hatchkit 0.1.35 → 0.1.38

package/dist/deploy/sync.d.ts

@@ -0,0 +1,98 @@
+import { type ProjectManifest } from "../scaffold/manifest.js";
+import { type CoolifyApplication } from "../utils/coolify-api.js";
+export interface SyncOptions {
+    /** Project root containing `.hatchkit.json`. */
+    projectDir: string;
+    /** Print the desired changes without PATCHing Coolify. */
+    dryRun?: boolean;
+    /** Emit `{ ok, apps: [...] }` JSON to stdout. Suppresses the human
+     *  rendering for scripts. */
+    json?: boolean;
+}
+/** What sync intends to do for one Coolify application — surfaces both
+ *  the desired payload and a diff against what Coolify currently reports.
+ *  Renderable in either human-readable or JSON form. */
+export interface AppSyncPlan {
+    /** Coolify uuid. */
+    uuid: string;
+    /** Coolify app name (used to locate the resource). */
+    name: string;
+    /** Build pack reported by Coolify — drives which API field carries
+     *  the domain payload. */
+    buildPack?: CoolifyApplication["buildPack"];
+    /** Per-service domains for dockercompose apps. Always populated when
+     *  the build pack is dockercompose; undefined otherwise. */
+    desiredDockerComposeDomains?: Array<{
+        name: string;
+        domain: string;
+    }>;
+    /** Comma-joined FQDN list for non-dockercompose apps. Always
+     *  populated when the build pack is nixpacks / dockerfile / static;
+     *  undefined for dockercompose. */
+    desiredDomains?: string[];
+    /** ports_exposes the manifest expects on this app. Always set —
+     *  Coolify keeps it as a non-empty string. */
+    desiredPortsExposes: string;
+    /** Snapshot of the same fields as Coolify currently reports them.
+     *  Used by the renderer to decide "already correct" vs. "will
+     *  change", and by the JSON output as the before-state. */
+    current: {
+        fqdn: string | null;
+        dockerComposeDomains?: Array<{
+            name: string;
+            domain: string;
+        }>;
+        portsExposes?: string;
+    };
+    /** Whether a PATCH is needed to converge — false means everything
+     *  already matches, sync skips the API call. */
+    changed: boolean;
+}
+export interface SyncResult {
+    ok: boolean;
+    /** Set when sync couldn't run at all (e.g. no manifest, no Coolify
+     *  config, no matching apps). Either `apps` or `error` will be
+     *  meaningful — never both. */
+    error?: string;
+    apps: AppSyncPlan[];
+    /** When dryRun, no PATCH was made even if `changed` was true. */
+    dryRun: boolean;
+}
+/** Top-level entrypoint. Reads the project manifest, finds the Coolify
+ *  app(s) hatchkit knows about by name, and pushes the desired domain
+ *  + ports payload — or just prints what it would push when `dryRun`. */
+export declare function runSync(opts: SyncOptions): Promise<SyncResult>;
+/** Desired state for one Coolify application, derived from the manifest.
+ *  Computed before any API calls so `--dry-run` never hits the network
+ *  for plan generation. */
+interface DesiredApp {
+    /** Name to look up in Coolify. */
+    appName: string;
+    /** Build-pack-aware payload — only one of these is set per app. The
+     *  CoolifyApi.updateApplication shape needs the right field for the
+     *  build pack reported by Coolify; we resolve that at apply time, not
+     *  here, since the manifest doesn't carry build pack. */
+    domains: Array<{
+        name: string;
+        domain: string;
+    }>;
+    /** ports_exposes for this app. Comma-separated string Coolify
+     *  stores verbatim. */
+    portsExposes: string;
+}
+/** Map a manifest to the set of Coolify apps hatchkit owns for it. The
+ *  shapes we cover (matching the layouts `findCoolifyAppsForProject`
+ *  understands):
+ *
+ *    1. Adopted single-app:        `<name>`
+ *    2. Starter split (legacy):    `<name>-server` + `<name>-client`
+ *    3. Old single-app fallbacks:  `<name>-web` / `<name>-app` / `<name>-api`
+ *
+ *  We synthesize a candidate list per layout. The actual lookup happens
+ *  per-name; misses are skipped. This means a project that scaffolded as
+ *  starter-split AND was later adopted as single-app would push twice —
+ *  not a problem because each PATCH is independent and idempotent. */
+export declare function computeDesiredAppStates(manifest: ProjectManifest): DesiredApp[];
+export declare function runSyncCli(args: string[]): Promise<void>;
+export {};
+//# sourceMappingURL=sync.d.ts.map

package/dist/deploy/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../src/deploy/sync.ts"],"names":[],"mappings":"AAoCA,OAAO,EAAE,KAAK,eAAe,EAAgB,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAc,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;iCAC6B;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;wDAEwD;AACxD,MAAM,WAAW,WAAW;IAC1B,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAC;IACb;8BAC0B;IAC1B,SAAS,CAAC,EAAE,kBAAkB,CAAC,WAAW,CAAC,CAAC;IAC5C;gEAC4D;IAC5D,2BAA2B,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACtE;;uCAEmC;IACnC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;kDAC8C;IAC9C,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;+DAE2D;IAC3D,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,oBAAoB,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAC/D,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IACF;oDACgD;IAChD,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ;;mCAE+B;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,WAAW,EAAE,CAAC;IACpB,iEAAiE;IACjE,MAAM,EAAE,OAAO,CAAC;CACjB;AAED;;yEAEyE;AACzE,wBAAsB,OAAO,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,CAsHpE;AAMD;;2BAE2B;AAC3B,UAAU,UAAU;IAClB,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB;;;6DAGyD;IACzD,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjD;2BACuB;IACvB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;sEAWsE;AACtE,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,eAAe,GAAG,UAAU,EAAE,CA6E/E;AA2HD,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAe9D"}

package/dist/deploy/sync.js

@@ -0,0 +1,354 @@
+/*
+ * sync — push the .hatchkit.json manifest's view of the project onto
+ * the Coolify resource(s) hatchkit created (or adopted) for it.
+ *
+ * Why this exists: Coolify's auto-generated Traefik labels are derived
+ * from the application's Domain field (`docker_compose_domains` for
+ * dockercompose build packs, `fqdn` / `domains` otherwise). When a
+ * scaffold or adopt run created the app without that field populated —
+ * either because of the pre-fix bug where `updateApplication` couldn't
+ * push domains, or because the user changed the manifest after scaffold —
+ * the container ends up with zero traefik labels and Traefik silently
+ * drops the route. `hatchkit sync` reads the manifest, finds the matching
+ * Coolify app(s), and PATCHes them so Coolify regenerates the labels on
+ * the next deploy.
+ *
+ * Scope is deliberately narrow. Sync only pushes fields that are safe to
+ * blast over the wire idempotently:
+ *   · domain (`docker_compose_domains` for compose apps; `domains` for
+ *     nixpacks / dockerfile / static)
+ *   · ports_exposes (so the multi-host routing for the starter's split
+ *     compose stays consistent with what runCoolifySetup creates)
+ *
+ * Out of scope (handled by other commands):
+ *   · env vars              → `hatchkit keys push` + adopt's setAppEnv
+ *   · DNS records           → adopt's wireDns + `rename-domain`
+ *   · ML services / GPU     → `hatchkit add gpu`
+ *   · S3 buckets / tokens   → `hatchkit provision s3`
+ *
+ * Idempotent by design: reads current state first, only PATCHes when the
+ * desired domain set differs from what Coolify reports. `--dry-run`
+ * shows the diff without touching anything.
+ */
+import chalk from "chalk";
+import ora from "ora";
+import { getCoolifyConfig } from "../config.js";
+import { readManifest } from "../scaffold/manifest.js";
+import { CoolifyApi } from "../utils/coolify-api.js";
+/** Top-level entrypoint. Reads the project manifest, finds the Coolify
+ *  app(s) hatchkit knows about by name, and pushes the desired domain
+ *  + ports payload — or just prints what it would push when `dryRun`. */
+export async function runSync(opts) {
+    const manifest = readManifest(opts.projectDir);
+    if (!manifest) {
+        const err = `No .hatchkit.json found in ${opts.projectDir}.`;
+        if (!opts.json) {
+            console.log(chalk.red(`  ${err}`));
+            console.log(chalk.dim("  Run `hatchkit sync` from a hatchkit-scaffolded project root, or `hatchkit adopt` to onboard an existing project first."));
+        }
+        return { ok: false, error: err, apps: [], dryRun: !!opts.dryRun };
+    }
+    const cfg = await getCoolifyConfig();
+    if (!cfg) {
+        const err = "Coolify is not configured. Run `hatchkit config add coolify` first.";
+        if (!opts.json)
+            console.log(chalk.red(`  ${err}`));
+        return { ok: false, error: err, apps: [], dryRun: !!opts.dryRun };
+    }
+    const api = new CoolifyApi({ url: cfg.url, token: cfg.token });
+    const desiredAll = computeDesiredAppStates(manifest);
+    const apps = [];
+    const errors = [];
+    // Match every desired-app entry against Coolify by name. We don't
+    // pre-list /applications and intersect because sync should still work
+    // when the user has hundreds of apps; a per-name lookup is cheaper.
+    // Apps the manifest expects but that don't exist in Coolify are
+    // logged as a hint (the user probably needs `hatchkit adopt` first)
+    // but don't fail the whole run — partial sync of the apps that DO
+    // exist is the most useful behavior.
+    for (const desired of desiredAll) {
+        const matchSpinner = opts.json ? null : ora(`Coolify: locating "${desired.appName}"`).start();
+        const found = await api.findApplicationByName(desired.appName);
+        if (!found) {
+            matchSpinner?.warn(`Coolify: no app named "${desired.appName}" — skipping`);
+            continue;
+        }
+        matchSpinner?.succeed(`Coolify: found "${desired.appName}" (${found.uuid})`);
+        let current;
+        try {
+            current = await api.getApplication(found.uuid);
+        }
+        catch (err) {
+            errors.push(`Failed to read Coolify app "${desired.appName}" (${found.uuid}): ${err.message}`);
+            continue;
+        }
+        const plan = buildPlan(found.uuid, desired, current);
+        apps.push(plan);
+        if (!opts.json)
+            renderPlan(plan);
+        if (!plan.changed)
+            continue;
+        if (opts.dryRun)
+            continue;
+        const patch = ora(`Coolify: updating "${desired.appName}"`).start();
+        try {
+            await api.updateApplication(plan.uuid, {
+                portsExposes: plan.desiredPortsExposes,
+                ...(plan.desiredDockerComposeDomains
+                    ? { dockerComposeDomains: plan.desiredDockerComposeDomains }
+                    : {}),
+                ...(plan.desiredDomains ? { domains: plan.desiredDomains } : {}),
+            });
+            patch.succeed(`Coolify: updated "${desired.appName}"`);
+        }
+        catch (err) {
+            patch.fail(`Coolify: PATCH failed: ${err.message}`);
+            errors.push(`PATCH ${desired.appName}: ${err.message}`);
+        }
+    }
+    if (apps.length === 0 && errors.length === 0) {
+        const err = `No Coolify apps matched manifest project "${manifest.name}".`;
+        if (!opts.json) {
+            console.log(chalk.yellow(`  ${err}`));
+            console.log(chalk.dim(`  Looked for: ${desiredAll.map((d) => `"${d.appName}"`).join(", ")}.\n` +
+                `  Run \`hatchkit adopt\` to create them, or rename the existing app(s) to match.`));
+        }
+        return { ok: false, error: err, apps, dryRun: !!opts.dryRun };
+    }
+    if (!opts.json) {
+        if (opts.dryRun) {
+            console.log(chalk.dim("\n  --dry-run: no changes pushed."));
+        }
+        else {
+            const changed = apps.filter((a) => a.changed);
+            if (changed.length === 0) {
+                console.log(chalk.green("\n  ✓ Coolify already in sync with manifest."));
+            }
+            else {
+                console.log(chalk.green(`\n  ✓ Synced ${changed.length} app(s) to manifest state.`) +
+                    chalk.dim("\n  Trigger a redeploy in Coolify (or push a commit) for Traefik to pick up the new labels."));
+            }
+        }
+        if (errors.length > 0) {
+            console.log(chalk.yellow("\n  Errors:"));
+            for (const e of errors)
+                console.log(chalk.yellow(`    · ${e}`));
+        }
+    }
+    return {
+        ok: errors.length === 0,
+        apps,
+        dryRun: !!opts.dryRun,
+        ...(errors.length > 0 ? { error: errors.join("; ") } : {}),
+    };
+}
+/** Map a manifest to the set of Coolify apps hatchkit owns for it. The
+ *  shapes we cover (matching the layouts `findCoolifyAppsForProject`
+ *  understands):
+ *
+ *    1. Adopted single-app:        `<name>`
+ *    2. Starter split (legacy):    `<name>-server` + `<name>-client`
+ *    3. Old single-app fallbacks:  `<name>-web` / `<name>-app` / `<name>-api`
+ *
+ *  We synthesize a candidate list per layout. The actual lookup happens
+ *  per-name; misses are skipped. This means a project that scaffolded as
+ *  starter-split AND was later adopted as single-app would push twice —
+ *  not a problem because each PATCH is independent and idempotent. */
+export function computeDesiredAppStates(manifest) {
+    const { name, domain, surfaces, ports } = manifest;
+    const portServer = String(ports?.server ?? 3000);
+    const portClient = String(ports?.client ?? 3001);
+    // Routing recipes — see `runCoolifySetup` (cli/src/deploy/coolify.ts)
+    // for the create-time source of truth. Sync mirrors that exactly so
+    // re-running sync converges to the same labels Coolify generated at
+    // create time.
+    const apiDomain = `api.${domain}`;
+    const frontendDomain = `https://${domain}`;
+    const backendDomains = [
+        `https://${apiDomain}`,
+        `https://${domain}/api`,
+        `https://${domain}/api/ws`,
+        `https://${apiDomain}/ws`,
+    ];
+    const splitClientDomains = [{ name: "client", domain: frontendDomain }];
+    const splitServerDomains = backendDomains.map((d) => ({ name: "server", domain: d }));
+    // Single-app layout: one Coolify app named `<name>` with one compose
+    // service `app`. ports_exposes is surface-aware:
+    //   server-only / both → server port (the public listener)
+    //   client-only        → 80 (matches adopt.ts's static-site default)
+    const singleAppPort = surfaces === "client-only" ? "80" : portServer;
+    const singleAppDomain = surfaces === "client-only" && (singleAppPort === "80" || singleAppPort === "443")
+        ? `https://${domain}`
+        : `https://${domain}:${singleAppPort}`;
+    // Use bare `https://<domain>` when the listener is on the conventional
+    // 80/443 — Coolify's Traefik handles the HTTPS termination and the
+    // explicit port suffix would push the route through Traefik on a
+    // non-standard port (which won't match the Coolify ingress). The
+    // formatDockerComposeDomain helper in coolify-app.ts uses the same
+    // rule; mirror it here so sync output matches what adopt creates.
+    const singleAppCanonicalDomain = singleAppPort === "80" || singleAppPort === "443" ? `https://${domain}` : singleAppDomain;
+    const singleApp = {
+        appName: name,
+        domains: [{ name: "app", domain: singleAppCanonicalDomain }],
+        portsExposes: singleAppPort,
+    };
+    // Starter-split layout: two apps. Each app's compose has its own
+    // service named `client` or `server` respectively; routing splits
+    // along the same lines as runCoolifySetup creates.
+    const splitClient = {
+        appName: `${name}-client`,
+        domains: splitClientDomains,
+        portsExposes: portClient,
+    };
+    const splitServer = {
+        appName: `${name}-server`,
+        domains: splitServerDomains,
+        portsExposes: portServer,
+    };
+    // Old single-app fallbacks. `runCoolifySetup` creates `<name>-web`
+    // for the very-old starter shape; the others are speculative for
+    // hand-written compose layouts that adopt previously matched.
+    const fallbackWeb = {
+        ...singleApp,
+        appName: `${name}-web`,
+    };
+    // Filter by surfaces so we don't ship a non-existent split shape
+    // in JSON output. The actual Coolify lookup will skip non-existent
+    // names anyway, but keeping the candidate list tight reduces noise.
+    if (surfaces === "client-only") {
+        return [singleApp, fallbackWeb, splitClient];
+    }
+    if (surfaces === "server-only") {
+        return [singleApp, fallbackWeb, splitServer];
+    }
+    // both / undefined → server-of-truth is the split layout, but adopt
+    // collapses to single-app for projects without a separate frontend.
+    return [singleApp, fallbackWeb, splitServer, splitClient];
+}
+// ---------------------------------------------------------------------------
+// Plan rendering
+// ---------------------------------------------------------------------------
+function buildPlan(uuid, desired, current) {
+    const isCompose = current.buildPack === "dockercompose";
+    // dockercompose apps use docker_compose_domains; everything else uses
+    // the flat `domains` field. Coolify rejects a domain payload that
+    // doesn't match the build pack with a 422.
+    const desiredDockerComposeDomains = isCompose ? desired.domains : undefined;
+    const desiredDomains = isCompose ? undefined : desired.domains.map((d) => d.domain);
+    const portsChanged = current.portsExposes !== undefined && current.portsExposes !== desired.portsExposes;
+    const domainsChanged = isCompose
+        ? !sameDockerComposeDomains(current.dockerComposeDomains, desired.domains)
+        : !sameStringList(splitFqdn(current.fqdn), desired.domains.map((d) => d.domain));
+    return {
+        uuid,
+        name: current.name || desired.appName,
+        buildPack: current.buildPack,
+        ...(desiredDockerComposeDomains ? { desiredDockerComposeDomains } : {}),
+        ...(desiredDomains ? { desiredDomains } : {}),
+        desiredPortsExposes: desired.portsExposes,
+        current: {
+            fqdn: current.fqdn,
+            ...(current.dockerComposeDomains
+                ? { dockerComposeDomains: current.dockerComposeDomains }
+                : {}),
+            ...(current.portsExposes !== undefined ? { portsExposes: current.portsExposes } : {}),
+        },
+        changed: portsChanged || domainsChanged,
+    };
+}
+function renderPlan(plan) {
+    console.log(chalk.bold(`\n  ${plan.name}`) + chalk.dim(` (${plan.uuid.slice(0, 8)}…)`));
+    if (plan.buildPack) {
+        console.log(chalk.dim(`    build pack: ${plan.buildPack}`));
+    }
+    if (plan.desiredDockerComposeDomains) {
+        const before = plan.current.dockerComposeDomains ?? [];
+        const after = plan.desiredDockerComposeDomains;
+        const same = sameDockerComposeDomains(before, after);
+        if (same) {
+            console.log(chalk.green(`    ✓ docker_compose_domains: in sync`));
+            console.log(chalk.dim(`        ${formatDockerComposeDomains(after)}`));
+        }
+        else {
+            console.log(chalk.yellow(`    · docker_compose_domains:`));
+            console.log(chalk.dim(`        before: ${formatDockerComposeDomains(before)}`));
+            console.log(chalk.dim(`        after:  ${formatDockerComposeDomains(after)}`));
+        }
+    }
+    else if (plan.desiredDomains) {
+        const before = splitFqdn(plan.current.fqdn);
+        const after = plan.desiredDomains;
+        const same = sameStringList(before, after);
+        if (same) {
+            console.log(chalk.green(`    ✓ domains: in sync (${after.join(", ")})`));
+        }
+        else {
+            console.log(chalk.yellow(`    · domains:`));
+            console.log(chalk.dim(`        before: ${before.join(", ") || "(empty)"}`));
+            console.log(chalk.dim(`        after:  ${after.join(", ")}`));
+        }
+    }
+    if (plan.current.portsExposes !== undefined &&
+        plan.current.portsExposes !== plan.desiredPortsExposes) {
+        console.log(chalk.yellow(`    · ports_exposes:`));
+        console.log(chalk.dim(`        before: ${plan.current.portsExposes}`));
+        console.log(chalk.dim(`        after:  ${plan.desiredPortsExposes}`));
+    }
+    else if (plan.current.portsExposes === plan.desiredPortsExposes) {
+        console.log(chalk.green(`    ✓ ports_exposes: ${plan.desiredPortsExposes}`));
+    }
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function splitFqdn(fqdn) {
+    if (!fqdn)
+        return [];
+    return fqdn
+        .split(",")
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function sameStringList(a, b) {
+    if (a.length !== b.length)
+        return false;
+    const sa = [...a].sort();
+    const sb = [...b].sort();
+    return sa.every((v, i) => v === sb[i]);
+}
+function sameDockerComposeDomains(a, b) {
+    const left = a ?? [];
+    if (left.length !== b.length)
+        return false;
+    // Order-insensitive comparison — Coolify doesn't promise to round-trip
+    // the array in the same order it was sent.
+    const key = (e) => `${e.name}::${e.domain}`;
+    const setA = new Set(left.map(key));
+    return b.every((e) => setA.has(key(e)));
+}
+function formatDockerComposeDomains(entries) {
+    if (entries.length === 0)
+        return "(empty)";
+    return entries.map((e) => `${e.name}=${e.domain}`).join(", ");
+}
+// ---------------------------------------------------------------------------
+// CLI glue — thin wrapper the dispatcher calls.
+// ---------------------------------------------------------------------------
+export async function runSyncCli(args) {
+    const dryRun = args.includes("--dry-run");
+    const json = args.includes("--json");
+    const dirArg = (() => {
+        const i = args.findIndex((a) => a === "--dir");
+        if (i >= 0 && args[i + 1])
+            return args[i + 1];
+        return undefined;
+    })();
+    const projectDir = dirArg ? dirArg : process.cwd();
+    const result = await runSync({ projectDir, dryRun, json });
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+    }
+    if (!result.ok)
+        process.exit(1);
+}
+//# sourceMappingURL=sync.js.map

package/dist/deploy/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/deploy/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAwB,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC7E,OAAO,EAAE,UAAU,EAA2B,MAAM,yBAAyB,CAAC;AAyD9E;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAiB;IAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,GAAG,GAAG,8BAA8B,IAAI,CAAC,UAAU,GAAG,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,0HAA0H,CAC3H,CACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,qEAAqE,CAAC;QAClF,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IACrD,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,kEAAkE;IAClE,sEAAsE;IACtE,oEAAoE;IACpE,gEAAgE;IAChE,oEAAoE;IACpE,kEAAkE;IAClE,qCAAqC;IACrC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,sBAAsB,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,YAAY,EAAE,IAAI,CAAC,0BAA0B,OAAO,CAAC,OAAO,cAAc,CAAC,CAAC;YAC5E,SAAS;QACX,CAAC;QACD,YAAY,EAAE,OAAO,CAAC,mBAAmB,OAAO,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;QAE7E,IAAI,OAA2B,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CACT,+BAA+B,OAAO,CAAC,OAAO,MAAM,KAAK,CAAC,IAAI,MAAO,GAAa,CAAC,OAAO,EAAE,CAC7F,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEhB,IAAI,CAAC,IAAI,CAAC,IAAI;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,SAAS;QAC5B,IAAI,IAAI,CAAC,MAAM;YAAE,SAAS;QAE1B,MAAM,KAAK,GAAG,GAAG,CAAC,sBAAsB,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,CAAC;QACpE,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE;gBACrC,YAAY,EAAE,IAAI,CAAC,mBAAmB;gBACtC,GAAG,CAAC,IAAI,CAAC,2BAA2B;oBAClC,CAAC,CAAC,EAAE,oBAAoB,EAAE,IAAI,CAAC,2BAA2B,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE,CAAC,CAAC;YACH,KAAK,CAAC,OAAO,CAAC,qBAAqB,OAAO,CAAC,OAAO,GAAG,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,KAAK,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,SAAS,OAAO,CAAC,OAAO,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,6CAA6C,QAAQ,CAAC,IAAI,IAAI,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CACP,iBAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtE,kFAAkF,CACrF,CACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC,CAAC;YAC3E,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,4BAA4B,CAAC;oBACrE,KAAK,CAAC,GAAG,CACP,6FAA6F,CAC9F,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;YACzC,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC;QACvB,IAAI;QACJ,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;sEAWsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,QAAyB;IAC/D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IACnD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;IAEjD,sEAAsE;IACtE,oEAAoE;IACpE,oEAAoE;IACpE,eAAe;IACf,MAAM,SAAS,GAAG,OAAO,MAAM,EAAE,CAAC;IAClC,MAAM,cAAc,GAAG,WAAW,MAAM,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG;QACrB,WAAW,SAAS,EAAE;QACtB,WAAW,MAAM,MAAM;QACvB,WAAW,MAAM,SAAS;QAC1B,WAAW,SAAS,KAAK;KAC1B,CAAC;IACF,MAAM,kBAAkB,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;IACxE,MAAM,kBAAkB,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAEtF,qEAAqE;IACrE,iDAAiD;IACjD,2DAA2D;IAC3D,qEAAqE;IACrE,MAAM,aAAa,GAAG,QAAQ,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;IACrE,MAAM,eAAe,GACnB,QAAQ,KAAK,aAAa,IAAI,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,KAAK,CAAC;QAC/E,CAAC,CAAC,WAAW,MAAM,EAAE;QACrB,CAAC,CAAC,WAAW,MAAM,IAAI,aAAa,EAAE,CAAC;IAC3C,uEAAuE;IACvE,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,mEAAmE;IACnE,kEAAkE;IAClE,MAAM,wBAAwB,GAC5B,aAAa,KAAK,IAAI,IAAI,aAAa,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IAC5F,MAAM,SAAS,GAAe;QAC5B,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC;QAC5D,YAAY,EAAE,aAAa;KAC5B,CAAC;IAEF,iEAAiE;IACjE,kEAAkE;IAClE,mDAAmD;IACnD,MAAM,WAAW,GAAe;QAC9B,OAAO,EAAE,GAAG,IAAI,SAAS;QACzB,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,UAAU;KACzB,CAAC;IACF,MAAM,WAAW,GAAe;QAC9B,OAAO,EAAE,GAAG,IAAI,SAAS;QACzB,OAAO,EAAE,kBAAkB;QAC3B,YAAY,EAAE,UAAU;KACzB,CAAC;IAEF,mEAAmE;IACnE,iEAAiE;IACjE,8DAA8D;IAC9D,MAAM,WAAW,GAAe;QAC9B,GAAG,SAAS;QACZ,OAAO,EAAE,GAAG,IAAI,MAAM;KACvB,CAAC;IAEF,iEAAiE;IACjE,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IACD,oEAAoE;IACpE,oEAAoE;IACpE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,SAAS,SAAS,CAAC,IAAY,EAAE,OAAmB,EAAE,OAA2B;IAC/E,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,KAAK,eAAe,CAAC;IACxD,sEAAsE;IACtE,kEAAkE;IAClE,2CAA2C;IAC3C,MAAM,2BAA2B,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpF,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC;IACtF,MAAM,cAAc,GAAG,SAAS;QAC9B,CAAC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,OAAO,CAAC;QAC1E,CAAC,CAAC,CAAC,cAAc,CACb,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EACvB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CACrC,CAAC;IAEN,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,OAAO;QACrC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,2BAA2B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,mBAAmB,EAAE,OAAO,CAAC,YAAY;QACzC,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,OAAO,CAAC,oBAAoB;gBAC9B,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF;QACD,OAAO,EAAE,YAAY,IAAI,cAAc;KACxC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAiB;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,IAAI,CAAC,2BAA2B,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,IAAI,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,IAAI,CAAC,2BAA2B,CAAC;QAC/C,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrD,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;YAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACzE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,0BAA0B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,CAAC;QAClC,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,IAAI,EAAE,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IACD,IACE,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS;QACvC,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EACtD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,KAAK,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wBAAwB,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,SAAS,CAAC,IAAmB;IACpC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,OAAO,IAAI;SACR,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,cAAc,CAAC,CAAW,EAAE,CAAW;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAC/B,CAAsD,EACtD,CAA0C;IAE1C,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC3C,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,GAAG,GAAG,CAAC,CAAmC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAgD;IAClF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChE,CAAC;AAED,8EAA8E;AAC9E,gDAAgD;AAChD,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAc;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,GAAuB,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9C,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,EAAE,CAAC;IAEL,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAuBA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAwfD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAoBnE;AAED;;;;;;;;;;;0CAW0C;AAC1C,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA6FrF;AAED;;;;;;;;;;;;;+CAa+C;AAC/C,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA6HxF;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C5E"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../src/doctor.ts"],"names":[],"mappings":"AAuBA,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAugBD,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAoBnE;AAED;;;;;;;;;;;0CAW0C;AAC1C,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA6FrF;AAED;;;;;;;;;;;;;+CAa+C;AAC/C,wBAAsB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CA6HxF;AAED,wBAAsB,SAAS,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA8C5E"}

package/dist/doctor.js

@@ -423,30 +423,47 @@ async function checkResend() {
         return undefined;
     });
 }
-async function checkStripe() {
-    const { getStripeConfig } = await import("./config.js");
-    const cfg = await getStripeConfig();
-    if (!cfg)
-        return { name: "Stripe", status: "skip" };
-    return check(`Stripe (${cfg.mode})`, async () => {
+async function checkStripeMode(mode, secretKey) {
+    return check(`Stripe (${mode} master)`, async () => {
         const res = await fetch("https://api.stripe.com/v1/balance", {
-            headers: { Authorization: `Bearer ${cfg.secretKey}` },
+            headers: { Authorization: `Bearer ${secretKey}` },
         });
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
-        return "secret key valid";
+        // The webhook_endpoints:write scope can't be cheaply tested with
+        // a GET, so /balance is the proxy: it proves the key is live and
+        // the account is reachable. A scope-mismatched key still passes
+        // /balance — at provision time, POST /v1/webhook_endpoints will
+        // surface the scope error inline (and `hatchkit create` already
+        // soft-fails to a manual fallback when that happens).
+        return "master key valid";
     }, (detail) => {
         const code = httpCode(detail);
         if (code === 401) {
             return [
-                "Stripe secret key is invalid or was rotated.",
-                "Find the current pair at https://dashboard.stripe.com/apikeys",
+                `Stripe ${mode} master key is invalid or was rotated.`,
+                `Create a new restricted key (${mode} mode) at https://dashboard.stripe.com/apikeys`,
+                "Required scope: Webhook Endpoints — Write",
                 "Then re-run: `hatchkit config add stripe`",
             ];
         }
         return undefined;
     });
 }
+async function checkStripe() {
+    const { getStripeConfig } = await import("./config.js");
+    const cfg = await getStripeConfig();
+    if (!cfg)
+        return [{ name: "Stripe", status: "skip" }];
+    const out = [];
+    if (cfg.testSecretKey)
+        out.push(await checkStripeMode("test", cfg.testSecretKey));
+    if (cfg.liveSecretKey)
+        out.push(await checkStripeMode("live", cfg.liveSecretKey));
+    if (out.length === 0)
+        return [{ name: "Stripe", status: "skip" }];
+    return out;
+}
 export async function collectDoctorResults() {
     const results = [];
     results.push(await checkGitHub());
@@ -460,7 +477,8 @@ export async function collectDoctorResults() {
     results.push(await checkGlitchtip());
     results.push(await checkOpenpanel());
     results.push(await checkResend());
-    results.push(await checkStripe());
+    for (const r of await checkStripe())
+        results.push(r);
     // Project-local checks — only run when doctor was invoked inside a
     // hatchkit-managed project (manifest at cwd). Globally they're a
     // no-op, so `hatchkit doctor` from $HOME stays clean.