `npm ci` can reach a\n * private registry — or `null` when the project has none.\n *\n * A pod installs the bundle's dependencies when it starts, from the public\n * registry unless told otherwise, so a dependency published to a private\n * registry or under a private scope could not install. This hands npm the\n * project's own `.npmrc`. Credentials stay out of the bundle: every credential\n * must be a `${VAR}` reference, which npm expands from the pod's environment —\n * `rebase cloud env set NPM_TOKEN=… --secret`. A literal token would be\n * uploaded with the code and stored beside every deployment, so it fails the\n * build instead.\n */\nexport function bundledNpmrc(projectRoot: string): string | null {\n    const parts: string[] = [];\n    for (const relative of BUNDLE_NPMRC_FILES) {\n        const file = path.join(projectRoot, relative);\n        if (!fs.existsSync(file)) continue;\n        const text = fs.readFileSync(file, \"utf8\");\n        text.split(/\\r?\\n/).forEach((line, index) => {\n            const trimmed = line.trim();\n            if (trimmed === \"\" || trimmed.startsWith(\"#\") || trimmed.startsWith(\";\")) return;\n            const eq = trimmed.indexOf(\"=\");\n            if (eq === -1) return;\n            const key = trimmed.slice(0, eq).trim();\n            const value = trimmed.slice(eq + 1).trim();\n            if (NPMRC_CREDENTIAL_KEY.test(key) && !NPMRC_ENV_REFERENCE.test(value)) {\n                throw new Error(\n                    `${relative}:${index + 1} sets ${key} to a literal value. The bundle would carry it to `\n                    + \"the platform with your code. Write it as a reference instead — \"\n                    + `${key}=\\${NPM_TOKEN} — and set the value with \\`rebase cloud env set NPM_TOKEN=… --secret\\`.`\n                );\n            }\n        });\n        parts.push(`# from ${relative}\\n${text.trimEnd()}\\n`);\n    }\n    return parts.length > 0 ? parts.join(\"\\n\") : null;\n}\n\n/**\n * Specifiers the registry the managed runtime installs from cannot resolve.\n *\n * `workspace:` is handled separately (it is normal and expected inside this\n * repo's own projects); everything here is a specifier that works on the\n * developer's disk and nowhere else. The runtime installs `deps.declared` from\n * npm with no access to the machine the bundle was built on, so a `file:` or a\n * `git+` range is a deploy-time install failure — the worst place to find out.\n */\nconst NON_REGISTRY_PROTOCOLS = [\"file:\", \"link:\", \"portal:\", \"git+\", \"git:\", \"github:\"];\n\n/** Whether a range names something npm could not install from the registry. */\nfunction nonRegistrySpecifier(version: string): string | null {\n    const trimmed = version.trim();\n    for (const protocol of NON_REGISTRY_PROTOCOLS) {\n        if (trimmed.startsWith(protocol)) return protocol;\n    }\n    // A bare path — `../shared`, `./vendor/lib`, `/opt/lib` — which npm accepts\n    // as a local directory and the registry has never heard of.\n    if (/^\\.{0,2}\\//.test(trimmed)) return \"a filesystem path\";\n    return null;\n}\n\n/**\n * Collect the runtime dependencies a bundle needs installed beside it.\n *\n * Packages the runtime image already provides are excluded — reinstalling a\n * second copy of the server next to the one running the process is at best\n * wasted space and at worst a version conflict. Workspace packages are excluded\n * too: they are not on the registry the runtime installs from, and the project's\n * own config package already travels inside the bundle.\n *\n * Throws when a declared range is not something the registry can resolve, or\n * when two manifests declare a name at ranges nothing satisfies. The\n * alternative is a bundle that builds green and fails at the deploy's install\n * step, minutes later and on a machine the developer cannot see. `rebase build`\n * reports both in its own words first; this is the backstop for every other\n * caller, `rebase cloud deploy` included.\n */\nexport function collectDeclaredDependencies(projectRoot: string): Record<string, string> {\n    const declared: Record<string, string> = {};\n\n    const conflicts = detectDeclaredDepConflicts(projectRoot);\n    if (conflicts.length > 0) {\n        const described = conflicts\n            .map(c => {\n                const [a, b] = c.declarations;\n                return `${c.name}: ${a.range} (${a.file}) vs ${b.range} (${b.file})`;\n            })\n            .join(\"; \");\n        throw new Error(\n            `No single version satisfies every range this project declares — ${described}. `\n            + \"The bundle installs one of them and the rest of the project was built against \"\n            + \"the other. Declare one range, in the app that uses it.\"\n        );\n    }\n\n    for (const relative of BUNDLE_DEP_MANIFESTS) {\n        const file = path.join(projectRoot, relative);\n        if (!fs.existsSync(file)) continue;\n        let pkg: { dependencies?: Record<string, string> };\n        try {\n            pkg = JSON.parse(fs.readFileSync(file, \"utf8\")) as typeof pkg;\n        } catch {\n            // Unparseable package.json: nothing to declare from it.\n            continue;\n        }\n        for (const [name, version] of Object.entries(pkg.dependencies ?? {})) {\n            if (RUNTIME_PROVIDED.has(name)) continue;\n            // A workspace protocol means nothing outside this repository.\n            if (typeof version === \"string\" && version.startsWith(\"workspace:\")) continue;\n            // A plain range that nonetheless resolves to an in-repo workspace\n            // package (e.g. `\"config\": \"*\"` symlinked to `../../config`) —\n            // the runtime cannot install it from the registry.\n            if (resolvesToWorkspacePackage(projectRoot, name)) continue;\n            const protocol = typeof version === \"string\" ? nonRegistrySpecifier(version) : null;\n            // The registry-install e2e stands packed tarballs in for versions\n            // that were never published, as `file:` ranges the scaffold and its\n            // Dockerfile both carry, and then builds and boots the result. The\n            // flag is the same one `init` reads to skip its release probe; it\n            // is set by that harness and by nothing a user runs.\n            if (protocol && parseEnvBoolean(process.env.REBASE_E2E) === true && protocol === \"file:\") {\n                declared[name] = version;\n                continue;\n            }\n            if (protocol) {\n                throw new Error(\n                    `${relative} declares \"${name}\": \"${version}\", which the managed runtime `\n                    + `cannot install — ${protocol} resolves only on this machine. Publish the `\n                    + \"package to a registry and depend on it by version, or vendor its source \"\n                    + \"into the backend.\"\n                );\n            }\n            declared[name] = version;\n        }\n    }\n\n    return declared;\n}\n\n/** One dependency as some package.json in the project declares it. */\nexport interface DeclaredFrameworkDep {\n    name: string;\n    range: string;\n    /** Project-relative package.json it was declared in. */\n    file: string;\n}\n\n/** One name two of the bundle's manifests declare at ranges nothing satisfies. */\nexport interface DeclaredDepConflict {\n    name: string;\n    /** The two declarations, in manifest order. */\n    declarations: [DeclaredFrameworkDep, DeclaredFrameworkDep];\n}\n\nexport interface FrameworkDepDrift {\n    /** Declared at a version that can never reach the CLI's own. */\n    behind: DeclaredFrameworkDep[];\n    /**\n     * The distinct lower bounds found across all declared `@rebasepro/*`, when\n     * there is more than one — the project is pinning mixed-era framework\n     * packages against each other.\n     */\n    disagreeing: string[];\n    /**\n     * Third-party names two bundle manifests declare at ranges no single version\n     * satisfies. One of the two wins in `deps.declared` and the loser's code was\n     * typechecked against a version the runtime will never install.\n     */\n    conflicting: DeclaredDepConflict[];\n}\n\n/**\n * Lowest version a range could resolve to, or null if it is not a range.\n *\n * Kept deliberately tiny and local. The published range grammar here is a caret,\n * a tilde, an exact version or a `>=` floor, and the alternative — a semver\n * dependency in the CLI — buys breadth this does not need.\n */\nfunction lowerBoundOf(range: string): [number, number, number] | null {\n    const raw = range.trim().replace(/^[\\^~]/, \"\").replace(/^>=\\s*/, \"\").replace(/^v/, \"\");\n    if (!/^\\d+(\\.\\d+){0,2}$/.test(raw)) return null;\n    const [major, minor = 0, patch = 0] = raw.split(\".\").map(Number);\n    return [major, minor, patch];\n}\n\n/** Highest version a range could resolve to (exclusive), or null. */\nfunction upperBoundOf(range: string): [number, number, number] | null {\n    const trimmed = range.trim();\n    const min = lowerBoundOf(trimmed);\n    if (!min) return null;\n    if (trimmed.startsWith(\">=\")) return null; // open — reaches anything\n    const [major, minor, patch] = min;\n    if (trimmed.startsWith(\"^\")) {\n        if (major > 0) return [major + 1, 0, 0];\n        if (minor > 0) return [0, minor + 1, 0];\n        return [0, 0, patch + 1];\n    }\n    if (trimmed.startsWith(\"~\")) {\n        return trimmed.replace(/^~v?/, \"\").split(\".\").length >= 2\n            ? [major, minor + 1, 0]\n            : [major + 1, 0, 0];\n    }\n    const parts = trimmed.replace(/^v/, \"\").split(\".\").length;\n    if (parts === 1) return [major + 1, 0, 0];\n    if (parts === 2) return [major, minor + 1, 0];\n    return [major, minor, patch + 1];\n}\n\nfunction compareTriples(a: [number, number, number], b: [number, number, number]): number {\n    for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;\n    return 0;\n}\n\n/**\n * Whether a declared range could EVER resolve at or above `target`.\n *\n * The same question the control plane asks at intake, asked here first. Only a\n * range whose entire span sits below the target is reported — `^0.10.0` can\n * never cross to 0.12 whatever npm publishes — because a false alarm on a build\n * that would have worked trains people to ignore the warning that matters.\n */\nfunction canReach(range: string, target: string): boolean | null {\n    const ceiling = upperBoundOf(range);\n    const floor = lowerBoundOf(target);\n    if (!floor || !lowerBoundOf(range)) return null;\n    if (!ceiling) return true;\n    return compareTriples(ceiling, floor) > 0;\n}\n\n/**\n * Whether no single published version can satisfy both ranges.\n *\n * Only a provable disagreement counts. Anything this tiny grammar cannot read —\n * a tag, an `||`, a `*` — returns false, because a build refused over a range\n * the CLI merely failed to parse is worse than the drift it was looking for.\n */\nfunction rangesDisjoint(a: string, b: string): boolean {\n    const loA = lowerBoundOf(a);\n    const loB = lowerBoundOf(b);\n    if (!loA || !loB) return false;\n    const hiA = upperBoundOf(a);\n    const hiB = upperBoundOf(b);\n    if (hiA && compareTriples(hiA, loB) <= 0) return true;\n    if (hiB && compareTriples(hiB, loA) <= 0) return true;\n    return false;\n}\n\n/**\n * Names two of the bundle's manifests declare at ranges nothing satisfies.\n *\n * `collectDeclaredDependencies` has to pick one — the app's — and the loser is\n * silent: the bundle tells the managed runtime to install a version the other\n * half of the project was never compiled against. The stock scaffold shipped\n * exactly that (`dotenv ^16` at the root, `^17.4.2` in `backend/`), so every\n * bundle built from a default project asked for dotenv 16.\n *\n * Scoped to the three manifests that feed `deps.declared`, and to their\n * `dependencies`: a `frontend/` that wants a different major of a build tool is\n * not this problem, and `devDependencies` never reach the bundle.\n */\nexport function detectDeclaredDepConflicts(projectRoot: string): DeclaredDepConflict[] {\n    const seen = new Map<string, DeclaredFrameworkDep>();\n    const conflicts: DeclaredDepConflict[] = [];\n\n    for (const relative of BUNDLE_DEP_MANIFESTS) {\n        const file = path.join(projectRoot, relative);\n        if (!fs.existsSync(file)) continue;\n        let pkg: { dependencies?: Record<string, string> };\n        try {\n            pkg = JSON.parse(fs.readFileSync(file, \"utf8\")) as typeof pkg;\n        } catch {\n            continue;\n        }\n        for (const [name, range] of Object.entries(pkg.dependencies ?? {})) {\n            if (typeof range !== \"string\") continue;\n            // The image supplies these; a disagreement about them never reaches\n            // the manifest, and `disagreeing` already reports the framework ones.\n            if (RUNTIME_PROVIDED.has(name)) continue;\n            if (range.startsWith(\"workspace:\")) continue;\n            const first = seen.get(name);\n            if (!first) {\n                seen.set(name, { name,\nrange,\nfile: relative });\n                continue;\n            }\n            if (first.range === range) continue;\n            if (!rangesDisjoint(first.range, range)) continue;\n            conflicts.push({ name,\ndeclarations: [first, { name,\nrange,\nfile: relative }] });\n        }\n    }\n\n    return conflicts;\n}\n\n/**\n * Find `@rebasepro/*` dependencies pinned to a version older than this CLI.\n *\n * This is the only place a developer can be told. In development, every\n * `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the\n * checkout, so the version STRINGS in package.json are never exercised — the\n * project runs fine locally on whatever is on disk, and the declared numbers are\n * first honoured when the runtime npm-installs them from a bundle in the cloud.\n * A project scaffolded at 0.10.0 therefore keeps working on a developer's\n * machine indefinitely while being, in the cloud, a 0.10.0 driver.\n *\n * That matters because the image supplies only `@rebasepro/server`; the database\n * driver comes from these declarations and a newer runtime never updates it.\n * Every package.json is scanned, `dependencies` and `devDependencies` both,\n * because they have to be bumped together and the one that gets forgotten is the\n * one nobody looks at.\n */\nexport function detectFrameworkDepDrift(projectRoot: string, cliVersion: string): FrameworkDepDrift {\n    const found: DeclaredFrameworkDep[] = [];\n\n    for (const relative of [\n        \"package.json\",\n        \"backend/package.json\",\n        \"config/package.json\",\n        \"frontend/package.json\"\n    ]) {\n        const file = path.join(projectRoot, relative);\n        if (!fs.existsSync(file)) continue;\n        try {\n            const pkg = JSON.parse(fs.readFileSync(file, \"utf8\")) as {\n                dependencies?: Record<string, string>;\n                devDependencies?: Record<string, string>;\n            };\n            for (const block of [pkg.dependencies, pkg.devDependencies]) {\n                for (const [name, range] of Object.entries(block ?? {})) {\n                    if (!name.startsWith(\"@rebasepro/\")) continue;\n                    if (typeof range !== \"string\") continue;\n                    found.push({ name,\nrange,\nfile: relative });\n                }\n            }\n        } catch {\n            // Unparseable package.json: nothing to judge from it.\n        }\n    }\n\n    const behind = found.filter(d => canReach(d.range, cliVersion) === false);\n\n    // Mixed-era pins. Compared by lower bound rather than by string so `^0.12.0`\n    // and `0.12.0` are not reported as a disagreement — they are not one.\n    const bounds = new Set(\n        found\n            .map(d => lowerBoundOf(d.range))\n            .filter((b): b is [number, number, number] => b != null)\n            .map(b => b.join(\".\"))\n    );\n\n    return { behind,\ndisagreeing: bounds.size > 1 ? [...bounds].sort() : [],\nconflicting: detectDeclaredDepConflicts(projectRoot) };\n}\n\n/**\n * The `[start, end)` ranges of `//` and block comments in JavaScript source.\n *\n * `normalizeEsmSpecifiers` scans emitted output with a regular expression, and a\n * regular expression cannot tell a specifier from a specifier somebody wrote\n * about. The stock template ships one: `config/resources.ts` documents\n * `import { media } from \"../resources\";` inside a docblock, tsc preserves the\n * comment, and every `rebase build` of an untouched scaffold printed\n * `⚠ 1 import(s) could not be resolved`. A warning that is wrong on the default\n * project teaches people to ignore the warning that predicts a boot failure.\n *\n * Strings are tracked only so a `//` inside one — every `http://` in the tree —\n * does not open a comment that swallows the rest of the line. A `'` or `\"` span\n * ends at the newline as well as at its closing quote: a JavaScript string\n * cannot contain a raw newline, so a quote that reaches one was never a string\n * (a regex literal's, most likely) and the mistake must not run on.\n */\nexport function commentSpans(source: string): Array<[number, number]> {\n    const spans: Array<[number, number]> = [];\n    let quote: string | null = null;\n    let i = 0;\n\n    while (i < source.length) {\n        const c = source[i];\n\n        if (quote) {\n            if (c === \"\\\\\") { i += 2; continue; }\n            if (c === quote || (c === \"\\n\" && quote !== \"`\")) quote = null;\n            i++;\n            continue;\n        }\n        if (c === \"\\\"\" || c === \"'\" || c === \"`\") { quote = c; i++; continue; }\n\n        if (c === \"/\" && source[i + 1] === \"/\") {\n            const newline = source.indexOf(\"\\n\", i);\n            const end = newline === -1 ? source.length : newline;\n            spans.push([i, end]);\n            i = end;\n            continue;\n        }\n        if (c === \"/\" && source[i + 1] === \"*\") {\n            const close = source.indexOf(\"*/\", i + 2);\n            const end = close === -1 ? source.length : close + 2;\n            spans.push([i, end]);\n            i = end;\n            continue;\n        }\n        i++;\n    }\n    return spans;\n}\n\n/**\n * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.\n *\n * TypeScript deliberately does not touch specifiers: `moduleResolution: \"bundler\"`\n * lets a project write `from \"./posts\"` or `from \"./collections\"`, and TypeScript\n * emits them unchanged on the assumption that a bundler will finish the job.\n * Nothing bundles a Rebase bundle — the runtime imports these files directly with\n * Node's ESM loader, which requires a full path with an extension and refuses\n * directory imports outright.\n *\n * Without this, adopting the bundle would mean asking every project written in\n * the (extremely common) extensionless style to rewrite all of its imports. The\n * rewrite is mechanical and verifiable: only relative specifiers are touched, and\n * only when the target file actually exists on disk.\n *\n * `write: false` computes the same answer and leaves every file as it was —\n * `rebase normalize-imports --check`, which reports and must not repair.\n */\nexport function normalizeEsmSpecifiers(\n    outDir: string,\n    options: { write?: boolean } = {}\n): { rewritten: number; unresolved: string[] } {\n    const write = options.write !== false;\n    const unresolved: string[] = [];\n    let rewritten = 0;\n\n    // The specifier of a static import/export, a bare side-effect import, or a\n    // dynamic import. Emitted output is not minified, so these forms are stable.\n    const SPECIFIER = /(\\bfrom\\s*|\\bimport\\s*\\(\\s*|\\bimport\\s+)([\"'])(\\.[^\"']*)\\2/g;\n\n    const walk = (dir: string): void => {\n        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n            const full = path.join(dir, entry.name);\n            if (entry.isDirectory()) {\n                if (entry.name === \"node_modules\") continue;\n                walk(full);\n            } else if (entry.isFile() && entry.name.endsWith(\".js\")) {\n                rewriteFile(full);\n            }\n        }\n    };\n\n    const rewriteFile = (file: string): void => {\n        const original = fs.readFileSync(file, \"utf8\");\n        const dir = path.dirname(file);\n        const comments = commentSpans(original);\n        const inComment = (at: number) => comments.some(([start, end]) => at >= start && at < end);\n\n        const updated = original.replace(SPECIFIER, (match, prefix, quote, specifier, offset: number) => {\n            // Prose, not code. Neither rewritten nor reported — see commentSpans.\n            if (inComment(offset)) return match;\n\n            // Already resolvable: has a real extension.\n            if (/\\.(js|mjs|cjs|json|node)$/.test(specifier)) return match;\n\n            const target = path.resolve(dir, specifier);\n\n            if (fs.existsSync(`${target}.js`)) {\n                rewritten++;\n                return `${prefix}${quote}${specifier}.js${quote}`;\n            }\n            if (fs.existsSync(path.join(target, \"index.js\"))) {\n                rewritten++;\n                const suffix = specifier.endsWith(\"/\") ? \"index.js\" : \"/index.js\";\n                return `${prefix}${quote}${specifier}${suffix}${quote}`;\n            }\n\n            // A `.ts` extension written explicitly in source becomes `.js` on disk.\n            if (specifier.endsWith(\".ts\") && fs.existsSync(`${target.slice(0, -3)}.js`)) {\n                rewritten++;\n                return `${prefix}${quote}${specifier.slice(0, -3)}.js${quote}`;\n            }\n\n            unresolved.push(`${path.basename(file)} → ${specifier}`);\n            return match;\n        });\n\n        if (write && updated !== original) {\n            fs.writeFileSync(file, updated, \"utf8\");\n        }\n    };\n\n    if (fs.existsSync(outDir)) walk(outDir);\n    return { rewritten,\nunresolved };\n}\n\n/**\n * Remove a previous build so stale output cannot masquerade as current.\n *\n * The containment check matters because this is a recursive force-delete of a\n * path that came from a command-line flag: `rebase build --out ../..` would\n * otherwise erase the parent of the project. The manifest's own paths are\n * checked the same way; a flag deserves no less.\n */\nfunction cleanOutDir(projectRoot: string, outDir: string): void {\n    const relative = path.relative(projectRoot, outDir);\n    if (relative === \"\" || relative.startsWith(\"..\") || path.isAbsolute(relative)) {\n        throw new Error(\n            `Refusing to build into \"${outDir}\": the output directory must be inside the project.`\n        );\n    }\n\n    if (fs.existsSync(outDir)) {\n        fs.rmSync(outDir, { recursive: true,\nforce: true });\n    }\n    fs.mkdirSync(outDir, { recursive: true });\n}\n\n/**\n * Regenerate the Drizzle schema from the collections.\n *\n * Delegated to the database driver's own CLI — the same code `rebase schema\n * generate` runs — so there is one implementation of what a schema is. When no\n * driver is resolvable the build continues with a warning rather than failing:\n * a `baas` project has no schema to generate, and a project mid-install should\n * get a clear message rather than a hard stop.\n */\nasync function regenerateSchema(\n    projectRoot: string,\n    configDir: string,\n    options: BuildBundleOptions\n): Promise<void> {\n    const backendDir = path.join(projectRoot, \"backend\");\n    if (!fs.existsSync(backendDir)) return;\n\n    const plugin = getActiveBackendPlugin(backendDir);\n    const script = plugin ? resolvePluginCliScript(backendDir, plugin) : null;\n    if (!script) {\n        log(options, chalk.dim(\"  (no database driver found — skipping schema generation)\"));\n        return;\n    }\n\n    const runner = script.endsWith(\".ts\") ? resolveTsx(projectRoot) : \"node\";\n    if (!runner) {\n        log(options, chalk.dim(\"  (tsx not installed — skipping schema generation)\"));\n        return;\n    }\n\n    const collectionsPath = path.join(\"..\", configDir, \"collections\");\n    // Imported here, not at the top: this module is part of the package's\n    // entry, which every `rebase` invocation loads, and execa is ~100 modules.\n    const { execa } = await import(\"execa\");\n    try {\n        await execa(\n            runner,\n            [script, \"schema\", \"generate\", \"--collections\", collectionsPath],\n            { cwd: backendDir,\nstdio: \"pipe\" }\n        );\n        log(options, chalk.dim(\"  regenerated database schema from collections\"));\n    } catch (err) {\n        // A schema that cannot be generated means the bundle would carry a stale\n        // one, and a stale schema is how a deploy quietly writes to the wrong\n        // columns. Fail rather than ship it.\n        const detail = err instanceof Error ? err.message : String(err);\n        throw new Error(\n            `Schema generation failed, so the bundle was not written.\\n${detail}\\n` +\n            \"Run `rebase schema generate` to see the full output, or pass --skip-schema \" +\n            \"if the committed schema is deliberately hand-maintained.\"\n        );\n    }\n}\n\n/**\n * A hand-written server entrypoint that a bundle does not use.\n *\n * `rebase dev` runs `backend/src/index.ts` whenever a project has one, so for\n * the whole of local development that file *is* the server and every route\n * written in it works. A bundle has no entrypoint of its own: the runtime boots\n * the bundle and mounts what the manifest points at — the config package,\n * functions, crons and the schema. The file is not compiled, not shipped, and\n * never imported.\n *\n * Nothing said so. A project with custom routes in its entrypoint built clean,\n * deployed green, and answered 404 on every one of them, with the file still\n * sitting in the repository looking exactly like the server.\n *\n * A project that means to own its server process runs `rebase eject`, which\n * writes an entrypoint, a Dockerfile and a compose file together and flips the\n * backend to `runtime: \"custom\"`. The warning names that route rather than\n * implying the file is a mistake — but eject writes *its* entrypoint, so the\n * warning must not read as \"eject will keep what you wrote here\".\n */\nexport function findUnusedServerEntry(projectRoot: string, functionsDir: string): string | undefined {\n    // A project that relocated its functions keeps the entrypoint beside them,\n    // so the second candidate is derived rather than only the default known.\n    const candidates = [\n        path.join(\"backend\", \"src\", \"index.ts\"),\n        path.join(path.dirname(functionsDir), \"src\", \"index.ts\")\n    ];\n\n    const found = candidates.find(candidate => fs.existsSync(path.join(projectRoot, candidate)));\n    return found ? found.split(path.sep).join(\"/\") : undefined;\n}\n\n/**\n * Compile and assemble a bundle.\n */\n/** What `composeBundleManifest` needs: every input, already resolved. */\nexport interface ComposeManifestInput {\n    runtimeRange: string;\n    builtAgainst: string;\n    schemaVersion: string;\n    appName: string;\n    entry: RebaseBundleManifest[\"entry\"];\n    collectionSlugs: string[];\n    functions: RebaseBundleFunction[];\n    nativeModules: NativeDependency[];\n    declaresStorageAuthorize: boolean;\n    resources: ResourceGraph | undefined;\n    declaredDeps: Record<string, string>;\n    build: RebaseBundleManifest[\"build\"];\n}\n\n/**\n * The bundle manifest, as a pure function of its inputs.\n *\n * Separated from `buildBundle` so the SHAPE a host reads can be pinned by a\n * test without compiling a project: `tooling/contracts/bundle-manifest.json`\n * is written from this with fixed inputs, and the control plane's own tests\n * read that file to prove they consume what the CLI emits. That contract is\n * what was missing when buckets moved from `storage.sources` into `resources`\n * and the control plane went on reading the old field for two weeks — every\n * declared bucket arriving as nothing, with both suites green.\n */\nexport function composeBundleManifest(input: ComposeManifestInput): RebaseBundleManifest {\n    return {\n        bundleFormat: BUNDLE_FORMAT_VERSION,\n        runtime: {\n            range: input.runtimeRange,\n            builtAgainst: input.builtAgainst,\n            contract: RUNTIME_CONTRACT_VERSION\n        },\n        schemaVersion: input.schemaVersion,\n        app: input.appName,\n        kind: \"backend\",\n        entry: input.entry,\n        collections: [...input.collectionSlugs].sort(),\n        ...(input.functions.length > 0 ? { functions: input.functions } : {}),\n        hooks: {\n            native: input.nativeModules.length > 0,\n            nativeModules: input.nativeModules.length > 0 ? input.nativeModules : undefined\n        },\n        storage: {\n            // The hook, not the buckets. Those live in `resources` now, with\n            // every other kind, so a host reads one list instead of one per\n            // kind — which is what let databases and buckets drift apart.\n            authorize: input.declaresStorageAuthorize\n        },\n        resources: input.resources,\n        deps: { declared: input.declaredDeps },\n        build: input.build\n    };\n}\n\n/**\n * What a build refusing on {@link detectDeclaredDepConflicts} says: every name,\n * both ranges and where each is declared.\n */\nexport function describeDepConflicts(conflicts: DeclaredDepConflict[]): string {\n    const lines = [`${conflicts.length} dependency range(s) no single version satisfies:`];\n    for (const { name, declarations: [first, second] } of conflicts) {\n        lines.push(`    ${name}`, `      ${first.range}  (${first.file})`, `      ${second.range}  (${second.file})`);\n    }\n    lines.push(\n        \"  The bundle installs one range; the other half of the project was built against the other.\",\n        \"  Declare one range, in the app that uses it.\"\n    );\n    return lines.join(\"\\n\");\n}\n\nexport async function buildBundle(options: BuildBundleOptions): Promise<BuildBundleResult> {\n    const { projectRoot, app, appName } = options;\n\n    /* Two of this project's manifests want versions of one package that no\n       single release satisfies.\n\n       Fatal, and fatal before anything is built, because the bundle can only\n       carry one of them: whichever manifest is read last wins, and the other\n       half of the project was compiled against something the runtime will\n       never install. There is no correct bundle to produce. Here rather than\n       in a command, because every command that builds a bundle has to refuse\n       it: `rebase cloud deploy` builds its own, and shipped what `rebase\n       build` refused. */\n    const conflicts = detectDeclaredDepConflicts(projectRoot);\n    if (conflicts.length > 0) throw new Error(describeDepConflicts(conflicts));\n\n    const paths = resolveBackendPaths(app, projectRoot);\n    const outDir = path.resolve(projectRoot, options.outDir ?? DEFAULT_BUNDLE_DIR);\n\n    const includes: string[] = [];\n    const addIfExists = (relative: string, pattern: string): void => {\n        if (fs.existsSync(path.join(projectRoot, relative))) includes.push(pattern);\n    };\n\n    // The whole config package, not just its collections: a headless project\n    // has no `config/collections` but still ships `storageAuthorize` here.\n    if (paths.hasConfig) {\n        addIfExists(paths.config, `${paths.config}/**/*.ts`);\n    }\n    addIfExists(paths.functions, `${paths.functions}/**/*.ts`);\n    addIfExists(paths.crons, `${paths.crons}/**/*.ts`);\n    if (fs.existsSync(path.join(projectRoot, paths.schema))) {\n        includes.push(paths.schema);\n    }\n\n    if (includes.length === 0) {\n        throw new Error(\n            `Nothing to build for app \"${appName}\". Expected a config directory at ` +\n            `\"${paths.config}\" or functions at \"${paths.functions}\".`\n        );\n    }\n\n    // Regenerate the Drizzle schema from the collections first.\n    //\n    // The template's backend build did this, so a project moving to the bundle\n    // flow would otherwise silently ship whatever `schema.generated.ts` happened\n    // to be on disk — stale by exactly the edits just made.\n    if (paths.hasCollections && options.skipSchema !== true) {\n        await regenerateSchema(projectRoot, paths.config, options);\n    }\n\n    // The server-side `Database` registration, before anything compiles\n    // against it. It is gitignored, so on a fresh clone only this writes it:\n    // without it the callbacks compile against untyped `context.data`, and a\n    // project that builds locally fails to build in CI.\n    if (paths.hasCollections) {\n        const { writeRegistrationForBuild } = await import(\"./commands/generate_sdk\");\n        const registered = await writeRegistrationForBuild(\n            path.join(projectRoot, paths.config, \"collections\"),\n            app.registerDatabase === true\n        );\n        if (registered) {\n            log(options, chalk.dim(`  registered the Database for server-side code in ${path.relative(projectRoot, registered)}/`));\n        }\n    }\n\n    // Say out loud what this build is NOT going to include. See\n    // `findUnusedServerEntry` for why silence here was expensive.\n    const unusedEntry = findUnusedServerEntry(projectRoot, paths.functions);\n    if (unusedEntry) {\n        const parts = [\n            ...(paths.hasCollections ? [`${paths.config}/`] : []),\n            `${paths.functions}/`,\n            \"the schema\"\n        ];\n        const compiled = `${parts.slice(0, -1).join(\", \")} and ${parts[parts.length - 1]}`;\n        say(options, chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));\n        say(options, chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));\n        say(options, chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));\n        say(options, chalk.dim(\"      or run `rebase eject`, which writes an entrypoint of its own and owns\"));\n        say(options, chalk.dim(\"      the image — it does not adopt this file, and will not replace it\"));\n        say(options, chalk.dim(\"      without --force.\"));\n    }\n\n    log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));\n\n    cleanOutDir(projectRoot, outDir);\n    const tsconfigPath = await writeBundleTsconfig(projectRoot, outDir, includes, options);\n\n    const tsc = resolveLocalBin(projectRoot, \"tsc\");\n    if (!tsc) {\n        throw new Error(\n            \"TypeScript is not installed in this project. Run your package manager's install first.\"\n        );\n    }\n\n    const { execa } = await import(\"execa\");\n    try {\n        await execa(tsc, [\"-p\", tsconfigPath], { cwd: projectRoot,\nstdio: toolStdio(options.quietStdout) });\n    } catch {\n        throw new Error(\"TypeScript compilation failed — the bundle was not written.\");\n    }\n\n    // Node resolves these files directly, so their specifiers must be complete.\n    const normalized = normalizeEsmSpecifiers(outDir);\n    if (normalized.rewritten > 0) {\n        log(options, chalk.dim(`  resolved ${normalized.rewritten} relative import(s) for Node ESM`));\n    }\n    if (normalized.unresolved.length > 0) {\n        say(options, chalk.yellow(\n            `  ⚠ ${normalized.unresolved.length} import(s) could not be resolved to a file:`\n        ));\n        for (const item of normalized.unresolved.slice(0, 5)) {\n            say(options, chalk.dim(`      ${item}`));\n        }\n        if (normalized.unresolved.length > 5) {\n            say(options, chalk.dim(`      … and ${normalized.unresolved.length - 5} more`));\n        }\n    }\n\n    // ── Inspect what was produced ────────────────────────────────────────────\n    const compiledConfigDir = path.join(outDir, paths.config);\n    const compiledCollectionsDir = path.join(compiledConfigDir, \"collections\");\n\n    let collections: CollectionConfig[] = [];\n    if (paths.hasCollections) {\n        collections = await loadSourceCollections(path.join(projectRoot, paths.config, \"collections\"));\n        if (collections.length === 0) {\n            throw new Error(\n                \"No collections were found in \" +\n                `${path.join(paths.config, \"collections\")}. ` +\n                \"Define at least one collection there, or remove the directory to have the \" +\n                \"runtime introspect collections from the live database instead.\"\n            );\n        }\n        if (!fs.existsSync(compiledCollectionsDir)) {\n            throw new Error(\n                \"Compilation produced no collections directory at \" +\n                `${path.relative(projectRoot, compiledCollectionsDir)}.`\n            );\n        }\n    }\n\n    const declared = collectDeclaredDependencies(projectRoot);\n    const nativeModules = detectNativeDependencies(projectRoot, declared);\n    const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));\n\n    // Resolve the declared buckets now, and refuse the build if two of them would\n    // read the same environment variables. Catching it here means a rename, not a\n    // tenant that silently served one bucket's files from another's credentials.\n    const resourceGraph: ResourceGraph = options.resources ?? { version: 1, resources: [] };\n    const storageSources = resourceGraph.resources\n        .filter(r => r.kind === \"bucket\")\n        .map(r => ({\n            key: r.key,\n            engine: r.engine,\n            transport: r.transport,\n            ...(r.label !== undefined ? { label: r.label } : {})\n        }));\n    const collision = findStorageSuffixCollision(storageSources.map(s => s.key));\n    if (collision) {\n        throw new Error(\n            `Buckets \"${collision.a}\" and \"${collision.b}\" both map to the environment variable ` +\n            `suffix \"${collision.suffix || \"(none)\"}\", so they would read each other's ` +\n            \"configuration. Rename one of them.\"\n        );\n    }\n\n    const schemaOut = paths.schema.replace(/\\.ts$/, \".js\");\n    const relative = (target: string): string | undefined =>\n        fs.existsSync(path.join(outDir, target)) ? target : undefined;\n\n    // What is in the functions directory, and what each one needs from its\n    // host. Read from the *source*, not the compiled output, because the answer\n    // is about imports and `tsc` has already resolved some of them away.\n    const functionReports = analyseFunctionsDirectory(\n        path.join(projectRoot, paths.functions),\n        projectRoot\n    );\n    const bundledFunctions: RebaseBundleFunction[] = functionReports.map(report => {\n        const requires = [...new Set(\n            report.issues\n                .filter(issue => issue.kind === \"node-builtin\" || issue.kind === \"node-only-package\")\n                .map(issue => issue.message)\n        )];\n        return {\n            name: report.name,\n            // The path as it exists *in the bundle*: sources are compiled 1:1,\n            // so this is the same relative path with a `.js` extension.\n            file: report.file.replace(/\\.ts$/, \".js\"),\n            portable: report.portable,\n            ...(requires.length > 0 ? { requires } : {})\n        };\n    });\n\n    for (const line of summarisePortability(functionReports)) {\n        say(options, line.trimStart().startsWith(\"⚠\") ? chalk.yellow(line) : chalk.dim(line));\n    }\n\n    const manifest = composeBundleManifest({\n        runtimeRange: options.runtimeRange,\n        builtAgainst: resolveServerVersion(projectRoot),\n        // A build with no config directory genuinely does not know the schema —\n        // collections are introspected from the live database at boot. Recording\n        // a version here would stamp the hash of an empty list, and the runtime\n        // would then serve that as the identity of whatever it actually found.\n        // Empty means \"ask the runtime\", which is the honest answer.\n        schemaVersion: paths.hasCollections ? computeSchemaVersion(collections) : \"\",\n        appName,\n        entry: {\n            config: paths.hasConfig ? relative(paths.config) : undefined,\n            collections: paths.hasCollections ? relative(path.join(paths.config, \"collections\")) : undefined,\n            functions: relative(paths.functions),\n            crons: relative(paths.crons),\n            schema: relative(schemaOut),\n            usersCollection: paths.hasCollections\n                ? relative(path.join(paths.config, `${paths.usersCollection}.js`))\n                : undefined\n        },\n        collectionSlugs: collections\n            .map(collection => collection.slug)\n            .filter((slug): slug is string => Boolean(slug)),\n        functions: bundledFunctions,\n        nativeModules,\n        declaresStorageAuthorize,\n        resources: resourceGraph,\n        declaredDeps: declared,\n        build: {\n            cli: cliVersion(),\n            node: process.versions.node.split(\".\")[0],\n            createdAt: new Date().toISOString()\n        }\n    });\n\n    fs.writeFileSync(\n        path.join(outDir, \"manifest.json\"),\n        `${JSON.stringify(manifest, null, 2)}\\n`,\n        \"utf8\"\n    );\n\n    // The project's registry settings, credentials as `${VAR}` references only,\n    // so a private package installs on the pod as it does on this machine.\n    const npmrc = bundledNpmrc(projectRoot);\n    if (npmrc) fs.writeFileSync(path.join(outDir, \".npmrc\"), npmrc, \"utf8\");\n\n    // A package.json beside the bundle lets a deployment install exactly the\n    // dependencies the project declared, with no access to the repository.\n    fs.writeFileSync(\n        path.join(outDir, \"package.json\"),\n        `${JSON.stringify({\n            name: \"rebase-bundle\",\n            private: true,\n            type: \"module\",\n            dependencies: declared\n        }, null, 2)}\\n`,\n        \"utf8\"\n    );\n\n    const vendor = vendorDependencies({\n        outDir,\n        declared,\n        nativeModules,\n        // The driver is the one package the image does not supply, so it is the\n        // one a vendored tree must actually contain.\n        required: [getActiveBackendPlugin(path.join(projectRoot, \"backend\"))].filter(\n            (name): name is string => Boolean(name)),\n        requested: options.vendor\n    });\n    if (vendor.vendored) {\n        manifest.deps.vendored = true;\n        manifest.deps.vendorTarget = vendor.target;\n        // Rewritten rather than assembled differently above: the install needs\n        // the package.json this function already wrote, so the manifest cannot\n        // know the answer until afterwards.\n        fs.writeFileSync(\n            path.join(outDir, \"manifest.json\"),\n            `${JSON.stringify(manifest, null, 2)}\\n`,\n            \"utf8\"\n        );\n    }\n\n    return { outDir,\nmanifest,\ncollectionCount: collections.length,\nvendor };\n}\n\n/** Default install target: what the published runtime image runs. */\nexport const VENDOR_TARGET_OS = \"linux\";\nexport const VENDOR_TARGET_CPU = \"x64\";\n\nexport interface VendorResult {\n    vendored: boolean;\n    target?: { os: string; cpu: string; node: string };\n    /** Why nothing was installed. Present exactly when `vendored` is false. */\n    skipped?: string;\n    /** Size of the installed tree on disk, when one was installed. */\n    bytes?: number;\n}\n\n/**\n * Where a vendored bundle starts being too big to upload.\n *\n * The control plane refuses a bundle over 100 MB, and that ceiling is not\n * arbitrary or easily raised: its pod has a 512Mi memory limit and the upload\n * route holds the body while it writes it, so the cap protects the process that\n * also serves the console, deploys and billing. Vendoring is the one change that\n * can push a bundle near it.\n *\n * So the warning is here, at build time, where the remedy is one flag away —\n * rather than at deploy time as a 413 nobody can act on without rebuilding. The\n * threshold sits below the real cap because this measures the tree on disk and\n * the upload is compressed: crossing it means \"getting close\", not \"will fail\".\n */\nexport const VENDOR_SIZE_WARN_BYTES = 150 * 1024 * 1024;\n\n/**\n * Where vendoring stops being an optimisation and becomes a bundle nobody can\n * deploy.\n *\n * Past this, shipping the tree anyway trades a faster cold start for a 413 — and\n * the 413 arrives at deploy time, after a build nobody watches, with a remedy\n * (`--no-vendor`) that requires knowing this happened. Unvendoring here costs\n * 40–60s of cold start and produces a bundle that uploads; that is the better\n * side of the trade to be on by default.\n *\n * 200 MB assumes a **2x** floor on compression, which is pessimistic for a tree\n * of JavaScript (3–5x is typical) and deliberately so: source maps and prebuilt\n * binaries compress far worse than source, and the failure this prevents is\n * asymmetric — a bundle refused at the door versus a minute of cold start.\n * `--vendor` overrides it, for a deploy path with no upload at all (a Dockerfile\n * built from source, where the tree is copied into an image and the control\n * plane never sees it).\n */\nexport const VENDOR_SIZE_MAX_BYTES = 200 * 1024 * 1024;\n\n/** Bytes on disk under `dir`. Bounded so a pathological tree cannot hang a build. */\nfunction directorySize(dir: string, budget = 200_000): number {\n    let total = 0;\n    let visited = 0;\n    const stack = [dir];\n    while (stack.length > 0 && visited < budget) {\n        const current = stack.pop()!;\n        let entries: fs.Dirent[];\n        try {\n            entries = fs.readdirSync(current, { withFileTypes: true });\n        } catch {\n            continue;\n        }\n        for (const entry of entries) {\n            visited++;\n            const full = path.join(current, entry.name);\n            if (entry.isDirectory()) {\n                stack.push(full);\n            } else if (entry.isFile()) {\n                try {\n                    total += fs.statSync(full).size;\n                } catch {\n                    // A file that vanished between readdir and stat contributes\n                    // nothing; it is not worth failing a build over.\n                }\n            }\n        }\n    }\n    return total;\n}\n\n/**\n * Install the bundle's declared dependencies into the bundle itself.\n *\n * ## What this buys\n *\n * A managed pod's bundle lives on an `emptyDir`, so it is re-fetched and\n * re-installed on **every** start — an eviction, a node failure, an OOM, a\n * runtime rollout. The install is 35–55 seconds of a 40–60 second cold start,\n * which makes it the price of every unplanned restart a tenant suffers. Doing it\n * once at build time instead of every time at boot takes that to roughly the\n * cost of untarring.\n *\n * The pod side needs no change to benefit: the init container already skips\n * installing when `node_modules` is present, a guard that existed for\n * pre-baked images and turns out to be exactly the hook this needs.\n *\n * ## Why it refuses to vendor native code\n *\n * A compiled binary is valid only for the platform it was built for, and a\n * developer's machine is rarely the deployment's. The managed runtime already\n * refuses bundles containing native modules for the same reason, so this refusal\n * costs nothing there — but a self-hosted project may legitimately use them, and\n * for those the honest answer is to install in the container, where the platform\n * is known.\n *\n * ## Why `--os` and `--cpu` are not optional\n *\n * The dangerous case is not native code, which is detectable. It is a pure-JS\n * package whose real work lives in a **platform-specific optional dependency** —\n * `esbuild` being the one everybody meets. Installing on an Apple Silicon Mac\n * resolves `@esbuild/darwin-arm64`, produces a tree that looks complete, and\n * fails at import inside a linux/amd64 pod. npm resolves optional dependencies\n * for the declared target rather than the host when told to, so it is told to.\n */\nexport function vendorDependencies(options: {\n    outDir: string;\n    declared: Record<string, string>;\n    nativeModules: NativeDependency[];\n    /**\n     * Packages the runtime resolves *from the bundle* and cannot boot without —\n     * in practice the database driver, which the image deliberately does not\n     * supply. A vendored tree missing one of these is refused; see below.\n     */\n    required?: string[];\n    /** `false` disables; `undefined` means \"when it is safe to\". */\n    requested?: boolean;\n    /** Injected in tests. */\n    run?: (cmd: string, args: string[], cwd: string) => void;\n}): VendorResult {\n    if (options.requested === false) {\n        return { vendored: false, skipped: \"disabled with --no-vendor\" };\n    }\n    if (Object.keys(options.declared).length === 0) {\n        // Not a failure and not worth a warning: a project using only what the\n        // runtime already provides installs nothing at boot either way.\n        return { vendored: false, skipped: \"the bundle declares no dependencies\" };\n    }\n    if (options.nativeModules.length > 0) {\n        const names = options.nativeModules.map(m => m.name).join(\", \");\n        return {\n            vendored: false,\n            skipped:\n                `the dependency closure contains native code (${names}), which is only valid on the ` +\n                \"platform it was compiled for\"\n        };\n    }\n\n    const target = {\n        os: VENDOR_TARGET_OS,\n        cpu: VENDOR_TARGET_CPU,\n        node: process.versions.node.split(\".\")[0]\n    };\n\n    const run = options.run ?? ((cmd, args, cwd) => {\n        const result = spawnSync(cmd, args, { cwd, stdio: \"pipe\", encoding: \"utf8\" });\n        if (result.error) throw result.error;\n        if (result.status !== 0) {\n            throw new Error(\n                `${cmd} ${args.join(\" \")} exited ${result.status}\\n${result.stderr || result.stdout || \"\"}`.trim()\n            );\n        }\n    });\n\n    try {\n        run(\n            \"npm\",\n            [\n                \"install\",\n                \"--omit=dev\",\n                // Matches what the runtime image's entrypoint insists on, and\n                // what the init container passes. A bundle whose dependencies\n                // ran lifecycle scripts at build time would arrive at the pod\n                // carrying whatever they produced.\n                \"--ignore-scripts\",\n                \"--no-audit\",\n                \"--no-fund\",\n                `--os=${target.os}`,\n                `--cpu=${target.cpu}`\n            ],\n            options.outDir\n        );\n    } catch (error: unknown) {\n        // Never fatal. A bundle that could not be vendored is exactly the bundle\n        // every project shipped before this existed — slower to start, entirely\n        // functional — and failing the build over a speed optimisation would\n        // trade a working deploy for a faster one that does not happen.\n        return {\n            vendored: false,\n            skipped: `npm install failed: ${error instanceof Error ? error.message : String(error)}`\n        };\n    }\n\n    const installed = path.join(options.outDir, \"node_modules\");\n    if (!fs.existsSync(installed)) {\n        return { vendored: false, skipped: \"npm install produced no node_modules\" };\n    }\n\n    // An *incomplete* vendored tree is worse than none, because of the very\n    // guard that makes vendoring free: the init container skips installing when\n    // `node_modules` is present. So a tree missing the database driver does not\n    // start slowly — it does not start at all, with the boot dying on\n    // `Cannot find package \"@rebasepro/server-postgres\"`, and the step that\n    // would have installed it declining to run precisely because this directory\n    // exists.\n    //\n    // A driver goes missing whenever the project declares it in a way the\n    // registry cannot serve — `workspace:*` in a monorepo, a `link:` override —\n    // since `collectDeclaredDependencies` drops exactly those. Such a project\n    // could never deploy this bundle anyway; what it must not do is have a\n    // *build-time* optimisation quietly remove its ability to boot from source.\n    // Refusing leaves the bundle in the state every project shipped before\n    // vendoring existed.\n    const missing = (options.required ?? []).filter(name =>\n        !fs.existsSync(path.join(installed, ...name.split(\"/\"), \"package.json\")));\n    if (missing.length > 0) {\n        fs.rmSync(installed, { recursive: true, force: true });\n        fs.rmSync(path.join(options.outDir, \"package-lock.json\"), { force: true });\n        return {\n            vendored: false,\n            skipped:\n                `the installed tree is missing ${missing.join(\", \")}, which the runtime resolves from ` +\n                \"the bundle — the bundle declares it at a version no registry can serve (a workspace \" +\n                \"link), so nothing was vendored rather than shipping a tree that boots without a driver\"\n        };\n    }\n\n    const bytes = directorySize(installed);\n    if (bytes > VENDOR_SIZE_MAX_BYTES && options.requested !== true) {\n        fs.rmSync(installed, { recursive: true, force: true });\n        fs.rmSync(path.join(options.outDir, \"package-lock.json\"), { force: true });\n        return {\n            vendored: false,\n            skipped:\n                `the installed tree is ${Math.round(bytes / (1024 * 1024))} MB, past the point where the ` +\n                \"upload can be expected to fit under the control plane's 100 MB limit — a bundle that \" +\n                \"is refused at the door is worse than one that installs at boot. Pass --vendor to keep \" +\n                \"it anyway (a deploy that builds from source never uploads the tree), or shrink the \" +\n                \"declared dependencies\"\n        };\n    }\n\n    return { vendored: true, target, bytes };\n}\n\n/**\n * Package a built static app (a `static` or bundled-`admin` app) into a bundle.\n *\n * A static bundle is the counterpart to a backend bundle: the same shape, the\n * same runtime image runs it, but its manifest says `mode: \"static\"` and it\n * carries only the built assets under `static/`. That is what lets a frontend or\n * admin app be its own deployable, scalable unit rather than something baked into\n * the backend container.\n *\n * `assetsDir` is the app's built output (e.g. `frontend/dist`), already produced\n * by its own build command. This copies it into the bundle and writes the\n * manifest — no compilation, no dependency closure (a static bundle installs\n * nothing at boot).\n */\n/**\n * Fold a built static app into a backend bundle, so one runtime serves both.\n *\n * ## Why this exists\n *\n * A managed tenant runs one pod, and `bootFromBundle` on the backend path already\n * knows how to serve a SPA — it looks for `entry.static` and mounts `serveSPA`\n * last, behind `REBASE_SERVE_STATIC`. What was missing was anything putting the\n * assets there.\n *\n * The consequence was not subtle. A project whose custom image served its website\n * at `/` and its API at `/api` — the shape the scaffolded template produces — lost\n * the website the moment it moved to the managed runtime: the API answered\n * perfectly and every page 404'd. Managed could not be a drop-in replacement for\n * custom while the frontend simply vanished.\n *\n * Folding restores parity with the container it replaces, which is the only\n * honest baseline. It is deliberately the FIRST implementation and not the last:\n * a static app on its own bucket behind a CDN is better for cache behaviour and\n * lets the frontend deploy independently. But that needs infrastructure that does\n * not exist yet, and \"your site is gone\" is not an acceptable state to leave a\n * project in while it gets built.\n *\n * The trade it makes, stated plainly: frontend and backend now deploy together\n * and the bundle carries the built assets. For a project that was shipping both\n * in one image already, that is exactly what it had.\n */\nexport function foldStaticIntoBundle(options: {\n    /** The backend bundle directory, already written. */\n    bundleDir: string;\n    /** Directory of built frontend assets (the static app's `output`). */\n    assetsDir: string;\n    /** The app's name in `rebase.json`. Names its directory inside the bundle. */\n    appName: string;\n    /** Public base path this app is served under. Always a path, never a URL. */\n    path: string;\n    /** The one hostname this app answers on, when its manifest `path` names one. */\n    host?: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n    /** Where this app mounts the Rebase CMS, if it does. */\n    cms?: string;\n}): { fileCount: number; dir: string } {\n    const { bundleDir, assetsDir, appName, path: basePath, host, spa, cms } = options;\n    const manifestPath = path.join(bundleDir, \"manifest.json\");\n    if (!fs.existsSync(manifestPath)) {\n        throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);\n    }\n    if (!fs.existsSync(assetsDir)) {\n        throw new Error(`No built assets at ${assetsDir}.`);\n    }\n\n    // Each app gets its own directory, and only its own is cleared. Folding used\n    // to wipe `static/` wholesale and write a single `entry.static` string, so a\n    // second app silently replaced the first — both in the tree and in the\n    // manifest — and the bundle deployed looking complete.\n    const dir = path.posix.join(\"static\", appName);\n    const staticOut = path.join(bundleDir, \"static\", appName);\n    fs.rmSync(staticOut, { recursive: true,\nforce: true });\n    fs.mkdirSync(staticOut, { recursive: true });\n    fs.cpSync(assetsDir, staticOut, { recursive: true });\n\n    let fileCount = 0;\n    const count = (target: string): void => {\n        for (const entry of fs.readdirSync(target, { withFileTypes: true })) {\n            if (entry.isDirectory()) count(path.join(target, entry.name));\n            else fileCount++;\n        }\n    };\n    count(staticOut);\n    // After counting: `fileCount` is the app's files, not their siblings.\n    precompressStaticAssets(staticOut);\n\n    // Record it, because the runtime finds the assets through the manifest —\n    // not by guessing a directory name.\n    const manifest = JSON.parse(fs.readFileSync(manifestPath, \"utf8\")) as RebaseBundleManifest;\n    const existing = (manifest.entry?.static ?? []).filter(entry => entry.dir !== dir);\n    // Sorted into mount order rather than left in folding order, so the bundle\n    // reads the way it is served whatever order its apps were folded in — a\n    // refold of one app appends it after siblings it may have to outrank.\n    manifest.entry = {\n        ...manifest.entry,\n        static: [...existing, { path: basePath,\n...(host ? { host } : {}),\ndir,\nspa,\nname: appName,\n...(cms ? { cms } : {}) }].sort(compareMountOrder)\n    };\n    fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\\n`, \"utf8\");\n\n    return { fileCount,\ndir };\n}\n\nexport function buildStaticBundle(options: {\n    projectRoot: string;\n    appName: string;\n    assetsDir: string;\n    outDir: string;\n    runtimeRange: string;\n    /** Public base path. Default `/` — a standalone bundle owns its origin. Always a path. */\n    path?: string;\n    /** The one hostname this app answers on, when its manifest `path` names one. */\n    host?: string;\n    /** Serve `index.html` for unmatched paths. Default `true`. */\n    spa?: boolean;\n    /** Where this app mounts the Rebase CMS, if it does. */\n    cms?: string;\n}): { outDir: string; manifest: RebaseBundleManifest; fileCount: number } {\n    const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;\n    const basePath = options.path ?? \"/\";\n\n    cleanOutDir(projectRoot, outDir);\n\n    const staticOut = path.join(outDir, \"static\");\n    fs.mkdirSync(staticOut, { recursive: true });\n    fs.cpSync(assetsDir, staticOut, { recursive: true });\n\n    let fileCount = 0;\n    const count = (dir: string): void => {\n        for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {\n            if (entry.isDirectory()) count(path.join(dir, entry.name));\n            else fileCount++;\n        }\n    };\n    count(staticOut);\n    precompressStaticAssets(staticOut);\n\n    const manifest: RebaseBundleManifest = {\n        bundleFormat: BUNDLE_FORMAT_VERSION,\n        runtime: {\n            range: runtimeRange,\n            builtAgainst: resolveServerVersion(projectRoot),\n            contract: RUNTIME_CONTRACT_VERSION\n        },\n        // A static app has no collections and therefore no schema contract.\n        schemaVersion: \"\",\n        app: appName,\n        kind: \"static\",\n        // Normally `/` — a standalone bundle owns its origin. It carries the\n        // app's declared path rather than hardcoding one so that the bundle\n        // agrees with what the assets were actually *built* for; serving a\n        // `/admin`-built app at `/` is the blank-page failure in reverse. Its\n        // hostname travels too: this bundle is all the control plane sees of\n        // the app, and the hostname is what it registers on the project.\n        entry: { static: [{ path: basePath,\n...(options.host ? { host: options.host } : {}),\ndir: \"static\",\nspa: options.spa ?? true,\nname: appName,\n...(options.cms ? { cms: options.cms } : {}) }] },\n        hooks: { native: false },\n        // Nothing to install beside a static bundle — it is just files.\n        deps: { declared: {} },\n        build: {\n            cli: cliVersion(),\n            node: process.versions.node.split(\".\")[0],\n            createdAt: new Date().toISOString()\n        }\n    };\n\n    fs.writeFileSync(\n        path.join(outDir, \"manifest.json\"),\n        `${JSON.stringify(manifest, null, 2)}\\n`,\n        \"utf8\"\n    );\n    // An empty package.json keeps the runtime's boot-time install a clean no-op.\n    fs.writeFileSync(\n        path.join(outDir, \"package.json\"),\n        `${JSON.stringify({ name: \"rebase-bundle\",\nprivate: true,\ntype: \"module\",\ndependencies: {} }, null, 2)}\\n`,\n        \"utf8\"\n    );\n\n    return { outDir,\nmanifest,\nfileCount };\n}\n\n/**\n * Which files in a collections directory are collections.\n *\n * Mirrors the runtime loader's rules exactly, and must keep mirroring them: the\n * set of files counted here decides the schema version, and the runtime decides\n * what it serves the same way. A divergence would show up as a client that is\n * permanently \"out of date\" against a server that agrees with it.\n *\n * (`._*` guards macOS AppleDouble files, which look like sources and are not.)\n */\nfunction isCollectionSourceFile(name: string): boolean {\n    if (name.startsWith(\".\")) return false;\n    if (name.includes(\".test.\") || name.includes(\".spec.\")) return false;\n    if (name.endsWith(\".d.ts\")) return false;\n    if (name === \"index.ts\" || name === \"index.js\") return false;\n    return name.endsWith(\".ts\") || name.endsWith(\".js\");\n}\n\n/**\n * Load collections from **source**, for hashing and for the manifest's slug list.\n *\n * Deliberately not the compiled output. A compiled bundle imports its\n * dependencies from beside itself — that is the whole point of shipping a\n * `package.json` with it — but at build time nothing has been installed there\n * yet, and under pnpm the project's own `node_modules` lives one directory per\n * package, so the emitted files genuinely cannot resolve their imports until\n * they are deployed.\n *\n * Reading source costs nothing in fidelity: compilation erases types, it does\n * not change the values a collection module exports, so the hash is the same\n * either way.\n */\nasync function loadSourceCollections(collectionsDir: string): Promise<CollectionConfig[]> {\n    if (!fs.existsSync(collectionsDir)) return [];\n\n    const { createJiti } = await import(\"jiti\") as {\n        createJiti: (filename: string, options?: Record<string, unknown>) => {\n            import: (id: string) => Promise<unknown>;\n        };\n    };\n    const jiti = createJiti(path.join(collectionsDir, \"index.ts\"), {\n        interopDefault: true,\n        esmResolve: true\n    });\n\n    const files = fs.readdirSync(collectionsDir)\n        .filter(isCollectionSourceFile)\n        .sort();\n\n    const collections: CollectionConfig[] = [];\n    const failures: string[] = [];\n\n    for (const file of files) {\n        try {\n            const mod = await jiti.import(path.join(collectionsDir, file)) as\n                { default?: CollectionConfig } | CollectionConfig;\n            const collection = (mod as { default?: CollectionConfig }).default\n                ?? (mod as CollectionConfig);\n            if (collection && typeof collection === \"object\" && \"slug\" in collection) {\n                collections.push(collection);\n            } else {\n                failures.push(`${file}: no default-exported collection`);\n            }\n        } catch (err) {\n            failures.push(`${file}: ${err instanceof Error ? err.message : String(err)}`);\n        }\n    }\n\n    if (failures.length > 0) {\n        throw new Error(\n            `Could not read ${failures.length} collection file(s):\\n` +\n            failures.map(f => `  • ${f}`).join(\"\\n\")\n        );\n    }\n\n    return collections;\n}\n\n/** The `@rebasepro/server` version the project resolves — what it was built against. */\nfunction resolveServerVersion(projectRoot: string): string {\n    const candidates = [\n        path.join(projectRoot, \"node_modules\", \"@rebasepro\", \"server\", \"package.json\"),\n        path.join(projectRoot, \"backend\", \"node_modules\", \"@rebasepro\", \"server\", \"package.json\")\n    ];\n    for (const candidate of candidates) {\n        if (!fs.existsSync(candidate)) continue;\n        try {\n            return (JSON.parse(fs.readFileSync(candidate, \"utf8\")) as { version: string }).version;\n        } catch {\n            // fall through\n        }\n    }\n    return \"unknown\";\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAUA,SAAgB,UAAU,aAAwE;CAC9F,OAAO,cAAc;EAAC;EAAU;EAAG;CAAS,IAAI;AACpD;;;;;;;;;;;;;;;;;;;;;;;;;;;ACiBA,IAAM,YAAY;;;;;;;AAQlB,IAAM,+BAAe,IAAI,IAAI;CACzB;CAAM;CAAO;CAAO;CAAO;CAAQ;CAAO;CAAO;CAAO;CAAM;CAAO;CAAQ;CAC7E;CAAO;CAAQ;CAAO;CAAO;CAAO;CAAO;AAC/C,CAAC;;AAYD,SAAgB,wBAAwB,KAAiC;CACrE,MAAM,UAA8B;EAAE,OAAO;EAAG,OAAO;EAAG,aAAa;EAAG,WAAW;CAAE;CACvF,MAAM,UAAU,CAAC,GAAG;CACpB,OAAO,QAAQ,SAAS,GAAG;EACvB,MAAM,UAAU,QAAQ,IAAI;EAC5B,KAAK,MAAM,SAAS,GAAG,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;GAElE,IAAI,MAAM,KAAK,WAAW,GAAG,KAAK,MAAM,SAAS,gBAAgB;GACjE,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,IAAI;GAC1C,IAAI,MAAM,YAAY,GAAG;IACrB,QAAQ,KAAK,IAAI;IACjB;GACJ;GACA,IAAI,CAAC,MAAM,OAAO,KAAK,CAAC,iBAAiB,MAAM,IAAI,GAAG;GACtD,MAAM,SAAS,GAAG,aAAa,IAAI;GACnC,IAAI,OAAO,aAAa,WAAW;GAEnC,MAAM,SAAS,aAAa,GAAG,KAAK,MAAM,cAAc,KAAK,mBAAmB,QAAQ,EACpF,QAAQ;KACH,KAAK,UAAU,uBAAuB;KACtC,KAAK,UAAU,oBAAoB,KAAK,UAAU;KAClD,KAAK,UAAU,yBAAyB,OAAO;GACpD,EACJ,CAAC,CAAC;GACF,MAAM,OAAO,aAAa,GAAG,KAAK,MAAM,cAAc,KAAK,SAAS,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;GACzF,IAAI,WAAW,KAAK,SAAS,GAAG;GAChC,QAAQ;GACR,QAAQ,SAAS,OAAO;GACxB,QAAQ,eAAe;GACvB,QAAQ,aAAa;EACzB;CACJ;CACA,OAAO;AACX;AAEA,SAAS,iBAAiB,UAA2B;CACjD,MAAM,YAAY,SAAS,MAAM,SAAS,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,YAAY;CAC5E,OAAO,aAAa,IAAI,SAAS,KAAK,wBAAwB,QAAQ;AAC1E;;AAGA,SAAS,aAAa,QAAgB,QAAgB,UAAgC;CAClF,IAAI,GAAG,WAAW,MAAM,GAAG,OAAO;CAClC,MAAM,aAAa,SAAS;CAC5B,IAAI,WAAW,cAAc,OAAO,YAAY,OAAO;CACvD,GAAG,cAAc,QAAQ,UAAU;CACnC,OAAO,WAAW;AACtB;;;;;;;;;;;;;;;;;;ACtDA,IAAa,qBAAqB;;AA4DlC,IAAM,wCAAwB,IAAI,IAAI;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ,CAAC;;AAGD,IAAM,mCAAmB,IAAI,IAAI;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CAIA;AACJ,CAAC;AAED,SAAS,IAAI,SAA6B,SAAuB;CAC7D,CAAC,QAAQ,SAAS,MAAc,QAAQ,IAAI,CAAC,GAAA,CAAI,OAAO;AAC5D;;;;;;AAOA,SAAS,IAAI,SAA6B,MAAoB;CAC1D,IAAI,QAAQ,aAAa,QAAQ,MAAM,IAAI;MACtC,QAAQ,IAAI,IAAI;AACzB;;;;;;;;;;AAWA,SAAS,kBAAkB,aAA+B;CACtD,MAAM,aAAuB,CAAC;CAE9B,KAAK,MAAM,YAAY;EAAC;EAAK;EAAU;EAAW;CAAU,GACxD,WAAW,KAAK,KAAK,KAAK,aAAa,UAAU,gBAAgB,QAAQ,CAAC;CAI9E,IAAI,MAAM;CACV,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EACxB,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK;EACpB,WAAW,KAAK,KAAK,KAAK,QAAQ,gBAAgB,QAAQ,CAAC;EAC3D,MAAM;CACV;CAEA,OAAO,WAAW,QAAO,cAAa,GAAG,WAAW,SAAS,CAAC;AAClE;;;;;;;;;;;;;AAcA,eAAe,oBACX,aACA,MAC4C;CAC5C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,OAAO,KAAA;CAEjC,MAAM,OAAO,GAAG,aAAa,MAAM,MAAM;CAEzC,IAAI;EAQA,MAAM,EAAE,WAPQ,cAAc,KAAK,KAAK,aAAa,cAAc,CACxD,CAAA,CAAQ,YAMA,CAAA,CAAG,0BAA0B,MAAM,IAAI;EAC1D,OAAO,QAAQ;CACnB,QAAQ;EAIJ,IAAI;GAIA,OAHe,KAAK,MAAM,KAAK,QAAQ,iBAAiB,EAAE,CAGnD,CAAA,CAAO;EAClB,QAAQ;GACJ;EACJ;CACJ;AACJ;;;;;;;;;;;;;;AAeA,SAAS,mBACL,SACA,aACA,OACA,SACqD;CACrD,MAAM,OAAiC,CAAC;CACxC,MAAM,UAAoB,CAAC;CAE3B,KAAK,MAAM,CAAC,OAAO,YAAY,OAAO,QAAQ,KAAK,GAAG;EAClD,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG;EAC7B,MAAM,WAAW,QAAQ,KAAI,WAAU,KAAK,QAAQ,SAAS,MAAM,CAAC;EAKpE,IAJkB,SAAS,OAAM,WAAU;GACvC,MAAM,WAAW,KAAK,SAAS,aAAa,MAAM;GAClD,OAAO,aAAa,MAAO,CAAC,SAAS,WAAW,IAAI,KAAK,CAAC,KAAK,WAAW,QAAQ;EACtF,CACI,GACA,KAAK,SAAS,SAAS,KAAI,WAAU;GAEjC,OADiB,KAAK,SAAS,SAAS,MACjC,CAAA,CAAS,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;EAC5C,CAAC;OAED,QAAQ,KAAK,KAAK;CAE1B;CAEA,OAAO;EAAE;EACb;CAAQ;AACR;;;;;;;;;;;AAYA,eAAe,oBACX,aACA,QACA,UACA,SACe;CACf,MAAM,gBAAgB,QAAQ,kBAAkB;CAGhD,MAAM,cAAc,KAAK,KAAK,aAAa,SAAS;CACpD,MAAM,gBAAgB,WAA2B;EAE7C,OADiB,KAAK,SAAS,aAAa,KAAK,QAAQ,aAAa,MAAM,CACrE,CAAA,CAAS,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG;CAC5C;CAEA,MAAM,qBAAqB,KAAK,KAAK,aAAa,UAAU,eAAe;CAC3E,MAAM,cAAc,GAAG,WAAW,kBAAkB,IAC9C,aAAa,KAAK,KAAK,UAAU,eAAe,CAAC,IACjD,KAAA;CAGN,IAAI,gBAAyC,CAAC;CAC9C,MAAM,cAAc,MAAM,oBAAoB,aAAa,kBAAkB;CAC7E,IAAI,aAAa,SAAS,OAAO,YAAY,UAAU,UAAU;EAC7D,MAAM,UAAU,KAAK,QAAQ,kBAAkB;EAC/C,MAAM,UAAU,KAAK,QACjB,SACA,OAAO,YAAY,YAAY,WAAW,YAAY,UAAU,GACpE;EACA,MAAM,EAAE,MAAM,YAAY,mBACtB,aACA,aACA,YAAY,OACZ,OACJ;EACA,gBAAgB;GAAE,SAAS,aAAa,GAAG;GACnD,OAAO;EAAK;EACJ,IAAI,QAAQ,SAAS,GACjB,IAAI,SAAS,MAAM,IACf,gBAAgB,QAAQ,OAAO,gDAC3B,QAAQ,KAAK,IAAI,EAAE,8CAC3B,CAAC;CAET;CAEA,MAAM,kBAA2C;EAI7C,QAAQ;EACR,QAAQ;EACR,kBAAkB;EAClB,KAAK,CAAC,QAAQ;EACd,KAAK;EACL,8BAA8B;EAC9B,iBAAiB;EACjB,mBAAmB;EACnB,kCAAkC;EAGlC,SAAS,aAAa,GAAG;EACzB,QAAQ,aAAa,KAAK,SAAS,aAAa,MAAM,KAAK,GAAG;EAC9D,WAAW,kBAAkB,WAAW;EACxC,GAAG;EACH,aAAa;EACb,gBAAgB;EAChB,WAAW;EACX,QAAQ;EACR,cAAc;EAId,SAAS;EACT,GAAI,gBAAgB,EAAE,SAAS,KAAK,IAAI,CAAC;CAC7C;CAEA,MAAM,WAAW;EACb,GAAI,cAAc,EAAE,SAAS,YAAY,IAAI,CAAC;EAC9C;EACA,SAAS,SAAS,IAAI,YAAY;EAClC,SAAS;GACL;GACA;GACA;GACA;GACA;EACJ,CAAC,CAAC,KAAI,YAAY,QAAQ,WAAW,IAAI,IAAI,UAAU,aAAa,OAAO,CAAE;CACjF;CAEA,GAAG,UAAU,aAAa,EAAE,WAAW,KAAK,CAAC;CAC7C,MAAM,eAAe,KAAK,KAAK,aAAa,sBAAsB;CAClE,GAAG,cAAc,cAAc,KAAK,UAAU,UAAU,MAAM,CAAC,GAAG,MAAM;CACxE,OAAO;AACX;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,uBAAuB,mBAA2B,QAAQ,GAAY;CAClF,MAAM,YAAY;EAAC;EAAO;EAAQ;CAAK,CAAC,CACnC,KAAI,QAAO,KAAK,KAAK,mBAAmB,QAAQ,KAAK,CAAC,CAAC,CACvD,MAAK,cAAa,GAAG,WAAW,SAAS,CAAC;CAC/C,IAAI,CAAC,WAAW,OAAO;CACvB,OAAO,8BAA8B,WAAW,KAAK;AACzD;;;;;;;;;AAUA,SAAS,8BAA8B,YAAoB,OAAwB;CAC/E,IAAI;CACJ,IAAI;EACA,SAAS,GAAG,aAAa,YAAY,MAAM;CAC/C,QAAQ;EACJ,OAAO;CACX;CAGA,IAAI,0EAA0E,KAAK,MAAM,GACrF,OAAO;CAIX,KAAK,MAAM,UAAU,OAAO,SAAS,yBAAyB,GAK1D,IAJc,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,UAAS;EAC5C,MAAM,QAAQ,MAAM,MAAM,QAAQ;EAClC,OAAO,MAAM,MAAM,SAAS,EAAE,CAAC,KAAK;CACxC,CACI,CAAA,CAAM,SAAS,kBAAkB,GAAG,OAAO;CAMnD,IAAI,QAAQ,GACR,KAAK,MAAM,UAAU,OAAO,SAAS,0CAA0C,GAAG;EAC9E,MAAM,YAAY,OAAO;EACzB,IAAI,CAAC,UAAU,WAAW,GAAG,GAAG;EAChC,MAAM,WAAW,sBAAsB,KAAK,QAAQ,UAAU,GAAG,SAAS;EAC1E,IAAI,YAAY,8BAA8B,UAAU,QAAQ,CAAC,GAAG,OAAO;CAC/E;CAEJ,OAAO;AACX;;;;;;;;AASA,SAAS,sBAAsB,SAAiB,WAAkC;CAC9E,MAAM,OAAO,KAAK,QAAQ,SAAS,SAAS;CAC5C,MAAM,aAAa;EACf;EACA,GAAG,KAAK;EACR,GAAG,KAAK;EACR,GAAG,KAAK;EACR,KAAK,KAAK,MAAM,UAAU;EAC1B,KAAK,KAAK,MAAM,WAAW;EAC3B,KAAK,KAAK,MAAM,UAAU;CAC9B;CACA,KAAK,MAAM,aAAa,YACpB,IAAI;EACA,IAAI,GAAG,WAAW,SAAS,KAAK,GAAG,SAAS,SAAS,CAAC,CAAC,OAAO,GAAG,OAAO;CAC5E,QAAQ;EACJ;CACJ;CAIJ,IAAI,QAAQ,KAAK,IAAI,GAAG;EACpB,MAAM,OAAO,KAAK,QAAQ,SAAS,KAAK;EACxC,IAAI;GACA,IAAI,GAAG,WAAW,IAAI,KAAK,GAAG,SAAS,IAAI,CAAC,CAAC,OAAO,GAAG,OAAO;EAClE,QAAQ;GACJ,OAAO;EACX;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;;AAcA,SAAgB,yBACZ,aACA,UACA,QAAQ,KACU;CAClB,MAAM,QAA4B,CAAC;CACnC,MAAM,uBAAO,IAAI,IAAY;CAC7B,MAAM,QAAQ,OAAO,KAAK,QAAQ;CAClC,IAAI,UAAU;CAEd,MAAM,cAAc;EAChB,KAAK,KAAK,aAAa,cAAc;EACrC,KAAK,KAAK,aAAa,WAAW,cAAc;EAChD,KAAK,KAAK,aAAa,UAAU,cAAc;CACnD,CAAC,CAAC,QAAO,QAAO,GAAG,WAAW,GAAG,CAAC;CAElC,OAAO,MAAM,SAAS,KAAK,UAAU,OAAO;EACxC,MAAM,OAAO,MAAM,MAAM;EACzB,IAAI,KAAK,IAAI,IAAI,GAAG;EACpB,KAAK,IAAI,IAAI;EACb;EAEA,IAAI,sBAAsB,IAAI,IAAI,GAAG;GACjC,MAAM,KAAK;IAAE;IACzB,QAAQ;GAAsB,CAAC;GACnB;EACJ;EAEA,MAAM,aAAa,YACd,KAAI,SAAQ,KAAK,KAAK,MAAM,GAAG,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,CAChD,MAAK,QAAO,GAAG,WAAW,KAAK,KAAK,KAAK,cAAc,CAAC,CAAC;EAE9D,IAAI,CAAC,YAAY;EAEjB,IAAI;EAKJ,IAAI;GACA,MAAM,KAAK,MAAM,GAAG,aAAa,KAAK,KAAK,YAAY,cAAc,GAAG,MAAM,CAAC;EACnF,QAAQ;GACJ;EACJ;EAEA,IAAI,IAAI,WAAW,GAAG,WAAW,KAAK,KAAK,YAAY,aAAa,CAAC,GAAG;GACpE,MAAM,KAAK;IAAE;IACzB,QAAQ;GAAsC,CAAC;GACnC;EACJ;EAEA,MAAM,UAAU,GAAG,IAAI,SAAS,WAAW,GAAG,GAAG,IAAI,SAAS,cAAc,GAAG,GAAG,IAAI,SAAS,eAAe;EAC9G,IAAI,0CAA0C,KAAK,OAAO,GAAG;GACzD,MAAM,KAAK;IAAE;IACzB,QAAQ;GAAsC,CAAC;GACnC;EACJ;EAEA,IAAI,cAAc,UAAU,GAAG;GAC3B,MAAM,KAAK;IAAE;IACzB,QAAQ;GAAgC,CAAC;GAC7B;EACJ;EAEA,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,gBAAgB,CAAC,CAAC,GAChD,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,MAAM,KAAK,GAAG;CAE1C;CAEA,OAAO;AACX;;AAGA,SAAS,cAAc,KAAa,QAAQ,GAAY;CACpD,IAAI,QAAQ,GAAG,OAAO;CACtB,IAAI;CACJ,IAAI;EACA,UAAU,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;CACzD,QAAQ;EACJ,OAAO;CACX;CACA,KAAK,MAAM,SAAS,SAAS;EACzB,IAAI,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,OAAO,GAAG,OAAO;EAC3D,IAAI,MAAM,YAAY,KAAK,MAAM,SAAS,kBAAkB,MAAM,SAAS;OACnE,cAAc,KAAK,KAAK,KAAK,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,OAAO;EAAA;CAEzE;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;AAmBA,SAAS,2BAA2B,aAAqB,MAAuB;CAI5E,IAAI;CACJ,IAAI;EACA,WAAW,GAAG,aAAa,WAAW;CAC1C,QAAQ;EACJ,WAAW;CACf;CAEA,KAAK,MAAM,QAAQ;EAAC;EAAa,KAAK,KAAK,aAAa,SAAS;EAAG,KAAK,KAAK,aAAa,QAAQ;CAAC,GAAG;EACnG,MAAM,OAAO,KAAK,KAAK,MAAM,gBAAgB,IAAI;EACjD,IAAI;GAIA,IAAI,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC,eAAe,GAAG;GAC1C,MAAM,OAAO,GAAG,aAAa,IAAI;GACjC,MAAM,aAAa,KAAK,WAAW,WAAW,KAAK,GAAG;GAGtD,MAAM,UAAU,KAAK,SAAS,GAAG,KAAK,IAAI,OAAO,KAAK,KAAK,KACpD,KAAK,SAAS,GAAG,KAAK,IAAI,cAAc,KAAK,KAAK;GACzD,IAAI,cAAc,CAAC,SAAS,OAAO;EACvC,QAAQ,CAER;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;AAaA,IAAM,uBAAuB;CAAC;CAAgB;CAAuB;AAAsB;;;;;AAM3F,IAAM,qBAAqB,CAAC,UAAU,gBAAgB;;AAGtD,IAAM,uBAAuB;;AAG7B,IAAM,sBAAsB;;;;;;;;;;;;;;AAe5B,SAAgB,aAAa,aAAoC;CAC7D,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,YAAY,oBAAoB;EACvC,MAAM,OAAO,KAAK,KAAK,aAAa,QAAQ;EAC5C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG;EAC1B,MAAM,OAAO,GAAG,aAAa,MAAM,MAAM;EACzC,KAAK,MAAM,OAAO,CAAC,CAAC,SAAS,MAAM,UAAU;GACzC,MAAM,UAAU,KAAK,KAAK;GAC1B,IAAI,YAAY,MAAM,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG,GAAG;GAC1E,MAAM,KAAK,QAAQ,QAAQ,GAAG;GAC9B,IAAI,OAAO,IAAI;GACf,MAAM,MAAM,QAAQ,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK;GACtC,MAAM,QAAQ,QAAQ,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;GACzC,IAAI,qBAAqB,KAAK,GAAG,KAAK,CAAC,oBAAoB,KAAK,KAAK,GACjE,MAAM,IAAI,MACN,GAAG,SAAS,GAAG,QAAQ,EAAE,QAAQ,IAAI,mHAEhC,IAAI,uFACb;EAER,CAAC;EACD,MAAM,KAAK,UAAU,SAAS,IAAI,KAAK,QAAQ,EAAE,GAAG;CACxD;CACA,OAAO,MAAM,SAAS,IAAI,MAAM,KAAK,IAAI,IAAI;AACjD;;;;;;;;;;AAWA,IAAM,yBAAyB;CAAC;CAAS;CAAS;CAAW;CAAQ;CAAQ;AAAS;;AAGtF,SAAS,qBAAqB,SAAgC;CAC1D,MAAM,UAAU,QAAQ,KAAK;CAC7B,KAAK,MAAM,YAAY,wBACnB,IAAI,QAAQ,WAAW,QAAQ,GAAG,OAAO;CAI7C,IAAI,aAAa,KAAK,OAAO,GAAG,OAAO;CACvC,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,SAAgB,4BAA4B,aAA6C;CACrF,MAAM,WAAmC,CAAC;CAE1C,MAAM,YAAY,2BAA2B,WAAW;CACxD,IAAI,UAAU,SAAS,GAAG;EACtB,MAAM,YAAY,UACb,KAAI,MAAK;GACN,MAAM,CAAC,GAAG,KAAK,EAAE;GACjB,OAAO,GAAG,EAAE,KAAK,IAAI,EAAE,MAAM,IAAI,EAAE,KAAK,OAAO,EAAE,MAAM,IAAI,EAAE,KAAK;EACtE,CAAC,CAAC,CACD,KAAK,IAAI;EACd,MAAM,IAAI,MACN,mEAAmE,UAAU,uIAGjF;CACJ;CAEA,KAAK,MAAM,YAAY,sBAAsB;EACzC,MAAM,OAAO,KAAK,KAAK,aAAa,QAAQ;EAC5C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG;EAC1B,IAAI;EACJ,IAAI;GACA,MAAM,KAAK,MAAM,GAAG,aAAa,MAAM,MAAM,CAAC;EAClD,QAAQ;GAEJ;EACJ;EACA,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,IAAI,gBAAgB,CAAC,CAAC,GAAG;GAClE,IAAI,iBAAiB,IAAI,IAAI,GAAG;GAEhC,IAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,YAAY,GAAG;GAIrE,IAAI,2BAA2B,aAAa,IAAI,GAAG;GACnD,MAAM,WAAW,OAAO,YAAY,WAAW,qBAAqB,OAAO,IAAI;GAM/E,IAAI,YAAY,gBAAgB,QAAQ,IAAI,UAAU,MAAM,QAAQ,aAAa,SAAS;IACtF,SAAS,QAAQ;IACjB;GACJ;GACA,IAAI,UACA,MAAM,IAAI,MACN,GAAG,SAAS,aAAa,KAAK,MAAM,QAAQ,gDACtB,SAAS,sIAGnC;GAEJ,SAAS,QAAQ;EACrB;CACJ;CAEA,OAAO;AACX;;;;;;;;AAyCA,SAAS,aAAa,OAAgD;CAClE,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,QAAQ,MAAM,EAAE;CACrF,IAAI,CAAC,oBAAoB,KAAK,GAAG,GAAG,OAAO;CAC3C,MAAM,CAAC,OAAO,QAAQ,GAAG,QAAQ,KAAK,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,MAAM;CAC/D,OAAO;EAAC;EAAO;EAAO;CAAK;AAC/B;;AAGA,SAAS,aAAa,OAAgD;CAClE,MAAM,UAAU,MAAM,KAAK;CAC3B,MAAM,MAAM,aAAa,OAAO;CAChC,IAAI,CAAC,KAAK,OAAO;CACjB,IAAI,QAAQ,WAAW,IAAI,GAAG,OAAO;CACrC,MAAM,CAAC,OAAO,OAAO,SAAS;CAC9B,IAAI,QAAQ,WAAW,GAAG,GAAG;EACzB,IAAI,QAAQ,GAAG,OAAO;GAAC,QAAQ;GAAG;GAAG;EAAC;EACtC,IAAI,QAAQ,GAAG,OAAO;GAAC;GAAG,QAAQ;GAAG;EAAC;EACtC,OAAO;GAAC;GAAG;GAAG,QAAQ;EAAC;CAC3B;CACA,IAAI,QAAQ,WAAW,GAAG,GACtB,OAAO,QAAQ,QAAQ,QAAQ,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,IAClD;EAAC;EAAO,QAAQ;EAAG;CAAC,IACpB;EAAC,QAAQ;EAAG;EAAG;CAAC;CAE1B,MAAM,QAAQ,QAAQ,QAAQ,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;CACnD,IAAI,UAAU,GAAG,OAAO;EAAC,QAAQ;EAAG;EAAG;CAAC;CACxC,IAAI,UAAU,GAAG,OAAO;EAAC;EAAO,QAAQ;EAAG;CAAC;CAC5C,OAAO;EAAC;EAAO;EAAO,QAAQ;CAAC;AACnC;AAEA,SAAS,eAAe,GAA6B,GAAqC;CACtF,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,KAAK,EAAE,KAAK,KAAK;CACzE,OAAO;AACX;;;;;;;;;AAUA,SAAS,SAAS,OAAe,QAAgC;CAC7D,MAAM,UAAU,aAAa,KAAK;CAClC,MAAM,QAAQ,aAAa,MAAM;CACjC,IAAI,CAAC,SAAS,CAAC,aAAa,KAAK,GAAG,OAAO;CAC3C,IAAI,CAAC,SAAS,OAAO;CACrB,OAAO,eAAe,SAAS,KAAK,IAAI;AAC5C;;;;;;;;AASA,SAAS,eAAe,GAAW,GAAoB;CACnD,MAAM,MAAM,aAAa,CAAC;CAC1B,MAAM,MAAM,aAAa,CAAC;CAC1B,IAAI,CAAC,OAAO,CAAC,KAAK,OAAO;CACzB,MAAM,MAAM,aAAa,CAAC;CAC1B,MAAM,MAAM,aAAa,CAAC;CAC1B,IAAI,OAAO,eAAe,KAAK,GAAG,KAAK,GAAG,OAAO;CACjD,IAAI,OAAO,eAAe,KAAK,GAAG,KAAK,GAAG,OAAO;CACjD,OAAO;AACX;;;;;;;;;;;;;;AAeA,SAAgB,2BAA2B,aAA4C;CACnF,MAAM,uBAAO,IAAI,IAAkC;CACnD,MAAM,YAAmC,CAAC;CAE1C,KAAK,MAAM,YAAY,sBAAsB;EACzC,MAAM,OAAO,KAAK,KAAK,aAAa,QAAQ;EAC5C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG;EAC1B,IAAI;EACJ,IAAI;GACA,MAAM,KAAK,MAAM,GAAG,aAAa,MAAM,MAAM,CAAC;EAClD,QAAQ;GACJ;EACJ;EACA,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,IAAI,gBAAgB,CAAC,CAAC,GAAG;GAChE,IAAI,OAAO,UAAU,UAAU;GAG/B,IAAI,iBAAiB,IAAI,IAAI,GAAG;GAChC,IAAI,MAAM,WAAW,YAAY,GAAG;GACpC,MAAM,QAAQ,KAAK,IAAI,IAAI;GAC3B,IAAI,CAAC,OAAO;IACR,KAAK,IAAI,MAAM;KAAE;KACjC;KACA,MAAM;IAAS,CAAC;IACA;GACJ;GACA,IAAI,MAAM,UAAU,OAAO;GAC3B,IAAI,CAAC,eAAe,MAAM,OAAO,KAAK,GAAG;GACzC,UAAU,KAAK;IAAE;IAC7B,cAAc,CAAC,OAAO;KAAE;KACxB;KACA,MAAM;IAAS,CAAC;GAAE,CAAC;EACX;CACJ;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,wBAAwB,aAAqB,YAAuC;CAChG,MAAM,QAAgC,CAAC;CAEvC,KAAK,MAAM,YAAY;EACnB;EACA;EACA;EACA;CACJ,GAAG;EACC,MAAM,OAAO,KAAK,KAAK,aAAa,QAAQ;EAC5C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG;EAC1B,IAAI;GACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,MAAM,MAAM,CAAC;GAIpD,KAAK,MAAM,SAAS,CAAC,IAAI,cAAc,IAAI,eAAe,GACtD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,SAAS,CAAC,CAAC,GAAG;IACrD,IAAI,CAAC,KAAK,WAAW,aAAa,GAAG;IACrC,IAAI,OAAO,UAAU,UAAU;IAC/B,MAAM,KAAK;KAAE;KACjC;KACA,MAAM;IAAS,CAAC;GACA;EAER,QAAQ,CAER;CACJ;CAEA,MAAM,SAAS,MAAM,QAAO,MAAK,SAAS,EAAE,OAAO,UAAU,MAAM,KAAK;CAIxE,MAAM,SAAS,IAAI,IACf,MACK,KAAI,MAAK,aAAa,EAAE,KAAK,CAAC,CAAC,CAC/B,QAAQ,MAAqC,KAAK,IAAI,CAAC,CACvD,KAAI,MAAK,EAAE,KAAK,GAAG,CAAC,CAC7B;CAEA,OAAO;EAAE;EACb,aAAa,OAAO,OAAO,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,KAAK,IAAI,CAAC;EACrD,aAAa,2BAA2B,WAAW;CAAE;AACrD;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,aAAa,QAAyC;CAClE,MAAM,QAAiC,CAAC;CACxC,IAAI,QAAuB;CAC3B,IAAI,IAAI;CAER,OAAO,IAAI,OAAO,QAAQ;EACtB,MAAM,IAAI,OAAO;EAEjB,IAAI,OAAO;GACP,IAAI,MAAM,MAAM;IAAE,KAAK;IAAG;GAAU;GACpC,IAAI,MAAM,SAAU,MAAM,QAAQ,UAAU,KAAM,QAAQ;GAC1D;GACA;EACJ;EACA,IAAI,MAAM,QAAQ,MAAM,OAAO,MAAM,KAAK;GAAE,QAAQ;GAAG;GAAK;EAAU;EAEtE,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,KAAK;GACpC,MAAM,UAAU,OAAO,QAAQ,MAAM,CAAC;GACtC,MAAM,MAAM,YAAY,KAAK,OAAO,SAAS;GAC7C,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC;GACnB,IAAI;GACJ;EACJ;EACA,IAAI,MAAM,OAAO,OAAO,IAAI,OAAO,KAAK;GACpC,MAAM,QAAQ,OAAO,QAAQ,MAAM,IAAI,CAAC;GACxC,MAAM,MAAM,UAAU,KAAK,OAAO,SAAS,QAAQ;GACnD,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC;GACnB,IAAI;GACJ;EACJ;EACA;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBACZ,QACA,UAA+B,CAAC,GACW;CAC3C,MAAM,QAAQ,QAAQ,UAAU;CAChC,MAAM,aAAuB,CAAC;CAC9B,IAAI,YAAY;CAIhB,MAAM,YAAY;CAElB,MAAM,QAAQ,QAAsB;EAChC,KAAK,MAAM,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAAG;GAC9D,MAAM,OAAO,KAAK,KAAK,KAAK,MAAM,IAAI;GACtC,IAAI,MAAM,YAAY,GAAG;IACrB,IAAI,MAAM,SAAS,gBAAgB;IACnC,KAAK,IAAI;GACb,OAAO,IAAI,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,KAAK,GAClD,YAAY,IAAI;EAExB;CACJ;CAEA,MAAM,eAAe,SAAuB;EACxC,MAAM,WAAW,GAAG,aAAa,MAAM,MAAM;EAC7C,MAAM,MAAM,KAAK,QAAQ,IAAI;EAC7B,MAAM,WAAW,aAAa,QAAQ;EACtC,MAAM,aAAa,OAAe,SAAS,MAAM,CAAC,OAAO,SAAS,MAAM,SAAS,KAAK,GAAG;EAEzF,MAAM,UAAU,SAAS,QAAQ,YAAY,OAAO,QAAQ,OAAO,WAAW,WAAmB;GAE7F,IAAI,UAAU,MAAM,GAAG,OAAO;GAG9B,IAAI,4BAA4B,KAAK,SAAS,GAAG,OAAO;GAExD,MAAM,SAAS,KAAK,QAAQ,KAAK,SAAS;GAE1C,IAAI,GAAG,WAAW,GAAG,OAAO,IAAI,GAAG;IAC/B;IACA,OAAO,GAAG,SAAS,QAAQ,UAAU,KAAK;GAC9C;GACA,IAAI,GAAG,WAAW,KAAK,KAAK,QAAQ,UAAU,CAAC,GAAG;IAC9C;IAEA,OAAO,GAAG,SAAS,QAAQ,YADZ,UAAU,SAAS,GAAG,IAAI,aAAa,cACN;GACpD;GAGA,IAAI,UAAU,SAAS,KAAK,KAAK,GAAG,WAAW,GAAG,OAAO,MAAM,GAAG,EAAE,EAAE,IAAI,GAAG;IACzE;IACA,OAAO,GAAG,SAAS,QAAQ,UAAU,MAAM,GAAG,EAAE,EAAE,KAAK;GAC3D;GAEA,WAAW,KAAK,GAAG,KAAK,SAAS,IAAI,EAAE,KAAK,WAAW;GACvD,OAAO;EACX,CAAC;EAED,IAAI,SAAS,YAAY,UACrB,GAAG,cAAc,MAAM,SAAS,MAAM;CAE9C;CAEA,IAAI,GAAG,WAAW,MAAM,GAAG,KAAK,MAAM;CACtC,OAAO;EAAE;EACb;CAAW;AACX;;;;;;;;;AAUA,SAAS,YAAY,aAAqB,QAAsB;CAC5D,MAAM,WAAW,KAAK,SAAS,aAAa,MAAM;CAClD,IAAI,aAAa,MAAM,SAAS,WAAW,IAAI,KAAK,KAAK,WAAW,QAAQ,GACxE,MAAM,IAAI,MACN,2BAA2B,OAAO,oDACtC;CAGJ,IAAI,GAAG,WAAW,MAAM,GACpB,GAAG,OAAO,QAAQ;EAAE,WAAW;EACvC,OAAO;CAAK,CAAC;CAET,GAAG,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;AAC5C;;;;;;;;;;AAWA,eAAe,iBACX,aACA,WACA,SACa;CACb,MAAM,aAAa,KAAK,KAAK,aAAa,SAAS;CACnD,IAAI,CAAC,GAAG,WAAW,UAAU,GAAG;CAEhC,MAAM,SAAS,uBAAuB,UAAU;CAChD,MAAM,SAAS,SAAS,uBAAuB,YAAY,MAAM,IAAI;CACrE,IAAI,CAAC,QAAQ;EACT,IAAI,SAAS,MAAM,IAAI,2DAA2D,CAAC;EACnF;CACJ;CAEA,MAAM,SAAS,OAAO,SAAS,KAAK,IAAI,WAAW,WAAW,IAAI;CAClE,IAAI,CAAC,QAAQ;EACT,IAAI,SAAS,MAAM,IAAI,oDAAoD,CAAC;EAC5E;CACJ;CAEA,MAAM,kBAAkB,KAAK,KAAK,MAAM,WAAW,aAAa;CAGhE,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,IAAI;EACA,MAAM,MACF,QACA;GAAC;GAAQ;GAAU;GAAY;GAAiB;EAAe,GAC/D;GAAE,KAAK;GACnB,OAAO;EAAO,CACN;EACA,IAAI,SAAS,MAAM,IAAI,gDAAgD,CAAC;CAC5E,SAAS,KAAK;EAIV,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAC9D,MAAM,IAAI,MACN,6DAA6D,OAAO,wIAGxE;CACJ;AACJ;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,aAAqB,cAA0C;CAQjG,MAAM,QAAQ,CAJV,KAAK,KAAK,WAAW,OAAO,UAAU,GACtC,KAAK,KAAK,KAAK,QAAQ,YAAY,GAAG,OAAO,UAAU,CAG7C,CAAA,CAAW,MAAK,cAAa,GAAG,WAAW,KAAK,KAAK,aAAa,SAAS,CAAC,CAAC;CAC3F,OAAO,QAAQ,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,IAAI,KAAA;AACrD;;;;;;;;;;;;AAgCA,SAAgB,sBAAsB,OAAmD;CACrF,OAAO;EACH,cAAc;EACd,SAAS;GACL,OAAO,MAAM;GACb,cAAc,MAAM;GACpB,UAAU;EACd;EACA,eAAe,MAAM;EACrB,KAAK,MAAM;EACX,MAAM;EACN,OAAO,MAAM;EACb,aAAa,CAAC,GAAG,MAAM,eAAe,CAAC,CAAC,KAAK;EAC7C,GAAI,MAAM,UAAU,SAAS,IAAI,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACnE,OAAO;GACH,QAAQ,MAAM,cAAc,SAAS;GACrC,eAAe,MAAM,cAAc,SAAS,IAAI,MAAM,gBAAgB,KAAA;EAC1E;EACA,SAAS,EAIL,WAAW,MAAM,yBACrB;EACA,WAAW,MAAM;EACjB,MAAM,EAAE,UAAU,MAAM,aAAa;EACrC,OAAO,MAAM;CACjB;AACJ;;;;;AAMA,SAAgB,qBAAqB,WAA0C;CAC3E,MAAM,QAAQ,CAAC,GAAG,UAAU,OAAO,kDAAkD;CACrF,KAAK,MAAM,EAAE,MAAM,cAAc,CAAC,OAAO,aAAa,WAClD,MAAM,KAAK,OAAO,QAAQ,SAAS,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,SAAS,OAAO,MAAM,KAAK,OAAO,KAAK,EAAE;CAEhH,MAAM,KACF,+FACA,+CACJ;CACA,OAAO,MAAM,KAAK,IAAI;AAC1B;AAEA,eAAsB,YAAY,SAAyD;CACvF,MAAM,EAAE,aAAa,KAAK,YAAY;CAYtC,MAAM,YAAY,2BAA2B,WAAW;CACxD,IAAI,UAAU,SAAS,GAAG,MAAM,IAAI,MAAM,qBAAqB,SAAS,CAAC;CAEzE,MAAM,QAAQ,oBAAoB,KAAK,WAAW;CAClD,MAAM,SAAS,KAAK,QAAQ,aAAa,QAAQ,UAAA,aAA4B;CAE7E,MAAM,WAAqB,CAAC;CAC5B,MAAM,eAAe,UAAkB,YAA0B;EAC7D,IAAI,GAAG,WAAW,KAAK,KAAK,aAAa,QAAQ,CAAC,GAAG,SAAS,KAAK,OAAO;CAC9E;CAIA,IAAI,MAAM,WACN,YAAY,MAAM,QAAQ,GAAG,MAAM,OAAO,SAAS;CAEvD,YAAY,MAAM,WAAW,GAAG,MAAM,UAAU,SAAS;CACzD,YAAY,MAAM,OAAO,GAAG,MAAM,MAAM,SAAS;CACjD,IAAI,GAAG,WAAW,KAAK,KAAK,aAAa,MAAM,MAAM,CAAC,GAClD,SAAS,KAAK,MAAM,MAAM;CAG9B,IAAI,SAAS,WAAW,GACpB,MAAM,IAAI,MACN,6BAA6B,QAAQ,qCACjC,MAAM,OAAO,qBAAqB,MAAM,UAAU,GAC1D;CAQJ,IAAI,MAAM,kBAAkB,QAAQ,eAAe,MAC/C,MAAM,iBAAiB,aAAa,MAAM,QAAQ,OAAO;CAO7D,IAAI,MAAM,gBAAgB;EACtB,MAAM,EAAE,8BAA8B,MAAM,OAAO;EACnD,MAAM,aAAa,MAAM,0BACrB,KAAK,KAAK,aAAa,MAAM,QAAQ,aAAa,GAClD,IAAI,qBAAqB,IAC7B;EACA,IAAI,YACA,IAAI,SAAS,MAAM,IAAI,qDAAqD,KAAK,SAAS,aAAa,UAAU,EAAE,EAAE,CAAC;CAE9H;CAIA,MAAM,cAAc,sBAAsB,aAAa,MAAM,SAAS;CACtE,IAAI,aAAa;EACb,MAAM,QAAQ;GACV,GAAI,MAAM,iBAAiB,CAAC,GAAG,MAAM,OAAO,EAAE,IAAI,CAAC;GACnD,GAAG,MAAM,UAAU;GACnB;EACJ;EACA,MAAM,WAAW,GAAG,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,MAAM,MAAM,SAAS;EAC9E,IAAI,SAAS,MAAM,OAAO,OAAO,YAAY,kEAAkE,CAAC;EAChH,IAAI,SAAS,MAAM,IAAI,wDAAwD,SAAS,EAAE,CAAC;EAC3F,IAAI,SAAS,MAAM,IAAI,yEAAyE,MAAM,UAAU,GAAG,CAAC;EACpH,IAAI,SAAS,MAAM,IAAI,6EAA6E,CAAC;EACrG,IAAI,SAAS,MAAM,IAAI,wEAAwE,CAAC;EAChG,IAAI,SAAS,MAAM,IAAI,wBAAwB,CAAC;CACpD;CAEA,IAAI,SAAS,MAAM,IAAI,eAAe,SAAS,OAAO,qBAAqB,KAAK,SAAS,aAAa,MAAM,EAAE,EAAE,CAAC;CAEjH,YAAY,aAAa,MAAM;CAC/B,MAAM,eAAe,MAAM,oBAAoB,aAAa,QAAQ,UAAU,OAAO;CAErF,MAAM,MAAM,gBAAgB,aAAa,KAAK;CAC9C,IAAI,CAAC,KACD,MAAM,IAAI,MACN,wFACJ;CAGJ,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,IAAI;EACA,MAAM,MAAM,KAAK,CAAC,MAAM,YAAY,GAAG;GAAE,KAAK;GACtD,OAAO,UAAU,QAAQ,WAAW;EAAE,CAAC;CACnC,QAAQ;EACJ,MAAM,IAAI,MAAM,6DAA6D;CACjF;CAGA,MAAM,aAAa,uBAAuB,MAAM;CAChD,IAAI,WAAW,YAAY,GACvB,IAAI,SAAS,MAAM,IAAI,cAAc,WAAW,UAAU,iCAAiC,CAAC;CAEhG,IAAI,WAAW,WAAW,SAAS,GAAG;EAClC,IAAI,SAAS,MAAM,OACf,OAAO,WAAW,WAAW,OAAO,4CACxC,CAAC;EACD,KAAK,MAAM,QAAQ,WAAW,WAAW,MAAM,GAAG,CAAC,GAC/C,IAAI,SAAS,MAAM,IAAI,SAAS,MAAM,CAAC;EAE3C,IAAI,WAAW,WAAW,SAAS,GAC/B,IAAI,SAAS,MAAM,IAAI,eAAe,WAAW,WAAW,SAAS,EAAE,MAAM,CAAC;CAEtF;CAGA,MAAM,oBAAoB,KAAK,KAAK,QAAQ,MAAM,MAAM;CACxD,MAAM,yBAAyB,KAAK,KAAK,mBAAmB,aAAa;CAEzE,IAAI,cAAkC,CAAC;CACvC,IAAI,MAAM,gBAAgB;EACtB,cAAc,MAAM,sBAAsB,KAAK,KAAK,aAAa,MAAM,QAAQ,aAAa,CAAC;EAC7F,IAAI,YAAY,WAAW,GACvB,MAAM,IAAI,MACN,gCACG,KAAK,KAAK,MAAM,QAAQ,aAAa,EAAE,2IAG9C;EAEJ,IAAI,CAAC,GAAG,WAAW,sBAAsB,GACrC,MAAM,IAAI,MACN,oDACG,KAAK,SAAS,aAAa,sBAAsB,EAAE,EAC1D;CAER;CAEA,MAAM,WAAW,4BAA4B,WAAW;CACxD,MAAM,gBAAgB,yBAAyB,aAAa,QAAQ;CACpE,MAAM,2BAA2B,uBAAuB,KAAK,KAAK,QAAQ,MAAM,MAAM,CAAC;CAKvF,MAAM,gBAA+B,QAAQ,aAAa;EAAE,SAAS;EAAG,WAAW,CAAC;CAAE;CAStF,MAAM,YAAY,2BARK,cAAc,UAChC,QAAO,MAAK,EAAE,SAAS,QAAQ,CAAC,CAChC,KAAI,OAAM;EACP,KAAK,EAAE;EACP,QAAQ,EAAE;EACV,WAAW,EAAE;EACb,GAAI,EAAE,UAAU,KAAA,IAAY,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;CACtD,EACyC,CAAA,CAAe,KAAI,MAAK,EAAE,GAAG,CAAC;CAC3E,IAAI,WACA,MAAM,IAAI,MACN,YAAY,UAAU,EAAE,SAAS,UAAU,EAAE,iDAClC,UAAU,UAAU,SAAS,sEAE5C;CAGJ,MAAM,YAAY,MAAM,OAAO,QAAQ,SAAS,KAAK;CACrD,MAAM,YAAY,WACd,GAAG,WAAW,KAAK,KAAK,QAAQ,MAAM,CAAC,IAAI,SAAS,KAAA;CAKxD,MAAM,kBAAkB,0BACpB,KAAK,KAAK,aAAa,MAAM,SAAS,GACtC,WACJ;CACA,MAAM,mBAA2C,gBAAgB,KAAI,WAAU;EAC3E,MAAM,WAAW,CAAC,GAAG,IAAI,IACrB,OAAO,OACF,QAAO,UAAS,MAAM,SAAS,kBAAkB,MAAM,SAAS,mBAAmB,CAAC,CACpF,KAAI,UAAS,MAAM,OAAO,CACnC,CAAC;EACD,OAAO;GACH,MAAM,OAAO;GAGb,MAAM,OAAO,KAAK,QAAQ,SAAS,KAAK;GACxC,UAAU,OAAO;GACjB,GAAI,SAAS,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;EAC9C;CACJ,CAAC;CAED,KAAK,MAAM,QAAQ,qBAAqB,eAAe,GACnD,IAAI,SAAS,KAAK,UAAU,CAAC,CAAC,WAAW,GAAG,IAAI,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC;CAGxF,MAAM,WAAW,sBAAsB;EACnC,cAAc,QAAQ;EACtB,cAAc,qBAAqB,WAAW;EAM9C,eAAe,MAAM,iBAAiB,qBAAqB,WAAW,IAAI;EAC1E;EACA,OAAO;GACH,QAAQ,MAAM,YAAY,SAAS,MAAM,MAAM,IAAI,KAAA;GACnD,aAAa,MAAM,iBAAiB,SAAS,KAAK,KAAK,MAAM,QAAQ,aAAa,CAAC,IAAI,KAAA;GACvF,WAAW,SAAS,MAAM,SAAS;GACnC,OAAO,SAAS,MAAM,KAAK;GAC3B,QAAQ,SAAS,SAAS;GAC1B,iBAAiB,MAAM,iBACjB,SAAS,KAAK,KAAK,MAAM,QAAQ,GAAG,MAAM,gBAAgB,IAAI,CAAC,IAC/D,KAAA;EACV;EACA,iBAAiB,YACZ,KAAI,eAAc,WAAW,IAAI,CAAC,CAClC,QAAQ,SAAyB,QAAQ,IAAI,CAAC;EACnD,WAAW;EACX;EACA;EACA,WAAW;EACX,cAAc;EACd,OAAO;GACH,KAAK,WAAW;GAChB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;GACvC,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACtC;CACJ,CAAC;CAED,GAAG,cACC,KAAK,KAAK,QAAQ,eAAe,GACjC,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,KACrC,MACJ;CAIA,MAAM,QAAQ,aAAa,WAAW;CACtC,IAAI,OAAO,GAAG,cAAc,KAAK,KAAK,QAAQ,QAAQ,GAAG,OAAO,MAAM;CAItE,GAAG,cACC,KAAK,KAAK,QAAQ,cAAc,GAChC,GAAG,KAAK,UAAU;EACd,MAAM;EACN,SAAS;EACT,MAAM;EACN,cAAc;CAClB,GAAG,MAAM,CAAC,EAAE,KACZ,MACJ;CAEA,MAAM,SAAS,mBAAmB;EAC9B;EACA;EACA;EAGA,UAAU,CAAC,uBAAuB,KAAK,KAAK,aAAa,SAAS,CAAC,CAAC,CAAC,CAAC,QACjE,SAAyB,QAAQ,IAAI,CAAC;EAC3C,WAAW,QAAQ;CACvB,CAAC;CACD,IAAI,OAAO,UAAU;EACjB,SAAS,KAAK,WAAW;EACzB,SAAS,KAAK,eAAe,OAAO;EAIpC,GAAG,cACC,KAAK,KAAK,QAAQ,eAAe,GACjC,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,KACrC,MACJ;CACJ;CAEA,OAAO;EAAE;EACb;EACA,iBAAiB,YAAY;EAC7B;CAAO;AACP;;AAGA,IAAa,mBAAmB;AAChC,IAAa,oBAAoB;;;;;;;;;;;;;;;AAyBjC,IAAa,yBAAyB,MAAM,OAAO;;;;;;;;;;;;;;;;;;;AAoBnD,IAAa,wBAAwB,MAAM,OAAO;;AAGlD,SAAS,cAAc,KAAa,SAAS,KAAiB;CAC1D,IAAI,QAAQ;CACZ,IAAI,UAAU;CACd,MAAM,QAAQ,CAAC,GAAG;CAClB,OAAO,MAAM,SAAS,KAAK,UAAU,QAAQ;EACzC,MAAM,UAAU,MAAM,IAAI;EAC1B,IAAI;EACJ,IAAI;GACA,UAAU,GAAG,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC;EAC7D,QAAQ;GACJ;EACJ;EACA,KAAK,MAAM,SAAS,SAAS;GACzB;GACA,MAAM,OAAO,KAAK,KAAK,SAAS,MAAM,IAAI;GAC1C,IAAI,MAAM,YAAY,GAClB,MAAM,KAAK,IAAI;QACZ,IAAI,MAAM,OAAO,GACpB,IAAI;IACA,SAAS,GAAG,SAAS,IAAI,CAAC,CAAC;GAC/B,QAAQ,CAGR;EAER;CACJ;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,mBAAmB,SAclB;CACb,IAAI,QAAQ,cAAc,OACtB,OAAO;EAAE,UAAU;EAAO,SAAS;CAA4B;CAEnE,IAAI,OAAO,KAAK,QAAQ,QAAQ,CAAC,CAAC,WAAW,GAGzC,OAAO;EAAE,UAAU;EAAO,SAAS;CAAsC;CAE7E,IAAI,QAAQ,cAAc,SAAS,GAE/B,OAAO;EACH,UAAU;EACV,SACI,gDAJM,QAAQ,cAAc,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAIF,EAAM;CAE9D;CAGJ,MAAM,SAAS;EACX,IAAI;EACJ,KAAA;EACA,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;CAC3C;CAEA,MAAM,MAAM,QAAQ,SAAS,KAAK,MAAM,QAAQ;EAC5C,MAAM,SAAS,UAAU,KAAK,MAAM;GAAE;GAAK,OAAO;GAAQ,UAAU;EAAO,CAAC;EAC5E,IAAI,OAAO,OAAO,MAAM,OAAO;EAC/B,IAAI,OAAO,WAAW,GAClB,MAAM,IAAI,MACN,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG,EAAE,UAAU,OAAO,OAAO,IAAI,OAAO,UAAU,OAAO,UAAU,KAAK,KAAK,CACrG;CAER;CAEA,IAAI;EACA,IACI,OACA;GACI;GACA;GAKA;GACA;GACA;GACA,QAAQ,OAAO;GACf,SAAS,OAAO;EACpB,GACA,QAAQ,MACZ;CACJ,SAAS,OAAgB;EAKrB,OAAO;GACH,UAAU;GACV,SAAS,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EACzF;CACJ;CAEA,MAAM,YAAY,KAAK,KAAK,QAAQ,QAAQ,cAAc;CAC1D,IAAI,CAAC,GAAG,WAAW,SAAS,GACxB,OAAO;EAAE,UAAU;EAAO,SAAS;CAAuC;CAkB9E,MAAM,WAAW,QAAQ,YAAY,CAAC,EAAA,CAAG,QAAO,SAC5C,CAAC,GAAG,WAAW,KAAK,KAAK,WAAW,GAAG,KAAK,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC;CAC5E,IAAI,QAAQ,SAAS,GAAG;EACpB,GAAG,OAAO,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACrD,GAAG,OAAO,KAAK,KAAK,QAAQ,QAAQ,mBAAmB,GAAG,EAAE,OAAO,KAAK,CAAC;EACzE,OAAO;GACH,UAAU;GACV,SACI,iCAAiC,QAAQ,KAAK,IAAI,EAAE;EAG5D;CACJ;CAEA,MAAM,QAAQ,cAAc,SAAS;CACrC,IAAI,QAAA,aAAiC,QAAQ,cAAc,MAAM;EAC7D,GAAG,OAAO,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACrD,GAAG,OAAO,KAAK,KAAK,QAAQ,QAAQ,mBAAmB,GAAG,EAAE,OAAO,KAAK,CAAC;EACzE,OAAO;GACH,UAAU;GACV,SACI,yBAAyB,KAAK,MAAM,SAAS,OAAO,KAAK,EAAE;EAKnE;CACJ;CAEA,OAAO;EAAE,UAAU;EAAM;EAAQ;CAAM;AAC3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAgB,qBAAqB,SAeE;CACnC,MAAM,EAAE,WAAW,WAAW,SAAS,MAAM,UAAU,MAAM,KAAK,QAAQ;CAC1E,MAAM,eAAe,KAAK,KAAK,WAAW,eAAe;CACzD,IAAI,CAAC,GAAG,WAAW,YAAY,GAC3B,MAAM,IAAI,MAAM,kBAAkB,aAAa,mCAAmC;CAEtF,IAAI,CAAC,GAAG,WAAW,SAAS,GACxB,MAAM,IAAI,MAAM,sBAAsB,UAAU,EAAE;CAOtD,MAAM,MAAM,KAAK,MAAM,KAAK,UAAU,OAAO;CAC7C,MAAM,YAAY,KAAK,KAAK,WAAW,UAAU,OAAO;CACxD,GAAG,OAAO,WAAW;EAAE,WAAW;EACtC,OAAO;CAAK,CAAC;CACT,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CAC3C,GAAG,OAAO,WAAW,WAAW,EAAE,WAAW,KAAK,CAAC;CAEnD,IAAI,YAAY;CAChB,MAAM,SAAS,WAAyB;EACpC,KAAK,MAAM,SAAS,GAAG,YAAY,QAAQ,EAAE,eAAe,KAAK,CAAC,GAC9D,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,KAAK,QAAQ,MAAM,IAAI,CAAC;OACvD;CAEb;CACA,MAAM,SAAS;CAEf,wBAAwB,SAAS;CAIjC,MAAM,WAAW,KAAK,MAAM,GAAG,aAAa,cAAc,MAAM,CAAC;CACjE,MAAM,YAAY,SAAS,OAAO,UAAU,CAAC,EAAA,CAAG,QAAO,UAAS,MAAM,QAAQ,GAAG;CAIjF,SAAS,QAAQ;EACb,GAAG,SAAS;EACZ,QAAQ,CAAC,GAAG,UAAU;GAAE,MAAM;GACtC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;GACvB;GACA;GACA,MAAM;GACN,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;EAAG,CAAC,CAAC,CAAC,KAAK,iBAAiB;CAC7C;CACA,GAAG,cAAc,cAAc,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,KAAK,MAAM;CAE/E,OAAO;EAAE;EACb;CAAI;AACJ;AAEA,SAAgB,kBAAkB,SAcwC;CACtE,MAAM,EAAE,aAAa,SAAS,WAAW,QAAQ,iBAAiB;CAClE,MAAM,WAAW,QAAQ,QAAQ;CAEjC,YAAY,aAAa,MAAM;CAE/B,MAAM,YAAY,KAAK,KAAK,QAAQ,QAAQ;CAC5C,GAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;CAC3C,GAAG,OAAO,WAAW,WAAW,EAAE,WAAW,KAAK,CAAC;CAEnD,IAAI,YAAY;CAChB,MAAM,SAAS,QAAsB;EACjC,KAAK,MAAM,SAAS,GAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC,GAC3D,IAAI,MAAM,YAAY,GAAG,MAAM,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC;OACpD;CAEb;CACA,MAAM,SAAS;CACf,wBAAwB,SAAS;CAEjC,MAAM,WAAiC;EACnC,cAAc;EACd,SAAS;GACL,OAAO;GACP,cAAc,qBAAqB,WAAW;GAC9C,UAAU;EACd;EAEA,eAAe;EACf,KAAK;EACL,MAAM;EAON,OAAO,EAAE,QAAQ,CAAC;GAAE,MAAM;GAClC,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;GAC7C,KAAK;GACL,KAAK,QAAQ,OAAO;GACpB,MAAM;GACN,GAAI,QAAQ,MAAM,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC;EAAG,CAAC,EAAE;EACxC,OAAO,EAAE,QAAQ,MAAM;EAEvB,MAAM,EAAE,UAAU,CAAC,EAAE;EACrB,OAAO;GACH,KAAK,WAAW;GAChB,MAAM,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;GACvC,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EACtC;CACJ;CAEA,GAAG,cACC,KAAK,KAAK,QAAQ,eAAe,GACjC,GAAG,KAAK,UAAU,UAAU,MAAM,CAAC,EAAE,KACrC,MACJ;CAEA,GAAG,cACC,KAAK,KAAK,QAAQ,cAAc,GAChC,GAAG,KAAK,UAAU;EAAE,MAAM;EAClC,SAAS;EACT,MAAM;EACN,cAAc,CAAC;CAAE,GAAG,MAAM,CAAC,EAAE,KACrB,MACJ;CAEA,OAAO;EAAE;EACb;EACA;CAAU;AACV;;;;;;;;;;;AAYA,SAAS,uBAAuB,MAAuB;CACnD,IAAI,KAAK,WAAW,GAAG,GAAG,OAAO;CACjC,IAAI,KAAK,SAAS,QAAQ,KAAK,KAAK,SAAS,QAAQ,GAAG,OAAO;CAC/D,IAAI,KAAK,SAAS,OAAO,GAAG,OAAO;CACnC,IAAI,SAAS,cAAc,SAAS,YAAY,OAAO;CACvD,OAAO,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK;AACtD;;;;;;;;;;;;;;;AAgBA,eAAe,sBAAsB,gBAAqD;CACtF,IAAI,CAAC,GAAG,WAAW,cAAc,GAAG,OAAO,CAAC;CAE5C,MAAM,EAAE,eAAe,MAAM,OAAO;CAKpC,MAAM,OAAO,WAAW,KAAK,KAAK,gBAAgB,UAAU,GAAG;EAC3D,gBAAgB;EAChB,YAAY;CAChB,CAAC;CAED,MAAM,QAAQ,GAAG,YAAY,cAAc,CAAC,CACvC,OAAO,sBAAsB,CAAC,CAC9B,KAAK;CAEV,MAAM,cAAkC,CAAC;CACzC,MAAM,WAAqB,CAAC;CAE5B,KAAK,MAAM,QAAQ,OACf,IAAI;EACA,MAAM,MAAM,MAAM,KAAK,OAAO,KAAK,KAAK,gBAAgB,IAAI,CAAC;EAE7D,MAAM,aAAc,IAAuC,WACnD;EACR,IAAI,cAAc,OAAO,eAAe,YAAY,UAAU,YAC1D,YAAY,KAAK,UAAU;OAE3B,SAAS,KAAK,GAAG,KAAK,iCAAiC;CAE/D,SAAS,KAAK;EACV,SAAS,KAAK,GAAG,KAAK,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG;CAChF;CAGJ,IAAI,SAAS,SAAS,GAClB,MAAM,IAAI,MACN,kBAAkB,SAAS,OAAO,0BAClC,SAAS,KAAI,MAAK,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,CAC3C;CAGJ,OAAO;AACX;;AAGA,SAAS,qBAAqB,aAA6B;CACvD,MAAM,aAAa,CACf,KAAK,KAAK,aAAa,gBAAgB,cAAc,UAAU,cAAc,GAC7E,KAAK,KAAK,aAAa,WAAW,gBAAgB,cAAc,UAAU,cAAc,CAC5F;CACA,KAAK,MAAM,aAAa,YAAY;EAChC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;EAC/B,IAAI;GACA,OAAQ,KAAK,MAAM,GAAG,aAAa,WAAW,MAAM,CAAC,CAAC,CAAyB;EACnF,QAAQ,CAER;CACJ;CACA,OAAO;AACX"}

package/dist/bundle.d.ts

@@ -86,6 +86,20 @@ export declare function detectStorageAuthorize(compiledConfigDir: string, depth?
  * heuristic gate whose false negatives are caught at deploy time anyway.
  */
 export declare function detectNativeDependencies(projectRoot: string, declared: Record<string, string>, limit?: number): NativeDependency[];
+/**
+ * The npm configuration a bundle carries, so the runtime's `npm ci` can reach a
+ * private registry — or `null` when the project has none.
+ *
+ * A pod installs the bundle's dependencies when it starts, from the public
+ * registry unless told otherwise, so a dependency published to a private
+ * registry or under a private scope could not install. This hands npm the
+ * project's own `.npmrc`. Credentials stay out of the bundle: every credential
+ * must be a `${VAR}` reference, which npm expands from the pod's environment —
+ * `rebase cloud env set NPM_TOKEN=… --secret`. A literal token would be
+ * uploaded with the code and stored beside every deployment, so it fails the
+ * build instead.
+ */
+export declare function bundledNpmrc(projectRoot: string): string | null;
 /**
  * Collect the runtime dependencies a bundle needs installed beside it.
  *