hatchkit 0.1.25 → 0.1.27

package/dist/doctor.js

@@ -178,7 +178,7 @@ async function checkS3(provider) {
             detail: "configured; admin token not set (bucket provisioning will prompt)",
             hint: [
                 "Optional unless you want bucket auto-create / public-URL setup.",
-                "When ready: `hatchkit provision s3` will prompt and store it.",
+                "When ready: `hatchkit config add s3 r2` to store + verify the admin token globally.",
             ],
         };
     }
@@ -223,20 +223,22 @@ async function checkS3(provider) {
                 "Create a new one: https://dash.cloudflare.com/profile/api-tokens → Custom token",
                 "Permissions:    Account > Workers R2 Storage > Edit",
                 "                User    > API Tokens         > Edit",
-                "Then re-run: `hatchkit provision s3` to re-store + retry.",
+                "Then re-run: `hatchkit config add s3 r2` to re-paste + verify globally.",
             ];
         }
         if (/api-tokens list/i.test(detail)) {
             return [
                 "Admin token has R2 perm but lacks `User > API Tokens > Edit`.",
                 "Without it, hatchkit can't mint per-project R2 credentials at provision-time.",
-                "Edit at https://dash.cloudflare.com/profile/api-tokens, add the perm, save.",
+                "Edit at https://dash.cloudflare.com/profile/api-tokens, add the perm, save —",
+                "or re-run `hatchkit config add s3 r2` to paste a fresh token.",
             ];
         }
         if (code === 403 || /10000|10001|9109/.test(detail)) {
             return [
                 "Token verifies but lacks `Account > Workers R2 Storage > Edit`.",
-                "Edit at https://dash.cloudflare.com/profile/api-tokens, add the perm, save.",
+                "Edit at https://dash.cloudflare.com/profile/api-tokens, add the perm, save —",
+                "or re-run `hatchkit config add s3 r2` to paste a fresh token.",
             ];
         }
         return undefined;
@@ -439,8 +441,121 @@ export async function collectDoctorResults() {
     results.push(await checkOpenpanel());
     results.push(await checkResend());
     results.push(await checkStripe());
+    // Project-local checks — only run when doctor was invoked inside a
+    // hatchkit-managed project (manifest at cwd). Globally they're a
+    // no-op, so `hatchkit doctor` from $HOME stays clean.
+    const projectChecks = await checkProjectKeyState(process.cwd());
+    for (const r of projectChecks)
+        results.push(r);
     return results;
 }
+/** Project-local key hygiene checks, gated on the presence of
+ *  `.hatchkit.json` in the cwd:
+ *
+ *    1. `.env.keys` is NOT tracked by git. (If it is, the dotenvx
+ *       private key has either already leaked or is one push away.)
+ *    2. The keychain copy of DOTENV_PRIVATE_KEY_PRODUCTION matches
+ *       the value in `.env.keys`. After `dotenvx rotate` the file
+ *       updates but the keychain doesn't — `keys set` fixes that;
+ *       this check surfaces the drift before a deploy goes wrong.
+ *
+ *  Exported so tests can invoke it directly with a fixture dir
+ *  instead of munging `process.cwd()`. */
+export async function checkProjectKeyState(projectDir) {
+    const out = [];
+    const manifestPath = `${projectDir}/.hatchkit.json`;
+    const { existsSync, readFileSync } = await import("node:fs");
+    if (!existsSync(manifestPath))
+        return out;
+    let projectName;
+    try {
+        const m = JSON.parse(readFileSync(manifestPath, "utf-8"));
+        if (!m.name)
+            return out;
+        projectName = m.name;
+    }
+    catch {
+        return out;
+    }
+    const { locateEnvKeysFile, parsePrivateKeyValue } = await import("./deploy/keys.js");
+    const envKeysPath = locateEnvKeysFile(projectDir);
+    if (!envKeysPath) {
+        // No `.env.keys` on disk → nothing to verify against. Common in
+        // CI checkouts where dotenvx setup hasn't run; not a problem.
+        return out;
+    }
+    // Check 1: tracked-by-git status. Pass the path relative to
+    // projectDir so `git ls-files --error-unmatch` resolves it inside
+    // the repo regardless of where the user invoked `hatchkit doctor`
+    // from. `--error-unmatch` exits 1 when the path is untracked, 0
+    // when tracked — so execOk's true/false maps directly to "tracked".
+    const { relative } = await import("node:path");
+    const relEnvKeys = relative(projectDir, envKeysPath);
+    const tracked = await execOk("git", ["ls-files", "--error-unmatch", relEnvKeys], {
+        cwd: projectDir,
+    });
+    if (tracked) {
+        out.push({
+            name: `Project ${projectName} (.env.keys leak)`,
+            status: "fail",
+            detail: ".env.keys is tracked by git",
+            hint: [
+                "The dotenvx private key may already be in your git history.",
+                "Treat as a credential leak: rotate immediately.",
+                `  git rm --cached ${envKeysPath}`,
+                `  echo .env.keys >> .gitignore`,
+                `  hatchkit keys rotate ${projectName} --push-coolify`,
+                "Then check the remote (e.g. GitHub) for any commits that include .env.keys and force-purge if necessary.",
+            ],
+        });
+    }
+    else {
+        out.push({
+            name: `Project ${projectName} (.env.keys hygiene)`,
+            status: "ok",
+            detail: ".env.keys present on disk and not tracked by git",
+        });
+    }
+    // Check 2: keychain matches `.env.keys`.
+    const fileKey = parsePrivateKeyValue(readFileSync(envKeysPath, "utf-8"));
+    if (!fileKey) {
+        // .env.keys exists but has no DOTENV_PRIVATE_KEY_PRODUCTION line —
+        // unusual but not necessarily wrong (e.g., only dev keys present).
+        return out;
+    }
+    const keychainKey = await getSecret(SECRET_KEYS.dotenvxPrivateKey(projectName));
+    if (!keychainKey) {
+        out.push({
+            name: `Project ${projectName} (keychain drift)`,
+            status: "fail",
+            detail: "DOTENV_PRIVATE_KEY_PRODUCTION is missing from the OS keychain",
+            hint: [
+                "The keychain copy was wiped (e.g. by `config reset`) but `.env.keys` still has the value.",
+                `Restore it from disk: hatchkit keys set ${projectName}`,
+            ],
+        });
+    }
+    else if (keychainKey !== fileKey) {
+        out.push({
+            name: `Project ${projectName} (keychain drift)`,
+            status: "fail",
+            detail: "OS keychain holds a different DOTENV_PRIVATE_KEY_PRODUCTION than .env.keys",
+            hint: [
+                "Likely cause: `dotenvx rotate` ran but the keychain wasn't updated.",
+                `Sync from .env.keys: hatchkit keys set ${projectName}`,
+                `(Or, if you want the OLD key: hatchkit keys show ${projectName} > .env.keys.bak)`,
+            ],
+        });
+    }
+    else {
+        out.push({
+            name: `Project ${projectName} (keychain sync)`,
+            status: "ok",
+            detail: "OS keychain matches .env.keys",
+        });
+    }
+    return out;
+}
 export async function runDoctor(opts = {}) {
     const results = await collectDoctorResults();
     const okCount = results.filter((r) => r.status === "ok").length;

package/dist/doctor.js.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,QAAQ,EACR,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY5D,KAAK,UAAU,KAAK,CAClB,IAAY,EACZ,EAAqC,EACrC,MAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sBAAsB;YAC9B,IAAI,EAAE;gBACJ,kEAAkE;gBAClE,oCAAoC;aACrC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,CAAC,4DAA4D,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrD,OAAO,KAAK,CACV,SAAS,EACT,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,+BAA+B;gBAC/B,qBAAqB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB;gBACrE,4CAA4C;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,0BAA0B,GAAG,CAAC,GAAG,GAAG;gBACpC,wFAAwF;aACzF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,OAAO,KAAK,CACV,eAAe,EACf,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iDAAiD,EAAE;YACzE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2D,CAAC;QAC1F,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,IAAI,GAAG,YAAY,CAAC;IACpE,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,mGAAmG;gBACnG,4CAA4C;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8DAA8D;gBAC9D,wDAAwD;aACzD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CACV,kBAAkB,EAClB,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;gBACjF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,QAAQ,EAAE,EAAE;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;YACpE,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QACzC,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO;oBACL,uDAAuD;oBACvD,kEAAkE;oBAClE,uFAAuF;oBACvF,wCAAwC;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO;oBACL,mFAAmF;oBACnF,uHAAuH;iBACxH,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC;IACD,yFAAyF;IACzF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,6CAA6C;KACtD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAkC;IACvD,MAAM,IAAI,GAAG,OAAO,QAAQ,GAAG,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1C,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE;oBACJ,oEAAoE;oBACpE,qDAAqD;iBACtD;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,mEAAmE;YAC3E,IAAI,EAAE;gBACJ,iEAAiE;gBACjE,+DAA+D;aAChE;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,KAAK,CACnC,wDAAwD,CACzD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,GAAG,CAAC,QAAQ,mCAAmC;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;YACvF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,SAAS,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,MAAM,KAAK,CACvB,iDAAiD,SAAS,aAAa,EACvE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,EAAE,CACvD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE1C,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAyC,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;QAE5C,wDAAwD;QACxD,+DAA+D;QAC/D,gEAAgE;QAChE,gBAAgB;QAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6DAA6D,EAAE;YAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,4CAA4C,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,eAAe,CAAC,gEAAgE,CAAC;IAC1F,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,iFAAiF;gBACjF,qDAAqD;gBACrD,qDAAqD;gBACrD,2DAA2D;aAC5D,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,+DAA+D;gBAC/D,+EAA+E;gBAC/E,6EAA6E;aAC9E,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,iEAAiE;gBACjE,6EAA6E;aAC9E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAoC,CAAC;IACvF,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,CAAC;IACjC,IAAI,IAAI,EAAE,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+BAA+B;YACvC,IAAI,EAAE,CAAC,gDAAgD,QAAQ,GAAG,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,GAAG,KAAK,iCAAiC;gBACzC,qBAAqB,SAAS,EAAE;gBAChC,wCAAwC;aACzC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACJ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sCAAsC,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;YACrD,OAAO,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;QACtC,CAAC,EACD,OAAO,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sCAAsC,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,EAAE,EAAE;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC;QACzB,CAAC,EACD,OAAO,CAAC,WAAW,EAAE,0CAA0C,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;gBACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC;QACzB,CAAC,EACD,OAAO,CAAC,QAAQ,EAAE,6CAA6C,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,wBAAwB,GAAG,CAAC,gBAAgB,GAAG,EAAE;YACjF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,mCAAmC;gBACnC,qBAAqB,IAAI,sBAAsB;gBAC/C,8CAA8C;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,iBAAiB,GAAG,CAAC,gBAAgB,kCAAkC;gBACvE,YAAY,IAAI,iDAAiD;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IAC1E,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,WAAW,EAAE;YAChD,OAAO,EAAE;gBACP,qBAAqB,EAAE,GAAG,CAAC,YAAY;gBACvC,yBAAyB,EAAE,GAAG,CAAC,gBAAgB;aAChD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,gBAAgB,CAAC;IAC1B,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,kFAAkF;gBAClF,8EAA8E;aAC/E,CAAC;QACJ,CAAC;QACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC7D,OAAO;gBACL,4DAA4D;gBAC5D,YAAY,UAAU,EAAE;gBACxB,2FAA2F;gBAC3F,yEAAyE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,KAAK,CACV,QAAQ,EACR,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC;IACzB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,2CAA2C;gBAC3C,6DAA6D;gBAC7D,2CAA2C;aAC5C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,kFAAkF;gBAClF,mFAAmF;aACpF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,KAAK,CACV,WAAW,GAAG,CAAC,IAAI,GAAG,EACtB,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mCAAmC,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,SAAS,EAAE,EAAE;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,kBAAkB,CAAC;IAC5B,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,+DAA+D;gBAC/D,2CAA2C;aAC5C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAU;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA2B,EAAE;IAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEpE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;YACvE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,iBAAiB,CAAC,IAAI,CAChK,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI;gBACtB,0GAA0G;aAC3G,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,QAAQ,EACR,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAY5D,KAAK,UAAU,KAAK,CAClB,IAAY,EACZ,EAAqC,EACrC,MAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC;QAC1B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,SAAS,EAAE,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;IAClE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,MAAc;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,sBAAsB;YAC9B,IAAI,EAAE;gBACJ,kEAAkE;gBAClE,oCAAoC;aACrC;SACF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,mBAAmB;YAC3B,IAAI,EAAE,CAAC,4DAA4D,CAAC;SACrE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrD,OAAO,KAAK,CACV,SAAS,EACT,KAAK,IAAI,EAAE;QACT,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,EAAE,CAAC;IACjB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,+BAA+B;gBAC/B,qBAAqB,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,sBAAsB;gBACrE,4CAA4C;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,sCAAsC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO;gBACL,0BAA0B,GAAG,CAAC,GAAG,GAAG;gBACpC,wFAAwF;aACzF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC3D,OAAO,KAAK,CACV,eAAe,EACf,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,iDAAiD,EAAE;YACzE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2D,CAAC;QAC1F,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,aAAa,IAAI,GAAG,YAAY,CAAC;IACpE,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,mGAAmG;gBACnG,4CAA4C;aAC7C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8DAA8D;gBAC9D,wDAAwD;aACzD,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ;IACrB,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9E,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CACV,kBAAkB,EAClB,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;gBACjF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,QAAQ,EAAE,EAAE;aACrD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqC,CAAC;YACpE,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC;QACzC,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;YACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO;oBACL,uDAAuD;oBACvD,kEAAkE;oBAClE,uFAAuF;oBACvF,wCAAwC;iBACzC,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBACjB,OAAO;oBACL,mFAAmF;oBACnF,uHAAuH;iBACxH,CAAC;YACJ,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC,CACF,CAAC;IACJ,CAAC;IACD,yFAAyF;IACzF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,6CAA6C;KACtD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,QAAkC;IACvD,MAAM,IAAI,GAAG,OAAO,QAAQ,GAAG,CAAC;IAChC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE1C,mEAAmE;IACnE,oEAAoE;IACpE,iEAAiE;IACjE,iEAAiE;IACjE,iEAAiE;IACjE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,KAAK,GAAG,iBAAiB,CAAC,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,KAAK,EAAE,CAAC;YACV,OAAO;gBACL,IAAI;gBACJ,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE;oBACJ,oEAAoE;oBACpE,qDAAqD;iBACtD;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC;IAC7E,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,kEAAkE;IAClE,iEAAiE;IACjE,4DAA4D;IAC5D,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,mEAAmE;YAC3E,IAAI,EAAE;gBACJ,iEAAiE;gBACjE,qFAAqF;aACtF;SACF,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,QAAQ,EAAE,KAAK,CACnC,wDAAwD,CACzD,EAAE,CAAC,CAAC,CAAC,CAAC;IACP,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,GAAG,CAAC,QAAQ,mCAAmC;SACpE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;QACT,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,yDAAyD,EAAE;YACvF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,SAAS,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,MAAM,KAAK,CACvB,iDAAiD,SAAS,aAAa,EACvE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE,EAAE,CACvD,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE1C,CAAC;YACT,MAAM,IAAI,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,aAAa,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAyC,CAAC;QAC1E,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC;QAE5C,wDAAwD;QACxD,+DAA+D;QAC/D,gEAAgE;QAChE,gBAAgB;QAChB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,6DAA6D,EAAE;YAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,4CAA4C,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,eAAe,CAAC,gEAAgE,CAAC;IAC1F,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,iFAAiF;gBACjF,qDAAqD;gBACrD,qDAAqD;gBACrD,yEAAyE;aAC1E,CAAC;QACJ,CAAC;QACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,+DAA+D;gBAC/D,+EAA+E;gBAC/E,8EAA8E;gBAC9E,+DAA+D;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO;gBACL,iEAAiE;gBACjE,8EAA8E;gBAC9E,+DAA+D;aAChE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,QAAgB;IACtC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAoC,CAAC;IACvF,MAAM,IAAI,GAAG,QAAQ,QAAQ,GAAG,CAAC;IACjC,IAAI,IAAI,EAAE,MAAM,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACnE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAC5B,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YAClD,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+BAA+B;YACvC,IAAI,EAAE,CAAC,gDAAgD,QAAQ,GAAG,CAAC;SACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GACX,CAAC,KAAa,EAAE,SAAiB,EAAU,EAAE,CAC7C,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,GAAG,KAAK,iCAAiC;gBACzC,qBAAqB,SAAS,EAAE;gBAChC,wCAAwC;aACzC,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACJ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sCAAsC,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAC;YACrD,OAAO,IAAI,CAAC,IAAI,IAAI,eAAe,CAAC;QACtC,CAAC,EACD,OAAO,CAAC,cAAc,EAAE,wCAAwC,CAAC,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,sCAAsC,EAAE;gBAC9D,OAAO,EAAE,EAAE,aAAa,EAAE,SAAS,GAAG,EAAE,EAAE;aAC3C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC;QACzB,CAAC,EACD,OAAO,CAAC,WAAW,EAAE,0CAA0C,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CACV,IAAI,EACJ,KAAK,IAAI,EAAE;YACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;gBACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE;aAC5C,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,OAAO,eAAe,CAAC;QACzB,CAAC,EACD,OAAO,CAAC,QAAQ,EAAE,6CAA6C,CAAC,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,wBAAwB,GAAG,CAAC,gBAAgB,GAAG,EAAE;YACjF,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,KAAK,EAAE,EAAE;SAClD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,QAAQ,GAAG,CAAC,gBAAgB,EAAE,CAAC;IACxC,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,mCAAmC;gBACnC,qBAAqB,IAAI,sBAAsB;gBAC/C,8CAA8C;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,iBAAiB,GAAG,CAAC,gBAAgB,kCAAkC;gBACvE,YAAY,IAAI,iDAAiD;aAClE,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc;IAC3B,MAAM,GAAG,GAAG,MAAM,kBAAkB,EAAE,CAAC;IACvC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC;IAC1E,OAAO,KAAK,CACV,WAAW,EACX,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,UAAU,WAAW,EAAE;YAChD,OAAO,EAAE;gBACP,qBAAqB,EAAE,GAAG,CAAC,YAAY;gBACvC,yBAAyB,EAAE,GAAG,CAAC,gBAAgB;aAChD;SACF,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,gBAAgB,CAAC;IAC1B,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,OAAO;gBACL,kFAAkF;gBAClF,8EAA8E;aAC/E,CAAC;QACJ,CAAC;QACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAC7D,OAAO;gBACL,4DAA4D;gBAC5D,YAAY,UAAU,EAAE;gBACxB,2FAA2F;gBAC3F,yEAAyE;aAC1E,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,KAAK,CACV,QAAQ,EACR,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gCAAgC,EAAE;YACxD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE;SACnD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,eAAe,CAAC;IACzB,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,2CAA2C;gBAC3C,6DAA6D;gBAC7D,2CAA2C;aAC5C,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,kFAAkF;gBAClF,mFAAmF;aACpF,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,KAAK,CACV,WAAW,GAAG,CAAC,IAAI,GAAG,EACtB,KAAK,IAAI,EAAE;QACT,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,mCAAmC,EAAE;YAC3D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,SAAS,EAAE,EAAE;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACnD,OAAO,kBAAkB,CAAC;IAC5B,CAAC,EACD,CAAC,MAAM,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,OAAO;gBACL,8CAA8C;gBAC9C,+DAA+D;gBAC/D,2CAA2C;aAC5C,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,EAAE,CAAC,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAU;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,IAAI,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC;IAClC,mEAAmE;IACnE,iEAAiE;IACjE,sDAAsD;IACtD,MAAM,aAAa,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAChE,KAAK,MAAM,CAAC,IAAI,aAAa;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;0CAW0C;AAC1C,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,UAAkB;IAC3D,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,GAAG,UAAU,iBAAiB,CAAC;IACpD,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,GAAG,CAAC;IAE1C,IAAI,WAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAsB,CAAC;QAC/E,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QACxB,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrF,MAAM,WAAW,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,gEAAgE;QAChE,8DAA8D;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IAED,4DAA4D;IAC5D,kEAAkE;IAClE,kEAAkE;IAClE,gEAAgE;IAChE,oEAAoE;IACpE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE;QAC/E,GAAG,EAAE,UAAU;KAChB,CAAC,CAAC;IACH,IAAI,OAAO,EAAE,CAAC;QACZ,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,WAAW,WAAW,mBAAmB;YAC/C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,6BAA6B;YACrC,IAAI,EAAE;gBACJ,6DAA6D;gBAC7D,iDAAiD;gBACjD,qBAAqB,WAAW,EAAE;gBAClC,gCAAgC;gBAChC,0BAA0B,WAAW,iBAAiB;gBACtD,0GAA0G;aAC3G;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,WAAW,WAAW,sBAAsB;YAClD,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,kDAAkD;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,OAAO,GAAG,oBAAoB,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,mEAAmE;QACnE,mEAAmE;QACnE,OAAO,GAAG,CAAC;IACb,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,WAAW,WAAW,mBAAmB;YAC/C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+DAA+D;YACvE,IAAI,EAAE;gBACJ,2FAA2F;gBAC3F,2CAA2C,WAAW,EAAE;aACzD;SACF,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,WAAW,WAAW,mBAAmB;YAC/C,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,4EAA4E;YACpF,IAAI,EAAE;gBACJ,qEAAqE;gBACrE,0CAA0C,WAAW,EAAE;gBACvD,oDAAoD,WAAW,mBAAmB;aACnF;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE,WAAW,WAAW,kBAAkB;YAC9C,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA2B,EAAE;IAC3D,MAAM,OAAO,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,MAAM,CAAC;IAChE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAEpE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,MAAM,OAAO,GAAG;YACd,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,SAAS,EAAE;YACvE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,IAAI,EAAE,CAAC,CAAC,IAAI;aACb,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,SAAS,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,CAAC;IAC/E,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GACR,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,iBAAiB,CAAC,IAAI,CAChK,CAAC;IAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI;gBACtB,0GAA0G;aAC3G,CAAC;YACF,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@ import { ensureCoolify, ensureGitHub, ensureHetzner, ensureS3, getConfig, getCon
 import { runCoolifySetup } from "./deploy/coolify.js";
 import { setupGitHub } from "./deploy/github.js";
 import { deployMlServices } from "./deploy/gpu.js";
-import { pushProjectKeyToCoolify, showProjectKey } from "./deploy/keys.js";
+import { pushProjectKeyToCoolify, pushProjectKeyToGh, rotateProjectKey, setProjectKey, showProjectKey, } from "./deploy/keys.js";
 import { handleCreateFailure, runRollback } from "./deploy/rollback.js";
 import { runTerraform } from "./deploy/terraform.js";
 import { collectProjectConfig } from "./prompts.js";
@@ -212,23 +212,130 @@ async function handleKeys() {
     const sub = args[1];
     const projectName = args[2];
     if (!sub || !projectName) {
-        console.log("Usage: hatchkit keys <show|push> <project-name>");
+        console.log("Usage: hatchkit keys <show|set|rotate|push> <project-name> [flags]");
         process.exit(1);
     }
     const isJson = args.includes("--json");
+    const dryRun = args.includes("--dry-run");
+    const keyFlag = flagValue("--key");
+    // The legacy `keys push` had no `--target` and always meant Coolify
+    // — keep that for back-compat. Anything explicit (`--target=gh|both`)
+    // overrides the default.
+    const target = (flagValue("--target") ?? "coolify");
+    if (!["coolify", "gh", "both"].includes(target)) {
+        console.log(`Invalid --target=${target}. Valid: coolify, gh, both`);
+        process.exit(1);
+    }
+    const pushCoolify = args.includes("--push-coolify");
+    const pushGh = flagValue("--push-gh");
+    const repoArg = flagValue("--repo");
     switch (sub) {
         case "show":
             await showProjectKey(projectName, { json: isJson });
             break;
-        case "push":
-            await pushProjectKeyToCoolify(projectName);
+        case "set": {
+            // `--stdin` is explicit. We avoid auto-detecting via
+            // `!process.stdin.isTTY` because npm/pnpm wrappers (and CI
+            // runners) replace stdin even when the user didn't pipe
+            // anything — that would falsely trigger a "stdin is empty" error
+            // and skip the autoread-from-`.env.keys` default.
+            const fromStdin = args.includes("--stdin");
+            const result = await setProjectKey(projectName, {
+                key: keyFlag,
+                fromStdin,
+                dryRun,
+            });
+            if (isJson) {
+                process.stdout.write(`${JSON.stringify({ project: projectName, ...result })}\n`);
+                return;
+            }
+            const verb = result.written ? "Updated" : result.changed ? "Would update" : "No change —";
+            const sourceLabel = result.source === "flag"
+                ? "--key flag"
+                : result.source === "stdin"
+                    ? "stdin"
+                    : `${result.envKeysPath}`;
+            console.log(chalk.green(`  ${verb} keychain entry ${chalk.cyan(result.account)}`));
+            console.log(chalk.dim(`  source: ${sourceLabel}`));
+            if (!result.changed) {
+                console.log(chalk.dim("  (keychain already held this value)"));
+            }
             break;
+        }
+        case "rotate": {
+            const result = await rotateProjectKey(projectName, {
+                pushCoolify,
+                pushGh,
+                dryRun,
+            });
+            if (isJson) {
+                process.stdout.write(`${JSON.stringify({ project: projectName, ...result })}\n`);
+                return;
+            }
+            if (dryRun) {
+                console.log(chalk.yellow("  --dry-run — nothing was rotated."));
+            }
+            else {
+                console.log(chalk.green(`  Rotated dotenvx keypair for ${result.envProductionPath}`));
+                console.log(chalk.green(`  Updated keychain entry ${chalk.cyan(result.set.account)}`));
+            }
+            if (result.pushedCoolify) {
+                console.log(chalk.green(`  Pushed to Coolify (${result.pushedCoolify.uuid})`));
+            }
+            if (result.pushedGh) {
+                console.log(chalk.green(`  Pushed to GitHub repo ${result.pushedGh.repo}`));
+            }
+            if (!opts(result).pushedAnywhere) {
+                console.log(chalk.dim("  Tip: pass --push-coolify and/or --push-gh <owner/repo> to fan out the new key."));
+            }
+            break;
+        }
+        case "push": {
+            const repo = repoArg ?? (target === "coolify" ? undefined : await detectRepoSlug());
+            if ((target === "gh" || target === "both") && !repo) {
+                throw new Error("Couldn't infer GitHub repo for --target=gh. Pass --repo <owner/repo>.");
+            }
+            if (target === "coolify" || target === "both") {
+                await pushProjectKeyToCoolify(projectName);
+            }
+            if (target === "gh" || target === "both") {
+                await pushProjectKeyToGh(projectName, repo);
+            }
+            break;
+        }
         default:
             console.log(`Unknown keys subcommand: ${sub}`);
-            console.log("Valid: show, push");
+            console.log("Valid: show, set, rotate, push");
             process.exit(1);
     }
 }
+/** `--flag=value` or `--flag value` lookup. Returns undefined when
+ *  absent. The first form is preferred in user-facing examples (no
+ *  ambiguity with positional args), but both forms parse cleanly. */
+function flagValue(name) {
+    const eq = args.find((a) => a.startsWith(`${name}=`));
+    if (eq)
+        return eq.slice(name.length + 1);
+    const idx = args.indexOf(name);
+    if (idx >= 0 && idx + 1 < args.length && !args[idx + 1].startsWith("--")) {
+        return args[idx + 1];
+    }
+    return undefined;
+}
+/** Resolve the GitHub `owner/repo` slug from the cwd's git origin.
+ *  Returns undefined when no remote is set or it's not a GitHub URL. */
+async function detectRepoSlug() {
+    const { repoSlugFromRemote } = await import("./deploy/gh-actions-secrets.js");
+    const res = await exec("git", ["remote", "get-url", "origin"], { silent: true });
+    if (res.exitCode !== 0)
+        return undefined;
+    return repoSlugFromRemote(res.stdout.trim());
+}
+/** Helper for the rotate-summary tip — collapses "did we push anywhere"
+ *  to a single boolean so the inline check stays readable. */
+function opts(result) {
+    return { pushedAnywhere: !!result.pushedCoolify || !!result.pushedGh };
+}
 async function handleAdd() {
     // Positional args are optional — anything missing is prompted for.
     //   hatchkit add                             (fully interactive)
@@ -325,8 +432,8 @@ async function handleProvisionS3() {
     // .hatchkit.json. Idempotent across re-runs.
     const projectDir = resolve(".");
     const { provisionS3ForProject } = await import("./provision/s3-buckets.js");
-    const { getSecret, setSecret, SECRET_KEYS: SK } = await import("./utils/secrets.js");
-    const { confirmPastedSecret, validateS3KeyPair } = await import("./config.js");
+    const { getSecret, SECRET_KEYS: SK } = await import("./utils/secrets.js");
+    const { validateS3KeyPair } = await import("./config.js");
     // Optional flags — keep minimal; the function reads everything else
     // from the manifest + global config + keychain.
     const flag = (name) => {
@@ -355,17 +462,16 @@ async function handleProvisionS3() {
     // Optional:
     //   · Zone    > Zone               > Read  — needed only if you
     //     want custom-domain attach instead of the managed r2.dev URL
+    //
+    // If it's missing, defer to `ensureS3("r2")` — the same global setup
+    // path `hatchkit config add s3 r2` runs, including token verification
+    // against both required perms. Keeps the global vs. per-project
+    // boundary clean: this command (provision s3) only does per-project
+    // work; the admin token is a global concern.
     const existingAdmin = await getSecret(SK.r2AdminToken);
     if (!existingAdmin) {
-        console.log(chalk.yellow("\n  R2 admin token not configured."));
-        console.log(chalk.dim("  Create at:    https://dash.cloudflare.com/profile/api-tokens → Create Token → Custom token"));
-        console.log(chalk.dim("  Required:     Account > Workers R2 Storage > Edit"));
-        console.log(chalk.dim("                User    > API Tokens         > Edit  (mints per-project tokens)"));
-        console.log(chalk.dim("  Optional:     Zone    > Zone               > Read  (custom-domain attach)"));
-        console.log(chalk.dim("  Account:      Just yours\n"));
-        const token = await confirmPastedSecret("R2 admin Bearer token");
-        await setSecret(SK.r2AdminToken, token);
-        console.log(chalk.green(`  ✓ Stored under keychain ${SK.r2AdminToken}`));
+        console.log(chalk.yellow("\n  R2 admin token not configured — running global setup first (same as `hatchkit config add s3 r2`)."));
+        await ensureS3("r2");
     }
     // Migrate away from the legacy account-wide S3 access/secret pair.
     // Old hatchkit stored a single shared pair under `s3:<provider>:access-key`
@@ -408,12 +514,6 @@ async function handleProvisionS3() {
     if (result.envKept.length > 0) {
         console.log(chalk.dim(`  · Kept ${result.envKept.length} existing entries: ${result.envKept.join(", ")}`));
     }
-    console.log(chalk.bold("\n  rclone — paste into ~/.config/rclone/rclone.conf:"));
-    console.log();
-    for (const line of result.rcloneSnippet.split("\n"))
-        console.log(`    ${chalk.dim(line)}`);
-    console.log(chalk.dim(`  Then upload with:`));
-    console.log(chalk.dim(`    rclone copy <local-dir>/ r2-${result.assets.name.replace(/-assets$/, "")}:${result.assets.name}/ \\\n      --progress --transfers=16 --checkers=32 --fast-list`));
     console.log();
 }
 async function handleDestroy() {
@@ -769,6 +869,14 @@ async function handleCreate() {
                 serverPort: scaffoldResult?.ports.server,
                 clientPort: scaffoldResult?.ports.client,
             });
+            // Order matters: rollback iterates the ledger in REVERSE, so we
+            // record parent-before-child (project before app). Otherwise
+            // reverse iteration tries to delete the project before the app
+            // and Coolify rejects with `Project has resources, so it cannot
+            // be deleted.` Same invariant applied in adopt.ts.
+            if (coolifyResult.projectCreated) {
+                ledger?.record({ kind: "coolifyProject", uuid: coolifyResult.projectUuid });
+            }
             ledger?.record({ kind: "coolifyApp", uuid: coolifyResult.appUuid });
             // Provision a per-project MongoDB container on Coolify when the
             // user picked that path. Best-effort: a failure here doesn't undo
@@ -950,15 +1058,33 @@ async function handleConfig() {
                     await reconfigureProvider(provider);
                     break;
                 case "s3": {
-                    const { select } = await import("@inquirer/prompts");
-                    const p = await select({
-                        message: "S3 provider:",
-                        choices: [
-                            { name: "Hetzner", value: "hetzner" },
-                            { name: "AWS", value: "aws" },
-                            { name: "R2", value: "r2" },
-                        ],
-                    });
+                    // Accept the sub-provider as a positional arg so doctor's
+                    // recovery hint (`hatchkit config add s3 r2`) is a one-line
+                    // copy-paste — no interactive picker between the user and
+                    // re-pasting the rotated token. Falls back to the picker
+                    // when omitted, for parity with the no-arg menu.
+                    const sub = args[3];
+                    const validSubs = ["hetzner", "aws", "r2"];
+                    let p;
+                    if (sub && validSubs.includes(sub)) {
+                        p = sub;
+                    }
+                    else if (sub) {
+                        console.log(chalk.red(`  Unknown S3 sub-provider: ${sub}`));
+                        console.log(chalk.dim(`  Valid: ${validSubs.join(", ")}`));
+                        return;
+                    }
+                    else {
+                        const { select } = await import("@inquirer/prompts");
+                        p = await select({
+                            message: "S3 provider:",
+                            choices: [
+                                { name: "Hetzner", value: "hetzner" },
+                                { name: "AWS", value: "aws" },
+                                { name: "R2 (Cloudflare)", value: "r2" },
+                            ],
+                        });
+                    }
                     await reconfigureProvider(`s3.${p}`);
                     break;
                 }
@@ -1053,13 +1179,36 @@ function printHelp(topic) {
   ${chalk.bold("hatchkit keys")} — manage per-project dotenvx private keys
 
   ${chalk.bold("Subcommands:")}
-    keys show <project>   Print DOTENV_PRIVATE_KEY_PRODUCTION from the
-                          OS keychain. Useful for piping into pbcopy or
-                          pasting into Coolify / CI secret stores.
-    keys push <project>   Upsert the key onto the project's Coolify
-                          app via the Coolify API. Assumes the app
-                          already exists (created by \`create\` with
-                          runDeployment or manually).
+    keys show <project>     Print DOTENV_PRIVATE_KEY_PRODUCTION from the
+                            OS keychain. Useful for piping into pbcopy
+                            or pasting into Coolify / CI secret stores.
+    keys set <project>      Upsert the key into the OS keychain. Source
+                            (in priority order): ${chalk.cyan("--key=…")}, ${chalk.cyan("--stdin")},
+                            or auto-read from ${chalk.cyan("./.env.keys")}'s
+                            DOTENV_PRIVATE_KEY_PRODUCTION line. Idempotent.
+    keys rotate <project>   Run \`dotenvx rotate -f .env.production\` in
+                            the project, then ${chalk.cyan("keys set")}, then
+                            optionally fan out to Coolify and/or GitHub.
+    keys push <project>     Mirror the keychain copy to a deploy target.
+
+  ${chalk.bold("Flags (apply to set / rotate / push):")}
+    --key=<value>           Direct value for ${chalk.cyan("keys set")}.
+    --stdin                 (set) Read the key from stdin (e.g. \`cat key | hatchkit keys set …\`).
+    --target={coolify|gh|both}  Where ${chalk.cyan("keys push")} mirrors to. Default
+                            ${chalk.dim("coolify")} for back-compat.
+    --repo <owner/repo>     GH repo for ${chalk.cyan("keys push --target=gh|both")}.
+                            Inferred from ${chalk.dim("git remote origin")} when omitted.
+    --push-coolify          (rotate) Mirror the new key onto Coolify.
+    --push-gh <owner/repo>  (rotate) Mirror the new key into the named
+                            GH repo's DOTENV_PRIVATE_KEY_PRODUCTION
+                            Actions secret.
+    --dry-run               Print what would change, don't write.
+    --json                  Machine-readable output.
+
+  ${chalk.bold("Examples:")}
+    hatchkit keys rotate raptor-runner --push-coolify --push-gh acme/raptor
+    cat .env.keys | hatchkit keys set raptor-runner --stdin
+    hatchkit keys push raptor-runner --target=both --repo acme/raptor
 
   The key is generated at scaffold time and lives in macOS Keychain /
   libsecret under the "hatchkit" service. Never written to git.
@@ -1462,7 +1611,9 @@ function printHelp(topic) {
     gh-pages        Wire GitHub Pages for the current repo (static / Vite / Jekyll — with DNS)
     dns             DNS reconciliation helpers (link-to-cloudflare, …)
     keys show <p>   Print the dotenvx private key for a project
-    keys push <p>   Push the key onto the project's Coolify app
+    keys set <p>    Upsert the key into the OS keychain (after \`dotenvx rotate\`)
+    keys rotate <p> Rotate the dotenvx keypair, mirror to keychain + (optional) deploy targets
+    keys push <p>   Push the key to Coolify (default) and/or GitHub Actions
 
   ${chalk.bold("Config:")}
     config          Show provider status (same as \`status\`)