@stll/oxlint-config 0.12.2 → 0.15.0

package/dist/toolchain-inputs.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"toolchain-inputs.cjs","names":["exhaustive","exhaustive","path"],"sources":["../src/cloud-setup-install.ts","../src/cloud-setup-schema.ts","../src/cloud-setup-services.ts","../src/toolchain-node.ts","../src/cloud-setup.ts","../src/toolchain-workspaces.ts","../src/toolchain-container-inputs.ts","../src/toolchain-inputs.ts"],"sourcesContent":["import type { CloudService } from \"./cloud-setup-schema\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\ntype CloudServiceInstallOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n  valkeyArtifacts: ReturnType<typeof parseToolchainPolicy>[\"valkeyArtifacts\"];\n};\n\nconst packageInstall = String.raw`\n# Prevent package maintainer scripts from starting unmanaged system services.\napt_install() (\n  # EXIT runs after function locals expire; this subshell owns the trap state.\n  backup=''\n  policy_state=untouched\n  [[ ! -L /var/lock/stll-cloud-apt.lock ]] || fail 'Invalid package install lock'\n  exec 8>/var/lock/stll-cloud-apt.lock\n  flock -x -w 120 8 || fail 'Another package installation is active'\n  [[ ! -L /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy symlink'\n  [[ ! -e /usr/sbin/policy-rc.d || -f /usr/sbin/policy-rc.d ]] || fail 'Unsupported service-start policy file'\n  backup=\"$(mktemp -d)\"\n  cleanup_package_policy() {\n    local status=$?\n    trap - EXIT HUP INT TERM\n    if [[ \"$policy_state\" == installed ]]; then\n      if [[ -f \"$backup/original\" ]]; then\n        if ! cp -p \"$backup/original\" /usr/sbin/policy-rc.d; then status=1; fi\n      else\n        if ! rm -f /usr/sbin/policy-rc.d; then status=1; fi\n      fi\n    fi\n    rm -rf -- \"$backup\"\n    exit \"$status\"\n  }\n  trap cleanup_package_policy EXIT\n  trap 'exit 129' HUP\n  trap 'exit 130' INT\n  trap 'exit 143' TERM\n  if [[ -e /usr/sbin/policy-rc.d ]]; then cp -p /usr/sbin/policy-rc.d \"$backup/original\"; fi\n  policy_state=installed\n  printf '%s\\n' '#!/bin/sh' 'exit 101' > /usr/sbin/policy-rc.d\n  chmod 755 /usr/sbin/policy-rc.d\n  DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \"$@\"\n)\n\n`;\n\nconst postgresSourceLine =\n  \"deb [signed-by=/usr/share/keyrings/stll-pgdg.asc] https://apt.postgresql.org/pub/repos/apt noble-pgdg main\";\nconst postgresSigningFingerprint = \"B97B0AFCAA1A47F044F244A07FCC7D46ACCC4CF8\";\n\nconst postgresSources = String.raw`\npgdg_key_fingerprint() {\n  gpg --batch --show-keys --with-colons \"$1\" | awk -F: '$1 == \"pub\" { primary = 1 } $1 == \"sub\" { primary = 0 } $1 == \"fpr\" && primary { print toupper($10); primary = 0 }'\n}\npgdg_sources_ready() {\n  local managed=\"$1\" file mode records suite keyring override fingerprint selected_keyring=''\n  shift\n  PGDG_SOURCE_STATE=missing\n  [[ ! -L \"$managed\" ]] || fail \"Managed PGDG source must not be a symlink: $managed\"\n  for file in \"$@\"; do\n    [[ -e \"$file\" ]] || continue\n    [[ -f \"$file\" ]] || fail \"APT source must be a regular file: $file\"\n    case \"$file\" in *.sources) mode=sources ;; *) mode=list ;; esac\n    records=\"$(awk -v mode=\"$mode\" '\n      function trim(value) { gsub(/^[[:space:]]+|[[:space:]]+$/, \"\", value); return value }\n      function pgdg_uri(uri) {\n        uri = tolower(uri)\n        if (uri !~ /^[a-z][a-z0-9+.-]*:\\/\\//) return 0\n        sub(/^[a-z][a-z0-9+.-]*:\\/\\//, \"\", uri)\n        sub(/[\\/?#].*$/, \"\", uri)\n        sub(/^.*@/, \"\", uri)\n        sub(/:.*$/, \"\", uri)\n        return uri == \"apt.postgresql.org\" || uri == \"apt.postgresql.org.\"\n      }\n      function contains_pgdg(value, tokens, count, token_index) {\n        count = split(value, tokens, /[[:space:]]+/)\n        for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) return 1\n        return 0\n      }\n      function unsafe_field(name) {\n        return name ~ /^(trusted|allow-insecure|allow-weak|allow-downgrade-to-insecure)$/\n      }\n      function disabled_override(value) {\n        value = tolower(trim(value))\n        gsub(/^[\"\\047]|[\"\\047]$/, \"\", value)\n        return value ~ /^(no|false|without|off|disable|0)$/\n      }\n      function stanza(override_index) {\n        override = 0\n        for (override_index = 1; override_index <= override_count; override_index++) {\n          if (!disabled_override(override_values[override_index])) override = 1\n          delete override_values[override_index]\n        }\n        if (tolower(trim(enabled)) != \"no\" && pgdg) print (trim(suites) == \"\" ? \"-\" : trim(suites)) \"\\t\" (trim(keyring) == \"\" ? \"-\" : trim(keyring)) \"\\t\" (override ? \"unsafe\" : \"safe\")\n        enabled = \"\"; pgdg = 0; field = \"\"; suites = \"\"; keyring = \"\"; override = 0; override_count = 0\n      }\n      /^[[:space:]]*#/ { if (mode == \"list\" || $0 ~ /^#/) next }\n      {\n        line = $0\n        if (mode == \"list\") {\n          sub(/[[:space:]]*#.*$/, \"\", line)\n          if (line !~ /^[[:space:]]*deb(-src)?[[:space:]]/ || !contains_pgdg(line)) next\n          keyring = \"\"; override = 0\n          if (match(line, /\\[[^]]*\\]/)) {\n            options = substr(line, RSTART + 1, RLENGTH - 2)\n            count = split(options, tokens, /[[:space:]]+/)\n            for (token_index = 1; token_index <= count; token_index++) {\n              if (tolower(tokens[token_index]) ~ /^signed-by=/) { keyring = tokens[token_index]; sub(/^[^=]*=/, \"\", keyring) }\n              option_name = tolower(tokens[token_index]); sub(/=.*/, \"\", option_name)\n              option_value = tokens[token_index]; sub(/^[^=]*=/, \"\", option_value)\n              if (unsafe_field(option_name) && !disabled_override(option_value)) override = 1\n            }\n            sub(/\\[[^]]*\\]/, \"\", line)\n          }\n          count = split(line, tokens, /[[:space:]]+/)\n          for (token_index = 1; token_index <= count; token_index++) if (pgdg_uri(tokens[token_index])) print (tokens[token_index + 1] == \"\" ? \"-\" : tokens[token_index + 1]) \"\\t\" (keyring == \"\" ? \"-\" : keyring) \"\\t\" (override ? \"unsafe\" : \"safe\")\n          next\n        }\n        if (line ~ /^[[:space:]]*$/) { stanza(); next }\n        if (line ~ /^[[:space:]]/) {\n          if (field == \"uris\" && contains_pgdg(line)) pgdg = 1\n          if (field == \"enabled\") enabled = enabled \" \" line\n          if (field == \"suites\") suites = suites \" \" line\n          if (field == \"signed-by\") keyring = keyring \" \" line\n          if (unsafe_field(field)) override_values[override_count] = override_values[override_count] \" \" line\n          next\n        }\n        field = tolower(line)\n        sub(/:.*/, \"\", field)\n        value = line\n        sub(/^[^:]*:[[:space:]]*/, \"\", value)\n        if (field == \"uris\" && contains_pgdg(value)) pgdg = 1\n        if (field == \"enabled\") enabled = value\n        if (field == \"suites\") suites = value\n        if (field == \"signed-by\") keyring = value\n        if (unsafe_field(field)) override_values[++override_count] = value\n      }\n      END { if (mode == \"sources\") stanza() }\n    ' \"$file\")\" || fail \"Cannot inspect APT source: $file\"\n    if [[ \"$file\" == \"$managed\" && -z \"$records\" ]]; then\n      fail \"Managed PGDG source has no active PGDG entry: $file\"\n    fi\n    while IFS=$'\\t' read -r suite keyring override; do\n      [[ -n \"$suite\" ]] || continue\n      [[ \"$override\" == safe ]] || fail \"PGDG source enables an unsafe trust override: $file\"\n      [[ \"$suite\" == noble-pgdg && \"$keyring\" == /* && ! \"$keyring\" =~ [[:space:],] ]] || fail \"PGDG source requires noble-pgdg and one Signed-By keyring: $file\"\n      [[ -z \"$selected_keyring\" || \"$selected_keyring\" == \"$keyring\" ]] || fail \"Conflicting PGDG Signed-By keyrings: $file\"\n      fingerprint=\"$(pgdg_key_fingerprint \"$keyring\")\" || fail \"Cannot verify PGDG Signed-By keyring: $file\"\n      [[ \"$fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail \"PGDG Signed-By fingerprint mismatch: $file\"\n      selected_keyring=\"$keyring\"\n      PGDG_SOURCE_STATE=reuse\n    done <<< \"$records\"\n  done\n}\n`;\n\nconst postgresInstall = String.raw`\n  postgres_ready() {\n    local binary\n    for binary in postgres initdb pg_ctl psql createdb; do\n      [[ -x \"/usr/lib/postgresql/@POSTGRES@/bin/$binary\" ]] || return 1\n    done\n    /usr/lib/postgresql/@POSTGRES@/bin/postgres --version | grep -Eq '^postgres \\(PostgreSQL\\) @POSTGRES@\\.'\n  }\n  if ! postgres_ready; then\n    pgdg_sources_ready /etc/apt/sources.list.d/stll-pgdg.list /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources\n    if [[ \"$PGDG_SOURCE_STATE\" == missing ]]; then\n      local key key_fingerprint\n      key=\"$(mktemp)\"\n      curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 https://www.postgresql.org/media/keys/ACCC4CF8.asc -o \"$key\"\n      key_fingerprint=\"$(pgdg_key_fingerprint \"$key\")\"\n      [[ \"$key_fingerprint\" == @PGDG_FINGERPRINT@ ]] || fail 'PostgreSQL signing key mismatch'\n      install -d -m 755 /usr/share/keyrings\n      install -m 644 \"$key\" /usr/share/keyrings/stll-pgdg.asc\n      rm -- \"$key\"\n      printf '%s\\n' '@PGDG_SOURCE@' > /etc/apt/sources.list.d/stll-pgdg.list\n    fi\n    apt-get update\n    apt_install postgresql-@POSTGRES@ postgresql-client-@POSTGRES@\n  fi\n  postgres_ready || fail 'PostgreSQL toolchain is incomplete or differs from the policy major'\n`;\n\nconst valkeyInstall = String.raw`\n  if ! command -v valkey-server >/dev/null || [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" != '@VALKEY@' ]] || ! command -v valkey-cli >/dev/null || [[ \"$(valkey-cli --version)\" != 'valkey-cli @VALKEY@' ]]; then\n    local scratch server_url server_sha tools_url tools_sha package\n    scratch=\"$(mktemp -d)\"\n    chmod 755 \"$scratch\"\n    case \"$ARCH\" in\n      amd64) server_url='@AMD64_SERVER_URL@'; server_sha='@AMD64_SERVER_SHA@'; tools_url='@AMD64_TOOLS_URL@'; tools_sha='@AMD64_TOOLS_SHA@' ;;\n      arm64) server_url='@ARM64_SERVER_URL@'; server_sha='@ARM64_SERVER_SHA@'; tools_url='@ARM64_TOOLS_URL@'; tools_sha='@ARM64_TOOLS_SHA@' ;;\n      *) fail 'Unsupported Valkey architecture' ;;\n    esac\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$server_url\" -o \"$scratch/valkey-server.deb\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"$tools_url\" -o \"$scratch/valkey-tools.deb\"\n    (cd \"$scratch\"; printf '%s  %s\\n' \"$server_sha\" valkey-server.deb \"$tools_sha\" valkey-tools.deb | sha256sum --strict -c -)\n    for package in valkey-server valkey-tools; do\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Package)\" == \"$package\" ]] || fail 'Valkey artifact package mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Version)\" == '@VALKEY@-1.noble' ]] || fail 'Valkey artifact version mismatch'\n      [[ \"$(dpkg-deb -f \"$scratch/$package.deb\" Architecture)\" == \"$ARCH\" ]] || fail 'Valkey artifact architecture mismatch'\n    done\n    apt-get update\n    apt_install \"$scratch/valkey-server.deb\" \"$scratch/valkey-tools.deb\"\n    rm -rf -- \"$scratch\"\n  fi\n  [[ \"$(valkey-server --version | sed -nE 's/.*v=([0-9.]+).*/\\1/p')\" == '@VALKEY@' ]] || fail 'Valkey version differs from policy'\n  [[ \"$(valkey-cli --version)\" == 'valkey-cli @VALKEY@' ]] || fail 'Valkey client version differs from policy'\n`;\n\nconst state = String.raw`\nservice_account_ready() {\n  local uid gid shell\n  uid=\"$(id -u stll-cloud)\" || fail 'Service user is unavailable; run install'\n  gid=\"$(id -g stll-cloud)\"\n  shell=\"$(getent passwd stll-cloud | cut -d: -f7)\"\n  [[ \"$uid\" =~ ^[1-9][0-9]*$ && \"$gid\" =~ ^[1-9][0-9]*$ && \"$shell\" == /usr/sbin/nologin ]] || fail 'Service user must be unprivileged with no login shell'\n}\nprepare_state() {\n  service_account_ready\n  [[ ! -L /var/lib/stll-cloud ]] || fail 'Service state root must not be a symlink'\n  if [[ -e /var/lib/stll-cloud ]]; then\n    [[ -d /var/lib/stll-cloud && \"$(stat -c '%u:%a' /var/lib/stll-cloud)\" == 0:755 ]] || fail 'Invalid service state root'\n  else\n    install -d -m 755 -o root -g root /var/lib/stll-cloud\n  fi\n  STATE=\"/var/lib/stll-cloud/$(printf '%s' \"$REPO_ROOT\" | sha256sum | cut -d' ' -f1)\"\n  [[ ! -L \"$STATE\" ]] || fail 'Service state must not be a symlink'\n  if [[ -e \"$STATE\" ]]; then\n    [[ -d \"$STATE\" && \"$(stat -c '%u:%a' \"$STATE\")\" == 0:710 && \"$(stat -c '%g' \"$STATE\")\" == \"$(id -g stll-cloud)\" ]] || fail 'Invalid service state ownership'\n  else\n    install -d -m 710 -o root -g stll-cloud \"$STATE\"\n  fi\n  [[ ! -L \"$STATE/lock\" ]] || fail 'Service lock must not be a symlink'\n  exec 9>\"$STATE/lock\"\n  flock -x -w 10 9 || fail 'Another setup process owns the service state'\n}\n`;\n\nexport const renderCloudServiceInstall = ({\n  services,\n  postgres,\n  valkey,\n  valkeyArtifacts,\n}: CloudServiceInstallOptions) => {\n  const parts = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresInstall\n          .replaceAll(\"@POSTGRES@\", postgres)\n          .replaceAll(\"@PGDG_SOURCE@\", postgresSourceLine)\n          .replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint);\n      case \"valkey\": {\n        const replacements = new Map([\n          [\"@VALKEY@\", valkey],\n          [\"@AMD64_SERVER_URL@\", valkeyArtifacts.amd64.server.url],\n          [\"@AMD64_SERVER_SHA@\", valkeyArtifacts.amd64.server.sha256],\n          [\"@AMD64_TOOLS_URL@\", valkeyArtifacts.amd64.tools.url],\n          [\"@AMD64_TOOLS_SHA@\", valkeyArtifacts.amd64.tools.sha256],\n          [\"@ARM64_SERVER_URL@\", valkeyArtifacts.arm64.server.url],\n          [\"@ARM64_SERVER_SHA@\", valkeyArtifacts.arm64.server.sha256],\n          [\"@ARM64_TOOLS_URL@\", valkeyArtifacts.arm64.tools.url],\n          [\"@ARM64_TOOLS_SHA@\", valkeyArtifacts.arm64.tools.sha256],\n        ]);\n        return valkeyInstall.replace(/@[A-Z0-9_]+@/g, (token) => {\n          const value = replacements.get(token);\n          if (value === undefined)\n            throw new Error(`Missing Valkey artifact field: ${token}`);\n          return value;\n        });\n      }\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  const user =\n    services.length === 0\n      ? \"\"\n      : \"  if ! id stll-cloud >/dev/null 2>&1; then useradd --system --user-group --no-create-home --shell /usr/sbin/nologin stll-cloud; fi\\n  service_account_ready\\n\";\n  return `${packageInstall}\\n${services.includes(\"postgres\") ? postgresSources.replaceAll(\"@PGDG_FINGERPRINT@\", postgresSigningFingerprint) : \"\"}\\n${services.length === 0 ? \"prepare_state() { :; }\\n\" : state}\\ninstall_services() {\\n${user}${parts.join(\"\")}\\n  :\\n}\\n`;\n};\n","export const cloudServices = [\"postgres\", \"valkey\"] as const;\nexport type CloudService = (typeof cloudServices)[number];\nexport const cloudInstallCommand = \"bun install --frozen-lockfile\";\n\nconst cloudService = (value: unknown): value is CloudService =>\n  cloudServices.some((service) => value === service);\n\n/** Parse an explicit declaration without assuming services for undeclared repositories. */\nexport const parseCloudSetup = (input: unknown) => {\n  if (input === undefined) return undefined;\n  if (typeof input !== \"object\" || input === null || Array.isArray(input))\n    throw new Error(\"cloud must be an object\");\n  for (const key of Object.keys(input))\n    if (key !== \"services\" && key !== \"install\" && key !== \"envFile\")\n      throw new Error(`unsupported cloud key: ${key}`);\n  const selected = \"services\" in input ? input.services : [];\n  if (!Array.isArray(selected))\n    throw new Error(\"cloud.services must be an array when provided\");\n  if (!(\"install\" in input) || input.install !== cloudInstallCommand)\n    throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);\n  const seen = new Set<CloudService>();\n  const services = Array.from(selected, (service: unknown) => {\n    if (!cloudService(service))\n      throw new Error(\"cloud.services contains an unsupported service\");\n    if (seen.has(service))\n      throw new Error(`cloud.services contains duplicate service: ${service}`);\n    seen.add(service);\n    return service;\n  });\n  if (services.length === 0) {\n    if (\"envFile\" in input)\n      throw new Error(\"cloud.envFile is not allowed without services\");\n    return { services, install: cloudInstallCommand } as const;\n  }\n  if (!(\"envFile\" in input) || typeof input.envFile !== \"string\")\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  const envFile = input.envFile;\n  if (\n    envFile.startsWith(\"/\") ||\n    /^[A-Za-z]:/.test(envFile) ||\n    envFile.includes(\"\\\\\") ||\n    /\\p{Cc}/u.test(envFile) ||\n    envFile\n      .split(\"/\")\n      .some((part) => part === \"\" || part === \".\" || part === \"..\")\n  )\n    throw new Error(\n      \"cloud.envFile must be a canonical repository-relative path\",\n    );\n  return { services, install: cloudInstallCommand, envFile } as const;\n};\n","import type { CloudService } from \"./cloud-setup-schema\";\n\ntype CloudServiceStartOptions = {\n  services: readonly CloudService[];\n  postgres: string;\n  valkey: string;\n};\n\nconst common = String.raw`\nservice_file() {\n  local file=\"$1\" owner=\"$2\"\n  [[ ! -L \"$file\" ]] || fail \"Service state must not contain symbolic links\"\n  if [[ -e \"$file\" ]]; then\n    [[ -f \"$file\" && \"$(stat -c '%u:%a' \"$file\")\" == \"$owner:600\" ]] || fail \"Invalid service state file\"\n  fi\n}\nservice_directory() {\n  local directory=\"$1\"\n  [[ ! -L \"$directory\" ]] || fail \"Service directory must not be a symbolic link\"\n  if [[ -e \"$directory\" ]]; then\n    [[ -d \"$directory\" && \"$(stat -c '%u:%a' \"$directory\")\" == \"$SERVICE_UID:700\" ]] || fail \"Invalid service directory\"\n  else\n    root install -d -m 700 -o stll-cloud -g stll-cloud \"$directory\"\n  fi\n}\nservice_password() {\n  local file=\"$1\"\n  service_file \"$file\" 0\n  if [[ ! -e \"$file\" ]]; then\n    (umask 077; openssl rand -hex 32 > \"$file\")\n    root chown root:root \"$file\"\n  fi\n  [[ \"$(cat \"$file\")\" =~ ^[0-9a-f]{64}$ ]] || fail \"Invalid service credential state\"\n}\nservice_process_matches() {\n  local pid=\"$1\" executable=\"$2\" owner actual expected\n  [[ \"$pid\" =~ ^[1-9][0-9]*$ && -d \"/proc/$pid\" ]] || return 1\n  owner=\"$(stat -c '%u' \"/proc/$pid\" 2>/dev/null)\" || return 2\n  [[ \"$owner\" =~ ^[0-9]+$ ]] || return 2\n  [[ \"$owner\" == \"$SERVICE_UID\" ]] || return 1\n  actual=\"$(readlink -f \"/proc/$pid/exe\" 2>/dev/null)\" || return 2\n  expected=\"$(readlink -f \"$executable\")\" || return 2\n  [[ -n \"$actual\" && -n \"$expected\" && \"$actual\" != *' (deleted)' ]] || return 2\n  [[ \"$actual\" == \"$expected\" ]]\n}\nservice_process() {\n  service_process_matches \"$1\" \"$2\" || fail \"Managed service process identity differs from the recorded state\"\n}\nservice_prune_pid() {\n  local file=\"$1\" executable=\"$2\" service=\"$3\" pid identity\n  [[ -e \"$file\" ]] || return 0\n  pid=\"$(head -n 1 \"$file\")\"\n  # PostgreSQL encodes a standalone backend with a negative PID.\n  if [[ \"$service\" == postgres ]]; then pid=\"$(printf '%s' \"$pid\" | sed 's/^-//')\"; fi\n  if service_process_matches \"$pid\" \"$executable\"; then return 0; else identity=$?; fi\n  [[ \"$identity\" != 2 ]] || fail \"Cannot verify recorded live service process; retaining its PID file\"\n  # Let PostgreSQL check orphan shared memory before removing a dead-PID lock.\n  if [[ \"$service\" == postgres && \"$pid\" =~ ^[1-9][0-9]*$ && ! -d \"/proc/$pid\" ]]; then return 0; fi\n  if [[ \"$service\" == postgres ]]; then\n    [[ \"$pid\" =~ ^[1-9][0-9]*$ && \"$SERVICE_UID\" != 0 ]] || fail \"Cannot safely recover PostgreSQL PID state\"\n    # The root controller is not our nonroot postgres. Preserve the remaining\n    # lock rows so PostgreSQL's EPERM/ancestor path still checks orphan memory.\n    root sed -i \"1s/.*/$$/\" \"$file\"\n    return 0\n  fi\n  # Restored state can name an unrelated live process; never signal that PID.\n  root rm -- \"$file\"\n}\n`;\n\nconst postgresStart = String.raw`\n  local pg_bin='/usr/lib/postgresql/@POSTGRES@/bin' pg_data=\"$STATE/postgres\" pg_password pg_details pg_pid pg_version\n  service_password \"$STATE/postgres.password\"\n  pg_password=\"$(cat \"$STATE/postgres.password\")\"\n  service_directory \"$pg_data\"\n  for file in PG_VERSION postmaster.pid postgresql.conf pg_hba.conf pg_ident.conf postgresql.auto.conf; do\n    service_file \"$pg_data/$file\" \"$SERVICE_UID\"\n  done\n  if [[ ! -e \"$pg_data/PG_VERSION\" ]]; then\n    [[ -z \"$(ls -A \"$pg_data\")\" ]] || fail \"PostgreSQL data directory is not initialized\"\n    service_file \"$STATE/postgres.init-password\" \"$SERVICE_UID\"\n    (umask 077; printf '%s\\n' \"$pg_password\" > \"$STATE/postgres.init-password\")\n    root chown stll-cloud:stll-cloud \"$STATE/postgres.init-password\"\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/initdb\" -D \"$pg_data\" --username=stll_cloud --auth-host=scram-sha-256 --auth-local=scram-sha-256 --pwfile=\"$STATE/postgres.init-password\" --encoding=UTF8 --locale=C --set=unix_socket_directories= >/dev/null || fail \"PostgreSQL initialization failed\"\n    root rm \"$STATE/postgres.init-password\"\n  fi\n  [[ -f \"$pg_data/PG_VERSION\" && \"$(cat \"$pg_data/PG_VERSION\")\" == '@POSTGRES@' ]] || fail \"PostgreSQL data has a different major version\"\n  service_prune_pid \"$pg_data/postmaster.pid\" \"$pg_bin/postgres\" postgres\n  if ! service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" status >/dev/null 2>&1; then\n    service_run env PGHOST=127.0.0.1 PGHOSTADDR=127.0.0.1 \"$pg_bin/pg_ctl\" -D \"$pg_data\" -l \"$pg_data/cloud.log\" -o \"-h 127.0.0.1 -p 55432 -c unix_socket_directories=\" -t 10 -w start >/dev/null || fail \"PostgreSQL start failed; port 55432 must be available\"\n  fi\n  pg_details=\"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT current_setting('data_directory'), current_setting('listen_addresses'), current_setting('port'), current_setting('server_version_num'), current_setting('unix_socket_directories')\")\" || fail \"PostgreSQL authenticated readiness failed\"\n  pg_version=\"$(printf '%s\\n' \"$pg_details\" | cut -d '|' -f4)\"\n  [[ \"$pg_details\" == \"$pg_data|127.0.0.1|55432|$pg_version|\" && \"$pg_version\" =~ ^[0-9]{6}$ ]] || fail \"PostgreSQL endpoint does not match managed data and listener\"\n  (( pg_version / 10000 == @POSTGRES@ )) || fail \"PostgreSQL endpoint has a different major version\"\n  pg_pid=\"$(head -n 1 \"$pg_data/postmaster.pid\")\"\n  service_process \"$pg_pid\" \"$pg_bin/postgres\"\n  [[ \"$(env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/psql\" -X -h 127.0.0.1 -p 55432 -U stll_cloud -d postgres -At -v ON_ERROR_STOP=1 -c \"SELECT count(*) FROM pg_database WHERE datname = 'cloud_test'\")\" == 1 ]] || env -u PGSERVICE -u PGSERVICEFILE -u PGOPTIONS PGHOSTADDR=127.0.0.1 PGPASSWORD=\"$pg_password\" PGCONNECT_TIMEOUT=2 \"$pg_bin/createdb\" -h 127.0.0.1 -p 55432 -U stll_cloud cloud_test || fail \"PostgreSQL test database creation failed\"\n  DATABASE_URL=\"postgresql://stll_cloud:$pg_password@127.0.0.1:55432/cloud_test\"\n`;\n\nconst valkeyStart = String.raw`\n  local vk_data=\"$STATE/valkey\" vk_password vk_config vk_info vk_pid vk_expected ready=0\n  service_password \"$STATE/valkey.password\"\n  vk_password=\"$(cat \"$STATE/valkey.password\")\"\n  service_directory \"$vk_data\"\n  vk_config=\"$vk_data/valkey.conf\"\n  service_file \"$vk_config\" \"$SERVICE_UID\"\n  for file in valkey.pid valkey.log dump.rdb; do\n    [[ ! -L \"$vk_data/$file\" ]] || fail \"Valkey state must not contain symbolic links\"\n    if [[ -e \"$vk_data/$file\" ]]; then\n      [[ -f \"$vk_data/$file\" && \"$(stat -c '%u' \"$vk_data/$file\")\" == \"$SERVICE_UID\" ]] || fail \"Invalid Valkey state file\"\n    fi\n  done\n  vk_expected=\"$(printf '%s\\n' 'bind 127.0.0.1' 'port 56379' 'protected-mode yes' 'daemonize yes' \"requirepass $vk_password\" \"dir $vk_data\" \"pidfile $vk_data/valkey.pid\" \"logfile $vk_data/valkey.log\" 'save \"\"' 'appendonly no')\"\n  if [[ ! -e \"$vk_config\" ]]; then\n    (umask 077; printf '%s\\n' \"$vk_expected\" > \"$vk_config\")\n    root chown stll-cloud:stll-cloud \"$vk_config\"\n  fi\n  [[ \"$(cat \"$vk_config\")\" == \"$vk_expected\" ]] || fail \"Valkey configuration differs from managed settings\"\n  service_prune_pid \"$vk_data/valkey.pid\" \"$(command -v valkey-server)\" valkey\n  if [[ ! -e \"$vk_data/valkey.pid\" ]]; then\n    service_run valkey-server \"$vk_config\" || fail \"Valkey start failed; port 56379 must be available\"\n  fi\n  for ((attempt=0; attempt<20; attempt++)); do\n    if vk_info=\"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 0.2 valkey-cli -h 127.0.0.1 -p 56379 --raw INFO server 2>/dev/null)\"; then\n      if [[ \"$vk_info\" == *$'valkey_version:@VALKEY@\\r\\n'* && \"$vk_info\" == *\"config_file:$vk_config\"$'\\r\\n'* ]]; then ready=1; break; fi\n    fi\n    sleep 0.25\n  done\n  [[ \"$ready\" == 1 ]] || fail \"Valkey authenticated readiness or managed version/configuration check failed\"\n  [[ -f \"$vk_data/valkey.pid\" ]] || fail \"Valkey managed process identifier is unavailable\"\n  vk_pid=\"$(cat \"$vk_data/valkey.pid\")\"\n  service_process \"$vk_pid\" \"$(command -v valkey-server)\"\n  [[ \"$vk_info\" == *\"process_id:$vk_pid\"$'\\r\\n'* ]] || fail \"Valkey endpoint has a different process identifier\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET bind)\" == $'bind\\n127.0.0.1' ]] || fail \"Valkey endpoint must bind only loopback\"\n  [[ \"$(VALKEYCLI_AUTH=\"$vk_password\" timeout 2 valkey-cli -h 127.0.0.1 -p 56379 --raw CONFIG GET dir)\" == \"$(printf 'dir\\n%s' \"$vk_data\")\" ]] || fail \"Valkey endpoint has a different data directory\"\n  REDIS_URL=\"redis://:$vk_password@127.0.0.1:56379/0\"\n`;\n\n/** Render only declared services; installation and environment-file ownership stay with the caller. */\nexport const renderCloudServiceStart = ({\n  services,\n  postgres,\n  valkey,\n}: CloudServiceStartOptions): string => {\n  if (!/^[1-9][0-9]*$/.test(postgres) || !/^\\d+\\.\\d+\\.\\d+$/.test(valkey))\n    throw new Error(\"Invalid cloud service runtime policy\");\n  if (services.length === 0) return \"start_services() { :; }\\n\";\n  const bodies = services.map((service) => {\n    switch (service) {\n      case \"postgres\":\n        return postgresStart.replaceAll(\"@POSTGRES@\", postgres);\n      case \"valkey\":\n        return valkeyStart.replaceAll(\"@VALKEY@\", valkey);\n      default: {\n        const exhaustive: never = service;\n        throw new Error(`Unsupported cloud service: ${String(exhaustive)}`);\n      }\n    }\n  });\n  return `${common}\\nstart_services() {\\n  local SERVICE_UID file attempt\\n  SERVICE_UID=\"$(id -u stll-cloud)\"\\n  [[ -d \"$STATE\" && ! -L \"$STATE\" && \"$(stat -c '%u' \"$STATE\")\" == 0 ]] || fail \"Invalid cloud service state directory\"\\n${bodies.join(\"\")}\\n}\\n`;\n};\n","import { subset, validRange } from \"semver\";\n\nconst numericComponent = \"(?:0|[1-9]\\\\d*)\";\nconst policyPattern = new RegExp(`^${numericComponent}\\\\.x$`);\nconst selectorPattern = new RegExp(\n  `^(${numericComponent})(?:\\\\.(?:x|${numericComponent}(?:\\\\.${numericComponent})?))?$`,\n);\n\n/** A Node policy selects the complete stable release series of one major. */\nexport const nodePolicyValid = (value: string) =>\n  policyPattern.test(value) && validRange(value) !== null;\n\n/** Static selectors may narrow that series, but cannot float across majors. */\nexport const nodeSelectorMatches = (value: unknown, policy: string) => {\n  if (!nodePolicyValid(policy) || typeof value !== \"string\") return false;\n  const major = selectorPattern.exec(value)?.[1];\n  return (\n    major !== undefined &&\n    major === policy.slice(0, -2) &&\n    validRange(value) !== null\n  );\n};\n\n/** Engines must support every stable release in the approved major series. */\nexport const nodeSupportRangeMatches = (policy: string, range: string) => {\n  if (!nodePolicyValid(policy)) return false;\n  try {\n    return subset(policy, range);\n  } catch {\n    return false;\n  }\n};\n","import { valid } from \"semver\";\n\nimport { renderCloudServiceInstall } from \"./cloud-setup-install\";\nimport { cloudServices, parseCloudSetup } from \"./cloud-setup-schema\";\nimport { renderCloudServiceStart } from \"./cloud-setup-services\";\nimport { nodeSelectorMatches } from \"./toolchain-node\";\nimport type { parseToolchainPolicy } from \"./toolchain-schema\";\n\nexport const cloudSetupPath = \".agents/cloud-setup.sh\";\nexport const cloudEnvironmentMarker =\n  \"# Generated by stll-cloud-setup; disposable local test services.\";\n\ntype GenerateCloudSetupOptions = {\n  policy: ReturnType<typeof parseToolchainPolicy>;\n  cloud: NonNullable<ReturnType<typeof parseCloudSetup>>;\n  nodeVersion: string;\n};\n\nconst script = String.raw`#!/usr/bin/env bash\n# Generated by stll-cloud-setup. Regenerate with stll-cloud-setup.\n# Networked installation and offline service startup are separate lifecycle steps.\n# Cached filesystems may not preserve processes; run start at every session start.\n# Supported platform: Ubuntu 24.04 (noble), amd64/arm64, root or passwordless sudo.\nset -euo pipefail\n\nusage() { echo 'Usage: cloud-setup.sh install|start' >&2; exit 2; }\n[[ \"$#\" == 1 ]] || usage\ncase \"$1\" in install|start) MODE=\"$1\" ;; *) usage ;; esac\nfail() { echo \"cloud-setup: $*\" >&2; exit 1; }\ntrap 'echo \"cloud-setup: command failed at line $LINENO\" >&2' ERR\n[[ -f /etc/os-release ]] || fail 'Ubuntu 24.04 is required'\n. /etc/os-release\n[[ \"$ID\" == ubuntu && \"$VERSION_ID\" == 24.04 && \"$VERSION_CODENAME\" == noble ]] || fail 'Only Ubuntu 24.04 (noble) is supported'\nSCRIPT=\"$(realpath -- \"$0\")\"\nREPO_ROOT=\"$(cd -- \"$(dirname -- \"$SCRIPT\")/..\" && pwd -P)\"\n[[ \"$SCRIPT\" == \"$REPO_ROOT/.agents/cloud-setup.sh\" ]] || fail 'Run the generated repository script'\nif [[ \"$(id -u)\" != 0 ]]; then\n  command -v sudo >/dev/null && sudo -n true || fail 'Root or passwordless sudo is required'\n  exec sudo -n -- bash \"$SCRIPT\" \"$MODE\"\nfi\nOUTPUT_UID=\"$(printenv SUDO_UID || id -u)\"\n[[ \"$OUTPUT_UID\" =~ ^[0-9]+$ ]] || fail 'Invalid invoking user'\nOUTPUT_GID=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f4)\"\n[[ \"$OUTPUT_GID\" =~ ^[0-9]+$ ]] || fail 'Invoking user is unavailable'\nOUTPUT_USER=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f1)\"\nOUTPUT_HOME=\"$(getent passwd \"$OUTPUT_UID\" | cut -d: -f6)\"\n[[ -n \"$OUTPUT_USER\" && \"$OUTPUT_HOME\" == /* && -d \"$OUTPUT_HOME\" ]] || fail 'Invoking user requires an existing home directory'\nroot() { \"$@\"; }\nservice_run() { runuser -u stll-cloud -- \"$@\" 9>&-; }\nBUN_VERSION='@BUN@'\nNODE_VERSION='@NODE@'\nNODE_DIR=\"/opt/stll-cloud/node/$NODE_VERSION\"\nBUN_DIR=\"/opt/stll-cloud/bun/$BUN_VERSION\"\nexport PATH=\"$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin\"\nBUN_CACHE=\"/var/cache/stll-cloud/bun/$OUTPUT_UID\"\n@ENV_ASSIGNMENTS@\n[[ -f \"$REPO_ROOT/.node-version\" && ! -L \"$REPO_ROOT/.node-version\" ]] || fail 'A regular root .node-version is required'\n[[ \"$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' \"$REPO_ROOT/.node-version\")\" == \"$NODE_VERSION\" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'\ncd -- \"$REPO_ROOT\"\ncase \"$(uname -m)\" in\n  x86_64) ARCH=amd64; NODE_ARCH=x64; BUN_ARCH=x64 ;;\n  aarch64|arm64) ARCH=arm64; NODE_ARCH=arm64; BUN_ARCH=aarch64 ;;\n  *) fail 'Only amd64 and arm64 are supported' ;;\nesac\n\nruntime_ready() {\n  [[ -x \"$NODE_DIR/bin/node\" && \"$($NODE_DIR/bin/node --version)\" == \"v$NODE_VERSION\" ]] || fail 'Pinned Node is unavailable; run install'\n  [[ -x \"$BUN_DIR/bun\" && \"$($BUN_DIR/bun --version)\" == \"$BUN_VERSION\" ]] || fail 'Pinned Bun is unavailable; run install'\n}\ninstall_runtimes() {\n  if ! command -v curl >/dev/null || ! command -v unzip >/dev/null || ! command -v xz >/dev/null || ! command -v openssl >/dev/null || ! command -v gpg >/dev/null; then\n    apt-get update\n    DEBIAN_FRONTEND=noninteractive apt_install ca-certificates curl unzip xz-utils openssl gnupg util-linux\n  fi\n  local scratch node_archive bun_archive bun_folder\n  scratch=\"$(mktemp -d)\"\n  trap 'rm -rf -- \"$scratch\"' RETURN\n  if [[ ! -x \"$NODE_DIR/bin/node\" ]] || [[ \"$($NODE_DIR/bin/node --version)\" != \"v$NODE_VERSION\" ]]; then\n    node_archive=\"node-v$NODE_VERSION-linux-$NODE_ARCH.tar.xz\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/$node_archive\" -o \"$scratch/$node_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt\" -o \"$scratch/node-sums\"\n    (cd \"$scratch\"; awk -v name=\"$node_archive\" '$2 == name { print; count++ } END { if (count != 1) exit 1 }' node-sums | sha256sum --strict -c -)\n    install -d -m 755 \"$NODE_DIR\"\n    tar -xJf \"$scratch/$node_archive\" --strip-components=1 -C \"$NODE_DIR\"\n  fi\n  if [[ ! -x \"$BUN_DIR/bun\" ]] || [[ \"$($BUN_DIR/bun --version)\" != \"$BUN_VERSION\" ]]; then\n    bun_folder=\"bun-linux-$BUN_ARCH\"\n    bun_archive=\"$bun_folder.zip\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/$bun_archive\" -o \"$scratch/$bun_archive\"\n    curl --fail --silent --show-error --location --proto '=https' --proto-redir '=https' --tlsv1.2 \"https://github.com/oven-sh/bun/releases/download/bun-v$BUN_VERSION/SHASUMS256.txt\" -o \"$scratch/bun-sums\"\n    (cd \"$scratch\"; awk -v name=\"$bun_archive\" '$2 == name || $2 == \"*\" name { print $1 \"  \" name; count++ } END { if (count != 1) exit 1 }' bun-sums | sha256sum --strict -c -)\n    unzip -q \"$scratch/$bun_archive\" -d \"$scratch/bun\"\n    install -d -m 755 \"$BUN_DIR\"\n    install -m 755 \"$scratch/bun/$bun_folder/bun\" \"$BUN_DIR/bun\"\n  fi\n  runtime_ready\n  ln -sfnT -- \"$NODE_DIR/bin/node\" /usr/local/bin/node\n  ln -sfnT -- \"$NODE_DIR/bin/npm\" /usr/local/bin/npm\n  ln -sfnT -- \"$NODE_DIR/bin/npx\" /usr/local/bin/npx\n  ln -sfnT -- \"$BUN_DIR/bun\" /usr/local/bin/bun\n  rm -rf -- \"$scratch\"\n  trap - RETURN\n}\n\ndependency_install() {\n  local directory\n  for directory in /var/cache/stll-cloud /var/cache/stll-cloud/bun; do\n    [[ ! -L \"$directory\" ]] || fail 'Dependency cache parent must not be a symlink'\n    if [[ -e \"$directory\" ]]; then\n      [[ -d \"$directory\" && \"$(stat -c '%u' \"$directory\")\" == 0 ]] || fail 'Dependency cache parent must be root-owned'\n    fi\n    install -d -m 755 -o root -g root \"$directory\"\n  done\n  [[ ! -L \"$BUN_CACHE\" ]] || fail 'Dependency cache must not be a symlink'\n  if [[ -e \"$BUN_CACHE\" ]]; then\n    [[ -d \"$BUN_CACHE\" && \"$(stat -c '%u' \"$BUN_CACHE\")\" == \"$OUTPUT_UID\" ]] || fail 'Dependency cache ownership differs from the invoking user'\n  fi\n  install -d -m 700 -o \"$OUTPUT_UID\" -g \"$OUTPUT_GID\" \"$BUN_CACHE\"\n  runuser -u \"$OUTPUT_USER\" -- env HOME=\"$OUTPUT_HOME\" BUN_INSTALL_CACHE_DIR=\"$BUN_CACHE\" PATH=\"$PATH\" \"$BUN_DIR/bun\" install --frozen-lockfile\n}\n\n@SERVICE_INSTALL@\n@SERVICE_START@\n\n@ENV_FUNCTIONS@\n\nif [[ \"$MODE\" == install ]]; then\n  install_runtimes\n  install_services\n  dependency_install\n  exit 0\nfi\nruntime_ready\n@ENV_VALIDATE@\nprepare_state\nstart_services\n@ENV_WRITE@\n`;\n\nconst environmentFunctions = String.raw`\nvalidate_environment() {\n  local part target=\"$REPO_ROOT\" env_path=\"$REPO_ROOT/$ENV_FILE\" first_line temporary\n  while IFS= read -r part; do\n    target=\"$target/$part\"\n    [[ ! -L \"$target\" ]] || fail 'Environment path must not contain symbolic links'\n  done < <(printf '%s\\n' \"$ENV_FILE\" | tr '/' '\\n')\n  [[ -d \"$(dirname -- \"$env_path\")\" ]] || fail 'Environment parent directory is missing'\n  if [[ -e \"$env_path\" ]]; then\n    [[ -f \"$env_path\" ]] || fail 'Environment target must be a regular file'\n    IFS= read -r first_line < \"$env_path\" || fail 'Refusing to overwrite an unowned environment file'\n    [[ \"$first_line\" == \"$ENV_MARKER\" ]] || fail 'Refusing to overwrite an unowned environment file'\n  fi\n}\nwrite_environment() {\n  validate_environment\n  local env_path=\"$REPO_ROOT/$ENV_FILE\" temporary\n  temporary=\"$(mktemp \"$(dirname -- \"$env_path\")/.stll-cloud-env.XXXXXX\")\"\n  chmod 600 \"$temporary\"\n  {\n    printf '%s\\n' \"$ENV_MARKER\" 'NODE_ENV=test'\n    if [[ -n \"$DATABASE_URL\" ]]; then printf 'DATABASE_URL=%s\\n' \"$DATABASE_URL\"; fi\n    if [[ -n \"$REDIS_URL\" ]]; then printf 'REDIS_URL=%s\\n' \"$REDIS_URL\"; fi\n  } > \"$temporary\"\n  chown \"$OUTPUT_UID:$OUTPUT_GID\" \"$temporary\"\n  mv -f -- \"$temporary\" \"$env_path\"\n}\n`;\n\nconst shellQuote = (value: string) => `'${value.replaceAll(\"'\", \"'\\\\''\")}'`;\n\nexport const generateCloudSetup = ({\n  policy,\n  cloud,\n  nodeVersion,\n}: GenerateCloudSetupOptions) => {\n  const selected = parseCloudSetup(cloud);\n  if (selected === undefined) throw new Error(\"cloud declaration is required\");\n  const exactNode = nodeVersion.trim();\n  if (\n    valid(exactNode) !== exactNode ||\n    !nodeSelectorMatches(exactNode, policy.node)\n  )\n    throw new Error(\n      \"cloud requires a tracked exact .node-version within the shared Node series\",\n    );\n  const services = cloudServices.filter((service) =>\n    selected.services.includes(service),\n  );\n  const replacements = new Map([\n    [\"@BUN@\", policy.bun],\n    [\"@NODE@\", exactNode],\n    [\n      \"@ENV_ASSIGNMENTS@\",\n      selected.envFile === undefined\n        ? \"\"\n        : `ENV_FILE=${shellQuote(selected.envFile)}\\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`,\n    ],\n    [\n      \"@ENV_FUNCTIONS@\",\n      selected.envFile === undefined ? \"\" : environmentFunctions,\n    ],\n    [\n      \"@ENV_VALIDATE@\",\n      selected.envFile === undefined\n        ? \"\"\n        : \"DATABASE_URL=''\\nREDIS_URL=''\\nvalidate_environment\",\n    ],\n    [\"@ENV_WRITE@\", selected.envFile === undefined ? \"\" : \"write_environment\"],\n    [\n      \"@SERVICE_INSTALL@\",\n      renderCloudServiceInstall({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n        valkeyArtifacts: policy.valkeyArtifacts,\n      }),\n    ],\n    [\n      \"@SERVICE_START@\",\n      renderCloudServiceStart({\n        services,\n        postgres: policy.postgres,\n        valkey: policy.valkey,\n      }),\n    ],\n  ]);\n  return script.replace(/@[A-Z0-9_]+@/g, (token) => {\n    const value = replacements.get(token);\n    if (value === undefined)\n      throw new Error(`Missing cloud setup field: ${token}`);\n    return value;\n  });\n};\n","import path from \"node:path\";\nimport picomatch from \"picomatch\";\n\ntype WorkspaceContainsOptions = {\n  directory: string;\n  file: string;\n  patterns: unknown;\n  rootMembership: \"implicit\" | \"patterns\";\n};\n\n/** Match manifest directories with the same positive and negative workspace patterns. */\nexport const workspaceContains = ({\n  directory,\n  file,\n  patterns,\n  rootMembership,\n}: WorkspaceContainsOptions) => {\n  const relative = path.posix.relative(directory, path.posix.dirname(file));\n  if (relative === \"\" && rootMembership === \"implicit\") return true;\n  if (relative === \"..\" || relative.startsWith(\"../\")) return false;\n  if (!Array.isArray(patterns)) return false;\n  const normalize = (pattern: string) => path.posix.normalize(pattern);\n  const selected = patterns.filter(\n    (value: unknown): value is string => typeof value === \"string\",\n  );\n  return (\n    picomatch(\n      selected.filter((pattern) => !pattern.startsWith(\"!\")).map(normalize),\n    )(relative) &&\n    !picomatch(\n      selected\n        .filter((pattern) => pattern.startsWith(\"!\"))\n        .map((pattern) => normalize(pattern.slice(1))),\n    )(relative)\n  );\n};\n","const record = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null && !Array.isArray(value);\n\n/** Filename class recognized by Dependabot's Docker Compose fetcher. */\nexport const isComposeDefinitionPath = (file: string) =>\n  /^\\.?(?:docker-)?compose(?:-[\\w]+)?(?:\\.[\\w-]+)?\\.ya?ml$/i.test(\n    file.split(\"/\").at(-1) ?? \"\",\n  );\n\n/** Candidate YAML files are classified by their document shape after reading. */\nexport const isKubernetesDefinitionPath = (file: string) =>\n  /^[^.].*\\.ya?ml$/i.test(file.split(\"/\").at(-1) ?? \"\");\n\ntype ContainerImage = { image: unknown; path: (string | number)[] };\ntype ContainerDocument = {\n  ecosystem: \"docker-compose\" | \"docker\";\n  images: ContainerImage[];\n};\n\nexport const kubernetesPodSpecPaths = {\n  Pod: [\"spec\"],\n  Deployment: [\"spec\", \"template\", \"spec\"],\n  DaemonSet: [\"spec\", \"template\", \"spec\"],\n  StatefulSet: [\"spec\", \"template\", \"spec\"],\n  ReplicaSet: [\"spec\", \"template\", \"spec\"],\n  ReplicationController: [\"spec\", \"template\", \"spec\"],\n  Job: [\"spec\", \"template\", \"spec\"],\n  CronJob: [\"spec\", \"jobTemplate\", \"spec\", \"template\", \"spec\"],\n} as const;\n\n/** Shared semantic image enumeration for runtime checks and update-root generation. */\nexport const containerDocumentImages = (\n  document: unknown,\n  file: string,\n): ContainerDocument | undefined => {\n  if (!record(document)) return undefined;\n  const services = document[\"services\"];\n  if (isComposeDefinitionPath(file) && record(services)) {\n    const images: ContainerImage[] = [];\n    for (const [name, service] of Object.entries(services)) {\n      if (record(service) && service[\"image\"] !== undefined)\n        images.push({\n          image: service[\"image\"],\n          path: [\"services\", name, \"image\"],\n        });\n    }\n    return { ecosystem: \"docker-compose\", images };\n  }\n  if (\n    typeof document[\"apiVersion\"] !== \"string\" ||\n    typeof document[\"kind\"] !== \"string\"\n  )\n    return undefined;\n  const images: ContainerImage[] = [];\n  const visited = new Set<Record<string, unknown>>();\n  const walkResource = (\n    resource: Record<string, unknown>,\n    prefix: (string | number)[],\n  ) => {\n    if (visited.has(resource)) return;\n    visited.add(resource);\n    if (\n      typeof resource[\"apiVersion\"] !== \"string\" ||\n      typeof resource[\"kind\"] !== \"string\"\n    )\n      return;\n    if (resource[\"kind\"] === \"List\" && Array.isArray(resource[\"items\"])) {\n      for (const [index, item] of resource[\"items\"].entries())\n        if (record(item)) walkResource(item, [...prefix, \"items\", index]);\n      return;\n    }\n    const specPath = Object.entries(kubernetesPodSpecPaths).find(\n      ([kind]) => kind === resource[\"kind\"],\n    )?.[1];\n    if (specPath === undefined) return;\n    let spec: unknown = resource;\n    for (const key of specPath) spec = record(spec) ? spec[key] : undefined;\n    if (!record(spec)) return;\n    for (const key of [\"containers\", \"initContainers\", \"ephemeralContainers\"]) {\n      const containers = spec[key];\n      if (!Array.isArray(containers)) continue;\n      for (const [index, container] of containers.entries()) {\n        if (record(container) && container[\"image\"] !== undefined)\n          images.push({\n            image: container[\"image\"],\n            path: [...prefix, ...specPath, key, index, \"image\"],\n          });\n      }\n    }\n  };\n  walkResource(document, []);\n  return images.length === 0 ? undefined : { ecosystem: \"docker\", images };\n};\n","import { cloudSetupPath } from \"./cloud-setup\";\nimport {\n  isComposeDefinitionPath,\n  isKubernetesDefinitionPath,\n} from \"./toolchain-container-inputs\";\n\nconst excludedInputPath = (file: string) =>\n  file === \"\" ||\n  file.split(\"/\").some((part) => part === \"node_modules\" || part === \"vendor\");\n\nexport const javascriptDependencyLockfiles = [\n  \"bun.lock\",\n  \"package-lock.json\",\n  \"yarn.lock\",\n  \"pnpm-lock.yaml\",\n] as const;\n\n/** Match project, environment, local, and fragment filenames recognized by mise. */\nexport const isMiseConfigPath = (file: string) =>\n  !excludedInputPath(file) &&\n  (/(?:^|\\/)\\.?mise(?:\\.[^./][^/]*)?\\.toml$/.test(file) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/config(?:\\.[^./][^/]*)?\\.toml$/.test(\n      file,\n    ) ||\n    /(?:^|\\/)(?:\\.?mise|\\.config\\/mise)\\/conf\\.d\\/[^./][^/]*\\.toml$/.test(\n      file,\n    ));\n\n/** GitHub action metadata may live at the repository root or in any directory. */\nexport const githubAutomationFileKind = (file: string) => {\n  if (file === \"\") return undefined;\n  if (/^\\.github\\/workflows\\/[^/]+\\.ya?ml$/.test(file)) return \"workflow\";\n  if (/(?:^|\\/)action\\.ya?ml$/.test(file)) return \"action\";\n  return undefined;\n};\n\n/** Dependabot updates workflows and repository-root action metadata. */\nexport const isDependabotGithubActionsPath = (file: string) => {\n  const kind = githubAutomationFileKind(file);\n  return kind === \"workflow\" || (kind === \"action\" && !file.includes(\"/\"));\n};\n\n/** Use one filename discriminator for reader selection and Python ecosystem decisions. */\nexport const pythonDependencyManifestKind = (file: string) => {\n  if (excludedInputPath(file)) return undefined;\n  const name = file.split(\"/\").at(-1);\n  if (name === \"pyproject.toml\") return \"project\";\n  if (name === \"Pipfile\") return \"pipfile\";\n  if (name === \"Pipfile.lock\") return \"pipfile-lock\";\n  if (name === \"setup.py\" || name === \"setup.cfg\") return \"setup\";\n  if (name !== undefined && /^requirements[^/]*\\.(?:txt|in)$/.test(name))\n    return \"requirements\";\n  return undefined;\n};\n\nexport const isPythonDependencyManifest = (file: string) =>\n  pythonDependencyManifestKind(file) !== undefined;\n\n/** Docker definition names use dot-delimited variants, excluding source and documentation. */\nexport const isDockerDefinitionPath = (file: string) => {\n  if (excludedInputPath(file)) return false;\n  const name = file.split(\"/\").at(-1) ?? \"\";\n  if (\n    /\\.(?:[cm]?[jt]sx?|mdx?|rst|txt|html?|py|rs|go|java|sh|c|cc|cpp|cxx|h|hpp|cs|rb|php|swift|kt|css|scss)$/i.test(\n      name,\n    )\n  )\n    return false;\n  return /^(?:[^./]+\\.)*(?:dockerfile|containerfile)(?:\\.[^./]+)*$/i.test(name);\n};\n\n/** Lockfiles establish ecosystem presence without reading their dependency graphs. */\nexport const toolchainInputKind = (file: string) => {\n  if (file === cloudSetupPath) return \"config\";\n  if (githubAutomationFileKind(file) !== undefined) return \"config\";\n  if (excludedInputPath(file)) return undefined;\n  if (\n    pythonDependencyManifestKind(file) === \"pipfile-lock\" ||\n    javascriptDependencyLockfiles.some(\n      (name) => file.split(\"/\").at(-1) === name,\n    ) ||\n    /(?:^|\\/)uv\\.lock$/.test(file)\n  )\n    return \"presence\";\n  if (\n    githubAutomationFileKind(file) !== undefined ||\n    isMiseConfigPath(file) ||\n    isPythonDependencyManifest(file) ||\n    isDockerDefinitionPath(file) ||\n    isComposeDefinitionPath(file) ||\n    isKubernetesDefinitionPath(file) ||\n    /(?:^|\\/)(?:package\\.json|consumer-compat\\.json|pnpm-workspace\\.yaml|stll-toolchain\\.json|\\.bun-version|\\.node-version|\\.nvmrc|\\.python-version|rust-toolchain(?:\\.toml)?|\\.tool-versions|\\.?mise\\.toml|uv\\.toml|\\.uv\\.toml|\\.github\\/dependabot\\.ya?ml|Cargo\\.toml)$/.test(\n      file,\n    )\n  )\n    return \"config\";\n  return undefined;\n};\n"],"mappings":";;;;;;;AAUA,MAAM,iBAAiB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCjC,MAAM,qBACJ;AACF,MAAM,6BAA6B;AAEnC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0GlC,MAAM,kBAAkB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BlC,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;AA0BhC,MAAM,QAAQ,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BxB,MAAa,6BAA6B,EACxC,UACA,UACA,QACA,sBACgC;CAChC,MAAM,QAAQ,SAAS,KAAK,YAAY;EACtC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,gBACJ,WAAW,cAAc,QAAQ,CAAC,CAClC,WAAW,iBAAiB,kBAAkB,CAAC,CAC/C,WAAW,sBAAsB,0BAA0B;GAChE,KAAK,UAAU;IACb,MAAM,+BAAe,IAAI,IAAI;KAC3B,CAAC,YAAY,MAAM;KACnB,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;KACxD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,GAAG;KACvD,CAAC,sBAAsB,gBAAgB,MAAM,OAAO,MAAM;KAC1D,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,GAAG;KACrD,CAAC,qBAAqB,gBAAgB,MAAM,MAAM,MAAM;IAC1D,CAAC;IACD,OAAO,cAAc,QAAQ,kBAAkB,UAAU;KACvD,MAAM,QAAQ,aAAa,IAAI,KAAK;KACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,kCAAkC,OAAO;KAC3D,OAAO;IACT,CAAC;GACH;GACA,SAEE,MAAM,IAAI,MAAM,wBAAwB,OAAOA,OAAU,GAAG;EAEhE;CACF,CAAC;CACD,MAAM,OACJ,SAAS,WAAW,IAChB,KACA;CACN,OAAO,GAAG,eAAe,IAAI,SAAS,SAAS,UAAU,IAAI,gBAAgB,WAAW,sBAAsB,0BAA0B,IAAI,GAAG,IAAI,SAAS,WAAW,IAAI,6BAA6B,MAAM,0BAA0B,OAAO,MAAM,KAAK,EAAE,EAAE;AAChQ;;;AC3RA,MAAa,gBAAgB,CAAC,YAAY,QAAQ;AAElD,MAAa,sBAAsB;AAEnC,MAAM,gBAAgB,UACpB,cAAc,MAAM,YAAY,UAAU,OAAO;;AAGnD,MAAa,mBAAmB,UAAmB;CACjD,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,yBAAyB;CAC3C,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,QAAQ,cAAc,QAAQ,aAAa,QAAQ,WACrD,MAAM,IAAI,MAAM,0BAA0B,KAAK;CACnD,MAAM,WAAW,cAAc,QAAQ,MAAM,WAAW,CAAC;CACzD,IAAI,CAAC,MAAM,QAAQ,QAAQ,GACzB,MAAM,IAAI,MAAM,+CAA+C;CACjE,IAAI,EAAE,aAAa,UAAU,MAAM,YAAA,iCACjC,MAAM,IAAI,MAAM,iCAAiC,qBAAqB;CACxE,MAAM,uBAAO,IAAI,IAAkB;CACnC,MAAM,WAAW,MAAM,KAAK,WAAW,YAAqB;EAC1D,IAAI,CAAC,aAAa,OAAO,GACvB,MAAM,IAAI,MAAM,gDAAgD;EAClE,IAAI,KAAK,IAAI,OAAO,GAClB,MAAM,IAAI,MAAM,8CAA8C,SAAS;EACzE,KAAK,IAAI,OAAO;EAChB,OAAO;CACT,CAAC;CACD,IAAI,SAAS,WAAW,GAAG;EACzB,IAAI,aAAa,OACf,MAAM,IAAI,MAAM,+CAA+C;EACjE,OAAO;GAAE;GAAU,SAAS;EAAoB;CAClD;CACA,IAAI,EAAE,aAAa,UAAU,OAAO,MAAM,YAAY,UACpD,MAAM,IAAI,MACR,4DACF;CACF,MAAM,UAAU,MAAM;CACtB,IACE,QAAQ,WAAW,GAAG,KACtB,aAAa,KAAK,OAAO,KACzB,QAAQ,SAAS,IAAI,KACrB,UAAU,KAAK,OAAO,KACtB,QACG,MAAM,GAAG,CAAC,CACV,MAAM,SAAS,SAAS,MAAM,SAAS,OAAO,SAAS,IAAI,GAE9D,MAAM,IAAI,MACR,4DACF;CACF,OAAO;EAAE;EAAU,SAAS;EAAqB;CAAQ;AAC3D;;;AC5CA,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8DzB,MAAM,gBAAgB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BhC,MAAM,cAAc,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwC9B,MAAa,2BAA2B,EACtC,UACA,UACA,aACsC;CACtC,IAAI,CAAC,gBAAgB,KAAK,QAAQ,KAAK,CAAC,kBAAkB,KAAK,MAAM,GACnE,MAAM,IAAI,MAAM,sCAAsC;CACxD,IAAI,SAAS,WAAW,GAAG,OAAO;CAClC,MAAM,SAAS,SAAS,KAAK,YAAY;EACvC,QAAQ,SAAR;GACE,KAAK,YACH,OAAO,cAAc,WAAW,cAAc,QAAQ;GACxD,KAAK,UACH,OAAO,YAAY,WAAW,YAAY,MAAM;GAClD,SAEE,MAAM,IAAI,MAAM,8BAA8B,OAAOC,OAAU,GAAG;EAEtE;CACF,CAAC;CACD,OAAO,GAAG,OAAO,wNAAwN,OAAO,KAAK,EAAE,EAAE;AAC3P;;;AChKA,MAAM,mBAAmB;AACzB,MAAM,gBAAgB,IAAI,OAAO,IAAI,iBAAiB,MAAM;AAC5D,MAAM,kBAAkB,IAAI,OAC1B,KAAK,iBAAiB,cAAc,iBAAiB,QAAQ,iBAAiB,OAChF;;AAGA,MAAa,mBAAmB,UAC9B,cAAc,KAAK,KAAK,MAAA,GAAA,OAAA,WAAA,CAAgB,KAAK,MAAM;;AAGrD,MAAa,uBAAuB,OAAgB,WAAmB;CACrE,IAAI,CAAC,gBAAgB,MAAM,KAAK,OAAO,UAAU,UAAU,OAAO;CAClE,MAAM,QAAQ,gBAAgB,KAAK,KAAK,CAAC,GAAG;CAC5C,OACE,UAAU,KAAA,KACV,UAAU,OAAO,MAAM,GAAG,EAAE,MAAA,GAAA,OAAA,WAAA,CACjB,KAAK,MAAM;AAE1B;;AAGA,MAAa,2BAA2B,QAAgB,UAAkB;CACxE,IAAI,CAAC,gBAAgB,MAAM,GAAG,OAAO;CACrC,IAAI;EACF,QAAA,GAAA,OAAA,OAAA,CAAc,QAAQ,KAAK;CAC7B,QAAQ;EACN,OAAO;CACT;AACF;;;ACvBA,MAAa,iBAAiB;AAC9B,MAAa,yBACX;AAQF,MAAM,SAAS,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyHzB,MAAM,uBAAuB,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BvC,MAAM,cAAc,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,EAAE;AAEzE,MAAa,sBAAsB,EACjC,QACA,OACA,kBAC+B;CAC/B,MAAM,WAAW,gBAAgB,KAAK;CACtC,IAAI,aAAa,KAAA,GAAW,MAAM,IAAI,MAAM,+BAA+B;CAC3E,MAAM,YAAY,YAAY,KAAK;CACnC,KAAA,GAAA,OAAA,MAAA,CACQ,SAAS,MAAM,aACrB,CAAC,oBAAoB,WAAW,OAAO,IAAI,GAE3C,MAAM,IAAI,MACR,4EACF;CACF,MAAM,WAAW,cAAc,QAAQ,YACrC,SAAS,SAAS,SAAS,OAAO,CACpC;CACA,MAAM,+BAAe,IAAI,IAAI;EAC3B,CAAC,SAAS,OAAO,GAAG;EACpB,CAAC,UAAU,SAAS;EACpB,CACE,qBACA,SAAS,YAAY,KAAA,IACjB,KACA,YAAY,WAAW,SAAS,OAAO,EAAE,eAAe,WAAW,sBAAsB,GAC/F;EACA,CACE,mBACA,SAAS,YAAY,KAAA,IAAY,KAAK,oBACxC;EACA,CACE,kBACA,SAAS,YAAY,KAAA,IACjB,KACA,qDACN;EACA,CAAC,eAAe,SAAS,YAAY,KAAA,IAAY,KAAK,mBAAmB;EACzE,CACE,qBACA,0BAA0B;GACxB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;GACf,iBAAiB,OAAO;EAC1B,CAAC,CACH;EACA,CACE,mBACA,wBAAwB;GACtB;GACA,UAAU,OAAO;GACjB,QAAQ,OAAO;EACjB,CAAC,CACH;CACF,CAAC;CACD,OAAO,OAAO,QAAQ,kBAAkB,UAAU;EAChD,MAAM,QAAQ,aAAa,IAAI,KAAK;EACpC,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,MAAM,8BAA8B,OAAO;EACvD,OAAO;CACT,CAAC;AACH;;;;AC7NA,MAAa,qBAAqB,EAChC,WACA,MACA,UACA,qBAC8B;CAC9B,MAAM,WAAWC,UAAAA,QAAK,MAAM,SAAS,WAAWA,UAAAA,QAAK,MAAM,QAAQ,IAAI,CAAC;CACxE,IAAI,aAAa,MAAM,mBAAmB,YAAY,OAAO;CAC7D,IAAI,aAAa,QAAQ,SAAS,WAAW,KAAK,GAAG,OAAO;CAC5D,IAAI,CAAC,MAAM,QAAQ,QAAQ,GAAG,OAAO;CACrC,MAAM,aAAa,YAAoBA,UAAAA,QAAK,MAAM,UAAU,OAAO;CACnE,MAAM,WAAW,SAAS,QACvB,UAAoC,OAAO,UAAU,QACxD;CACA,QAAA,GAAA,UAAA,QAAA,CAEI,SAAS,QAAQ,YAAY,CAAC,QAAQ,WAAW,GAAG,CAAC,CAAC,CAAC,IAAI,SAAS,CACtE,CAAC,CAAC,QAAQ,KACV,EAAA,GAAA,UAAA,QAAA,CACE,SACG,QAAQ,YAAY,QAAQ,WAAW,GAAG,CAAC,CAAC,CAC5C,KAAK,YAAY,UAAU,QAAQ,MAAM,CAAC,CAAC,CAAC,CACjD,CAAC,CAAC,QAAQ;AAEd;;;ACnCA,MAAM,UAAU,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;;AAGrE,MAAa,2BAA2B,SACtC,2DAA2D,KACzD,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAC5B;;AAGF,MAAa,8BAA8B,SACzC,mBAAmB,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE;AAQtD,MAAa,yBAAyB;CACpC,KAAK,CAAC,MAAM;CACZ,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,WAAW;EAAC;EAAQ;EAAY;CAAM;CACtC,aAAa;EAAC;EAAQ;EAAY;CAAM;CACxC,YAAY;EAAC;EAAQ;EAAY;CAAM;CACvC,uBAAuB;EAAC;EAAQ;EAAY;CAAM;CAClD,KAAK;EAAC;EAAQ;EAAY;CAAM;CAChC,SAAS;EAAC;EAAQ;EAAe;EAAQ;EAAY;CAAM;AAC7D;;AAGA,MAAa,2BACX,UACA,SACkC;CAClC,IAAI,CAAC,OAAO,QAAQ,GAAG,OAAO,KAAA;CAC9B,MAAM,WAAW,SAAS;CAC1B,IAAI,wBAAwB,IAAI,KAAK,OAAO,QAAQ,GAAG;EACrD,MAAM,SAA2B,CAAC;EAClC,KAAK,MAAM,CAAC,MAAM,YAAY,OAAO,QAAQ,QAAQ,GACnD,IAAI,OAAO,OAAO,KAAK,QAAQ,aAAa,KAAA,GAC1C,OAAO,KAAK;GACV,OAAO,QAAQ;GACf,MAAM;IAAC;IAAY;IAAM;GAAO;EAClC,CAAC;EAEL,OAAO;GAAE,WAAW;GAAkB;EAAO;CAC/C;CACA,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B,OAAO,KAAA;CACT,MAAM,SAA2B,CAAC;CAClC,MAAM,0BAAU,IAAI,IAA6B;CACjD,MAAM,gBACJ,UACA,WACG;EACH,IAAI,QAAQ,IAAI,QAAQ,GAAG;EAC3B,QAAQ,IAAI,QAAQ;EACpB,IACE,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,YAAY,UAE5B;EACF,IAAI,SAAS,YAAY,UAAU,MAAM,QAAQ,SAAS,QAAQ,GAAG;GACnE,KAAK,MAAM,CAAC,OAAO,SAAS,SAAS,QAAQ,CAAC,QAAQ,GACpD,IAAI,OAAO,IAAI,GAAG,aAAa,MAAM;IAAC,GAAG;IAAQ;IAAS;GAAK,CAAC;GAClE;EACF;EACA,MAAM,WAAW,OAAO,QAAQ,sBAAsB,CAAC,CAAC,MACrD,CAAC,UAAU,SAAS,SAAS,OAChC,CAAC,GAAG;EACJ,IAAI,aAAa,KAAA,GAAW;EAC5B,IAAI,OAAgB;EACpB,KAAK,MAAM,OAAO,UAAU,OAAO,OAAO,IAAI,IAAI,KAAK,OAAO,KAAA;EAC9D,IAAI,CAAC,OAAO,IAAI,GAAG;EACnB,KAAK,MAAM,OAAO;GAAC;GAAc;GAAkB;EAAqB,GAAG;GACzE,MAAM,aAAa,KAAK;GACxB,IAAI,CAAC,MAAM,QAAQ,UAAU,GAAG;GAChC,KAAK,MAAM,CAAC,OAAO,cAAc,WAAW,QAAQ,GAClD,IAAI,OAAO,SAAS,KAAK,UAAU,aAAa,KAAA,GAC9C,OAAO,KAAK;IACV,OAAO,UAAU;IACjB,MAAM;KAAC,GAAG;KAAQ,GAAG;KAAU;KAAK;KAAO;IAAO;GACpD,CAAC;EAEP;CACF;CACA,aAAa,UAAU,CAAC,CAAC;CACzB,OAAO,OAAO,WAAW,IAAI,KAAA,IAAY;EAAE,WAAW;EAAU;CAAO;AACzE;;;ACtFA,MAAM,qBAAqB,SACzB,SAAS,MACT,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,SAAS,kBAAkB,SAAS,QAAQ;AAE7E,MAAa,gCAAgC;CAC3C;CACA;CACA;CACA;AACF;;AAGA,MAAa,oBAAoB,SAC/B,CAAC,kBAAkB,IAAI,MACtB,0CAA0C,KAAK,IAAI,KAClD,qEAAqE,KACnE,IACF,KACA,iEAAiE,KAC/D,IACF;;AAGJ,MAAa,4BAA4B,SAAiB;CACxD,IAAI,SAAS,IAAI,OAAO,KAAA;CACxB,IAAI,sCAAsC,KAAK,IAAI,GAAG,OAAO;CAC7D,IAAI,yBAAyB,KAAK,IAAI,GAAG,OAAO;AAElD;;AAGA,MAAa,iCAAiC,SAAiB;CAC7D,MAAM,OAAO,yBAAyB,IAAI;CAC1C,OAAO,SAAS,cAAe,SAAS,YAAY,CAAC,KAAK,SAAS,GAAG;AACxE;;AAGA,MAAa,gCAAgC,SAAiB;CAC5D,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE;CAClC,IAAI,SAAS,kBAAkB,OAAO;CACtC,IAAI,SAAS,WAAW,OAAO;CAC/B,IAAI,SAAS,gBAAgB,OAAO;CACpC,IAAI,SAAS,cAAc,SAAS,aAAa,OAAO;CACxD,IAAI,SAAS,KAAA,KAAa,kCAAkC,KAAK,IAAI,GACnE,OAAO;AAEX;AAEA,MAAa,8BAA8B,SACzC,6BAA6B,IAAI,MAAM,KAAA;;AAGzC,MAAa,0BAA0B,SAAiB;CACtD,IAAI,kBAAkB,IAAI,GAAG,OAAO;CACpC,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK;CACvC,IACE,0GAA0G,KACxG,IACF,GAEA,OAAO;CACT,OAAO,4DAA4D,KAAK,IAAI;AAC9E;;AAGA,MAAa,sBAAsB,SAAiB;CAClD,IAAI,SAAA,0BAAyB,OAAO;CACpC,IAAI,yBAAyB,IAAI,MAAM,KAAA,GAAW,OAAO;CACzD,IAAI,kBAAkB,IAAI,GAAG,OAAO,KAAA;CACpC,IACE,6BAA6B,IAAI,MAAM,kBACvC,8BAA8B,MAC3B,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,IACvC,KACA,oBAAoB,KAAK,IAAI,GAE7B,OAAO;CACT,IACE,yBAAyB,IAAI,MAAM,KAAA,KACnC,iBAAiB,IAAI,KACrB,2BAA2B,IAAI,KAC/B,uBAAuB,IAAI,KAC3B,wBAAwB,IAAI,KAC5B,2BAA2B,IAAI,KAC/B,uQAAuQ,KACrQ,IACF,GAEA,OAAO;AAEX"}