everything-dev 1.53.2 → 2.0.0-rc.1

package/dist/cli/infra.cjs

@@ -1,19 +1,25 @@
-const require_runtime = require('../_virtual/_rolldown/runtime.cjs');
 let node_fs = require("node:fs");
 let node_path = require("node:path");
 let node_crypto = require("node:crypto");
-let _clack_prompts = require("@clack/prompts");
-_clack_prompts = require_runtime.__toESM(_clack_prompts, 1);
-let dotenv = require("dotenv");
 
 //#region src/cli/infra.ts
 const POSTGRES_USER = "everythingdev";
 const POSTGRES_PASSWORD = "everythingdev";
-const API_DATABASE_SECRET = "API_DATABASE_URL";
 const AUTH_DATABASE_SECRET = "AUTH_DATABASE_URL";
 const HOST_SECRET = "CORS_ORIGIN";
-const BASE_POSTGRES_PORT = 5434;
-const BASE_REDIS_PORT = 6379;
+const REDIS_PORT = 6379;
+const TEST_AUTH_SECRET = "regression-test-secret-do-not-use-in-production";
+const VESTIGIAL_SECRETS = /* @__PURE__ */ new Set(["NEAR_RELAYER_PRIVATE_KEY_MAINNET", "NEAR_RELAYER_PRIVATE_KEY_TESTNET"]);
+/**
+* Fixed local-development database conventions. The committed
+* docker-compose.yml provisions exactly these services/ports — nothing is
+* derived from runtime config. Every non-auth `*_DATABASE_URL` secret shares
+* the api database (schema-isolated per plugin); auth gets its own.
+*/
+const DEV_API_DB_PORT = 5432;
+const DEV_AUTH_DB_PORT = 5433;
+const TEST_API_DB_PORT = 5434;
+const TEST_AUTH_DB_PORT = 5435;
 function uniqueSecrets(values) {
 	const secrets = [];
 	const seen = /* @__PURE__ */ new Set();
@@ -25,27 +31,13 @@ function uniqueSecrets(values) {
 	return secrets;
 }
 function loadPortState(configDir) {
-	if (!configDir) return {
-		postgresPorts: {},
-		redisPorts: {}
-	};
+	if (!configDir) return {};
 	const statePath = (0, node_path.join)(configDir, ".bos", "infra-state.json");
-	if (!(0, node_fs.existsSync)(statePath)) return {
-		postgresPorts: {},
-		redisPorts: {}
-	};
+	if (!(0, node_fs.existsSync)(statePath)) return {};
 	try {
-		const raw = JSON.parse((0, node_fs.readFileSync)(statePath, "utf-8"));
-		return {
-			postgresPorts: raw.postgresPorts ?? {},
-			redisPorts: raw.redisPorts ?? {},
-			devPorts: raw.devPorts
-		};
+		return { devPorts: JSON.parse((0, node_fs.readFileSync)(statePath, "utf-8")).devPorts };
 	} catch {
-		return {
-			postgresPorts: {},
-			redisPorts: {}
-		};
+		return {};
 	}
 }
 function savePortState(configDir, state) {
@@ -53,22 +45,48 @@ function savePortState(configDir, state) {
 	(0, node_fs.mkdirSync)((0, node_path.dirname)(statePath), { recursive: true });
 	(0, node_fs.writeFileSync)(statePath, `${JSON.stringify(state, null, 2)}\n`);
 }
-function resolvePort(slug, portMap, basePort) {
-	if (portMap[slug] !== void 0) return portMap[slug];
-	const assigned = Object.values(portMap);
-	const maxAssigned = assigned.length > 0 ? Math.max(...assigned) : basePort - 1;
-	const next = Math.max(maxAssigned + 1, basePort);
-	portMap[slug] = next;
-	return next;
+function normalizeDatabaseSlug(secret) {
+	return secret.replace(/_DATABASE_URL$/, "").toLowerCase();
 }
 function normalizeRedisSlug(secret) {
 	return secret.replace(/_REDIS_URL$/, "").toLowerCase();
 }
+function databaseUrl(port, databaseName) {
+	return `postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:${port}/${databaseName}`;
+}
+function buildConventionalDatabases(secrets) {
+	return uniqueSecrets(secrets.filter((secret) => secret.endsWith("_DATABASE_URL"))).sort((a, b) => normalizeDatabaseSlug(a).localeCompare(normalizeDatabaseSlug(b))).map((secret) => {
+		const slug = normalizeDatabaseSlug(secret);
+		const isAuth = secret === AUTH_DATABASE_SECRET;
+		const port = isAuth ? DEV_AUTH_DB_PORT : DEV_API_DB_PORT;
+		const databaseName = isAuth ? "auth_db" : "api_db";
+		return {
+			secret,
+			slug,
+			port,
+			databaseName,
+			url: databaseUrl(port, databaseName)
+		};
+	});
+}
+function buildConventionalRedis(secrets) {
+	return uniqueSecrets(secrets.filter((secret) => secret.endsWith("_REDIS_URL"))).sort((a, b) => normalizeRedisSlug(a).localeCompare(normalizeRedisSlug(b))).map((secret) => ({
+		secret,
+		slug: normalizeRedisSlug(secret),
+		port: REDIS_PORT,
+		url: `redis://localhost:${REDIS_PORT}`
+	}));
+}
+function testDatabaseUrl(secret) {
+	const isAuth = secret === AUTH_DATABASE_SECRET;
+	return databaseUrl(isAuth ? TEST_AUTH_DB_PORT : TEST_API_DB_PORT, isAuth ? "auth_test_db" : "api_test_db");
+}
 function getSecretGroups(runtimeConfig) {
 	const groups = [];
 	const seen = /* @__PURE__ */ new Set();
 	const addGroup = (section, secrets) => {
 		const filtered = secrets.filter((s) => {
+			if (VESTIGIAL_SECRETS.has(s)) return false;
 			if (seen.has(s)) return false;
 			seen.add(s);
 			return true;
@@ -86,102 +104,6 @@ function getSecretGroups(runtimeConfig) {
 	}
 	return groups;
 }
-function buildGeneratedInfraSpec(runtimeConfig, configDir) {
-	const groups = getSecretGroups(runtimeConfig);
-	const allSecrets = groups.flatMap((group) => group.secrets);
-	const originMap = configDir ? buildOriginMap(configDir, runtimeConfig) : /* @__PURE__ */ new Map();
-	const portState = loadPortState(configDir);
-	return {
-		spec: {
-			groups,
-			databases: buildDatabaseConfigs(allSecrets, originMap, portState.postgresPorts),
-			redis: buildRedisConfigs(allSecrets, originMap, portState.redisPorts)
-		},
-		portState
-	};
-}
-function normalizeDatabaseSlug(secret) {
-	return secret.replace(/_DATABASE_URL$/, "").toLowerCase();
-}
-function buildOriginMap(configDir, runtimeConfig) {
-	const configPath = (0, node_path.join)(configDir, "bos.config.json");
-	const originMap = /* @__PURE__ */ new Map();
-	const account = runtimeConfig.account;
-	const resolveOrigin = (extendsRef) => {
-		if (typeof extendsRef === "string") return extendsRef.match(/^bos:\/\/([^/]+)\//)?.[1] ?? null;
-		return null;
-	};
-	const rawConfig = (0, node_fs.existsSync)(configPath) ? JSON.parse((0, node_fs.readFileSync)(configPath, "utf-8")) : null;
-	const rawPlugins = rawConfig?.plugins;
-	for (const secret of runtimeConfig.api.secrets ?? []) if (!originMap.has(secret)) originMap.set(secret, account);
-	const authExtends = ((rawConfig?.app)?.auth)?.extends;
-	const authOrigin = resolveOrigin(authExtends) ?? account;
-	for (const secret of runtimeConfig.auth?.secrets ?? []) if (!originMap.has(secret)) originMap.set(secret, authOrigin);
-	for (const [pluginKey, pluginEntry] of Object.entries(runtimeConfig.plugins ?? {})) {
-		const rawPlugin = rawPlugins?.[pluginKey];
-		let pluginOrigin;
-		if (typeof rawPlugin === "string") pluginOrigin = resolveOrigin(rawPlugin) ?? account;
-		else if (rawPlugin && typeof rawPlugin === "object") pluginOrigin = resolveOrigin(rawPlugin.extends) ?? account;
-		else pluginOrigin = account;
-		for (const secret of pluginEntry.secrets ?? []) if (!originMap.has(secret)) originMap.set(secret, pluginOrigin);
-	}
-	for (const secret of runtimeConfig.host.secrets ?? []) if (!originMap.has(secret)) originMap.set(secret, account);
-	return originMap;
-}
-function buildDatabaseConfigs(secrets, originMap, portMap) {
-	const orderedSecrets = [...uniqueSecrets(secrets.filter((secret) => secret.endsWith("_DATABASE_URL")))];
-	const currentSlugs = new Set(orderedSecrets.map(normalizeDatabaseSlug));
-	for (const slug of Object.keys(portMap)) if (!currentSlugs.has(slug)) delete portMap[slug];
-	orderedSecrets.sort((a, b) => normalizeDatabaseSlug(a).localeCompare(normalizeDatabaseSlug(b)));
-	for (const secret of orderedSecrets) {
-		const slug = normalizeDatabaseSlug(secret);
-		if (secret === API_DATABASE_SECRET) portMap[slug] = 5432;
-		else if (secret === AUTH_DATABASE_SECRET) portMap[slug] = 5433;
-		else resolvePort(slug, portMap, BASE_POSTGRES_PORT);
-	}
-	return orderedSecrets.map((secret) => {
-		const slug = normalizeDatabaseSlug(secret);
-		const fromKey = originMap.get(secret) ?? "";
-		const port = portMap[slug];
-		const volumeName = fromKey ? `${fromKey.replace(/\./g, "_")}_postgres_${slug}_data` : `postgres_${slug}_data`;
-		const containerName = fromKey ? `${fromKey}-postgres-${slug}` : `postgres-${slug}`;
-		return {
-			secret,
-			slug,
-			fromKey,
-			port,
-			serviceName: `postgres-${slug.replace(/_/g, "-")}`,
-			containerName,
-			databaseName: `${slug}_db`,
-			volumeName,
-			url: `postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:${port}/${slug}_db`
-		};
-	});
-}
-function buildRedisConfigs(secrets, originMap, portMap) {
-	const orderedSecrets = [...uniqueSecrets(secrets.filter((secret) => secret.endsWith("_REDIS_URL")))];
-	const currentSlugs = new Set(orderedSecrets.map(normalizeRedisSlug));
-	for (const slug of Object.keys(portMap)) if (!currentSlugs.has(slug)) delete portMap[slug];
-	orderedSecrets.sort((a, b) => normalizeRedisSlug(a).localeCompare(normalizeRedisSlug(b)));
-	for (const secret of orderedSecrets) resolvePort(normalizeRedisSlug(secret), portMap, BASE_REDIS_PORT);
-	return orderedSecrets.map((secret) => {
-		const slug = normalizeRedisSlug(secret);
-		const fromKey = originMap.get(secret) ?? "";
-		const port = portMap[slug];
-		const volumeName = fromKey ? `${fromKey.replace(/\./g, "_")}_redis_${slug}_data` : `redis_${slug}_data`;
-		const containerName = fromKey ? `${fromKey}-redis-${slug}` : `redis-${slug}`;
-		return {
-			secret,
-			slug,
-			fromKey,
-			port,
-			serviceName: `redis-${slug.replace(/_/g, "-")}`,
-			containerName,
-			volumeName,
-			url: `redis://localhost:${port}`
-		};
-	});
-}
 function extractPortFromUrl(url) {
 	return url.match(/:(\d{4,5})(?:\/|$)/)?.[1] ?? null;
 }
@@ -197,158 +119,144 @@ function resolveDevHostPort(runtimeConfig) {
 function defaultSecretValue(secret, databases, redisConfigs, options) {
 	if (secret === "BETTER_AUTH_SECRET") return options.forExample ? "" : (0, node_crypto.randomBytes)(32).toString("base64url");
 	if (secret === "CORS_ORIGIN") {
+		if (options.forExample) return "http://localhost:3000";
 		if (typeof options.devHostPort === "number") return `http://localhost:${options.devHostPort}`;
 		return "http://localhost:3000";
 	}
 	return databases.get(secret)?.url ?? redisConfigs.get(secret)?.url ?? "";
 }
-function renderEnvFile(groups, databases, redisConfigs, options) {
-	const databaseMap = new Map(databases.map((entry) => [entry.secret, entry]));
-	const redisMap = new Map(redisConfigs.map((entry) => [entry.secret, entry]));
+/**
+* Plugin `*_DATABASE_URL` secrets share the API database (the platform's
+* two-database contract), so they are not rendered as template entries —
+* the host falls back to `API_DATABASE_URL` when they are unset.
+*/
+function isFallbackDatabaseSecret(secret) {
+	return secret.endsWith("_DATABASE_URL") && secret !== "API_DATABASE_URL" && secret !== "AUTH_DATABASE_URL";
+}
+function renderEnvFile(groups, options) {
+	const rendered = groups.map((group) => ({
+		section: group.section,
+		secrets: group.secrets.filter((secret) => !isFallbackDatabaseSecret(secret))
+	})).filter((group) => group.secrets.length > 0);
+	const allSecrets = rendered.flatMap((group) => group.secrets);
+	const databaseMap = new Map(buildConventionalDatabases(allSecrets).map((entry) => [entry.secret, entry]));
+	const redisMap = new Map(buildConventionalRedis(allSecrets).map((entry) => [entry.secret, entry]));
 	const lines = [
 		"# Generated from configured bos secrets",
 		"# Update values as needed for your local environment",
 		""
 	];
-	for (const group of groups) {
+	for (const group of rendered) {
 		lines.push(`# ${group.section}`);
 		for (const secret of group.secrets) lines.push(`${secret}=${defaultSecretValue(secret, databaseMap, redisMap, options)}`);
 		lines.push("");
 	}
 	return `${lines.join("\n")}\n`;
 }
-function renderDockerCompose(databases, redisConfigs, projectName) {
-	const lines = [`name: ${projectName}`, ""];
-	if (databases.length > 0) lines.push("x-pg-common: &pg-common", "  image: postgres:17-alpine", "  environment: &pg-env", `    POSTGRES_USER: ${POSTGRES_USER}`, `    POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}`, "  healthcheck:", "    test: [\"CMD-SHELL\", \"pg_isready -U everythingdev\"]", "    interval: 3s", "    timeout: 3s", "    retries: 5", "");
-	if (redisConfigs.length > 0) lines.push("x-redis-common: &redis-common", "  image: redis:7-alpine", "  command: redis-server --appendonly yes", "  healthcheck:", "    test: [\"CMD\", \"redis-cli\", \"ping\"]", "    interval: 3s", "    timeout: 3s", "    retries: 5", "");
-	lines.push("services:");
-	for (const database of databases) {
-		lines.push(`  ${database.serviceName}:`);
-		lines.push("    <<: *pg-common");
-		lines.push(`    container_name: ${database.containerName}`);
-		lines.push("    environment:");
-		lines.push("      <<: *pg-env");
-		lines.push(`      POSTGRES_DB: ${database.databaseName}`);
-		lines.push("    ports:");
-		lines.push(`      - "${database.port}:5432"`);
-		lines.push("    volumes:");
-		lines.push(`      - ${database.volumeName}:/var/lib/postgresql/data`);
-		lines.push("");
-	}
-	for (const redis of redisConfigs) {
-		lines.push(`  ${redis.serviceName}:`);
-		lines.push("    <<: *redis-common");
-		lines.push(`    container_name: ${redis.containerName}`);
-		lines.push("    ports:");
-		lines.push(`      - "${redis.port}:6379"`);
-		lines.push("    volumes:");
-		lines.push(`      - ${redis.volumeName}:/data`);
-		lines.push("");
-	}
-	lines.push("volumes:");
-	for (const database of databases) {
-		lines.push(`  ${database.volumeName}:`);
-		lines.push(`    name: ${database.volumeName}`);
-	}
-	for (const redis of redisConfigs) {
-		lines.push(`  ${redis.volumeName}:`);
-		lines.push(`    name: ${redis.volumeName}`);
+function renderEnvTestFile(groups) {
+	const lines = [
+		"# Generated test environment — loaded by test suites instead of .env",
+		"# Test databases run on dedicated *-test docker-compose services",
+		""
+	];
+	for (const group of groups) {
+		const entries = [];
+		for (const secret of group.secrets) if (secret === "BETTER_AUTH_SECRET") entries.push(`${secret}=${TEST_AUTH_SECRET}`);
+		else if (secret.endsWith("_DATABASE_URL")) entries.push(`${secret}=${testDatabaseUrl(secret)}`);
+		if (entries.length > 0) {
+			lines.push(`# ${group.section}`);
+			lines.push(...entries);
+			lines.push("");
+		}
 	}
 	return `${lines.join("\n")}\n`;
 }
-function syncTextFile(filePath, nextContent) {
-	if ((0, node_fs.existsSync)(filePath) && (0, node_fs.readFileSync)(filePath, "utf-8") === nextContent) return false;
-	(0, node_fs.writeFileSync)(filePath, nextContent);
-	return true;
-}
-function writeGeneratedInfra(configDir, runtimeConfig) {
-	const result = syncGeneratedInfra(configDir, runtimeConfig);
-	if (result.staleEnvWarnings.length > 0) {
-		_clack_prompts.log.warn(`.env has ${result.staleEnvWarnings.length} stale value(s) compared to .env.example:`);
-		for (const warning of result.staleEnvWarnings) _clack_prompts.log.message(`  ${warning}`);
+function buildCiInfraPlan(runtimeConfig, options = {}) {
+	const allSecrets = collectAllSecrets(runtimeConfig);
+	const databases = buildConventionalDatabases(allSecrets);
+	const redisConfigs = buildConventionalRedis(allSecrets);
+	const hostPort = options.hostPortOverride ?? (Number.isFinite(Number(process.env.BOS_CI_HOST_PORT)) ? Number(process.env.BOS_CI_HOST_PORT) : void 0) ?? resolveDevHostPort(runtimeConfig);
+	const env = {};
+	for (const db of databases) env[db.secret] = db.url;
+	for (const r of redisConfigs) env[r.secret] = r.url;
+	env.CORS_ORIGIN = `http://127.0.0.1:${hostPort}`;
+	if (!env.BETTER_AUTH_SECRET) env.BETTER_AUTH_SECRET = "";
+	const services = [];
+	const seenPorts = /* @__PURE__ */ new Set();
+	for (const db of databases) {
+		if (seenPorts.has(db.port)) continue;
+		seenPorts.add(db.port);
+		services.push({
+			key: db.slug,
+			slug: db.slug,
+			image: "public.ecr.aws/docker/library/postgres:17-alpine",
+			env: {
+				POSTGRES_USER,
+				POSTGRES_PASSWORD,
+				POSTGRES_DB: db.databaseName
+			},
+			ports: [`${db.port}:5432`],
+			healthcheck: {
+				test: ["CMD-SHELL", `pg_isready -U ${POSTGRES_USER} -d ${db.databaseName}`],
+				interval: "3s",
+				timeout: "3s",
+				retries: 10
+			},
+			volumes: [`${db.slug}_data:/var/lib/postgresql/data`],
+			database: {
+				user: POSTGRES_USER,
+				password: POSTGRES_PASSWORD,
+				name: db.databaseName
+			}
+		});
 	}
-	return result.secrets;
-}
-function syncGeneratedInfra(configDir, runtimeConfig) {
-	const { spec, portState } = buildGeneratedInfraSpec(runtimeConfig, configDir);
-	const secrets = spec.groups.flatMap((group) => group.secrets);
-	const envOptions = { forExample: true };
-	if (runtimeConfig.env === "development") envOptions.devHostPort = resolveDevHostPort(runtimeConfig);
-	const newEnvContent = renderEnvFile(spec.groups, spec.databases, spec.redis, envOptions);
-	const newDockerContent = renderDockerCompose(spec.databases, spec.redis, runtimeConfig.account);
-	const envExamplePath = (0, node_path.join)(configDir, ".env.example");
-	const dockerComposePath = (0, node_path.join)(configDir, "docker-compose.yml");
-	const staleWarnings = checkEnvStaleness(configDir, spec.databases, spec.redis);
-	if (configDir) savePortState(configDir, portState);
+	for (const r of redisConfigs) services.push({
+		key: r.slug,
+		slug: r.slug,
+		image: "public.ecr.aws/docker/library/redis:7-alpine",
+		env: {},
+		ports: [`${r.port}:6379`],
+		healthcheck: {
+			test: [
+				"CMD",
+				"redis-cli",
+				"ping"
+			],
+			interval: "3s",
+			timeout: "3s",
+			retries: 10
+		},
+		volumes: [`${r.slug}_data:/data`]
+	});
 	return {
-		secrets,
-		envExampleChanged: syncTextFile(envExamplePath, newEnvContent),
-		dockerComposeChanged: syncTextFile(dockerComposePath, newDockerContent),
-		staleEnvWarnings: staleWarnings
+		account: runtimeConfig.account,
+		gateway: runtimeConfig.domain ?? runtimeConfig.account,
+		project: runtimeConfig.account,
+		env,
+		services,
+		generatedAt: (/* @__PURE__ */ new Date()).toISOString()
 	};
 }
-function checkEnvStaleness(configDir, databases, redisConfigs) {
-	const envPath = (0, node_path.join)(configDir, ".env");
-	if (!(0, node_fs.existsSync)(envPath)) return [];
-	const existingEnv = (0, node_fs.readFileSync)(envPath, "utf-8");
-	const envMap = /* @__PURE__ */ new Map();
-	for (const line of existingEnv.split("\n")) {
-		const match = line.match(/^([A-Z_]+)=(.*)$/);
-		if (match) envMap.set(match[1], match[2]);
-	}
-	const stale = [];
-	for (const db of databases) {
-		const existing = envMap.get(db.secret);
-		if (existing && existing !== db.url) {
-			const oldPort = extractPortFromUrl(existing) ?? "?";
-			stale.push(`${db.secret}: port ${oldPort} → ${db.port}`);
-		}
-	}
-	for (const redis of redisConfigs) {
-		const existing = envMap.get(redis.secret);
-		if (existing && existing !== redis.url) {
-			const oldPort = extractPortFromUrl(existing) ?? "?";
-			stale.push(`${redis.secret}: port ${oldPort} → ${redis.port}`);
-		}
+function collectAllSecrets(runtimeConfig) {
+	const all = [];
+	all.push(...runtimeConfig.host.secrets ?? []);
+	all.push(...runtimeConfig.api.secrets ?? []);
+	if (runtimeConfig.auth) all.push(...runtimeConfig.auth.secrets ?? []);
+	if (runtimeConfig.plugins) {
+		for (const plugin of Object.values(runtimeConfig.plugins)) if (plugin.secrets) all.push(...plugin.secrets);
 	}
-	return stale;
-}
-function ensureEnvFile(configDir) {
-	const envPath = (0, node_path.join)(configDir, ".env");
-	const examplePath = (0, node_path.join)(configDir, ".env.example");
-	if ((0, node_fs.existsSync)(envPath) || !(0, node_fs.existsSync)(examplePath)) return;
-	const lines = (0, node_fs.readFileSync)(examplePath, "utf-8").split("\n");
-	const secret = (0, node_crypto.randomBytes)(32).toString("base64url");
-	(0, node_fs.writeFileSync)(envPath, lines.map((line) => {
-		if (/^BETTER_AUTH_SECRET=/.test(line)) return `BETTER_AUTH_SECRET=${secret}`;
-		return line;
-	}).join("\n"));
-	_clack_prompts.log.info("Created .env from generated .env.example with generated BETTER_AUTH_SECRET");
-}
-let envLoadedDir = null;
-function loadProjectEnv(configDir) {
-	if (envLoadedDir === configDir) return;
-	const envPath = (0, node_path.join)(configDir, ".env");
-	if (!(0, node_fs.existsSync)(envPath)) return;
-	(0, dotenv.config)({
-		path: envPath,
-		processEnv: process.env,
-		quiet: true
-	});
-	envLoadedDir = configDir;
+	return all.filter((s) => !VESTIGIAL_SECRETS.has(s));
 }
 
 //#endregion
-exports.buildDatabaseConfigs = buildDatabaseConfigs;
-exports.buildOriginMap = buildOriginMap;
-exports.buildRedisConfigs = buildRedisConfigs;
-exports.ensureEnvFile = ensureEnvFile;
+exports.buildCiInfraPlan = buildCiInfraPlan;
+exports.buildConventionalDatabases = buildConventionalDatabases;
+exports.buildConventionalRedis = buildConventionalRedis;
 exports.getSecretGroups = getSecretGroups;
 exports.loadPortState = loadPortState;
-exports.loadProjectEnv = loadProjectEnv;
 exports.normalizeDatabaseSlug = normalizeDatabaseSlug;
-exports.normalizeRedisSlug = normalizeRedisSlug;
+exports.renderEnvFile = renderEnvFile;
+exports.renderEnvTestFile = renderEnvTestFile;
+exports.resolveDevHostPort = resolveDevHostPort;
 exports.savePortState = savePortState;
-exports.syncGeneratedInfra = syncGeneratedInfra;
-exports.writeGeneratedInfra = writeGeneratedInfra;
 //# sourceMappingURL=infra.cjs.map

package/dist/cli/infra.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"infra.cjs","names":[],"sources":["../../src/cli/infra.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport * as p from \"@clack/prompts\";\nimport { config as loadDotenv } from \"dotenv\";\nimport type { RuntimeConfig } from \"../types\";\n\nconst POSTGRES_USER = \"everythingdev\";\nconst POSTGRES_PASSWORD = \"everythingdev\";\nconst API_DATABASE_SECRET = \"API_DATABASE_URL\";\nconst AUTH_DATABASE_SECRET = \"AUTH_DATABASE_URL\";\nconst HOST_SECRET = \"CORS_ORIGIN\";\nconst BASE_POSTGRES_PORT = 5434;\nconst BASE_REDIS_PORT = 6379;\n\nexport interface DatabaseSecretConfig {\n  secret: string;\n  slug: string;\n  fromKey: string;\n  port: number;\n  serviceName: string;\n  containerName: string;\n  databaseName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport interface RedisSecretConfig {\n  secret: string;\n  slug: string;\n  fromKey: string;\n  port: number;\n  serviceName: string;\n  containerName: string;\n  volumeName: string;\n  url: string;\n}\n\nexport interface SecretGroup {\n  section: string;\n  secrets: string[];\n}\n\ninterface DevPortState {\n  host?: number;\n  api?: number;\n  ui?: number;\n  auth?: number;\n  pluginPortStart?: number;\n}\n\nexport interface PortState {\n  postgresPorts: Record<string, number>;\n  redisPorts: Record<string, number>;\n  devPorts?: DevPortState;\n}\n\nexport interface GeneratedInfraSpec {\n  groups: SecretGroup[];\n  databases: DatabaseSecretConfig[];\n  redis: RedisSecretConfig[];\n}\n\ninterface SyncGeneratedInfraResult {\n  secrets: string[];\n  envExampleChanged: boolean;\n  dockerComposeChanged: boolean;\n  staleEnvWarnings: string[];\n}\n\nfunction uniqueSecrets(values: Array<string | undefined>): string[] {\n  const secrets: string[] = [];\n  const seen = new Set<string>();\n\n  for (const value of values) {\n    if (!value || seen.has(value)) continue;\n    seen.add(value);\n    secrets.push(value);\n  }\n\n  return secrets;\n}\n\nexport function loadPortState(configDir?: string): PortState {\n  if (!configDir) return { postgresPorts: {}, redisPorts: {} };\n  const statePath = join(configDir, \".bos\", \"infra-state.json\");\n  if (!existsSync(statePath)) return { postgresPorts: {}, redisPorts: {} };\n  try {\n    const raw = JSON.parse(readFileSync(statePath, \"utf-8\")) as Partial<PortState>;\n    return {\n      postgresPorts: raw.postgresPorts ?? {},\n      redisPorts: raw.redisPorts ?? {},\n      devPorts: raw.devPorts,\n    };\n  } catch {\n    return { postgresPorts: {}, redisPorts: {} };\n  }\n}\n\nexport function savePortState(configDir: string, state: PortState): void {\n  const statePath = join(configDir, \".bos\", \"infra-state.json\");\n  mkdirSync(dirname(statePath), { recursive: true });\n  writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\\n`);\n}\n\nexport type { DevPortState };\n\nfunction resolvePort(slug: string, portMap: Record<string, number>, basePort: number): number {\n  if (portMap[slug] !== undefined) return portMap[slug];\n  const assigned = Object.values(portMap);\n  const maxAssigned = assigned.length > 0 ? Math.max(...assigned) : basePort - 1;\n  const next = Math.max(maxAssigned + 1, basePort);\n  portMap[slug] = next;\n  return next;\n}\n\nexport function normalizeRedisSlug(secret: string): string {\n  return secret.replace(/_REDIS_URL$/, \"\").toLowerCase();\n}\n\nexport function getSecretGroups(runtimeConfig: RuntimeConfig): SecretGroup[] {\n  const groups: SecretGroup[] = [];\n  const seen = new Set<string>();\n\n  const addGroup = (section: string, secrets: string[]) => {\n    const filtered = secrets.filter((s) => {\n      if (seen.has(s)) return false;\n      seen.add(s);\n      return true;\n    });\n    if (filtered.length > 0) {\n      groups.push({ section, secrets: filtered });\n    }\n  };\n\n  addGroup(\"app.host\", uniqueSecrets([...(runtimeConfig.host.secrets ?? []), HOST_SECRET]));\n\n  addGroup(\"app.api\", uniqueSecrets(runtimeConfig.api.secrets ?? []));\n\n  if (runtimeConfig.auth) {\n    addGroup(\"app.auth\", uniqueSecrets(runtimeConfig.auth.secrets ?? []));\n  }\n\n  if (runtimeConfig.plugins) {\n    for (const [pluginKey, plugin] of Object.entries(runtimeConfig.plugins)) {\n      if (plugin.secrets && plugin.secrets.length > 0) {\n        addGroup(`plugins.${pluginKey}`, plugin.secrets);\n      }\n    }\n  }\n\n  return groups;\n}\n\nfunction buildGeneratedInfraSpec(\n  runtimeConfig: RuntimeConfig,\n  configDir?: string,\n): { spec: GeneratedInfraSpec; portState: PortState } {\n  const groups = getSecretGroups(runtimeConfig);\n  const allSecrets = groups.flatMap((group) => group.secrets);\n  const originMap = configDir ? buildOriginMap(configDir, runtimeConfig) : new Map();\n  const portState = loadPortState(configDir);\n\n  const databases = buildDatabaseConfigs(allSecrets, originMap, portState.postgresPorts);\n  const redis = buildRedisConfigs(allSecrets, originMap, portState.redisPorts);\n\n  return { spec: { groups, databases, redis }, portState };\n}\n\nexport function normalizeDatabaseSlug(secret: string): string {\n  return secret.replace(/_DATABASE_URL$/, \"\").toLowerCase();\n}\n\nexport function buildOriginMap(\n  configDir: string,\n  runtimeConfig: RuntimeConfig,\n): Map<string, string> {\n  const configPath = join(configDir, \"bos.config.json\");\n\n  const originMap = new Map<string, string>();\n  const account = runtimeConfig.account;\n\n  const resolveOrigin = (extendsRef: unknown): string | null => {\n    if (typeof extendsRef === \"string\") {\n      const match = extendsRef.match(/^bos:\\/\\/([^/]+)\\//);\n      return match?.[1] ?? null;\n    }\n    return null;\n  };\n\n  const rawConfig = existsSync(configPath)\n    ? (JSON.parse(readFileSync(configPath, \"utf-8\")) as Record<string, unknown>)\n    : null;\n  const rawPlugins = rawConfig?.plugins as Record<string, unknown> | undefined;\n\n  for (const secret of runtimeConfig.api.secrets ?? []) {\n    if (!originMap.has(secret)) originMap.set(secret, account);\n  }\n\n  const rawApp = rawConfig?.app as Record<string, unknown> | undefined;\n  const authExtends = (rawApp?.auth as Record<string, unknown> | undefined)?.extends;\n  const authOrigin = resolveOrigin(authExtends) ?? account;\n  for (const secret of runtimeConfig.auth?.secrets ?? []) {\n    if (!originMap.has(secret)) originMap.set(secret, authOrigin);\n  }\n\n  for (const [pluginKey, pluginEntry] of Object.entries(runtimeConfig.plugins ?? {})) {\n    const rawPlugin = rawPlugins?.[pluginKey];\n    let pluginOrigin: string;\n    if (typeof rawPlugin === \"string\") {\n      pluginOrigin = resolveOrigin(rawPlugin) ?? account;\n    } else if (rawPlugin && typeof rawPlugin === \"object\") {\n      pluginOrigin = resolveOrigin((rawPlugin as Record<string, unknown>).extends) ?? account;\n    } else {\n      pluginOrigin = account;\n    }\n    for (const secret of pluginEntry.secrets ?? []) {\n      if (!originMap.has(secret)) originMap.set(secret, pluginOrigin);\n    }\n  }\n\n  for (const secret of runtimeConfig.host.secrets ?? []) {\n    if (!originMap.has(secret)) originMap.set(secret, account);\n  }\n\n  return originMap;\n}\n\nexport function buildDatabaseConfigs(\n  secrets: string[],\n  originMap: Map<string, string>,\n  portMap: Record<string, number>,\n): DatabaseSecretConfig[] {\n  const databaseSecrets = uniqueSecrets(\n    secrets.filter((secret) => secret.endsWith(\"_DATABASE_URL\")),\n  );\n\n  const orderedSecrets = [...databaseSecrets];\n\n  // Prune stale entries from removed plugins\n  const currentSlugs = new Set(orderedSecrets.map(normalizeDatabaseSlug));\n  for (const slug of Object.keys(portMap)) {\n    if (!currentSlugs.has(slug)) delete portMap[slug];\n  }\n\n  // Sort by slug for deterministic assignment order\n  orderedSecrets.sort((a, b) => normalizeDatabaseSlug(a).localeCompare(normalizeDatabaseSlug(b)));\n\n  for (const secret of orderedSecrets) {\n    const slug = normalizeDatabaseSlug(secret);\n    if (secret === API_DATABASE_SECRET) {\n      portMap[slug] = 5432;\n    } else if (secret === AUTH_DATABASE_SECRET) {\n      portMap[slug] = 5433;\n    } else {\n      resolvePort(slug, portMap, BASE_POSTGRES_PORT);\n    }\n  }\n\n  return orderedSecrets.map((secret) => {\n    const slug = normalizeDatabaseSlug(secret);\n    const fromKey = originMap.get(secret) ?? \"\";\n    const port = portMap[slug];\n\n    const volumeName = fromKey\n      ? `${fromKey.replace(/\\./g, \"_\")}_postgres_${slug}_data`\n      : `postgres_${slug}_data`;\n\n    const containerName = fromKey ? `${fromKey}-postgres-${slug}` : `postgres-${slug}`;\n\n    return {\n      secret,\n      slug,\n      fromKey,\n      port,\n      serviceName: `postgres-${slug.replace(/_/g, \"-\")}`,\n      containerName,\n      databaseName: `${slug}_db`,\n      volumeName,\n      url: `postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:${port}/${slug}_db`,\n    };\n  });\n}\n\nexport function buildRedisConfigs(\n  secrets: string[],\n  originMap: Map<string, string>,\n  portMap: Record<string, number>,\n): RedisSecretConfig[] {\n  const redisSecrets = uniqueSecrets(secrets.filter((secret) => secret.endsWith(\"_REDIS_URL\")));\n  const orderedSecrets = [...redisSecrets];\n\n  // Prune stale entries from removed plugins\n  const currentSlugs = new Set(orderedSecrets.map(normalizeRedisSlug));\n  for (const slug of Object.keys(portMap)) {\n    if (!currentSlugs.has(slug)) delete portMap[slug];\n  }\n\n  // Sort by slug for deterministic assignment order\n  orderedSecrets.sort((a, b) => normalizeRedisSlug(a).localeCompare(normalizeRedisSlug(b)));\n\n  for (const secret of orderedSecrets) {\n    const slug = normalizeRedisSlug(secret);\n    resolvePort(slug, portMap, BASE_REDIS_PORT);\n  }\n\n  return orderedSecrets.map((secret) => {\n    const slug = normalizeRedisSlug(secret);\n    const fromKey = originMap.get(secret) ?? \"\";\n    const port = portMap[slug];\n\n    const volumeName = fromKey\n      ? `${fromKey.replace(/\\./g, \"_\")}_redis_${slug}_data`\n      : `redis_${slug}_data`;\n\n    const containerName = fromKey ? `${fromKey}-redis-${slug}` : `redis-${slug}`;\n\n    return {\n      secret,\n      slug,\n      fromKey,\n      port,\n      serviceName: `redis-${slug.replace(/_/g, \"-\")}`,\n      containerName,\n      volumeName,\n      url: `redis://localhost:${port}`,\n    };\n  });\n}\n\nfunction extractPortFromUrl(url: string): string | null {\n  const match = url.match(/:(\\d{4,5})(?:\\/|$)/);\n  return match?.[1] ?? null;\n}\n\nfunction resolveDevHostPort(runtimeConfig: RuntimeConfig): number {\n  if (typeof runtimeConfig.host?.port === \"number\") return runtimeConfig.host.port;\n  const fromUrl = runtimeConfig.host?.url ? extractPortFromUrl(runtimeConfig.host.url) : null;\n  if (fromUrl) {\n    const parsed = Number.parseInt(fromUrl, 10);\n    if (!Number.isNaN(parsed)) return parsed;\n  }\n  return 3000;\n}\n\nfunction defaultSecretValue(\n  secret: string,\n  databases: Map<string, DatabaseSecretConfig>,\n  redisConfigs: Map<string, RedisSecretConfig>,\n  options: { forExample: boolean; devHostPort?: number },\n): string {\n  if (secret === \"BETTER_AUTH_SECRET\") {\n    return options.forExample ? \"\" : randomBytes(32).toString(\"base64url\");\n  }\n\n  if (secret === \"CORS_ORIGIN\") {\n    if (typeof options.devHostPort === \"number\") {\n      return `http://localhost:${options.devHostPort}`;\n    }\n    return \"http://localhost:3000\";\n  }\n\n  return databases.get(secret)?.url ?? redisConfigs.get(secret)?.url ?? \"\";\n}\n\nfunction renderEnvFile(\n  groups: SecretGroup[],\n  databases: DatabaseSecretConfig[],\n  redisConfigs: RedisSecretConfig[],\n  options: { forExample: boolean; devHostPort?: number },\n): string {\n  const databaseMap = new Map(databases.map((entry) => [entry.secret, entry]));\n  const redisMap = new Map(redisConfigs.map((entry) => [entry.secret, entry]));\n  const lines: string[] = [\n    \"# Generated from configured bos secrets\",\n    \"# Update values as needed for your local environment\",\n    \"\",\n  ];\n\n  for (const group of groups) {\n    lines.push(`# ${group.section}`);\n    for (const secret of group.secrets) {\n      lines.push(`${secret}=${defaultSecretValue(secret, databaseMap, redisMap, options)}`);\n    }\n    lines.push(\"\");\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nfunction renderDockerCompose(\n  databases: DatabaseSecretConfig[],\n  redisConfigs: RedisSecretConfig[],\n  projectName: string,\n): string {\n  const lines = [`name: ${projectName}`, \"\"];\n\n  if (databases.length > 0) {\n    lines.push(\n      \"x-pg-common: &pg-common\",\n      \"  image: postgres:17-alpine\",\n      \"  environment: &pg-env\",\n      `    POSTGRES_USER: ${POSTGRES_USER}`,\n      `    POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}`,\n      \"  healthcheck:\",\n      '    test: [\"CMD-SHELL\", \"pg_isready -U everythingdev\"]',\n      \"    interval: 3s\",\n      \"    timeout: 3s\",\n      \"    retries: 5\",\n      \"\",\n    );\n  }\n\n  if (redisConfigs.length > 0) {\n    lines.push(\n      \"x-redis-common: &redis-common\",\n      \"  image: redis:7-alpine\",\n      \"  command: redis-server --appendonly yes\",\n      \"  healthcheck:\",\n      '    test: [\"CMD\", \"redis-cli\", \"ping\"]',\n      \"    interval: 3s\",\n      \"    timeout: 3s\",\n      \"    retries: 5\",\n      \"\",\n    );\n  }\n\n  lines.push(\"services:\");\n\n  for (const database of databases) {\n    lines.push(`  ${database.serviceName}:`);\n    lines.push(\"    <<: *pg-common\");\n    lines.push(`    container_name: ${database.containerName}`);\n    lines.push(\"    environment:\");\n    lines.push(\"      <<: *pg-env\");\n    lines.push(`      POSTGRES_DB: ${database.databaseName}`);\n    lines.push(\"    ports:\");\n    lines.push(`      - \"${database.port}:5432\"`);\n    lines.push(\"    volumes:\");\n    lines.push(`      - ${database.volumeName}:/var/lib/postgresql/data`);\n    lines.push(\"\");\n  }\n\n  for (const redis of redisConfigs) {\n    lines.push(`  ${redis.serviceName}:`);\n    lines.push(\"    <<: *redis-common\");\n    lines.push(`    container_name: ${redis.containerName}`);\n    lines.push(\"    ports:\");\n    lines.push(`      - \"${redis.port}:6379\"`);\n    lines.push(\"    volumes:\");\n    lines.push(`      - ${redis.volumeName}:/data`);\n    lines.push(\"\");\n  }\n\n  lines.push(\"volumes:\");\n  for (const database of databases) {\n    lines.push(`  ${database.volumeName}:`);\n    lines.push(`    name: ${database.volumeName}`);\n  }\n  for (const redis of redisConfigs) {\n    lines.push(`  ${redis.volumeName}:`);\n    lines.push(`    name: ${redis.volumeName}`);\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport function renderEnvFileFromPlan(env: Record<string, string>, devHostPort?: number): string {\n  const lines: string[] = [\n    \"# Generated from bos dev infra plan\",\n    \"# Update values as needed for your local environment\",\n    \"\",\n  ];\n  const sortedKeys = Object.keys(env).sort();\n  for (const key of sortedKeys) {\n    let value = env[key];\n    if (key === \"CORS_ORIGIN\" && devHostPort && !value) {\n      value = `http://localhost:${devHostPort}`;\n    }\n    lines.push(`${key}=${value}`);\n  }\n  lines.push(\"\");\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport function renderDockerComposeFromPlan(\n  databases: {\n    serviceName: string;\n    containerName: string;\n    port: number;\n    volumeName: string;\n    databaseName: string;\n  }[],\n  redis: { serviceName: string; containerName: string; port: number; volumeName: string }[],\n  projectName: string,\n): string {\n  const lines = [`name: ${projectName}`, \"\"];\n\n  if (databases.length > 0) {\n    lines.push(\n      \"x-pg-common: &pg-common\",\n      \"  image: postgres:17-alpine\",\n      \"  environment: &pg-env\",\n      `    POSTGRES_USER: ${POSTGRES_USER}`,\n      `    POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}`,\n      \"  healthcheck:\",\n      '    test: [\"CMD-SHELL\", \"pg_isready -U everythingdev\"]',\n      \"    interval: 3s\",\n      \"    timeout: 3s\",\n      \"    retries: 5\",\n      \"\",\n    );\n  }\n\n  if (redis.length > 0) {\n    lines.push(\n      \"x-redis-common: &redis-common\",\n      \"  image: redis:7-alpine\",\n      \"  command: redis-server --appendonly yes\",\n      \"  healthcheck:\",\n      '    test: [\"CMD\", \"redis-cli\", \"ping\"]',\n      \"    interval: 3s\",\n      \"    timeout: 3s\",\n      \"    retries: 5\",\n      \"\",\n    );\n  }\n\n  lines.push(\"services:\");\n\n  for (const db of databases) {\n    lines.push(`  ${db.serviceName}:`);\n    lines.push(\"    <<: *pg-common\");\n    lines.push(`    container_name: ${db.containerName}`);\n    lines.push(\"    environment:\");\n    lines.push(\"      <<: *pg-env\");\n    lines.push(`      POSTGRES_DB: ${db.databaseName}`);\n    lines.push(\"    ports:\");\n    lines.push(`      - \"${db.port}:5432\"`);\n    lines.push(\"    volumes:\");\n    lines.push(`      - ${db.volumeName}:/var/lib/postgresql/data`);\n    lines.push(\"\");\n  }\n\n  for (const r of redis) {\n    lines.push(`  ${r.serviceName}:`);\n    lines.push(\"    <<: *redis-common\");\n    lines.push(`    container_name: ${r.containerName}`);\n    lines.push(\"    ports:\");\n    lines.push(`      - \"${r.port}:6379\"`);\n    lines.push(\"    volumes:\");\n    lines.push(`      - ${r.volumeName}:/data`);\n    lines.push(\"\");\n  }\n\n  lines.push(\"volumes:\");\n  for (const db of databases) {\n    lines.push(`  ${db.volumeName}:`);\n    lines.push(`    name: ${db.volumeName}`);\n  }\n  for (const r of redis) {\n    lines.push(`  ${r.volumeName}:`);\n    lines.push(`    name: ${r.volumeName}`);\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport function materializeInfraPlan(\n  configDir: string,\n  planEnv: Record<string, string>,\n  planDatabases: {\n    serviceName: string;\n    containerName: string;\n    port: number;\n    volumeName: string;\n    databaseName: string;\n  }[],\n  planRedis: { serviceName: string; containerName: string; port: number; volumeName: string }[],\n  projectName: string,\n  devHostPort?: number,\n): { envExampleChanged: boolean; dockerComposeChanged: boolean } {\n  const envContent = renderEnvFileFromPlan(planEnv, devHostPort);\n  const dockerContent = renderDockerComposeFromPlan(planDatabases, planRedis, projectName);\n\n  const envExamplePath = join(configDir, \".env.example\");\n  const dockerComposePath = join(configDir, \"docker-compose.yml\");\n\n  return {\n    envExampleChanged: syncTextFile(envExamplePath, envContent),\n    dockerComposeChanged: syncTextFile(dockerComposePath, dockerContent),\n  };\n}\n\nfunction syncTextFile(filePath: string, nextContent: string): boolean {\n  if (existsSync(filePath) && readFileSync(filePath, \"utf-8\") === nextContent) {\n    return false;\n  }\n\n  writeFileSync(filePath, nextContent);\n  return true;\n}\n\nexport function writeGeneratedInfra(configDir: string, runtimeConfig: RuntimeConfig): string[] {\n  const result = syncGeneratedInfra(configDir, runtimeConfig);\n\n  if (result.staleEnvWarnings.length > 0) {\n    p.log.warn(\n      `.env has ${result.staleEnvWarnings.length} stale value(s) compared to .env.example:`,\n    );\n    for (const warning of result.staleEnvWarnings) {\n      p.log.message(`  ${warning}`);\n    }\n  }\n\n  return result.secrets;\n}\n\nexport function syncGeneratedInfra(\n  configDir: string,\n  runtimeConfig: RuntimeConfig,\n): SyncGeneratedInfraResult {\n  const { spec, portState } = buildGeneratedInfraSpec(runtimeConfig, configDir);\n  const secrets = spec.groups.flatMap((group) => group.secrets);\n  const envOptions: { forExample: true; devHostPort?: number } = { forExample: true };\n  if (runtimeConfig.env === \"development\") {\n    envOptions.devHostPort = resolveDevHostPort(runtimeConfig);\n  }\n  const newEnvContent = renderEnvFile(spec.groups, spec.databases, spec.redis, envOptions);\n  const newDockerContent = renderDockerCompose(spec.databases, spec.redis, runtimeConfig.account);\n\n  const envExamplePath = join(configDir, \".env.example\");\n  const dockerComposePath = join(configDir, \"docker-compose.yml\");\n\n  const staleWarnings = checkEnvStaleness(configDir, spec.databases, spec.redis);\n\n  if (configDir) {\n    savePortState(configDir, portState);\n  }\n\n  return {\n    secrets,\n    envExampleChanged: syncTextFile(envExamplePath, newEnvContent),\n    dockerComposeChanged: syncTextFile(dockerComposePath, newDockerContent),\n    staleEnvWarnings: staleWarnings,\n  };\n}\n\nfunction checkEnvStaleness(\n  configDir: string,\n  databases: DatabaseSecretConfig[],\n  redisConfigs: RedisSecretConfig[],\n): string[] {\n  const envPath = join(configDir, \".env\");\n  if (!existsSync(envPath)) return [];\n\n  const existingEnv = readFileSync(envPath, \"utf-8\");\n  const envMap = new Map<string, string>();\n  for (const line of existingEnv.split(\"\\n\")) {\n    const match = line.match(/^([A-Z_]+)=(.*)$/);\n    if (match) envMap.set(match[1], match[2]);\n  }\n\n  const stale: string[] = [];\n\n  for (const db of databases) {\n    const existing = envMap.get(db.secret);\n    if (existing && existing !== db.url) {\n      const oldPort = extractPortFromUrl(existing) ?? \"?\";\n      stale.push(`${db.secret}: port ${oldPort} → ${db.port}`);\n    }\n  }\n\n  for (const redis of redisConfigs) {\n    const existing = envMap.get(redis.secret);\n    if (existing && existing !== redis.url) {\n      const oldPort = extractPortFromUrl(existing) ?? \"?\";\n      stale.push(`${redis.secret}: port ${oldPort} → ${redis.port}`);\n    }\n  }\n\n  return stale;\n}\n\nexport function ensureEnvFile(configDir: string): void {\n  const envPath = join(configDir, \".env\");\n  const examplePath = join(configDir, \".env.example\");\n\n  if (existsSync(envPath) || !existsSync(examplePath)) return;\n\n  const content = readFileSync(examplePath, \"utf-8\");\n  const lines = content.split(\"\\n\");\n  const secret = randomBytes(32).toString(\"base64url\");\n  const updated = lines\n    .map((line) => {\n      if (/^BETTER_AUTH_SECRET=/.test(line)) {\n        return `BETTER_AUTH_SECRET=${secret}`;\n      }\n      return line;\n    })\n    .join(\"\\n\");\n\n  writeFileSync(envPath, updated);\n  p.log.info(\"Created .env from generated .env.example with generated BETTER_AUTH_SECRET\");\n}\n\nlet envLoadedDir: string | null = null;\n\nexport function loadProjectEnv(configDir: string): void {\n  if (envLoadedDir === configDir) return;\n  const envPath = join(configDir, \".env\");\n  if (!existsSync(envPath)) return;\n\n  loadDotenv({ path: envPath, processEnv: process.env, quiet: true });\n  envLoadedDir = configDir;\n}\n"],"mappings":";;;;;;;;;AAOA,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AACpB,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;AAyDxB,SAAS,cAAc,QAA6C;CAClE,MAAM,UAAoB,CAAC;CAC3B,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,CAAC,SAAS,KAAK,IAAI,KAAK,GAAG;EAC/B,KAAK,IAAI,KAAK;EACd,QAAQ,KAAK,KAAK;CACpB;CAEA,OAAO;AACT;AAEA,SAAgB,cAAc,WAA+B;CAC3D,IAAI,CAAC,WAAW,OAAO;EAAE,eAAe,CAAC;EAAG,YAAY,CAAC;CAAE;CAC3D,MAAM,gCAAiB,WAAW,QAAQ,kBAAkB;CAC5D,IAAI,yBAAY,SAAS,GAAG,OAAO;EAAE,eAAe,CAAC;EAAG,YAAY,CAAC;CAAE;CACvE,IAAI;EACF,MAAM,MAAM,KAAK,gCAAmB,WAAW,OAAO,CAAC;EACvD,OAAO;GACL,eAAe,IAAI,iBAAiB,CAAC;GACrC,YAAY,IAAI,cAAc,CAAC;GAC/B,UAAU,IAAI;EAChB;CACF,QAAQ;EACN,OAAO;GAAE,eAAe,CAAC;GAAG,YAAY,CAAC;EAAE;CAC7C;AACF;AAEA,SAAgB,cAAc,WAAmB,OAAwB;CACvE,MAAM,gCAAiB,WAAW,QAAQ,kBAAkB;CAC5D,8CAAkB,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,2BAAc,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAChE;AAIA,SAAS,YAAY,MAAc,SAAiC,UAA0B;CAC5F,IAAI,QAAQ,UAAU,QAAW,OAAO,QAAQ;CAChD,MAAM,WAAW,OAAO,OAAO,OAAO;CACtC,MAAM,cAAc,SAAS,SAAS,IAAI,KAAK,IAAI,GAAG,QAAQ,IAAI,WAAW;CAC7E,MAAM,OAAO,KAAK,IAAI,cAAc,GAAG,QAAQ;CAC/C,QAAQ,QAAQ;CAChB,OAAO;AACT;AAEA,SAAgB,mBAAmB,QAAwB;CACzD,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,YAAY;AACvD;AAEA,SAAgB,gBAAgB,eAA6C;CAC3E,MAAM,SAAwB,CAAC;CAC/B,MAAM,uBAAO,IAAI,IAAY;CAE7B,MAAM,YAAY,SAAiB,YAAsB;EACvD,MAAM,WAAW,QAAQ,QAAQ,MAAM;GACrC,IAAI,KAAK,IAAI,CAAC,GAAG,OAAO;GACxB,KAAK,IAAI,CAAC;GACV,OAAO;EACT,CAAC;EACD,IAAI,SAAS,SAAS,GACpB,OAAO,KAAK;GAAE;GAAS,SAAS;EAAS,CAAC;CAE9C;CAEA,SAAS,YAAY,cAAc,CAAC,GAAI,cAAc,KAAK,WAAW,CAAC,GAAI,WAAW,CAAC,CAAC;CAExF,SAAS,WAAW,cAAc,cAAc,IAAI,WAAW,CAAC,CAAC,CAAC;CAElE,IAAI,cAAc,MAChB,SAAS,YAAY,cAAc,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC;CAGtE,IAAI,cAAc,SAChB;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,cAAc,OAAO,GACpE,IAAI,OAAO,WAAW,OAAO,QAAQ,SAAS,GAC5C,SAAS,WAAW,aAAa,OAAO,OAAO;CAEnD;CAGF,OAAO;AACT;AAEA,SAAS,wBACP,eACA,WACoD;CACpD,MAAM,SAAS,gBAAgB,aAAa;CAC5C,MAAM,aAAa,OAAO,SAAS,UAAU,MAAM,OAAO;CAC1D,MAAM,YAAY,YAAY,eAAe,WAAW,aAAa,oBAAI,IAAI,IAAI;CACjF,MAAM,YAAY,cAAc,SAAS;CAKzC,OAAO;EAAE,MAAM;GAAE;GAAQ,WAHP,qBAAqB,YAAY,WAAW,UAAU,aAGvC;GAAG,OAFtB,kBAAkB,YAAY,WAAW,UAAU,UAEzB;EAAE;EAAG;CAAU;AACzD;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,OAAO,QAAQ,kBAAkB,EAAE,CAAC,CAAC,YAAY;AAC1D;AAEA,SAAgB,eACd,WACA,eACqB;CACrB,MAAM,iCAAkB,WAAW,iBAAiB;CAEpD,MAAM,4BAAY,IAAI,IAAoB;CAC1C,MAAM,UAAU,cAAc;CAE9B,MAAM,iBAAiB,eAAuC;EAC5D,IAAI,OAAO,eAAe,UAExB,OADc,WAAW,MAAM,oBACpB,CAAC,GAAG,MAAM;EAEvB,OAAO;CACT;CAEA,MAAM,oCAAuB,UAAU,IAClC,KAAK,gCAAmB,YAAY,OAAO,CAAC,IAC7C;CACJ,MAAM,aAAa,WAAW;CAE9B,KAAK,MAAM,UAAU,cAAc,IAAI,WAAW,CAAC,GACjD,IAAI,CAAC,UAAU,IAAI,MAAM,GAAG,UAAU,IAAI,QAAQ,OAAO;CAI3D,MAAM,gBADS,WAAW,IACC,EAAE,KAAI,EAA0C;CAC3E,MAAM,aAAa,cAAc,WAAW,KAAK;CACjD,KAAK,MAAM,UAAU,cAAc,MAAM,WAAW,CAAC,GACnD,IAAI,CAAC,UAAU,IAAI,MAAM,GAAG,UAAU,IAAI,QAAQ,UAAU;CAG9D,KAAK,MAAM,CAAC,WAAW,gBAAgB,OAAO,QAAQ,cAAc,WAAW,CAAC,CAAC,GAAG;EAClF,MAAM,YAAY,aAAa;EAC/B,IAAI;EACJ,IAAI,OAAO,cAAc,UACvB,eAAe,cAAc,SAAS,KAAK;OACtC,IAAI,aAAa,OAAO,cAAc,UAC3C,eAAe,cAAe,UAAsC,OAAO,KAAK;OAEhF,eAAe;EAEjB,KAAK,MAAM,UAAU,YAAY,WAAW,CAAC,GAC3C,IAAI,CAAC,UAAU,IAAI,MAAM,GAAG,UAAU,IAAI,QAAQ,YAAY;CAElE;CAEA,KAAK,MAAM,UAAU,cAAc,KAAK,WAAW,CAAC,GAClD,IAAI,CAAC,UAAU,IAAI,MAAM,GAAG,UAAU,IAAI,QAAQ,OAAO;CAG3D,OAAO;AACT;AAEA,SAAgB,qBACd,SACA,WACA,SACwB;CAKxB,MAAM,iBAAiB,CAAC,GAJA,cACtB,QAAQ,QAAQ,WAAW,OAAO,SAAS,eAAe,CAAC,CAGpB,CAAC;CAG1C,MAAM,eAAe,IAAI,IAAI,eAAe,IAAI,qBAAqB,CAAC;CACtE,KAAK,MAAM,QAAQ,OAAO,KAAK,OAAO,GACpC,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG,OAAO,QAAQ;CAI9C,eAAe,MAAM,GAAG,MAAM,sBAAsB,CAAC,CAAC,CAAC,cAAc,sBAAsB,CAAC,CAAC,CAAC;CAE9F,KAAK,MAAM,UAAU,gBAAgB;EACnC,MAAM,OAAO,sBAAsB,MAAM;EACzC,IAAI,WAAW,qBACb,QAAQ,QAAQ;OACX,IAAI,WAAW,sBACpB,QAAQ,QAAQ;OAEhB,YAAY,MAAM,SAAS,kBAAkB;CAEjD;CAEA,OAAO,eAAe,KAAK,WAAW;EACpC,MAAM,OAAO,sBAAsB,MAAM;EACzC,MAAM,UAAU,UAAU,IAAI,MAAM,KAAK;EACzC,MAAM,OAAO,QAAQ;EAErB,MAAM,aAAa,UACf,GAAG,QAAQ,QAAQ,OAAO,GAAG,EAAE,YAAY,KAAK,SAChD,YAAY,KAAK;EAErB,MAAM,gBAAgB,UAAU,GAAG,QAAQ,YAAY,SAAS,YAAY;EAE5E,OAAO;GACL;GACA;GACA;GACA;GACA,aAAa,YAAY,KAAK,QAAQ,MAAM,GAAG;GAC/C;GACA,cAAc,GAAG,KAAK;GACtB;GACA,KAAK,cAAc,cAAc,GAAG,kBAAkB,aAAa,KAAK,GAAG,KAAK;EAClF;CACF,CAAC;AACH;AAEA,SAAgB,kBACd,SACA,WACA,SACqB;CAErB,MAAM,iBAAiB,CAAC,GADH,cAAc,QAAQ,QAAQ,WAAW,OAAO,SAAS,YAAY,CAAC,CACrD,CAAC;CAGvC,MAAM,eAAe,IAAI,IAAI,eAAe,IAAI,kBAAkB,CAAC;CACnE,KAAK,MAAM,QAAQ,OAAO,KAAK,OAAO,GACpC,IAAI,CAAC,aAAa,IAAI,IAAI,GAAG,OAAO,QAAQ;CAI9C,eAAe,MAAM,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,cAAc,mBAAmB,CAAC,CAAC,CAAC;CAExF,KAAK,MAAM,UAAU,gBAEnB,YADa,mBAAmB,MACjB,GAAG,SAAS,eAAe;CAG5C,OAAO,eAAe,KAAK,WAAW;EACpC,MAAM,OAAO,mBAAmB,MAAM;EACtC,MAAM,UAAU,UAAU,IAAI,MAAM,KAAK;EACzC,MAAM,OAAO,QAAQ;EAErB,MAAM,aAAa,UACf,GAAG,QAAQ,QAAQ,OAAO,GAAG,EAAE,SAAS,KAAK,SAC7C,SAAS,KAAK;EAElB,MAAM,gBAAgB,UAAU,GAAG,QAAQ,SAAS,SAAS,SAAS;EAEtE,OAAO;GACL;GACA;GACA;GACA;GACA,aAAa,SAAS,KAAK,QAAQ,MAAM,GAAG;GAC5C;GACA;GACA,KAAK,qBAAqB;EAC5B;CACF,CAAC;AACH;AAEA,SAAS,mBAAmB,KAA4B;CAEtD,OADc,IAAI,MAAM,oBACb,CAAC,GAAG,MAAM;AACvB;AAEA,SAAS,mBAAmB,eAAsC;CAChE,IAAI,OAAO,cAAc,MAAM,SAAS,UAAU,OAAO,cAAc,KAAK;CAC5E,MAAM,UAAU,cAAc,MAAM,MAAM,mBAAmB,cAAc,KAAK,GAAG,IAAI;CACvF,IAAI,SAAS;EACX,MAAM,SAAS,OAAO,SAAS,SAAS,EAAE;EAC1C,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,OAAO;CACpC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,WACA,cACA,SACQ;CACR,IAAI,WAAW,sBACb,OAAO,QAAQ,aAAa,kCAAiB,EAAE,CAAC,CAAC,SAAS,WAAW;CAGvE,IAAI,WAAW,eAAe;EAC5B,IAAI,OAAO,QAAQ,gBAAgB,UACjC,OAAO,oBAAoB,QAAQ;EAErC,OAAO;CACT;CAEA,OAAO,UAAU,IAAI,MAAM,CAAC,EAAE,OAAO,aAAa,IAAI,MAAM,CAAC,EAAE,OAAO;AACxE;AAEA,SAAS,cACP,QACA,WACA,cACA,SACQ;CACR,MAAM,cAAc,IAAI,IAAI,UAAU,KAAK,UAAU,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;CAC3E,MAAM,WAAW,IAAI,IAAI,aAAa,KAAK,UAAU,CAAC,MAAM,QAAQ,KAAK,CAAC,CAAC;CAC3E,MAAM,QAAkB;EACtB;EACA;EACA;CACF;CAEA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,KAAK,KAAK,MAAM,SAAS;EAC/B,KAAK,MAAM,UAAU,MAAM,SACzB,MAAM,KAAK,GAAG,OAAO,GAAG,mBAAmB,QAAQ,aAAa,UAAU,OAAO,GAAG;EAEtF,MAAM,KAAK,EAAE;CACf;CAEA,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE;AAC7B;AAEA,SAAS,oBACP,WACA,cACA,aACQ;CACR,MAAM,QAAQ,CAAC,SAAS,eAAe,EAAE;CAEzC,IAAI,UAAU,SAAS,GACrB,MAAM,KACJ,2BACA,+BACA,0BACA,sBAAsB,iBACtB,0BAA0B,qBAC1B,kBACA,8DACA,oBACA,mBACA,kBACA,EACF;CAGF,IAAI,aAAa,SAAS,GACxB,MAAM,KACJ,iCACA,2BACA,4CACA,kBACA,gDACA,oBACA,mBACA,kBACA,EACF;CAGF,MAAM,KAAK,WAAW;CAEtB,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,KAAK,KAAK,SAAS,YAAY,EAAE;EACvC,MAAM,KAAK,oBAAoB;EAC/B,MAAM,KAAK,uBAAuB,SAAS,eAAe;EAC1D,MAAM,KAAK,kBAAkB;EAC7B,MAAM,KAAK,mBAAmB;EAC9B,MAAM,KAAK,sBAAsB,SAAS,cAAc;EACxD,MAAM,KAAK,YAAY;EACvB,MAAM,KAAK,YAAY,SAAS,KAAK,OAAO;EAC5C,MAAM,KAAK,cAAc;EACzB,MAAM,KAAK,WAAW,SAAS,WAAW,0BAA0B;EACpE,MAAM,KAAK,EAAE;CACf;CAEA,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,KAAK,KAAK,MAAM,YAAY,EAAE;EACpC,MAAM,KAAK,uBAAuB;EAClC,MAAM,KAAK,uBAAuB,MAAM,eAAe;EACvD,MAAM,KAAK,YAAY;EACvB,MAAM,KAAK,YAAY,MAAM,KAAK,OAAO;EACzC,MAAM,KAAK,cAAc;EACzB,MAAM,KAAK,WAAW,MAAM,WAAW,OAAO;EAC9C,MAAM,KAAK,EAAE;CACf;CAEA,MAAM,KAAK,UAAU;CACrB,KAAK,MAAM,YAAY,WAAW;EAChC,MAAM,KAAK,KAAK,SAAS,WAAW,EAAE;EACtC,MAAM,KAAK,aAAa,SAAS,YAAY;CAC/C;CACA,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,KAAK,KAAK,MAAM,WAAW,EAAE;EACnC,MAAM,KAAK,aAAa,MAAM,YAAY;CAC5C;CAEA,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE;AAC7B;AAiIA,SAAS,aAAa,UAAkB,aAA8B;CACpE,4BAAe,QAAQ,+BAAkB,UAAU,OAAO,MAAM,aAC9D,OAAO;CAGT,2BAAc,UAAU,WAAW;CACnC,OAAO;AACT;AAEA,SAAgB,oBAAoB,WAAmB,eAAwC;CAC7F,MAAM,SAAS,mBAAmB,WAAW,aAAa;CAE1D,IAAI,OAAO,iBAAiB,SAAS,GAAG;EACtC,eAAE,IAAI,KACJ,YAAY,OAAO,iBAAiB,OAAO,0CAC7C;EACA,KAAK,MAAM,WAAW,OAAO,kBAC3B,eAAE,IAAI,QAAQ,KAAK,SAAS;CAEhC;CAEA,OAAO,OAAO;AAChB;AAEA,SAAgB,mBACd,WACA,eAC0B;CAC1B,MAAM,EAAE,MAAM,cAAc,wBAAwB,eAAe,SAAS;CAC5E,MAAM,UAAU,KAAK,OAAO,SAAS,UAAU,MAAM,OAAO;CAC5D,MAAM,aAAyD,EAAE,YAAY,KAAK;CAClF,IAAI,cAAc,QAAQ,eACxB,WAAW,cAAc,mBAAmB,aAAa;CAE3D,MAAM,gBAAgB,cAAc,KAAK,QAAQ,KAAK,WAAW,KAAK,OAAO,UAAU;CACvF,MAAM,mBAAmB,oBAAoB,KAAK,WAAW,KAAK,OAAO,cAAc,OAAO;CAE9F,MAAM,qCAAsB,WAAW,cAAc;CACrD,MAAM,wCAAyB,WAAW,oBAAoB;CAE9D,MAAM,gBAAgB,kBAAkB,WAAW,KAAK,WAAW,KAAK,KAAK;CAE7E,IAAI,WACF,cAAc,WAAW,SAAS;CAGpC,OAAO;EACL;EACA,mBAAmB,aAAa,gBAAgB,aAAa;EAC7D,sBAAsB,aAAa,mBAAmB,gBAAgB;EACtE,kBAAkB;CACpB;AACF;AAEA,SAAS,kBACP,WACA,WACA,cACU;CACV,MAAM,8BAAe,WAAW,MAAM;CACtC,IAAI,yBAAY,OAAO,GAAG,OAAO,CAAC;CAElC,MAAM,wCAA2B,SAAS,OAAO;CACjD,MAAM,yBAAS,IAAI,IAAoB;CACvC,KAAK,MAAM,QAAQ,YAAY,MAAM,IAAI,GAAG;EAC1C,MAAM,QAAQ,KAAK,MAAM,kBAAkB;EAC3C,IAAI,OAAO,OAAO,IAAI,MAAM,IAAI,MAAM,EAAE;CAC1C;CAEA,MAAM,QAAkB,CAAC;CAEzB,KAAK,MAAM,MAAM,WAAW;EAC1B,MAAM,WAAW,OAAO,IAAI,GAAG,MAAM;EACrC,IAAI,YAAY,aAAa,GAAG,KAAK;GACnC,MAAM,UAAU,mBAAmB,QAAQ,KAAK;GAChD,MAAM,KAAK,GAAG,GAAG,OAAO,SAAS,QAAQ,KAAK,GAAG,MAAM;EACzD;CACF;CAEA,KAAK,MAAM,SAAS,cAAc;EAChC,MAAM,WAAW,OAAO,IAAI,MAAM,MAAM;EACxC,IAAI,YAAY,aAAa,MAAM,KAAK;GACtC,MAAM,UAAU,mBAAmB,QAAQ,KAAK;GAChD,MAAM,KAAK,GAAG,MAAM,OAAO,SAAS,QAAQ,KAAK,MAAM,MAAM;EAC/D;CACF;CAEA,OAAO;AACT;AAEA,SAAgB,cAAc,WAAyB;CACrD,MAAM,8BAAe,WAAW,MAAM;CACtC,MAAM,kCAAmB,WAAW,cAAc;CAElD,4BAAe,OAAO,KAAK,yBAAY,WAAW,GAAG;CAGrD,MAAM,kCADuB,aAAa,OACtB,CAAC,CAAC,MAAM,IAAI;CAChC,MAAM,sCAAqB,EAAE,CAAC,CAAC,SAAS,WAAW;CAUnD,2BAAc,SATE,MACb,KAAK,SAAS;EACb,IAAI,uBAAuB,KAAK,IAAI,GAClC,OAAO,sBAAsB;EAE/B,OAAO;CACT,CAAC,CAAC,CACD,KAAK,IAEqB,CAAC;CAC9B,eAAE,IAAI,KAAK,4EAA4E;AACzF;AAEA,IAAI,eAA8B;AAElC,SAAgB,eAAe,WAAyB;CACtD,IAAI,iBAAiB,WAAW;CAChC,MAAM,8BAAe,WAAW,MAAM;CACtC,IAAI,yBAAY,OAAO,GAAG;CAE1B,mBAAW;EAAE,MAAM;EAAS,YAAY,QAAQ;EAAK,OAAO;CAAK,CAAC;CAClE,eAAe;AACjB"}
+{"version":3,"file":"infra.cjs","names":["join","existsSync","readFileSync","dirname","randomBytes"],"sources":["../../src/cli/infra.ts"],"sourcesContent":["import { randomBytes } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport type { RuntimeConfig } from \"../types\";\n\nconst POSTGRES_USER = \"everythingdev\";\nconst POSTGRES_PASSWORD = \"everythingdev\";\nconst AUTH_DATABASE_SECRET = \"AUTH_DATABASE_URL\";\nconst HOST_SECRET = \"CORS_ORIGIN\";\nconst REDIS_PORT = 6379;\nconst TEST_AUTH_SECRET = \"regression-test-secret-do-not-use-in-production\";\nconst VESTIGIAL_SECRETS = new Set([\n  \"NEAR_RELAYER_PRIVATE_KEY_MAINNET\",\n  \"NEAR_RELAYER_PRIVATE_KEY_TESTNET\",\n]);\n\n/**\n * Fixed local-development database conventions. The committed\n * docker-compose.yml provisions exactly these services/ports — nothing is\n * derived from runtime config. Every non-auth `*_DATABASE_URL` secret shares\n * the api database (schema-isolated per plugin); auth gets its own.\n */\nconst DEV_API_DB_PORT = 5432;\nconst DEV_AUTH_DB_PORT = 5433;\nconst TEST_API_DB_PORT = 5434;\nconst TEST_AUTH_DB_PORT = 5435;\n\nexport interface DatabaseConvention {\n  secret: string;\n  slug: string;\n  port: number;\n  databaseName: string;\n  url: string;\n}\n\nexport interface RedisConvention {\n  secret: string;\n  slug: string;\n  port: number;\n  url: string;\n}\n\nexport interface SecretGroup {\n  section: string;\n  secrets: string[];\n}\n\ninterface DevPortState {\n  host?: number;\n  api?: number;\n  ui?: number;\n  auth?: number;\n  pluginPortStart?: number;\n}\n\nexport type { DevPortState };\n\nexport interface PortState {\n  devPorts?: DevPortState;\n}\n\nfunction uniqueSecrets(values: Array<string | undefined>): string[] {\n  const secrets: string[] = [];\n  const seen = new Set<string>();\n\n  for (const value of values) {\n    if (!value || seen.has(value)) continue;\n    seen.add(value);\n    secrets.push(value);\n  }\n\n  return secrets;\n}\n\nexport function loadPortState(configDir?: string): PortState {\n  if (!configDir) return {};\n  const statePath = join(configDir, \".bos\", \"infra-state.json\");\n  if (!existsSync(statePath)) return {};\n  try {\n    const raw = JSON.parse(readFileSync(statePath, \"utf-8\")) as Partial<PortState>;\n    return { devPorts: raw.devPorts };\n  } catch {\n    return {};\n  }\n}\n\nexport function savePortState(configDir: string, state: PortState): void {\n  const statePath = join(configDir, \".bos\", \"infra-state.json\");\n  mkdirSync(dirname(statePath), { recursive: true });\n  writeFileSync(statePath, `${JSON.stringify(state, null, 2)}\\n`);\n}\n\nexport function normalizeDatabaseSlug(secret: string): string {\n  return secret.replace(/_DATABASE_URL$/, \"\").toLowerCase();\n}\n\nfunction normalizeRedisSlug(secret: string): string {\n  return secret.replace(/_REDIS_URL$/, \"\").toLowerCase();\n}\n\nfunction databaseUrl(port: number, databaseName: string): string {\n  return `postgres://${POSTGRES_USER}:${POSTGRES_PASSWORD}@localhost:${port}/${databaseName}`;\n}\n\nexport function buildConventionalDatabases(secrets: string[]): DatabaseConvention[] {\n  const databaseSecrets = uniqueSecrets(\n    secrets.filter((secret) => secret.endsWith(\"_DATABASE_URL\")),\n  );\n\n  return databaseSecrets\n    .sort((a, b) => normalizeDatabaseSlug(a).localeCompare(normalizeDatabaseSlug(b)))\n    .map((secret) => {\n      const slug = normalizeDatabaseSlug(secret);\n      const isAuth = secret === AUTH_DATABASE_SECRET;\n      const port = isAuth ? DEV_AUTH_DB_PORT : DEV_API_DB_PORT;\n      const databaseName = isAuth ? \"auth_db\" : \"api_db\";\n      return { secret, slug, port, databaseName, url: databaseUrl(port, databaseName) };\n    });\n}\n\nexport function buildConventionalRedis(secrets: string[]): RedisConvention[] {\n  const redisSecrets = uniqueSecrets(secrets.filter((secret) => secret.endsWith(\"_REDIS_URL\")));\n\n  return redisSecrets\n    .sort((a, b) => normalizeRedisSlug(a).localeCompare(normalizeRedisSlug(b)))\n    .map((secret) => ({\n      secret,\n      slug: normalizeRedisSlug(secret),\n      port: REDIS_PORT,\n      url: `redis://localhost:${REDIS_PORT}`,\n    }));\n}\n\nfunction testDatabaseUrl(secret: string): string {\n  const isAuth = secret === AUTH_DATABASE_SECRET;\n  const port = isAuth ? TEST_AUTH_DB_PORT : TEST_API_DB_PORT;\n  const databaseName = isAuth ? \"auth_test_db\" : \"api_test_db\";\n  return databaseUrl(port, databaseName);\n}\n\nexport function getSecretGroups(runtimeConfig: RuntimeConfig): SecretGroup[] {\n  const groups: SecretGroup[] = [];\n  const seen = new Set<string>();\n\n  const addGroup = (section: string, secrets: string[]) => {\n    const filtered = secrets.filter((s) => {\n      if (VESTIGIAL_SECRETS.has(s)) return false;\n      if (seen.has(s)) return false;\n      seen.add(s);\n      return true;\n    });\n    if (filtered.length > 0) {\n      groups.push({ section, secrets: filtered });\n    }\n  };\n\n  addGroup(\"app.host\", uniqueSecrets([...(runtimeConfig.host.secrets ?? []), HOST_SECRET]));\n\n  addGroup(\"app.api\", uniqueSecrets(runtimeConfig.api.secrets ?? []));\n\n  if (runtimeConfig.auth) {\n    addGroup(\"app.auth\", uniqueSecrets(runtimeConfig.auth.secrets ?? []));\n  }\n\n  if (runtimeConfig.plugins) {\n    for (const [pluginKey, plugin] of Object.entries(runtimeConfig.plugins)) {\n      if (plugin.secrets && plugin.secrets.length > 0) {\n        addGroup(`plugins.${pluginKey}`, plugin.secrets);\n      }\n    }\n  }\n\n  return groups;\n}\n\nfunction extractPortFromUrl(url: string): string | null {\n  const match = url.match(/:(\\d{4,5})(?:\\/|$)/);\n  return match?.[1] ?? null;\n}\n\nfunction resolveDevHostPort(runtimeConfig: RuntimeConfig): number {\n  if (typeof runtimeConfig.host?.port === \"number\") return runtimeConfig.host.port;\n  const fromUrl = runtimeConfig.host?.url ? extractPortFromUrl(runtimeConfig.host.url) : null;\n  if (fromUrl) {\n    const parsed = Number.parseInt(fromUrl, 10);\n    if (!Number.isNaN(parsed)) return parsed;\n  }\n  return 3000;\n}\n\nexport { resolveDevHostPort };\n\nfunction defaultSecretValue(\n  secret: string,\n  databases: Map<string, DatabaseConvention>,\n  redisConfigs: Map<string, RedisConvention>,\n  options: { forExample: boolean; devHostPort?: number },\n): string {\n  if (secret === \"BETTER_AUTH_SECRET\") {\n    return options.forExample ? \"\" : randomBytes(32).toString(\"base64url\");\n  }\n\n  if (secret === \"CORS_ORIGIN\") {\n    if (options.forExample) {\n      return \"http://localhost:3000\";\n    }\n    if (typeof options.devHostPort === \"number\") {\n      return `http://localhost:${options.devHostPort}`;\n    }\n    return \"http://localhost:3000\";\n  }\n\n  return databases.get(secret)?.url ?? redisConfigs.get(secret)?.url ?? \"\";\n}\n\n/**\n * Plugin `*_DATABASE_URL` secrets share the API database (the platform's\n * two-database contract), so they are not rendered as template entries —\n * the host falls back to `API_DATABASE_URL` when they are unset.\n */\nfunction isFallbackDatabaseSecret(secret: string): boolean {\n  return (\n    secret.endsWith(\"_DATABASE_URL\") &&\n    secret !== \"API_DATABASE_URL\" &&\n    secret !== \"AUTH_DATABASE_URL\"\n  );\n}\n\nfunction renderEnvFile(\n  groups: SecretGroup[],\n  options: { forExample: boolean; devHostPort?: number },\n): string {\n  const rendered = groups\n    .map((group) => ({\n      section: group.section,\n      secrets: group.secrets.filter((secret) => !isFallbackDatabaseSecret(secret)),\n    }))\n    .filter((group) => group.secrets.length > 0);\n  const allSecrets = rendered.flatMap((group) => group.secrets);\n  const databaseMap = new Map(\n    buildConventionalDatabases(allSecrets).map((entry) => [entry.secret, entry]),\n  );\n  const redisMap = new Map(\n    buildConventionalRedis(allSecrets).map((entry) => [entry.secret, entry]),\n  );\n  const lines: string[] = [\n    \"# Generated from configured bos secrets\",\n    \"# Update values as needed for your local environment\",\n    \"\",\n  ];\n\n  for (const group of rendered) {\n    lines.push(`# ${group.section}`);\n    for (const secret of group.secrets) {\n      lines.push(`${secret}=${defaultSecretValue(secret, databaseMap, redisMap, options)}`);\n    }\n    lines.push(\"\");\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport { renderEnvFile };\n\nfunction renderEnvTestFile(groups: SecretGroup[]): string {\n  const lines: string[] = [\n    \"# Generated test environment — loaded by test suites instead of .env\",\n    \"# Test databases run on dedicated *-test docker-compose services\",\n    \"\",\n  ];\n\n  for (const group of groups) {\n    const entries: string[] = [];\n    for (const secret of group.secrets) {\n      if (secret === \"BETTER_AUTH_SECRET\") {\n        entries.push(`${secret}=${TEST_AUTH_SECRET}`);\n      } else if (secret.endsWith(\"_DATABASE_URL\")) {\n        entries.push(`${secret}=${testDatabaseUrl(secret)}`);\n      }\n    }\n    if (entries.length > 0) {\n      lines.push(`# ${group.section}`);\n      lines.push(...entries);\n      lines.push(\"\");\n    }\n  }\n\n  return `${lines.join(\"\\n\")}\\n`;\n}\n\nexport { renderEnvTestFile };\n\nexport interface CiServiceSpec {\n  key: string;\n  slug: string;\n  image: string;\n  env: Record<string, string>;\n  ports: string[];\n  healthcheck?: { test: string[]; interval: string; timeout: string; retries: number };\n  volumes: string[];\n  database?: { user: string; password: string; name: string };\n}\n\nexport interface CiInfraPlan {\n  account: string;\n  gateway: string;\n  project: string;\n  env: Record<string, string>;\n  services: CiServiceSpec[];\n  generatedAt: string;\n}\n\nexport function buildCiInfraPlan(\n  runtimeConfig: RuntimeConfig,\n  options: { hostPortOverride?: number } = {},\n): CiInfraPlan {\n  const allSecrets = collectAllSecrets(runtimeConfig);\n  const databases = buildConventionalDatabases(allSecrets);\n  const redisConfigs = buildConventionalRedis(allSecrets);\n\n  const hostPort =\n    options.hostPortOverride ??\n    (Number.isFinite(Number(process.env.BOS_CI_HOST_PORT))\n      ? Number(process.env.BOS_CI_HOST_PORT)\n      : undefined) ??\n    resolveDevHostPort(runtimeConfig);\n  const env: Record<string, string> = {};\n  for (const db of databases) env[db.secret] = db.url;\n  for (const r of redisConfigs) env[r.secret] = r.url;\n\n  env.CORS_ORIGIN = `http://127.0.0.1:${hostPort}`;\n  if (!env.BETTER_AUTH_SECRET) env.BETTER_AUTH_SECRET = \"\";\n\n  const services: CiServiceSpec[] = [];\n  const seenPorts = new Set<number>();\n\n  for (const db of databases) {\n    if (seenPorts.has(db.port)) continue;\n    seenPorts.add(db.port);\n    services.push({\n      key: db.slug,\n      slug: db.slug,\n      image: \"public.ecr.aws/docker/library/postgres:17-alpine\",\n      env: {\n        POSTGRES_USER: POSTGRES_USER,\n        POSTGRES_PASSWORD: POSTGRES_PASSWORD,\n        POSTGRES_DB: db.databaseName,\n      },\n      ports: [`${db.port}:5432`],\n      healthcheck: {\n        test: [\"CMD-SHELL\", `pg_isready -U ${POSTGRES_USER} -d ${db.databaseName}`],\n        interval: \"3s\",\n        timeout: \"3s\",\n        retries: 10,\n      },\n      volumes: [`${db.slug}_data:/var/lib/postgresql/data`],\n      database: { user: POSTGRES_USER, password: POSTGRES_PASSWORD, name: db.databaseName },\n    });\n  }\n\n  for (const r of redisConfigs) {\n    services.push({\n      key: r.slug,\n      slug: r.slug,\n      image: \"public.ecr.aws/docker/library/redis:7-alpine\",\n      env: {},\n      ports: [`${r.port}:6379`],\n      healthcheck: {\n        test: [\"CMD\", \"redis-cli\", \"ping\"],\n        interval: \"3s\",\n        timeout: \"3s\",\n        retries: 10,\n      },\n      volumes: [`${r.slug}_data:/data`],\n    });\n  }\n\n  return {\n    account: runtimeConfig.account,\n    gateway: runtimeConfig.domain ?? runtimeConfig.account,\n    project: runtimeConfig.account,\n    env,\n    services,\n    generatedAt: new Date().toISOString(),\n  };\n}\n\nfunction collectAllSecrets(runtimeConfig: RuntimeConfig): string[] {\n  const all: string[] = [];\n  all.push(...(runtimeConfig.host.secrets ?? []));\n  all.push(...(runtimeConfig.api.secrets ?? []));\n  if (runtimeConfig.auth) all.push(...(runtimeConfig.auth.secrets ?? []));\n  if (runtimeConfig.plugins) {\n    for (const plugin of Object.values(runtimeConfig.plugins)) {\n      if (plugin.secrets) all.push(...plugin.secrets);\n    }\n  }\n  return all.filter((s) => !VESTIGIAL_SECRETS.has(s));\n}\n"],"mappings":";;;;;AAKA,MAAM,gBAAgB;AACtB,MAAM,oBAAoB;AAC1B,MAAM,uBAAuB;AAC7B,MAAM,cAAc;AACpB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,MAAM,oCAAoB,IAAI,IAAI,CAChC,oCACA,kCACF,CAAC;;;;;;;AAQD,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;AACzB,MAAM,mBAAmB;AACzB,MAAM,oBAAoB;AAoC1B,SAAS,cAAc,QAA6C;CAClE,MAAM,UAAoB,CAAC;CAC3B,MAAM,uBAAO,IAAI,IAAY;CAE7B,KAAK,MAAM,SAAS,QAAQ;EAC1B,IAAI,CAAC,SAAS,KAAK,IAAI,KAAK,GAAG;EAC/B,KAAK,IAAI,KAAK;EACd,QAAQ,KAAK,KAAK;CACpB;CAEA,OAAO;AACT;AAEA,SAAgB,cAAc,WAA+B;CAC3D,IAAI,CAAC,WAAW,OAAO,CAAC;CACxB,MAAM,gBAAYA,gBAAK,WAAW,QAAQ,kBAAkB;CAC5D,IAAI,KAACC,oBAAW,SAAS,GAAG,OAAO,CAAC;CACpC,IAAI;EAEF,OAAO,EAAE,UADG,KAAK,UAAMC,sBAAa,WAAW,OAAO,CACjC,CAAC,CAAC,SAAS;CAClC,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAgB,cAAc,WAAmB,OAAwB;CACvE,MAAM,gBAAYF,gBAAK,WAAW,QAAQ,kBAAkB;CAC5D,2BAAUG,mBAAQ,SAAS,GAAG,EAAE,WAAW,KAAK,CAAC;CACjD,2BAAc,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,GAAG;AAChE;AAEA,SAAgB,sBAAsB,QAAwB;CAC5D,OAAO,OAAO,QAAQ,kBAAkB,EAAE,CAAC,CAAC,YAAY;AAC1D;AAEA,SAAS,mBAAmB,QAAwB;CAClD,OAAO,OAAO,QAAQ,eAAe,EAAE,CAAC,CAAC,YAAY;AACvD;AAEA,SAAS,YAAY,MAAc,cAA8B;CAC/D,OAAO,cAAc,cAAc,GAAG,kBAAkB,aAAa,KAAK,GAAG;AAC/E;AAEA,SAAgB,2BAA2B,SAAyC;CAKlF,OAJwB,cACtB,QAAQ,QAAQ,WAAW,OAAO,SAAS,eAAe,CAAC,CAGxC,CAAC,CACnB,MAAM,GAAG,MAAM,sBAAsB,CAAC,CAAC,CAAC,cAAc,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAChF,KAAK,WAAW;EACf,MAAM,OAAO,sBAAsB,MAAM;EACzC,MAAM,SAAS,WAAW;EAC1B,MAAM,OAAO,SAAS,mBAAmB;EACzC,MAAM,eAAe,SAAS,YAAY;EAC1C,OAAO;GAAE;GAAQ;GAAM;GAAM;GAAc,KAAK,YAAY,MAAM,YAAY;EAAE;CAClF,CAAC;AACL;AAEA,SAAgB,uBAAuB,SAAsC;CAG3E,OAFqB,cAAc,QAAQ,QAAQ,WAAW,OAAO,SAAS,YAAY,CAAC,CAEzE,CAAC,CAChB,MAAM,GAAG,MAAM,mBAAmB,CAAC,CAAC,CAAC,cAAc,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAC1E,KAAK,YAAY;EAChB;EACA,MAAM,mBAAmB,MAAM;EAC/B,MAAM;EACN,KAAK,qBAAqB;CAC5B,EAAE;AACN;AAEA,SAAS,gBAAgB,QAAwB;CAC/C,MAAM,SAAS,WAAW;CAG1B,OAAO,YAFM,SAAS,oBAAoB,kBACrB,SAAS,iBAAiB,aACV;AACvC;AAEA,SAAgB,gBAAgB,eAA6C;CAC3E,MAAM,SAAwB,CAAC;CAC/B,MAAM,uBAAO,IAAI,IAAY;CAE7B,MAAM,YAAY,SAAiB,YAAsB;EACvD,MAAM,WAAW,QAAQ,QAAQ,MAAM;GACrC,IAAI,kBAAkB,IAAI,CAAC,GAAG,OAAO;GACrC,IAAI,KAAK,IAAI,CAAC,GAAG,OAAO;GACxB,KAAK,IAAI,CAAC;GACV,OAAO;EACT,CAAC;EACD,IAAI,SAAS,SAAS,GACpB,OAAO,KAAK;GAAE;GAAS,SAAS;EAAS,CAAC;CAE9C;CAEA,SAAS,YAAY,cAAc,CAAC,GAAI,cAAc,KAAK,WAAW,CAAC,GAAI,WAAW,CAAC,CAAC;CAExF,SAAS,WAAW,cAAc,cAAc,IAAI,WAAW,CAAC,CAAC,CAAC;CAElE,IAAI,cAAc,MAChB,SAAS,YAAY,cAAc,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC;CAGtE,IAAI,cAAc,SAChB;OAAK,MAAM,CAAC,WAAW,WAAW,OAAO,QAAQ,cAAc,OAAO,GACpE,IAAI,OAAO,WAAW,OAAO,QAAQ,SAAS,GAC5C,SAAS,WAAW,aAAa,OAAO,OAAO;CAEnD;CAGF,OAAO;AACT;AAEA,SAAS,mBAAmB,KAA4B;CAEtD,OADc,IAAI,MAAM,oBACb,CAAC,GAAG,MAAM;AACvB;AAEA,SAAS,mBAAmB,eAAsC;CAChE,IAAI,OAAO,cAAc,MAAM,SAAS,UAAU,OAAO,cAAc,KAAK;CAC5E,MAAM,UAAU,cAAc,MAAM,MAAM,mBAAmB,cAAc,KAAK,GAAG,IAAI;CACvF,IAAI,SAAS;EACX,MAAM,SAAS,OAAO,SAAS,SAAS,EAAE;EAC1C,IAAI,CAAC,OAAO,MAAM,MAAM,GAAG,OAAO;CACpC;CACA,OAAO;AACT;AAIA,SAAS,mBACP,QACA,WACA,cACA,SACQ;CACR,IAAI,WAAW,sBACb,OAAO,QAAQ,aAAa,SAAKC,yBAAY,EAAE,CAAC,CAAC,SAAS,WAAW;CAGvE,IAAI,WAAW,eAAe;EAC5B,IAAI,QAAQ,YACV,OAAO;EAET,IAAI,OAAO,QAAQ,gBAAgB,UACjC,OAAO,oBAAoB,QAAQ;EAErC,OAAO;CACT;CAEA,OAAO,UAAU,IAAI,MAAM,CAAC,EAAE,OAAO,aAAa,IAAI,MAAM,CAAC,EAAE,OAAO;AACxE;;;;;;AAOA,SAAS,yBAAyB,QAAyB;CACzD,OACE,OAAO,SAAS,eAAe,KAC/B,WAAW,sBACX,WAAW;AAEf;AAEA,SAAS,cACP,QACA,SACQ;CACR,MAAM,WAAW,OACd,KAAK,WAAW;EACf,SAAS,MAAM;EACf,SAAS,MAAM,QAAQ,QAAQ,WAAW,CAAC,yBAAyB,MAAM,CAAC;CAC7E,EAAE,CAAC,CACF,QAAQ,UAAU,MAAM,QAAQ,SAAS,CAAC;CAC7C,MAAM,aAAa,SAAS,SAAS,UAAU,MAAM,OAAO;CAC5D,MAAM,cAAc,IAAI,IACtB,2BAA2B,UAAU,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,QAAQ,KAAK,CAAC,CAC7E;CACA,MAAM,WAAW,IAAI,IACnB,uBAAuB,UAAU,CAAC,CAAC,KAAK,UAAU,CAAC,MAAM,QAAQ,KAAK,CAAC,CACzE;CACA,MAAM,QAAkB;EACtB;EACA;EACA;CACF;CAEA,KAAK,MAAM,SAAS,UAAU;EAC5B,MAAM,KAAK,KAAK,MAAM,SAAS;EAC/B,KAAK,MAAM,UAAU,MAAM,SACzB,MAAM,KAAK,GAAG,OAAO,GAAG,mBAAmB,QAAQ,aAAa,UAAU,OAAO,GAAG;EAEtF,MAAM,KAAK,EAAE;CACf;CAEA,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE;AAC7B;AAIA,SAAS,kBAAkB,QAA+B;CACxD,MAAM,QAAkB;EACtB;EACA;EACA;CACF;CAEA,KAAK,MAAM,SAAS,QAAQ;EAC1B,MAAM,UAAoB,CAAC;EAC3B,KAAK,MAAM,UAAU,MAAM,SACzB,IAAI,WAAW,sBACb,QAAQ,KAAK,GAAG,OAAO,GAAG,kBAAkB;OACvC,IAAI,OAAO,SAAS,eAAe,GACxC,QAAQ,KAAK,GAAG,OAAO,GAAG,gBAAgB,MAAM,GAAG;EAGvD,IAAI,QAAQ,SAAS,GAAG;GACtB,MAAM,KAAK,KAAK,MAAM,SAAS;GAC/B,MAAM,KAAK,GAAG,OAAO;GACrB,MAAM,KAAK,EAAE;EACf;CACF;CAEA,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE;AAC7B;AAwBA,SAAgB,iBACd,eACA,UAAyC,CAAC,GAC7B;CACb,MAAM,aAAa,kBAAkB,aAAa;CAClD,MAAM,YAAY,2BAA2B,UAAU;CACvD,MAAM,eAAe,uBAAuB,UAAU;CAEtD,MAAM,WACJ,QAAQ,qBACP,OAAO,SAAS,OAAO,QAAQ,IAAI,gBAAgB,CAAC,IACjD,OAAO,QAAQ,IAAI,gBAAgB,IACnC,WACJ,mBAAmB,aAAa;CAClC,MAAM,MAA8B,CAAC;CACrC,KAAK,MAAM,MAAM,WAAW,IAAI,GAAG,UAAU,GAAG;CAChD,KAAK,MAAM,KAAK,cAAc,IAAI,EAAE,UAAU,EAAE;CAEhD,IAAI,cAAc,oBAAoB;CACtC,IAAI,CAAC,IAAI,oBAAoB,IAAI,qBAAqB;CAEtD,MAAM,WAA4B,CAAC;CACnC,MAAM,4BAAY,IAAI,IAAY;CAElC,KAAK,MAAM,MAAM,WAAW;EAC1B,IAAI,UAAU,IAAI,GAAG,IAAI,GAAG;EAC5B,UAAU,IAAI,GAAG,IAAI;EACrB,SAAS,KAAK;GACZ,KAAK,GAAG;GACR,MAAM,GAAG;GACT,OAAO;GACP,KAAK;IACY;IACI;IACnB,aAAa,GAAG;GAClB;GACA,OAAO,CAAC,GAAG,GAAG,KAAK,MAAM;GACzB,aAAa;IACX,MAAM,CAAC,aAAa,iBAAiB,cAAc,MAAM,GAAG,cAAc;IAC1E,UAAU;IACV,SAAS;IACT,SAAS;GACX;GACA,SAAS,CAAC,GAAG,GAAG,KAAK,+BAA+B;GACpD,UAAU;IAAE,MAAM;IAAe,UAAU;IAAmB,MAAM,GAAG;GAAa;EACtF,CAAC;CACH;CAEA,KAAK,MAAM,KAAK,cACd,SAAS,KAAK;EACZ,KAAK,EAAE;EACP,MAAM,EAAE;EACR,OAAO;EACP,KAAK,CAAC;EACN,OAAO,CAAC,GAAG,EAAE,KAAK,MAAM;EACxB,aAAa;GACX,MAAM;IAAC;IAAO;IAAa;GAAM;GACjC,UAAU;GACV,SAAS;GACT,SAAS;EACX;EACA,SAAS,CAAC,GAAG,EAAE,KAAK,YAAY;CAClC,CAAC;CAGH,OAAO;EACL,SAAS,cAAc;EACvB,SAAS,cAAc,UAAU,cAAc;EAC/C,SAAS,cAAc;EACvB;EACA;EACA,8BAAa,IAAI,KAAK,EAAC,CAAC,YAAY;CACtC;AACF;AAEA,SAAS,kBAAkB,eAAwC;CACjE,MAAM,MAAgB,CAAC;CACvB,IAAI,KAAK,GAAI,cAAc,KAAK,WAAW,CAAC,CAAE;CAC9C,IAAI,KAAK,GAAI,cAAc,IAAI,WAAW,CAAC,CAAE;CAC7C,IAAI,cAAc,MAAM,IAAI,KAAK,GAAI,cAAc,KAAK,WAAW,CAAC,CAAE;CACtE,IAAI,cAAc,SAChB;OAAK,MAAM,UAAU,OAAO,OAAO,cAAc,OAAO,GACtD,IAAI,OAAO,SAAS,IAAI,KAAK,GAAG,OAAO,OAAO;CAChD;CAEF,OAAO,IAAI,QAAQ,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC;AACpD"}