@supatype/cli 0.1.5 → 0.1.7

package/dist/self-host-compose.js

@@ -3,9 +3,11 @@ import { dirname, join, relative, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 import { requireDockerDaemon } from "./docker-runtime.js";
 import { fatalError } from "./ui/fatal.js";
-import { preferredFunctionsPathFromProject, selfHostTlsEnabled } from "./project-config.js";
+import { apiSchemaList, externalDatabaseUrl, hooksPathFromProject, preferredFunctionsPathFromProject, realtimeEnabled, serviceRoleRoutes, selfHostTlsEnabled, usesExternalDatabase, } from "./project-config.js";
 import { hasEngineOverride, hasStudioOverride, pinnedVersion, fetchLatestVersion, VERSION_PIN_LOCAL } from "./binary-cache.js";
 import { buildKongDeclarative } from "./kong-config.js";
+import { readEnvFile } from "./env-file.js";
+import { fieldMaskingTierFromProject } from "./field-masking-tier.js";
 /** Env keys written when `versions` pins exist in supatype.config.ts. */
 export const COMPOSE_PINNED_IMAGE_ENV_KEYS = [
     "SUPATYPE_ENGINE_IMAGE",
@@ -159,6 +161,42 @@ function relativeFromProjectRoot(cwd, target) {
 function kongMountPath(_cwd) {
     return ".supatype/self-host/kong.yml";
 }
+/**
+ * The DSN every service uses for the schema-owning role.
+ *
+ * One expression instead of six identical constructions of `@db:5432`. With an external database it
+ * becomes `${DATABASE_URL:?…}`: the URL is the operator's, so there is nothing for the generator to
+ * build — and interpolating the value into the compose file would write a password into a generated
+ * file. Compose resolves the variable from `.env` at up-time, the same place the config's
+ * `process.env.DATABASE_URL` read it from.
+ */
+function ownerDatabaseUrl(config, scheme = "postgresql") {
+    if (usesExternalDatabase(config)) {
+        return "${DATABASE_URL:?DATABASE_URL is missing from .env — required by database.external}";
+    }
+    return (`${scheme}://\${POSTGRES_USER:-supatype_admin}:` +
+        "\${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is missing from .env}" +
+        "@db:5432/\${POSTGRES_DB:-supatype}");
+}
+/**
+ * PostgREST's DSN, which connects as `authenticator` rather than the owner.
+ *
+ * For an external database the host, port, database and query string are taken from the operator's
+ * URL and only the password stays a variable. The alternative — a second full URL in `.env` — is one
+ * more thing to keep in step with the first, and two URLs that disagree about *which database* is a
+ * split-brain nobody notices until the API is serving one and migrations are landing in the other.
+ * A hostname is not the secret here; the password is, and it stays out of the generated file.
+ */
+function postgrestDatabaseUrl(config) {
+    const password = "${AUTHENTICATOR_PASSWORD:?AUTHENTICATOR_PASSWORD is missing from .env}";
+    const externalUrl = externalDatabaseUrl(config);
+    if (externalUrl === undefined) {
+        return `postgresql://authenticator:${password}@db:5432/\${POSTGRES_DB:-supatype}`;
+    }
+    const parsed = new URL(externalUrl);
+    const port = parsed.port ? `:${parsed.port}` : "";
+    return `postgresql://authenticator:${password}@${parsed.hostname}${port}${parsed.pathname}${parsed.search}`;
+}
 /** Host Vite dev server as seen from Kong inside Docker Compose. */
 export const COMPOSE_STUDIO_HOST_URL = "http://host.docker.internal:3002";
 /** Studio container — always Docker Hub unless SUPATYPE_STUDIO_IMAGE is set in .env. */
@@ -200,6 +238,14 @@ function serverAppEnvForCompose(config, devLocal) {
 export function renderSelfHostCompose(config, cwd = process.cwd(), options) {
     const projectMount = projectMountPath(cwd);
     const kongMount = kongMountPath(cwd);
+    const external = usesExternalDatabase(config);
+    const ownerUrl = ownerDatabaseUrl(config);
+    // GoTrue's driver wants the `postgres://` spelling; an external URL is used as given.
+    const gotrueUrl = external ? ownerUrl : ownerDatabaseUrl(config, "postgres");
+    // An external URL may already carry query parameters (`?sslmode=require` is common on managed
+    // providers), and appending a second `?` produces a DSN that fails to parse.
+    const gotrueSearchPathSeparator = externalDatabaseUrl(config)?.includes("?") ? "&" : "?";
+    const postgrestUrl = postgrestDatabaseUrl(config);
     const devLocal = options?.devLocal === true;
     const tlsEnabled = selfHostTlsEnabled(config, devLocal);
     const domain = config.server.domain?.trim() ?? "";
@@ -274,60 +320,122 @@ ${studioService}
   #   server: { mode: "standalone", domain: "your.domain", tls: { email: "you@example.com" } }
   # then re-run \`supatype self-host compose up -d\`. Kong publishes :80/:443 and provisions certs automatically.
 `;
+    // An external database is not ours to declare a volume for.
     const volumesBlock = `volumes:
-  db-data:
-  minio-data:
+${external ? "" : "  db-data:\n"}  minio-data:
   valkey-data:
 `;
-    return `# Generated by supatype self-host compose
-# Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
-services:
-  db:
+    // `depends_on` for the services that talk to Postgres. With an external database there is no
+    // container to wait on, so the clause disappears entirely and each service retries on connect
+    // instead — which is also what covers a database that restarts *after* boot, something no
+    // healthcheck ever did.
+    const dbDependencyClause = external
+        ? ""
+        : `      db:
+        condition: service_healthy
+`;
+    const dbDependency = external ? "" : `    depends_on:\n${dbDependencyClause}`;
+    // Realtime, omitted entirely when the project has turned it off.
+    //
+    // Not started-and-disabled: the service degrades gracefully on its own (it reports the reason on
+    // /health/ready rather than crash-looping), so this switch is for the operator who has read
+    // `supatype db check`, knows their database cannot do logical decoding, and would rather not run a
+    // container that can only report that. The server then has no realtime URL, which is what makes
+    // subscription requests fail with a clear route error instead of hanging against a dead upstream.
+    const realtime = realtimeEnabled(config);
+    const realtimeBlock = realtime
+        ? `  realtime:
+    image: \${SUPATYPE_REALTIME_IMAGE:-supatype/realtime:latest}
+    expose:
+      - "4000"
+    environment:
+      PORT: "4000"
+      DATABASE_URL: "${ownerUrl}"
+      JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
+      SLOT_NAME: supatype_realtime
+      # Matches the publication the supatype/postgres image creates. Read by nothing today —
+      # wal2json decodes from the slot — and kept for a future pgoutput decoder.
+      PUBLICATION_NAME: supatype_realtime
+${dbDependency}`
+        : `  # No \`realtime\` service: database.external.realtime is false. Subscriptions are
+  # unavailable; REST, storage, auth and functions are unaffected.
+`;
+    const realtimeDependency = realtime
+        ? `      realtime:
+        condition: service_started
+`
+        : "";
+    const realtimeServerEnv = realtime ? "      SUPATYPE_REALTIME_URL: http://realtime:4000" : "";
+    const dbServiceBlock = external
+        ? `  # No \`db\` service: database.external points this stack at a Postgres it does not manage.
+  # Every service reads \${DATABASE_URL} from .env, and \`supatype db check\` reports what that
+  # database still needs (roles, extensions, wal_level for realtime).
+`
+        : `  db:
     image: \${SUPATYPE_POSTGRES_IMAGE:-supatype/postgres:latest}
     environment:
       POSTGRES_USER: \${POSTGRES_USER:-supatype_admin}
-      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:-postgres}
+      POSTGRES_PASSWORD: \${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is missing from .env}
       POSTGRES_DB: \${POSTGRES_DB:-supatype}
+      # Read by the image's init to password the \`authenticator\` role PostgREST connects as.
+      AUTHENTICATOR_PASSWORD: \${AUTHENTICATOR_PASSWORD:?AUTHENTICATOR_PASSWORD is missing from .env}
 ${dbPorts}    volumes:
       - db-data:/var/lib/postgresql/data
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U \${POSTGRES_USER:-supatype_admin}"]
+      # -h 127.0.0.1 forces TCP. Without it \`pg_isready\` uses the Unix socket, which the
+      # entrypoint's temporary init server is already listening on while TCP is still refused —
+      # so the container reported healthy, \`depends_on: service_healthy\` released, and every
+      # service that connects over the network died with ECONNREFUSED on first boot. PostgREST
+      # survived only because it retries. Observed on a clean stack: server, storage and
+      # realtime all exited 1 while db said "healthy".
+      test: ["CMD-SHELL", "pg_isready -h 127.0.0.1 -U \${POSTGRES_USER:-supatype_admin} -d \${POSTGRES_DB:-supatype}"]
       interval: 5s
       timeout: 5s
+      # First boot runs initdb plus every bootstrap migration. Failures inside the start period
+      # do not count against retries, so a slow init waits rather than being declared unhealthy.
+      start_period: 90s
       retries: 20
 
-  postgrest:
+`;
+    return `# Generated by supatype self-host compose
+# Kong → supatype-server (unified gateway) → internal PostgREST / storage / etc.
+services:
+${dbServiceBlock}  postgrest:
     image: postgrest/postgrest:v12.2.8
     expose:
       - "3000"
     environment:
-      PGRST_DB_URI: postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}
-      PGRST_DB_SCHEMA: "public, supatype, graphql_public, auth"
+      # Connects as \`authenticator\`, not \${POSTGRES_USER} — which is a superuser, and a
+      # superuser session may SET ROLE to any role in the cluster, so a request whose JWT
+      # named one got it. \`authenticator\` is NOINHERIT with membership in only
+      # anon/authenticated/service_role, so the same SET ROLE is refused.
+      #
+      # Its own credential, not POSTGRES_PASSWORD: yours is for direct SQL access and
+      # rotating it must not take the REST API down. \`supatype init\` generates this.
+      PGRST_DB_URI: ${postgrestUrl}
+      # Derived from schema.pg_schema (or schema.api_schemas). Hardcoding this is why choosing a
+      # non-public pg_schema used to give a correct push and an API that answered PGRST106 for
+      # everything — the engine moved and PostgREST was never told.
+      PGRST_DB_SCHEMA: "${apiSchemaList(config, options?.fieldMaskingTier)}"
       PGRST_DB_ANON_ROLE: anon
-      PGRST_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      PGRST_JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
       PGRST_DB_EXTRA_SEARCH_PATH: public,extensions
       PGRST_DB_POOL: 3
-    depends_on:
-      db:
-        condition: service_healthy
-
+${dbDependency}
   storage:
     image: \${SUPATYPE_STORAGE_IMAGE:-supatype/storage:latest}
     expose:
       - "5000"
     environment:
       PORT: 5000
-      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
-      JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      DATABASE_URL: "${ownerUrl}"
+      JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
       S3_ENDPOINT: http://minio:9000
       S3_REGION: us-east-1
       S3_ACCESS_KEY: supatype
       S3_SECRET_KEY: supatype-secret
       S3_FORCE_PATH_STYLE: "true"
-    depends_on:
-      db:
-        condition: service_healthy
-
+${dbDependency}
   functions-worker:
     image: \${SUPATYPE_FUNCTIONS_WORKER_IMAGE:-supatype/functions-worker:latest}
     expose:
@@ -337,31 +445,26 @@ ${dbPorts}    volumes:
     environment:
       SUPATYPE_FUNCTIONS_ROOT: /project/functions
       SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
+      # Model hooks, served by this same worker under a hooks/ route the gateway refuses from
+      # outside. One worker rather than two: a second container would cost a pod per project on
+      # cloud, for isolation the route boundary already provides.
+      SUPATYPE_HOOKS_ROOT: /project/hooks
       PORT: "8001"
-      SUPATYPE_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
+      # In-compose loopback to Kong (not API_EXTERNAL_URL / localhost — unreachable from this container).
+      SUPATYPE_URL: http://kong:8000
+      SUPATYPE_INTERNAL_URL: http://kong:8000
       SUPATYPE_ANON_KEY: \${ANON_KEY:-}
+      # Present so the worker can hand it to hooks — which are procedural and unreachable from
+      # outside — and to the public functions named below. Withheld from every other handler before
+      # any of them is imported: a function is a public endpoint, and an ambient admin credential made
+      # each one able to read past every access rule in the schema.
       SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
+      SUPATYPE_SERVICE_ROLE_ROUTES: "${serviceRoleRoutes(config).join(",")}"
       STRIPE_SECRET_KEY: \${STRIPE_SECRET_KEY:-}
       STRIPE_WEBHOOK_SECRET: \${STRIPE_WEBHOOK_SECRET:-}
       SITE_URL: \${SITE_URL:-\${API_EXTERNAL_URL:-${externalUrlFallback}}}
-    depends_on:
-      db:
-        condition: service_healthy
-
-  realtime:
-    image: \${SUPATYPE_REALTIME_IMAGE:-supatype/realtime:latest}
-    expose:
-      - "4000"
-    environment:
-      PORT: "4000"
-      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
-      JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
-      SLOT_NAME: supatype_realtime
-      PUBLICATION_NAME: supatype_realtime_pub
-    depends_on:
-      db:
-        condition: service_healthy
-
+${dbDependency}
+${realtimeBlock}
   control-plane:
     image: \${SUPATYPE_CONTROL_PLANE_IMAGE:-supatype/control-plane:latest}
     expose:
@@ -373,16 +476,13 @@ ${dbPorts}    volumes:
       PORT: "8080"
       SUPATYPE_PROJECT_REF: ${JSON.stringify(config.project.name)}
       SUPATYPE_PROJECT_ROOT: /project
-      DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      DATABASE_URL: "${ownerUrl}"
       SUPATYPE_FUNCTIONS_ROOT: /project/functions
       SUPATYPE_STATIC_ROOT: /project/${staticDir.replace(/^\.\//, "")}
       SUPATYPE_DEPLOYMENTS_DIR: /project/.supatype/deployments
       COMPOSE_PROJECT_NAME: ${composeProject}
       SUPATYPE_ENGINE_BIN: supatype-engine
-    depends_on:
-      db:
-        condition: service_healthy
-
+${dbDependency}
   server:
     image: \${SUPATYPE_SERVER_IMAGE:-\${SUPATYPE_AUTH_IMAGE:-supatype/server:latest}}
 ${serverPorts}    volumes:
@@ -399,10 +499,10 @@ ${serverPorts}    volumes:
       SUPATYPE_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       SUPATYPE_ANON_KEY: \${ANON_KEY:-}
       SUPATYPE_SERVICE_ROLE_KEY: \${SERVICE_ROLE_KEY:-}
-      SUPATYPE_SQL_DATABASE_URL: "postgresql://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}"
+      SUPATYPE_SQL_DATABASE_URL: "${ownerUrl}"
       SUPATYPE_DENO_FUNCTIONS_DIR: /project/functions
       SUPATYPE_FUNCTIONS_WORKER_URL: http://functions-worker:8001
-      SUPATYPE_REALTIME_URL: http://realtime:4000
+${realtimeServerEnv}
       SUPATYPE_CONTROL_PLANE_URL: http://control-plane:8080
       SUPATYPE_VALKEY_ADDR: valkey:6379
 ${appEnv}
@@ -411,9 +511,9 @@ ${appEnv}
       API_EXTERNAL_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       GOTRUE_API_EXTERNAL_URL: \${API_EXTERNAL_URL:-${externalUrlFallback}}
       GOTRUE_DB_DRIVER: postgres
-      GOTRUE_DB_DATABASE_URL: "postgres://\${POSTGRES_USER:-supatype_admin}:\${POSTGRES_PASSWORD:-postgres}@db:5432/\${POSTGRES_DB:-supatype}?search_path=auth"
+      GOTRUE_DB_DATABASE_URL: "${gotrueUrl}${gotrueSearchPathSeparator}search_path=auth"
       GOTRUE_SITE_URL: \${SITE_URL:-${siteUrlFallback}}
-      GOTRUE_JWT_SECRET: \${JWT_SECRET:-super-secret-jwt-token-change-in-production}
+      GOTRUE_JWT_SECRET: \${JWT_SECRET:?JWT_SECRET is missing from .env}
       GOTRUE_JWT_EXP: 3600
       GOTRUE_JWT_AUD: authenticated
       GOTRUE_JWT_DEFAULT_GROUP_NAME: authenticated
@@ -422,9 +522,7 @@ ${appEnv}
       GOTRUE_DISABLE_SIGNUP: \${DISABLE_SIGNUP:-false}
 ${devLocal ? "      STUDIO_OPEN_DEV: \"1\"\n" : ""}
     depends_on:
-      db:
-        condition: service_healthy
-      valkey:
+${dbDependencyClause}      valkey:
         condition: service_started
       postgrest:
         condition: service_started
@@ -432,9 +530,7 @@ ${devLocal ? "      STUDIO_OPEN_DEV: \"1\"\n" : ""}
         condition: service_started
       functions-worker:
         condition: service_started
-      realtime:
-        condition: service_started
-      control-plane:
+${realtimeDependency}      control-plane:
         condition: service_started
 
   minio:
@@ -453,10 +549,7 @@ ${minioPorts}    volumes:
     volumes:
       - ${projectMount}:/project
     working_dir: /project
-    depends_on:
-      db:
-        condition: service_healthy
-${studioBlock}${valkeyBlock}${tlsHintComment}  kong:
+${dbDependency}${studioBlock}${valkeyBlock}${tlsHintComment}  kong:
     image: kong:3.6
     environment:
       KONG_DATABASE: "off"
@@ -474,30 +567,169 @@ ${kongDependsOn}${kongValkeyDepends}
 
 ${volumesBlock}`;
 }
-function ensureComposeManifest(cwd) {
+/** In-compose worker address — matches the `functions-worker` service this file always generates. */
+const COMPOSE_FUNCTIONS_WORKER_URL = "http://functions-worker:8001";
+function ensureComposeManifest(cwd, config) {
     const manifestPath = join(cwd, ".supatype", "manifest.json");
-    if (existsSync(manifestPath))
-        return;
     mkdirSync(dirname(manifestPath), { recursive: true });
+    // The manifest is generated, not operator-authored, but `push` writes real values into it (the
+    // schema, for one), so an existing file is repaired rather than replaced.
+    if (existsSync(manifestPath)) {
+        repairComposeFunctionsFlag(manifestPath);
+        return;
+    }
     const manifest = {
         schema: "public",
         postgrest_url: "http://postgrest:3000",
         storage_url: "http://storage:5000",
-        realtime_enabled: true,
-        realtime_url: "http://realtime:4000",
-        functions_enabled: false,
+        // Matches the compose file: a manifest advertising a service that was not generated is how
+        // the server ends up proxying subscriptions to a host that does not resolve.
+        realtime_enabled: realtimeEnabled(config),
+        ...(realtimeEnabled(config) && { realtime_url: "http://realtime:4000" }),
+        // True because this file *always* generates a `functions-worker` service and hands the server
+        // `SUPATYPE_FUNCTIONS_WORKER_URL`. It said false, so the server answered 404 for every function
+        // in a stack that was running a worker for them — provisioned, then switched off.
+        functions_enabled: true,
+        functions_worker_url: COMPOSE_FUNCTIONS_WORKER_URL,
     };
     writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
 }
+/**
+ * Turn functions on in a manifest written by an older CLI, leaving every other key alone.
+ *
+ * Without this, only new projects get working functions: a stack generated before the flag was
+ * corrected keeps `functions_enabled: false` on disk, and regenerating the compose file — the
+ * obvious thing to try — does not fix it.
+ */
+function repairComposeFunctionsFlag(manifestPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+    }
+    catch {
+        return; // Malformed: leave it for the server to complain about rather than overwrite it here.
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return;
+    if (parsed["functions_enabled"] === true && parsed["functions_worker_url"] !== undefined)
+        return;
+    parsed["functions_enabled"] = true;
+    if (parsed["functions_worker_url"] === undefined) {
+        parsed["functions_worker_url"] = COMPOSE_FUNCTIONS_WORKER_URL;
+    }
+    writeFileSync(manifestPath, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");
+}
 function ensureProjectFunctionsDir(cwd, config) {
     mkdirSync(preferredFunctionsPathFromProject(config, cwd), { recursive: true });
+    // Both roots must exist before compose mounts the project read-only: a missing directory becomes
+    // a bind mount of a file that is not there, and the worker fails to start rather than serving the
+    // half it does have.
+    mkdirSync(hooksPathFromProject(config, cwd), { recursive: true });
+}
+/**
+ * The config's external URL and `.env`'s `DATABASE_URL` must be the same string.
+ *
+ * The CLI resolves the URL from config; Compose substitutes `.env` at up-time. If the two disagree,
+ * `push` migrates one database while the services serve another — which reads as data loss and
+ * isn't. It also makes the generated GoTrue DSN wrong, since whether to append `search_path` with
+ * `?` or `&` is decided from the config URL's query string.
+ */
+function assertExternalUrlMatchesEnv(cwd, config) {
+    const configured = externalDatabaseUrl(config);
+    if (configured === undefined)
+        return;
+    const fromEnv = readEnvFile(cwd)["DATABASE_URL"];
+    if (fromEnv === undefined) {
+        // Nothing to disagree with. Compose's own `:?` guard reports this at up-time, and the operator
+        // may be exporting the variable in their shell rather than keeping a file.
+        return;
+    }
+    if (fromEnv.trim() === configured)
+        return;
+    fatalError("DATABASE_URL in .env does not match database.external.url", [
+        `.env:    ${fromEnv.trim()}`,
+        `config:  ${configured}`,
+        "",
+        "The CLI connects using the config value and the stack connects using .env, so a push would",
+        "land in one database while the services serve the other.",
+        "Point the config at the same variable to keep them in step:",
+        "  database: { external: { url: process.env.DATABASE_URL! } }",
+    ], { brand: { intro: "Self-host compose" } });
+}
+/**
+ * A loopback host in the external URL cannot work from inside a container.
+ *
+ * `127.0.0.1` means "this container" to every service in the stack, so an external database on the
+ * host machine is unreachable — while the *CLI* reaches it fine, because the CLI runs on the host.
+ * That asymmetry is the trap: `supatype db check` passes, `push` applies the schema, and then
+ * storage, realtime and the server all die with ECONNREFUSED against their own loopback. Found by
+ * rehearsing exactly that.
+ *
+ * Refused rather than rewritten. The compose file interpolates one `${DATABASE_URL}` for every
+ * service, so silently substituting a different host would mean the CLI and the stack no longer
+ * agree about which database they are talking to — the thing every other check here exists to
+ * prevent.
+ */
+export function loopbackExternalHost(config) {
+    const url = externalDatabaseUrl(config);
+    if (url === undefined)
+        return undefined;
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return undefined; // Shape is validated at config load; nothing useful to add here.
+    }
+    // Node strips the brackets from an IPv6 hostname, and 127.0.0.0/8 is all loopback.
+    const loopback = host === "localhost" ||
+        host === "::1" ||
+        host === "[::1]" ||
+        /^127\.\d+\.\d+\.\d+$/.test(host);
+    return loopback ? host : undefined;
+}
+function assertExternalUrlReachableFromContainers(config) {
+    const host = loopbackExternalHost(config);
+    if (host === undefined)
+        return;
+    fatalError(`database.external.url points at ${host}, which no container can reach`, [
+        "Inside a container, localhost is that container — not the machine running Docker. Every",
+        "service in the stack would fail to connect, while the CLI succeeds because it runs on the host.",
+        "",
+        "Use a host the containers can resolve:",
+        "  host.docker.internal   (Docker Desktop on macOS and Windows)",
+        "  172.17.0.1             (the docker0 bridge on Linux, or add an extra_hosts entry)",
+        "  the database's LAN address or hostname",
+        "",
+        "The CLI reaches the same address, so one value keeps working for both.",
+    ], { brand: { intro: "Self-host compose" } });
+}
+/**
+ * The tier to write into the compose file.
+ *
+ * Resolved here so every caller gets it, rather than threaded through four call sites that load the
+ * schema a moment later anyway. A schema that fails to load falls back to the default list: compose
+ * generation is the wrong place to report a syntax error, and `push`/`dev` do it properly seconds
+ * later with the file and line.
+ */
+function resolveFieldMaskingTier(cwd, config, options) {
+    if (options?.fieldMaskingTier !== undefined)
+        return options.fieldMaskingTier;
+    return fieldMaskingTierFromProject(cwd, config);
 }
 export function writeSelfHostCompose(cwd, config, options) {
+    assertExternalUrlMatchesEnv(cwd, config);
+    const tier = resolveFieldMaskingTier(cwd, config, options);
+    const resolved = {
+        ...options,
+        ...(tier !== undefined && { fieldMaskingTier: tier }),
+    };
+    assertExternalUrlReachableFromContainers(config);
     const paths = selfHostComposePaths(cwd);
     mkdirSync(paths.dir, { recursive: true });
     ensureProjectFunctionsDir(cwd, config);
-    ensureComposeManifest(cwd);
-    writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd, options), "utf8");
+    ensureComposeManifest(cwd, config);
+    writeFileSync(paths.composePath, renderSelfHostCompose(config, cwd, resolved), "utf8");
     const studioHostDev = options?.devLocal === true && hasStudioOverride(config);
     const tlsEnabled = selfHostTlsEnabled(config, options?.devLocal === true);
     const domain = config.server.domain?.trim();

package/dist/self-host-compose.js.map

@@ -1 +1 @@
-{"version":3,"file":"self-host-compose.js","sourceRoot":"","sources":["../src/self-host-compose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAA2B,MAAM,qBAAqB,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EAAE,iCAAiC,EAAE,kBAAkB,EAA8B,MAAM,qBAAqB,CAAA;AACvH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AAEvD,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,uBAAuB;IACvB,uBAAuB;IACvB,yBAAyB;CACjB,CAAA;AAEV,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,GAAG,6BAA6B;IAChC,8BAA8B;IAC9B,qBAAqB;IACrB,uBAAuB;IACvB,wBAAwB;IACxB,iCAAiC;CACzB,CAAA;AAIV,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAC5B,SAA6B,EAC7B,OAAe,EACf,MAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAC9B,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,0BAA0B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAA;QACtF,KAAK,QAAQ;YACX,OAAO,mBAAmB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAA;QAC/E,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,qBAAqB,OAAO,EAAE,CAAA;YACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACnC,OAAO,qBAAqB,KAAK,SAAS,CAAA;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAA;IAEzB,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,GAAG,CAAC,qBAAqB,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,GAAG,CAAC,qBAAqB,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACjE,GAAG,CAAC,uBAAuB,GAAG,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC1F,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,iBAAiB;QACrC,QAAQ,CAAC,MAAM,KAAK,iBAAiB;QACrC,QAAQ,CAAC,QAAQ,KAAK,iBAAiB;QACvC,QAAQ,CAAC,IAAI,KAAK,iBAAiB,CACpC,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAA6B,EAC7B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAA;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA6B;IAE7B,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AASD,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IAClD,OAAO;QACL,GAAG;QACH,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QAC5C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;KACnC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC5C,OAAO,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yFAAyF;AACzF,SAAS,uBAAuB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,GAAG,GAAG,KAAK,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,8BAA8B,CAAA;AACvC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAA;AAEzE,wFAAwF;AACxF,SAAS,kBAAkB;IACzB,OAAO,8DAA8D,CAAA;AACvE,CAAC;AAED,qFAAqF;AACrF,SAAS,uBAAuB,CAAC,QAAgB,EAAE,QAAiB;IAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjE,GAAG,CAAC,QAAQ,GAAG,sBAAsB,CAAA;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA6B,EAAE,QAAiB;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAA;IACtC,MAAM,KAAK,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,UAAU,CAAA;QACrD,KAAK,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,gCAAgC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,gCAAgC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAC7F,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAOD,MAAM,UAAU,qBAAqB,CACnC,MAA6B,EAC7B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC;IAEhC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAA;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjD,+FAA+F;IAC/F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAA;IACvF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAA;IAClF,MAAM,aAAa,GAAG,QAAQ,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAA;IACzD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;EAEJ,aAAa;;2DAE4C,mBAAmB;;;CAG7E,CAAA;IACC,MAAM,aAAa,GAAG,aAAa;QACjC,CAAC,CAAC;sBACgB;QAClB,CAAC,CAAC;;sBAEgB,CAAA;IACpB,MAAM,eAAe,GAAG,CAAC,QAAQ,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,eAAe;QAC7B,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC;;CAEP;YACK,CAAC,CAAC;;CAEP;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;CAEL,CAAA;IACC,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;CAGL,CAAA;IACC,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC;;;CAGL;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC;mBACa;QACf,CAAC,CAAC,8CAA8C,CAAA;IAClD,MAAM,WAAW,GAAG;;;;;;;;CAQrB,CAAA;IACC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;IAC5C,MAAM,cAAc,GAAG,UAAU;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;CAGL,CAAA;IACC,MAAM,YAAY,GAAG;;;;CAItB,CAAA;IAEC,OAAO;;;;;;;;;EASP,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA6CC,YAAY;;;;;2CAKqB,mBAAmB;;;;;oDAKV,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;UAwB7D,YAAY;;;;8BAIQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;;;;uCAI1B,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;8BAEvC,cAAc;;;;;;;;EAQ1C,WAAW;UACH,YAAY;;;uBAGC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;;;;;;;2CAOX,mBAAmB;;;;;;;;;EAS5D,MAAM;;;+CAGuC,mBAAmB;sDACZ,mBAAmB;;;sCAGnC,eAAe;;;;;;;;EAQnD,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;;;;;;;;;;;;;;;;;;;;;;;EAuBhD,UAAU;;;;;;;;UAQF,YAAY;;;;;EAKpB,WAAW,GAAG,WAAW,GAAG,cAAc;;;;;;;;;EAS1C,UAAU;UACF,SAAS;;EAEjB,SAAS;;EAET,aAAa,GAAG,iBAAiB;;EAEjC,YAAY,EAAE,CAAA;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAA;IAC5D,IAAI,UAAU,CAAC,YAAY,CAAC;QAAE,OAAM;IACpC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,qBAAqB;QAClC,gBAAgB,EAAE,IAAI;QACtB,YAAY,EAAE,sBAAsB;QACpC,iBAAiB,EAAE,KAAK;KACzB,CAAA;IACD,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC/E,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW,EAAE,MAA6B;IAC3E,SAAS,CAAC,iCAAiC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAA6B,EAC7B,OAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACvC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACtC,qBAAqB,CAAC,GAAG,CAAC,CAAA;IAC1B,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAA;IACrF,MAAM,aAAa,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC7E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClD,aAAa,CACX,KAAK,CAAC,QAAQ,EACd,oBAAoB,CAAC;QACnB,cAAc,EAAE,IAAI;QACpB,GAAG,CAAC,aAAa,IAAI;YACnB,gBAAgB,EAAE,uBAAuB;YACzC,eAAe,EAAE,KAAK;SACvB,CAAC;QACF,GAAG,CAAC,UAAU,IAAI,MAAM,IAAI,SAAS;YACnC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,EACF,MAAM,CACP,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AASD,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,OAAe,EACf,KAA0B;IAE1B,UAAU,CACR,+BAA+B,MAAM,IAAI,EACzC,CAAC,OAAO,EAAE,6CAA6C,CAAC,EACxD,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAC/E,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,IAAc,EACd,cAAsB,OAAO,CAAC,GAAG,EAAE,EACnC,cAAuB,EACvB,OAAiC;IAEjC,mBAAmB,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,CAAA;IAC/B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,cAAc;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IAC1D,uFAAuF;IACvF,WAAW,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACpD,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACnC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;IACzB,MAAM,GAAG,GAAsB,OAAO,EAAE,KAAK;QAC3C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE;QAC/C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA;IACf,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE;QAC9C,KAAK;QACL,GAAG,EAAE,WAAW;QAChB,GAAG;QACH,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAA;IACF,IAAI,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,EAAE,CAAA;QACT,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC5F,OAAO,YAAY,IAAI,IAAI,SAAS,EAAE,CAAA;AACxC,CAAC"}
+{"version":3,"file":"self-host-compose.js","sourceRoot":"","sources":["../src/self-host-compose.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,mBAAmB,EAA2B,MAAM,qBAAqB,CAAA;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAC1C,OAAO,EACL,aAAa,EACb,mBAAmB,EACnB,oBAAoB,EACpB,iCAAiC,EACjC,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC9H,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAA;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAC3C,OAAO,EAAE,2BAA2B,EAAyB,MAAM,yBAAyB,CAAA;AAE5F,yEAAyE;AACzE,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,uBAAuB;IACvB,uBAAuB;IACvB,yBAAyB;CACjB,CAAA;AAEV,wEAAwE;AACxE,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,GAAG,6BAA6B;IAChC,8BAA8B;IAC9B,qBAAqB;IACrB,uBAAuB;IACvB,wBAAwB;IACxB,iCAAiC;CACzB,CAAA;AAIV,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAC5B,SAA6B,EAC7B,OAAe,EACf,MAA8B;IAE9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;IAC9B,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,QAAQ;YACX,OAAO,0BAA0B,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAA;QACtF,KAAK,QAAQ;YACX,OAAO,mBAAmB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,EAAE,CAAA;QAC/E,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;YAChD,IAAI,QAAQ;gBAAE,OAAO,QAAQ,CAAA;YAC7B,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,OAAO,qBAAqB,OAAO,EAAE,CAAA;YACtE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;YACnC,OAAO,qBAAqB,KAAK,SAAS,CAAA;QAC5C,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAA;IAEzB,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,GAAG,CAAC,qBAAqB,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC7D,GAAG,CAAC,qBAAqB,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACjE,GAAG,CAAC,uBAAuB,GAAG,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,0BAA0B,CAAC,GAAW;IACpD,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC1F,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACjC,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACxC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACzC,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAA;IAChC,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,iBAAiB;QACrC,QAAQ,CAAC,MAAM,KAAK,iBAAiB;QACrC,QAAQ,CAAC,QAAQ,KAAK,iBAAiB;QACvC,QAAQ,CAAC,IAAI,KAAK,iBAAiB,CACpC,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,sBAAsB,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAA;QAC1D,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9C,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAA6B,EAC7B,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,IAAI,mBAAmB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,yBAAyB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAA;AACvF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAA6B;IAE7B,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC9C,IAAI,MAAM,KAAK,iBAAiB;QAAE,OAAO,SAAS,CAAA;IAClD,IAAI,MAAM;QAAE,OAAO,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IACnD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;AAC1C,CAAC;AASD,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,CAAC,CAAA;IAClD,OAAO;QACL,GAAG;QACH,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,oBAAoB,CAAC;QAC5C,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC;KACnC,CAAA;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAA6B;IACjE,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAA;IACjD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAA;IAC5C,OAAO,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,MAA6B;IAC/D,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAClD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAA;IACzC,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAA;AACjD,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,yFAAyF;AACzF,SAAS,uBAAuB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,GAAG,GAAG,KAAK,GAAG,EAAE,CAAA;IAClB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,8BAA8B,CAAA;AACvC,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,MAA6B,EAAE,MAAM,GAAG,YAAY;IAC5E,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO,oFAAoF,CAAA;IAC7F,CAAC;IACD,OAAO,CACL,GAAG,MAAM,uCAAuC;QAChD,+DAA+D;QAC/D,oCAAoC,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,oBAAoB,CAAC,MAA6B;IACzD,MAAM,QAAQ,GAAG,wEAAwE,CAAA;IACzF,MAAM,WAAW,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC/C,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,8BAA8B,QAAQ,oCAAoC,CAAA;IACnF,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACjD,OAAO,8BAA8B,QAAQ,IAAI,MAAM,CAAC,QAAQ,GAAG,IAAI,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAA;AAC7G,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,kCAAkC,CAAA;AAEzE,wFAAwF;AACxF,SAAS,kBAAkB;IACzB,OAAO,8DAA8D,CAAA;AACvE,CAAC;AAED,qFAAqF;AACrF,SAAS,uBAAuB,CAAC,QAAgB,EAAE,QAAiB;IAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAA;IAC/B,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAA;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjE,GAAG,CAAC,QAAQ,GAAG,sBAAsB,CAAA;YACrC,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uCAAuC;IACzC,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA6B,EAAE,QAAiB;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,MAAM,CAAA;IACtC,MAAM,KAAK,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAA;IAClD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,UAAU,CAAA;QACrD,KAAK,CAAC,IAAI,CAAC,2CAA2C,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAA;IACnF,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CAAC,gCAAgC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAA;IACtG,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CACR,gCAAgC,uBAAuB,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAC7F,CAAA;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAeD,MAAM,UAAU,qBAAqB,CACnC,MAA6B,EAC7B,MAAc,OAAO,CAAC,GAAG,EAAE,EAC3B,OAAgC;IAEhC,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IACpC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAA;IACzC,sFAAsF;IACtF,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAC5E,8FAA8F;IAC9F,6EAA6E;IAC7E,MAAM,yBAAyB,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IACxF,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACjD,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAA;IAC3C,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACjD,+FAA+F;IAC/F,MAAM,mBAAmB,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAA;IACvF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAA;IAClF,MAAM,aAAa,GAAG,QAAQ,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAAC,IAAI,QAAQ,CAAA;IACzD,MAAM,cAAc,GAAG,kBAAkB,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,aAAa,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;EAEJ,aAAa;;2DAE4C,mBAAmB;;;CAG7E,CAAA;IACC,MAAM,aAAa,GAAG,aAAa;QACjC,CAAC,CAAC;sBACgB;QAClB,CAAC,CAAC;;sBAEgB,CAAA;IACpB,MAAM,eAAe,GAAG,CAAC,QAAQ,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,OAAO,GAAG,eAAe;QAC7B,CAAC,CAAC,QAAQ;YACR,CAAC,CAAC;;CAEP;YACK,CAAC,CAAC;;CAEP;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;CAEL,CAAA;IACC,MAAM,UAAU,GAAG,QAAQ;QACzB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;CAGL,CAAA;IACC,MAAM,UAAU,GAAG,UAAU;QAC3B,CAAC,CAAC;;;CAGL;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,SAAS,GAAG,UAAU;QAC1B,CAAC,CAAC;mBACa;QACf,CAAC,CAAC,8CAA8C,CAAA;IAClD,MAAM,WAAW,GAAG;;;;;;;;CAQrB,CAAA;IACC,MAAM,iBAAiB,GAAG,kBAAkB,CAAA;IAC5C,MAAM,cAAc,GAAG,UAAU;QAC/B,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;;CAGL,CAAA;IACC,4DAA4D;IAC5D,MAAM,YAAY,GAAG;EACrB,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc;;CAE/B,CAAA;IAEC,6FAA6F;IAC7F,8FAA8F;IAC9F,0FAA0F;IAC1F,wBAAwB;IACxB,MAAM,kBAAkB,GAAG,QAAQ;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC;;CAEL,CAAA;IACC,MAAM,YAAY,GAAG,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,kBAAkB,EAAE,CAAA;IAE7E,iEAAiE;IACjE,EAAE;IACF,iGAAiG;IACjG,4FAA4F;IAC5F,mGAAmG;IACnG,gGAAgG;IAChG,kGAAkG;IAClG,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAA;IACxC,MAAM,aAAa,GAAG,QAAQ;QAC5B,CAAC,CAAC;;;;;;uBAMiB,QAAQ;;;;;;EAM7B,YAAY,EAAE;QACZ,CAAC,CAAC;;CAEL,CAAA;IACC,MAAM,kBAAkB,GAAG,QAAQ;QACjC,CAAC,CAAC;;CAEL;QACG,CAAC,CAAC,EAAE,CAAA;IACN,MAAM,iBAAiB,GAAG,QAAQ,CAAC,CAAC,CAAC,mDAAmD,CAAC,CAAC,CAAC,EAAE,CAAA;IAE7F,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC;;;CAGL;QACG,CAAC,CAAC;;;;;;;;EAQJ,OAAO;;;;;;;;;;;;;;;;;CAiBR,CAAA;IAEC,OAAO;;;EAGP,cAAc;;;;;;;;;;;;sBAYM,YAAY;;;;0BAIR,aAAa,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC;;;;;EAKxE,YAAY;;;;;;;uBAOS,QAAQ;;;;;;;EAO7B,YAAY;;;;;;UAMJ,YAAY;;;;;;;;;;;;;;;;;;uCAkBiB,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;;;oDAGtB,mBAAmB;EACrE,YAAY;EACZ,aAAa;;;;;;UAML,YAAY;;;;8BAIQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;;uBAE1C,QAAQ;;uCAEQ,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;8BAEvC,cAAc;;EAE1C,YAAY;;;EAGZ,WAAW;UACH,YAAY;;;uBAGC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY;;;;;;;2CAOX,mBAAmB;;;oCAG1B,QAAQ;;;EAG1C,iBAAiB;;;EAGjB,MAAM;;;+CAGuC,mBAAmB;sDACZ,mBAAmB;;iCAExC,SAAS,GAAG,yBAAyB;sCAChC,eAAe;;;;;;;;EAQnD,QAAQ,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,EAAE;;EAEhD,kBAAkB;;;;;;;;EAQlB,kBAAkB;;;;;;;;;EASlB,UAAU;;;;;;;;UAQF,YAAY;;EAEpB,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,cAAc;;;;;;;;;EASzD,UAAU;UACF,SAAS;;EAEjB,SAAS;;EAET,aAAa,GAAG,iBAAiB;;EAEjC,YAAY,EAAE,CAAA;AAChB,CAAC;AAED,qGAAqG;AACrG,MAAM,4BAA4B,GAAG,8BAA8B,CAAA;AAEnE,SAAS,qBAAqB,CAAC,GAAW,EAAE,MAA6B;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,eAAe,CAAC,CAAA;IAC5D,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAErD,+FAA+F;IAC/F,0EAA0E;IAC1E,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,0BAA0B,CAAC,YAAY,CAAC,CAAA;QACxC,OAAM;IACR,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,MAAM,EAAE,QAAQ;QAChB,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,qBAAqB;QAClC,2FAA2F;QAC3F,6EAA6E;QAC7E,gBAAgB,EAAE,eAAe,CAAC,MAAM,CAAC;QACzC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,sBAAsB,EAAE,CAAC;QACxE,8FAA8F;QAC9F,gGAAgG;QAChG,kFAAkF;QAClF,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,4BAA4B;KACnD,CAAA;IACD,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,0BAA0B,CAAC,YAAoB;IACtD,IAAI,MAA+B,CAAA;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAA4B,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAM,CAAC,sFAAsF;IAC/F,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAM;IACzD,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,SAAS;QAAE,OAAM;IAEhG,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAA;IAClC,IAAI,MAAM,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;QACjD,MAAM,CAAC,sBAAsB,CAAC,GAAG,4BAA4B,CAAA;IAC/D,CAAC;IACD,aAAa,CAAC,YAAY,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;AAC7E,CAAC;AAED,SAAS,yBAAyB,CAAC,GAAW,EAAE,MAA6B;IAC3E,SAAS,CAAC,iCAAiC,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9E,iGAAiG;IACjG,kGAAkG;IAClG,qBAAqB;IACrB,SAAS,CAAC,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,2BAA2B,CAAC,GAAW,EAAE,MAA6B;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,UAAU,KAAK,SAAS;QAAE,OAAM;IAEpC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,CAAA;IAChD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,+FAA+F;QAC/F,2EAA2E;QAC3E,OAAM;IACR,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,UAAU;QAAE,OAAM;IAEzC,UAAU,CACR,2DAA2D,EAC3D;QACE,YAAY,OAAO,CAAC,IAAI,EAAE,EAAE;QAC5B,YAAY,UAAU,EAAE;QACxB,EAAE;QACF,4FAA4F;QAC5F,0DAA0D;QAC1D,6DAA6D;QAC7D,8DAA8D;KAC/D,EACD,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAC1C,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA6B;IAChE,MAAM,GAAG,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAEvC,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA,CAAC,iEAAiE;IACpF,CAAC;IACD,mFAAmF;IACnF,MAAM,QAAQ,GACZ,IAAI,KAAK,WAAW;QACpB,IAAI,KAAK,KAAK;QACd,IAAI,KAAK,OAAO;QAChB,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAA;AACpC,CAAC;AAED,SAAS,wCAAwC,CAAC,MAA6B;IAC7E,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAM;IAE9B,UAAU,CACR,mCAAmC,IAAI,gCAAgC,EACvE;QACE,yFAAyF;QACzF,iGAAiG;QACjG,EAAE;QACF,wCAAwC;QACxC,gEAAgE;QAChE,qFAAqF;QACrF,0CAA0C;QAC1C,EAAE;QACF,wEAAwE;KACzE,EACD,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,CAC1C,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAC9B,GAAW,EACX,MAA6B,EAC7B,OAAgC;IAEhC,IAAI,OAAO,EAAE,gBAAgB,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAA;IAC5E,OAAO,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAA6B,EAC7B,OAAgC;IAEhC,2BAA2B,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1D,MAAM,QAAQ,GAA2B;QACvC,GAAG,OAAO;QACV,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;KACtD,CAAA;IACD,wCAAwC,CAAC,MAAM,CAAC,CAAA;IAChD,MAAM,KAAK,GAAG,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACvC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,yBAAyB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IACtC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAClC,aAAa,CAAC,KAAK,CAAC,WAAW,EAAE,qBAAqB,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAA;IACtF,MAAM,aAAa,GAAG,OAAO,EAAE,QAAQ,KAAK,IAAI,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC7E,MAAM,UAAU,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAA;IAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAClD,aAAa,CACX,KAAK,CAAC,QAAQ,EACd,oBAAoB,CAAC;QACnB,cAAc,EAAE,IAAI;QACpB,GAAG,CAAC,aAAa,IAAI;YACnB,gBAAgB,EAAE,uBAAuB;YACzC,eAAe,EAAE,KAAK;SACvB,CAAC;QACF,GAAG,CAAC,UAAU,IAAI,MAAM,IAAI,SAAS;YACnC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,EACF,MAAM,CACP,CAAA;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AASD,oDAAoD;AACpD,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,OAAe,EACf,KAA0B;IAE1B,UAAU,CACR,+BAA+B,MAAM,IAAI,EACzC,CAAC,OAAO,EAAE,6CAA6C,CAAC,EACxD,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAC/E,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,WAAmB,EACnB,IAAc,EACd,cAAsB,OAAO,CAAC,GAAG,EAAE,EACnC,cAAuB,EACvB,OAAiC;IAEjC,mBAAmB,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAA;IAC5C,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,CAAA;IAC/B,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,4EAA4E;IAC5E,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,cAAc;QAAE,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAA;IAC1D,uFAAuF;IACvF,WAAW,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAA;IACpD,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;IACnC,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzC,CAAC;IACD,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAA;IACzB,MAAM,GAAG,GAAsB,OAAO,EAAE,KAAK;QAC3C,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,gBAAgB,EAAE,OAAO,EAAE;QAC/C,CAAC,CAAC,OAAO,CAAC,GAAG,CAAA;IACf,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACjD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,WAAW,EAAE;QAC9C,KAAK;QACL,GAAG,EAAE,WAAW;QAChB,GAAG;QACH,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC,CAAA;IACF,IAAI,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;aAC1C,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;aACpE,IAAI,CAAC,IAAI,CAAC;aACV,IAAI,EAAE,CAAA;QACT,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,8BAA8B,MAAM,EAAE,CAAC,CAAA;QACvD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAA;AAC3B,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC5F,OAAO,YAAY,IAAI,IAAI,SAAS,EAAE,CAAA;AACxC,CAAC"}

package/dist/service-role-check.d.ts

@@ -0,0 +1,21 @@
+import { type SupatypeProjectConfig } from "./project-config.js";
+export interface ServiceRoleProblems {
+    /** Names with no matching function. Each line is ready to print. */
+    errors: string[];
+    /** The same names, unformatted, for callers that need to mark them rather than print them. */
+    missing: string[];
+    /** Entries that are harmless but say nothing, e.g. a hook. */
+    warnings: string[];
+    /** Function names available to be granted, for the "did you mean" line. */
+    available: string[];
+}
+/**
+ * Resolve the declared grants against what is on disk.
+ *
+ * Returns the problems rather than throwing, so `push` can refuse while `doctor` reports alongside
+ * everything else it found.
+ */
+export declare function checkServiceRoleRoutes(cfg: SupatypeProjectConfig, cwd: string): ServiceRoleProblems;
+/** The full message for a refusal, including what *is* available to name. */
+export declare function serviceRoleProblemLines(problems: ServiceRoleProblems): string[];
+//# sourceMappingURL=service-role-check.d.ts.map

package/dist/service-role-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-role-check.d.ts","sourceRoot":"","sources":["../src/service-role-check.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,KAAK,qBAAqB,EAC3B,MAAM,qBAAqB,CAAA;AAE5B,MAAM,WAAW,mBAAmB;IAClC,oEAAoE;IACpE,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,8FAA8F;IAC9F,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,2EAA2E;IAC3E,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAoBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,qBAAqB,EAC1B,GAAG,EAAE,MAAM,GACV,mBAAmB,CAmCrB;AAED,6EAA6E;AAC7E,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,MAAM,EAAE,CAc/E"}