@atlasauth/cli 0.2.0 → 0.4.0

package/dist/commands/init.js

@@ -0,0 +1,409 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const output_1 = require("../output");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+/**
+ * `atlas init` — set up an Atlas app for a product in one idempotent command.
+ *
+ * It drives the platform API (a `psk_` platform key) to find or create the app
+ * + instance, then the instance's own Backend API to set sign-in strategies,
+ * the email sender, the custom domain, a first-party OAuth client and a
+ * webhook endpoint. Re-running finds each thing by name / host / URL and only
+ * fills what is missing.
+ *
+ * Every secret it receives goes straight into a 0600 file under
+ * `~/.config/<product>/` (directory 0700); stdout carries only public values
+ * and file paths. Before anything that would hand back a NEW secret is
+ * created, the target file is checked: an existing, different file is refused
+ * unless `--force`, so a secret is never minted only to be thrown away.
+ */
+const STRATEGY_ALIASES = {
+    password: 'password',
+    email_code: 'emailCode',
+    email_link: 'emailLink',
+    passkey: 'passkey',
+    phone_code: 'phoneCode',
+    username: 'username',
+    siwe: 'siwe',
+};
+/** Strategies that need email delivery: turned on only once the instance can send. */
+const EMAIL_STRATEGIES = new Set(['emailCode', 'emailLink']);
+const EMAIL_PROVIDERS = ['resend', 'brevo'];
+function camel(s) {
+    return s.replace(/_([a-z])/g, (_m, c) => c.toUpperCase());
+}
+function parseOptions(args) {
+    const v = args.values;
+    const product = (0, args_1.str)(v, 'product');
+    if (!product)
+        throw new errors_1.CliError('atlas init requires --product <name>.');
+    (0, secrets_1.assertProductName)(product);
+    const environment = (0, project_1.parseInstanceEnv)((0, args_1.str)(v, 'instance-env'), 'production');
+    const domain = (0, args_1.str)(v, 'domain')?.trim().toLowerCase().replace(/\.$/, '');
+    if (domain && !/^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/.test(domain)) {
+        throw new errors_1.CliError(`--domain must be a domain name like example.com, got '${domain}'.`);
+    }
+    const emailRaw = (0, args_1.str)(v, 'email') ?? (domain ? 'managed' : 'none');
+    if (emailRaw !== 'managed' && emailRaw !== 'development' && emailRaw !== 'none') {
+        throw new errors_1.CliError(`--email must be managed, development or none, got '${emailRaw}'.`);
+    }
+    if (emailRaw === 'managed' && !domain && !(0, args_1.str)(v, 'email-from')) {
+        throw new errors_1.CliError('--email managed needs --domain (or --email-from <address on your domain>).');
+    }
+    if (emailRaw === 'development' && environment !== 'development') {
+        throw new errors_1.CliError('--email development is only for --instance-env development. Use --email managed on production.');
+    }
+    const providerRaw = (0, args_1.str)(v, 'email-provider');
+    if (providerRaw !== undefined && !EMAIL_PROVIDERS.includes(providerRaw)) {
+        throw new errors_1.CliError(`--email-provider must be ${EMAIL_PROVIDERS.join(' or ')}, got '${providerRaw}'. Configure other providers with PUT /v1/messaging_providers/email.`);
+    }
+    const emailKeyFile = (0, args_1.str)(v, 'email-key-file');
+    if (emailKeyFile !== undefined && !providerRaw)
+        throw new errors_1.CliError('--email-key-file needs --email-provider resend|brevo.');
+    const strategies = (0, args_1.list)(v, 'strategies').map((s) => STRATEGY_ALIASES[s] ?? camel(s));
+    const redirects = (0, args_1.list)(v, 'client-redirect');
+    for (const r of redirects) {
+        try {
+            new URL(r);
+        }
+        catch {
+            throw new errors_1.CliError(`--client-redirect must be an absolute URL, got '${r}'.`);
+        }
+    }
+    return {
+        product,
+        appName: (0, args_1.str)(v, 'name') || product,
+        environment,
+        domain,
+        authHost: (0, args_1.str)(v, 'auth-host') || (domain ? `auth.${domain}` : undefined),
+        strategies,
+        email: emailRaw,
+        emailFrom: (0, args_1.str)(v, 'email-from') || (emailRaw === 'managed' && domain ? `noreply@mail.${domain}` : undefined),
+        emailProvider: providerRaw,
+        emailKeyFile,
+        redirects,
+        webhookUrl: (0, args_1.str)(v, 'webhook-url'),
+        force: v.force === true,
+        rotateSecret: v['rotate-secret'] === true,
+    };
+}
+/** The platform key and API URL: ATLAS_PLATFORM_KEY, else a stored profile holding a psk_ key. */
+function platformAuth(ctx, args) {
+    const file = ctx.config.load();
+    const profile = (0, args_1.str)(args.values, 'profile') || file.active_profile || 'default';
+    const stored = file.profiles[profile];
+    const envKey = ctx.env.ATLAS_PLATFORM_KEY?.trim();
+    const key = envKey || (stored?.secret_key.startsWith('psk_') ? stored.secret_key : undefined);
+    if (!key) {
+        throw new errors_1.CliError("atlas init needs a platform key (psk_…). Set ATLAS_PLATFORM_KEY, or store one with 'atlas login --secret-key psk_…'.");
+    }
+    const apiUrl = ctx.env.ATLAS_API_URL?.trim() || stored?.api_url || backend_1.DEFAULT_API_URL;
+    return { secretKey: key, apiUrl };
+}
+const isStatus = (err, status) => err instanceof backend_1.AtlasApiError && err.status === status;
+/**
+ * Read the customer's provider key from a file, or stdin with '-'. A bare key,
+ * or a dotenv line (`RESEND_API_KEY=re_…`). Never from argv, never printed.
+ */
+function readProviderKey(ctx, file) {
+    let text;
+    try {
+        text = ctx.readFile(file === '-' ? '/dev/stdin' : file);
+    }
+    catch {
+        throw new errors_1.CliError(`Could not read the email provider key from ${file === '-' ? 'stdin' : file}.`);
+    }
+    const line = text.split(/\r?\n/).map((l) => l.trim()).find((l) => l && !l.startsWith('#')) ?? '';
+    const m = /^[A-Za-z_][A-Za-z0-9_]*=(.*)$/.exec(line);
+    const key = (m ? m[1] : line).trim().replace(/^"(.*)"$/, '$1');
+    if (!key || /\s/.test(key))
+        throw new errors_1.CliError(`No email provider key found in ${file === '-' ? 'stdin' : file}.`);
+    return key;
+}
+/** Refuse up front when a NEW secret would land on an existing, different file. */
+function assertFreeForNewSecret(path, force) {
+    if ((0, node_fs_1.existsSync)(path) && !force) {
+        throw new errors_1.CliError(`${path} already exists. A new secret would be created and could not be saved there. Move the file aside, or re-run with --force to replace it.`);
+    }
+}
+async function init(ctx, args) {
+    const opts = parseOptions(args);
+    const json = (0, shared_1.wantsJson)(args.values);
+    const log = (line) => (json ? ctx.io.err(line) : ctx.io.out(line));
+    const dir = (0, secrets_1.productDir)(ctx.env, opts.product);
+    const env = opts.environment;
+    const secretFile = (0, node_path_1.join)(dir, `${env}.env`);
+    const clientFile = (0, node_path_1.join)(dir, `${env}-oauth-client.env`);
+    const webhookFile = (0, node_path_1.join)(dir, `${env}-webhook.env`);
+    // The plan, then a confirmation unless --yes.
+    log(`atlas init: ${opts.appName} (${env})`);
+    log(`  strategies: ${opts.strategies.length ? opts.strategies.join(', ') : '(instance defaults)'}`);
+    log(`  email:      ${opts.email}${opts.email === 'managed' ? ` from ${opts.emailFrom}` : ''}${opts.emailProvider ? ` (your ${opts.emailProvider} account)` : ''}`);
+    if (opts.authHost)
+        log(`  domain:     ${opts.authHost}`);
+    if (opts.redirects.length)
+        log(`  client:     first-party OAuth client → ${opts.redirects.join(', ')}`);
+    if (opts.webhookUrl)
+        log(`  webhook:    ${opts.webhookUrl}`);
+    log(`  secrets:    ${dir} (0600 files, never printed)`);
+    if (args.values.yes !== true) {
+        const answer = (await ctx.prompt.text('Proceed? (y/N)')).trim().toLowerCase();
+        if (answer !== 'y' && answer !== 'yes')
+            throw new errors_1.CliError('Aborted. Nothing was changed.');
+    }
+    const platform = platformAuth(ctx, args);
+    const plat = (0, project_1.httpFor)(ctx, platform);
+    // --- 1. app + instance --------------------------------------------------
+    const apps = (await plat.get('/v1/platform/apps')).data ?? [];
+    let app = apps.find((a) => a.name === opts.appName && a.environment === env);
+    let created = false;
+    if (!app) {
+        assertFreeForNewSecret(secretFile, opts.force);
+        const origins = [...new Set(opts.redirects.map((r) => new URL(r).origin).filter((o) => o.startsWith('http')))];
+        app = await plat.post('/v1/platform/apps', {
+            name: opts.appName,
+            environment: env,
+            create_development_sibling: false,
+            ...(origins.length ? { allowed_origins: origins } : {}),
+        });
+        created = true;
+        (0, secrets_1.writeSecretFile)(dir, `${env}.env`, { ATLAS_SECRET_KEY: app.secret ?? '' }, {
+            force: opts.force,
+            comment: `Atlas secret key for ${opts.appName} (${env}, ${app.id}). Server-side only.`,
+        });
+        log(`Created app ${app.id}. Secret key written to ${secretFile}.`);
+    }
+    else {
+        log(`Found app ${app.id}.`);
+    }
+    let secretKey = (0, secrets_1.readEnvFile)(secretFile)?.ATLAS_SECRET_KEY;
+    if (!secretKey) {
+        if (!opts.rotateSecret) {
+            throw new errors_1.CliError(`App ${app.id} exists but its secret key is not in ${secretFile}. Re-run with --rotate-secret to mint a new one (existing keys keep working for the default overlap window).`);
+        }
+        const rotated = await plat.post(`/v1/platform/apps/${app.id}/rotate_secret`, {});
+        (0, secrets_1.writeSecretFile)(dir, `${env}.env`, { ATLAS_SECRET_KEY: rotated.secret }, {
+            force: true,
+            comment: `Atlas secret key for ${opts.appName} (${env}, ${app.id}). Server-side only.`,
+        });
+        secretKey = rotated.secret;
+        const until = rotated.previous_keys_expire_at ? new Date(rotated.previous_keys_expire_at).toISOString() : 'now';
+        log(`Minted a new secret key into ${secretFile}. Previous keys stop working: ${until}.`);
+    }
+    const api = (0, project_1.httpFor)(ctx, { secretKey, apiUrl: platform.apiUrl });
+    const previous = (0, project_1.readManifest)(ctx.env, opts.product);
+    const record = {
+        ...(previous?.instances[env] ?? {}),
+        instance_id: app.id,
+        environment: env,
+        publishable_key: app.publishable_key,
+        frontend_api_host: app.frontend_api_host,
+        issuer: null,
+        discovery_url: null,
+        jwks_uri: null,
+        secret_file: secretFile,
+    };
+    // --- 2. email sender (before strategies: email methods need it) ----------
+    // Always the customer's own provider account: Atlas lends none. The key comes
+    // from --email-key-file (or stdin) and is sent once; it is never printed.
+    const providerKey = () => {
+        if (!opts.emailProvider || !opts.emailKeyFile) {
+            throw new errors_1.CliError(`--email ${opts.email} sends through your own email provider. Pass --email-provider resend|brevo and --email-key-file <path> (or - to read it from stdin).`);
+        }
+        return { transport: opts.emailProvider, config: { api_key: readProviderKey(ctx, opts.emailKeyFile) } };
+    };
+    let emailReady = opts.email === 'none';
+    if (opts.email === 'managed') {
+        let managed;
+        try {
+            managed = await api.get('/v1/messaging_providers/email/managed');
+        }
+        catch (err) {
+            if (!isStatus(err, 404))
+                throw err;
+            managed = await api.post('/v1/messaging_providers/email/managed', { from_address: opts.emailFrom, ...providerKey() });
+            log(`Registered ${opts.emailFrom} on your ${opts.emailProvider} account (managed email).`);
+        }
+        emailReady = managed.verified;
+        record.email = { mode: 'managed', from_address: managed.from_address };
+        if (!managed.verified) {
+            log('Publish these DNS records for managed email, then run: atlas init again (or POST /v1/messaging_providers/email/managed/verify):');
+            for (const r of managed.records ?? []) {
+                log(`  ${r.type.padEnd(5)} ${r.name}  ${r.value}${r.priority !== undefined ? `  (priority ${r.priority})` : ''}`);
+            }
+        }
+        else {
+            log(`Managed email verified: ${managed.from_address}.`);
+        }
+    }
+    else if (opts.email === 'development') {
+        const providers = await api.get('/v1/messaging_providers');
+        let dev;
+        if (providers.email?.mode === 'development' && !opts.emailKeyFile) {
+            dev = await api.get('/v1/messaging_providers/email/development');
+        }
+        else if (providers.email && !opts.emailKeyFile) {
+            dev = await api.post('/v1/messaging_providers/email/development', {
+                provider_id: providers.email.id,
+                ...(opts.emailFrom ? { from_address: opts.emailFrom } : {}),
+            });
+        }
+        else {
+            dev = await api.post('/v1/messaging_providers/email/development', {
+                ...providerKey(),
+                ...(opts.emailFrom ? { from_address: opts.emailFrom } : {}),
+            });
+        }
+        emailReady = dev.active;
+        record.email = { mode: 'development', from_address: dev.from_address };
+        log(`Development email sender on: your provider, from ${dev.from_address} (capped, development instances only).`);
+        if (dev.note)
+            log(`  Note: ${dev.note}`);
+    }
+    else {
+        record.email = { mode: 'none' };
+    }
+    // --- 3. strategies --------------------------------------------------------
+    if (opts.strategies.length) {
+        const current = (await api.get('/v1/instance')).auth_config_resolved?.strategies ?? {};
+        const missing = opts.strategies.filter((s) => current[s] !== true);
+        const enableNow = missing.filter((s) => !EMAIL_STRATEGIES.has(s) || emailReady);
+        const later = missing.filter((s) => EMAIL_STRATEGIES.has(s) && !emailReady);
+        if (enableNow.length) {
+            try {
+                await api.patch('/v1/instance', { auth_config: { strategies: Object.fromEntries(enableNow.map((s) => [s, true])) } });
+                log(`Turned on: ${enableNow.join(', ')}.`);
+            }
+            catch (err) {
+                // Password sign-up with email verification also needs a sender: say so, keep going.
+                if (!(err instanceof backend_1.AtlasApiError && err.status === 422 && err.code === 'EMAIL_PROVIDER_REQUIRED'))
+                    throw err;
+                log(`Not turned on yet: ${err.message} Re-run atlas init once email can be sent.`);
+            }
+        }
+        if (later.length) {
+            log(`Not turned on yet (the instance cannot send email until the sender is ready): ${later.join(', ')}. Re-run atlas init once it is.`);
+        }
+    }
+    // --- 4. custom domain ------------------------------------------------------
+    if (opts.authHost) {
+        const domains = (await api.get('/v1/domains')).data ?? [];
+        let d = domains.find((x) => x.host === opts.authHost);
+        if (!d) {
+            d = await api.post('/v1/domains', { host: opts.authHost, role: 'fapi' });
+            log(`Added custom domain ${opts.authHost}.`);
+        }
+        record.custom_domain = { host: d.host, cname_target: d.cname_target, status: d.status };
+        if (!d.live && d.cname_target) {
+            log(`Publish this DNS record for the sign-in domain: CNAME ${d.host} → ${d.cname_target} (DNS only, not proxied).`);
+        }
+    }
+    // --- 5. first-party OAuth client -----------------------------------------
+    if (opts.redirects.length) {
+        const clientName = `${opts.appName} (${env})`;
+        const clients = (await api.get('/v1/oauth_clients')).data ?? [];
+        const existing = clients.find((c) => c.name === clientName);
+        if (existing) {
+            const missingUris = opts.redirects.filter((r) => !existing.redirect_uris.includes(r));
+            if (missingUris.length) {
+                await api.patch(`/v1/oauth_clients/${existing.id}`, { redirect_uris: [...existing.redirect_uris, ...missingUris] });
+                log(`Added redirect URIs to OAuth client ${existing.client_id}: ${missingUris.join(', ')}.`);
+            }
+            else {
+                log(`Found OAuth client ${existing.client_id}.`);
+            }
+            const hasSecret = Boolean((0, secrets_1.readEnvFile)(clientFile)?.ATLAS_CLIENT_SECRET);
+            if (!hasSecret)
+                log(`Its secret is not in ${clientFile}. Mint one with: atlas client rotate ${existing.id} --product ${opts.product} --instance-env ${env}`);
+            record.oauth_client = {
+                id: existing.id,
+                client_id: existing.client_id,
+                redirect_uris: [...new Set([...existing.redirect_uris, ...missingUris])],
+                secret_file: hasSecret ? clientFile : null,
+            };
+        }
+        else {
+            assertFreeForNewSecret(clientFile, opts.force);
+            const c = await api.post('/v1/oauth_clients', {
+                name: clientName,
+                redirect_uris: opts.redirects,
+                first_party: true,
+            });
+            if (c.client_secret) {
+                (0, secrets_1.writeSecretFile)(dir, `${env}-oauth-client.env`, { ATLAS_CLIENT_ID: c.client_id, ATLAS_CLIENT_SECRET: c.client_secret }, {
+                    force: opts.force,
+                    comment: `OAuth client ${c.id} for ${opts.appName} (${env}). Server-side only.`,
+                });
+            }
+            record.oauth_client = { id: c.id, client_id: c.client_id, redirect_uris: c.redirect_uris, secret_file: c.client_secret ? clientFile : null };
+            log(`Created first-party OAuth client ${c.client_id}. Secret written to ${clientFile}.`);
+        }
+    }
+    // --- 6. webhook endpoint ---------------------------------------------------
+    if (opts.webhookUrl) {
+        const hooks = (await api.get('/v1/webhook_endpoints')).data ?? [];
+        const existing = hooks.find((h) => h.url === opts.webhookUrl);
+        if (existing) {
+            const hasSecret = Boolean((0, secrets_1.readEnvFile)(webhookFile)?.ATLAS_WEBHOOK_SECRET);
+            record.webhook = { id: existing.id, url: existing.url, secret_file: hasSecret ? webhookFile : null };
+            log(`Found webhook endpoint ${existing.id}.`);
+        }
+        else {
+            assertFreeForNewSecret(webhookFile, opts.force);
+            const h = await api.post('/v1/webhook_endpoints', { url: opts.webhookUrl });
+            if (h.secret) {
+                (0, secrets_1.writeSecretFile)(dir, `${env}-webhook.env`, { ATLAS_WEBHOOK_SECRET: h.secret }, {
+                    force: opts.force,
+                    comment: `Signing secret for webhook endpoint ${h.id} (${opts.webhookUrl}).`,
+                });
+            }
+            record.webhook = { id: h.id, url: h.url, secret_file: h.secret ? webhookFile : null };
+            log(`Created webhook endpoint ${h.id}. Signing secret written to ${webhookFile}.`);
+        }
+    }
+    // --- 7. public endpoints, manifest, summary ----------------------------------
+    const inst = await api.get('/v1/instance').catch(() => undefined);
+    const host = inst?.frontend_api_host ?? app.frontend_api_host;
+    const base = host ? `https://${host}` : null;
+    record.publishable_key = inst?.publishable_key ?? app.publishable_key;
+    record.frontend_api_host = host ?? null;
+    record.issuer = inst?.issuer ?? app.issuer ?? base;
+    record.discovery_url = inst?.discovery_url ?? app.discovery_url ?? (record.issuer ? `${record.issuer}/.well-known/openid-configuration` : null);
+    record.jwks_uri = inst?.jwks_uri ?? app.jwks_uri ?? (base ? `${base}/.well-known/jwks.json` : null);
+    const manifest = {
+        product: opts.product,
+        api_url: platform.apiUrl,
+        instances: { ...(previous?.instances ?? {}), [env]: record },
+    };
+    const manifestFile = (0, project_1.writeManifest)(ctx.env, manifest);
+    if (json) {
+        (0, output_1.printJson)(ctx.io, { created, manifest: manifestFile, ...record });
+        return 0;
+    }
+    ctx.io.out('');
+    ctx.io.out(`Done. ${created ? 'Created' : 'Updated'} ${opts.appName} (${env}).`);
+    ctx.io.out(`  Instance:          ${record.instance_id}`);
+    ctx.io.out(`  Publishable key:   ${record.publishable_key}`);
+    ctx.io.out(`  Frontend API:      ${base ?? '(not assigned)'}`);
+    ctx.io.out(`  Issuer:            ${record.issuer ?? '(unknown)'}`);
+    ctx.io.out(`  Discovery:         ${record.discovery_url ?? '(unknown)'}`);
+    if (record.oauth_client)
+        ctx.io.out(`  OAuth client id:   ${record.oauth_client.client_id}`);
+    ctx.io.out(`  Secret key file:   ${secretFile}`);
+    if (record.oauth_client?.secret_file)
+        ctx.io.out(`  Client secret file: ${record.oauth_client.secret_file}`);
+    if (record.webhook?.secret_file)
+        ctx.io.out(`  Webhook secret file: ${record.webhook.secret_file}`);
+    ctx.io.out(`  Project manifest:  ${manifestFile}`);
+    ctx.io.out(`Next: atlas preflight --product ${opts.product} --instance-env ${env}, and atlas env --product ${opts.product} --format dotenv`);
+    return 0;
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":";;AAoMA,oBA+QC;AAndD,qCAAqC;AACrC,yCAAiC;AACjC,gDAAoE;AACpE,kCAAqD;AAErD,sCAAqC;AACrC,sCAAsC;AACtC,wCAQoB;AACpB,wCAAyF;AACzF,qCAAqC;AAErC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,gBAAgB,GAA2B;IAC/C,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,WAAW;IACvB,UAAU,EAAE,WAAW;IACvB,OAAO,EAAE,SAAS;IAClB,UAAU,EAAE,WAAW;IACvB,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;CACb,CAAC;AACF,sFAAsF;AACtF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAG7D,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAU,CAAC;AAoBrD,SAAS,KAAK,CAAC,CAAS;IACtB,OAAO,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,IAAgB;IACpC,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,iBAAQ,CAAC,uCAAuC,CAAC,CAAC;IAC1E,IAAA,2BAAiB,EAAC,OAAO,CAAC,CAAC;IAC3B,MAAM,WAAW,GAAG,IAAA,0BAAgB,EAAC,IAAA,UAAG,EAAC,CAAC,EAAE,cAAc,CAAC,EAAE,YAAY,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACzE,IAAI,MAAM,IAAI,CAAC,mEAAmE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,iBAAQ,CAAC,yDAAyD,MAAM,IAAI,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,aAAa,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QAChF,MAAM,IAAI,iBAAQ,CAAC,sDAAsD,QAAQ,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,MAAM,IAAI,CAAC,IAAA,UAAG,EAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,iBAAQ,CAAC,4EAA4E,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,QAAQ,KAAK,aAAa,IAAI,WAAW,KAAK,aAAa,EAAE,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,gGAAgG,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7C,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,WAA4B,CAAC,EAAE,CAAC;QACzF,MAAM,IAAI,iBAAQ,CAChB,4BAA4B,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,WAAW,sEAAsE,CACpJ,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC9C,IAAI,YAAY,KAAK,SAAS,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,iBAAQ,CAAC,uDAAuD,CAAC,CAAC;IAC5H,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAA,WAAI,EAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAQ,CAAC,mDAAmD,CAAC,IAAI,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,OAAO;QACL,OAAO;QACP,OAAO,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,MAAM,CAAC,IAAI,OAAO;QAClC,WAAW;QACX,MAAM;QACN,QAAQ,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,UAAU;QACV,KAAK,EAAE,QAAQ;QACf,SAAS,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,aAAa,EAAE,WAAwC;QACvD,YAAY;QACZ,SAAS;QACT,UAAU,EAAE,IAAA,UAAG,EAAC,CAAC,EAAE,aAAa,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI;QACvB,YAAY,EAAE,CAAC,CAAC,eAAe,CAAC,KAAK,IAAI;KAC1C,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,SAAS,YAAY,CAAC,GAAe,EAAE,IAAgB;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9F,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,iBAAQ,CAChB,sHAAsH,CACvH,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,OAAO,IAAI,yBAAe,CAAC;IACnF,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AACpC,CAAC;AA0BD,MAAM,QAAQ,GAAG,CAAC,GAAY,EAAE,MAAc,EAAE,EAAE,CAAC,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;AAEzG;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAe,EAAE,IAAY;IACpD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAQ,CAAC,8CAA8C,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjG,MAAM,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;IACnH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,SAAS,sBAAsB,CAAC,IAAY,EAAE,KAAc;IAC1D,IAAI,IAAA,oBAAU,EAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,IAAI,iBAAQ,CAChB,GAAG,IAAI,yIAAyI,CACjJ,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,GAAe,EAAE,IAAgB;IAC1D,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,GAAG,GAAG,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;IAC7B,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,GAAG,GAAG,cAAc,CAAC,CAAC;IAEpD,8CAA8C;IAC9C,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC;IAC5C,GAAG,CAAC,iBAAiB,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpG,GAAG,CACD,iBAAiB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,aAAa,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9J,CAAC;IACF,IAAI,IAAI,CAAC,QAAQ;QAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,GAAG,CAAC,4CAA4C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxG,IAAI,IAAI,CAAC,UAAU;QAAE,GAAG,CAAC,iBAAiB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,iBAAiB,GAAG,8BAA8B,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK;YAAE,MAAM,IAAI,iBAAQ,CAAC,+BAA+B,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEpC,2EAA2E;IAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAmB,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;IAChF,IAAI,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC;IAC7E,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/G,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAS,mBAAmB,EAAE;YACjD,IAAI,EAAE,IAAI,CAAC,OAAO;YAClB,WAAW,EAAE,GAAG;YAChB,0BAA0B,EAAE,KAAK;YACjC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;QACf,IAAA,yBAAe,EAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,EAAE,gBAAgB,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE;YACzE,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,wBAAwB,IAAI,CAAC,OAAO,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE,sBAAsB;SACvF,CAAC,CAAC;QACH,GAAG,CAAC,eAAe,GAAG,CAAC,EAAE,2BAA2B,UAAU,GAAG,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,aAAa,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS,GAAG,IAAA,qBAAW,EAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,iBAAQ,CAChB,OAAO,GAAG,CAAC,EAAE,wCAAwC,UAAU,8GAA8G,CAC9K,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAC7B,qBAAqB,GAAG,CAAC,EAAE,gBAAgB,EAC3C,EAAE,CACH,CAAC;QACF,IAAA,yBAAe,EAAC,GAAG,EAAE,GAAG,GAAG,MAAM,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE;YACvE,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,wBAAwB,IAAI,CAAC,OAAO,KAAK,GAAG,KAAK,GAAG,CAAC,EAAE,sBAAsB;SACvF,CAAC,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;QAChH,GAAG,CAAC,gCAAgC,UAAU,iCAAiC,KAAK,GAAG,CAAC,CAAC;IAC3F,CAAC;IAED,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,MAAM,GAAoB;QAC9B,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,WAAW,EAAE,GAAG,CAAC,EAAE;QACnB,WAAW,EAAE,GAAG;QAChB,eAAe,EAAE,GAAG,CAAC,eAAe;QACpC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,MAAM,EAAE,IAAI;QACZ,aAAa,EAAE,IAAI;QACnB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,UAAU;KACxB,CAAC;IAEF,4EAA4E;IAC5E,8EAA8E;IAC9E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,iBAAQ,CAChB,WAAW,IAAI,CAAC,KAAK,sIAAsI,CAC5J,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;IACzG,CAAC,CAAC;IACF,IAAI,UAAU,GAAG,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC;IACvC,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAuI,CAAC;QAC5I,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACnC,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,WAAW,EAAE,EAAE,CAAC,CAAC;YACtH,GAAG,CAAC,cAAc,IAAI,CAAC,SAAS,YAAY,IAAI,CAAC,aAAa,2BAA2B,CAAC,CAAC;QAC7F,CAAC;QACD,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC9B,MAAM,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,GAAG,CAAC,iIAAiI,CAAC,CAAC;YACvI,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;gBACtC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,2BAA2B,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,GAAG,CAAmD,yBAAyB,CAAC,CAAC;QAC7G,IAAI,GAA6D,CAAC;QAClE,IAAI,SAAS,CAAC,KAAK,EAAE,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClE,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;aAAM,IAAI,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBAChE,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE;gBAC/B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,2CAA2C,EAAE;gBAChE,GAAG,WAAW,EAAE;gBAChB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;QACD,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC;QACxB,MAAM,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,CAAC,YAAY,EAAE,CAAC;QACvE,GAAG,CAAC,oDAAoD,GAAG,CAAC,YAAY,wCAAwC,CAAC,CAAC;QAClH,IAAI,GAAG,CAAC,IAAI;YAAE,GAAG,CAAC,WAAW,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAc,cAAc,CAAC,CAAC,CAAC,oBAAoB,EAAE,UAAU,IAAI,EAAE,CAAC;QACpG,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACnE,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC;QAChF,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5E,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,KAAK,CAAC,cAAc,EAAE,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtH,GAAG,CAAC,cAAc,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oFAAoF;gBACpF,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,yBAAyB,CAAC;oBAAE,MAAM,GAAG,CAAC;gBAC/G,GAAG,CAAC,sBAAsB,GAAG,CAAC,OAAO,4CAA4C,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,GAAG,CAAC,iFAAiF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAC1I,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAA0F,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACnJ,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,GAAG,CAAC,uBAAuB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,CAAC,aAAa,GAAG,EAAE,IAAI,EAAE,CAAE,CAAC,IAAI,EAAE,YAAY,EAAE,CAAE,CAAC,YAAY,EAAE,MAAM,EAAE,CAAE,CAAC,MAAM,EAAE,CAAC;QAC3F,IAAI,CAAC,CAAE,CAAC,IAAI,IAAI,CAAE,CAAC,YAAY,EAAE,CAAC;YAChC,GAAG,CAAC,yDAAyD,CAAE,CAAC,IAAI,MAAM,CAAE,CAAC,YAAY,2BAA2B,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,OAAO,KAAK,GAAG,GAAG,CAAC;QAC9C,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAqF,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACpJ,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YACtF,IAAI,WAAW,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,GAAG,CAAC,KAAK,CAAC,qBAAqB,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;gBACpH,GAAG,CAAC,uCAAuC,QAAQ,CAAC,SAAS,KAAK,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/F,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,sBAAsB,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;YACnD,CAAC;YACD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAA,qBAAW,EAAC,UAAU,CAAC,EAAE,mBAAmB,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS;gBAAE,GAAG,CAAC,wBAAwB,UAAU,wCAAwC,QAAQ,CAAC,EAAE,cAAc,IAAI,CAAC,OAAO,mBAAmB,GAAG,EAAE,CAAC,CAAC;YAC7J,MAAM,CAAC,YAAY,GAAG;gBACpB,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,QAAQ,CAAC,aAAa,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;gBACxE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;aAC3C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/C,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAqF,mBAAmB,EAAE;gBAChI,IAAI,EAAE,UAAU;gBAChB,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC;gBACpB,IAAA,yBAAe,EAAC,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE;oBACtH,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,gBAAgB,CAAC,CAAC,EAAE,QAAQ,IAAI,CAAC,OAAO,KAAK,GAAG,sBAAsB;iBAChF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7I,GAAG,CAAC,oCAAoC,CAAC,CAAC,SAAS,uBAAuB,UAAU,GAAG,CAAC,CAAC;QAC3F,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAwC,uBAAuB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,SAAS,GAAG,OAAO,CAAC,IAAA,qBAAW,EAAC,WAAW,CAAC,EAAE,oBAAoB,CAAC,CAAC;YAC1E,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACrG,GAAG,CAAC,0BAA0B,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAA+C,uBAAuB,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;YAC1H,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACb,IAAA,yBAAe,EAAC,GAAG,EAAE,GAAG,GAAG,cAAc,EAAE,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE;oBAC7E,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,uCAAuC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,IAAI;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtF,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAAE,+BAA+B,WAAW,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,CAAc,cAAc,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/E,MAAM,IAAI,GAAG,IAAI,EAAE,iBAAiB,IAAI,GAAG,CAAC,iBAAiB,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,MAAM,CAAC,eAAe,GAAG,IAAI,EAAE,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC;IACtE,MAAM,CAAC,iBAAiB,GAAG,IAAI,IAAI,IAAI,CAAC;IACxC,MAAM,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC;IACnD,MAAM,CAAC,aAAa,GAAG,IAAI,EAAE,aAAa,IAAI,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAChJ,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAEpG,MAAM,QAAQ,GAAoB;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,OAAO,EAAE,QAAQ,CAAC,MAAM;QACxB,SAAS,EAAE,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE;KAC7D,CAAC;IACF,MAAM,YAAY,GAAG,IAAA,uBAAa,EAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAEtD,IAAI,IAAI,EAAE,CAAC;QACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAClE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG,IAAI,CAAC,CAAC;IACjF,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,IAAI,IAAI,gBAAgB,EAAE,CAAC,CAAC;IAC/D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,aAAa,IAAI,WAAW,EAAE,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,YAAY;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7F,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,UAAU,EAAE,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC,YAAY,EAAE,WAAW;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7G,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACpG,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mCAAmC,IAAI,CAAC,OAAO,mBAAmB,GAAG,6BAA6B,IAAI,CAAC,OAAO,kBAAkB,CAAC,CAAC;IAC7I,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/project-commands.d.ts

@@ -0,0 +1,26 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+import { type ProjectInstance, type ProjectManifest } from '../project';
+/**
+ * The project commands that sit beside `atlas init`: `preflight` (a CI gate),
+ * `env` (deploy variables without secrets) and `client rotate` (a new OAuth
+ * client secret, written straight to its file).
+ */
+/**
+ * The instance credential a project command runs with:
+ *  - `--instance <id>`: the instance's secret file from a project manifest;
+ *  - `--product <name>` [`--instance-env`]: that project's instance;
+ *  - otherwise the profile / ATLAS_SECRET_KEY, as every other command.
+ */
+export declare function instanceCredential(ctx: RunContext, args: ParsedArgs): {
+    secretKey: string;
+    apiUrl: string;
+    manifest?: ProjectManifest;
+    instance?: ProjectInstance;
+};
+/** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
+export declare function preflight(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/** Public values, then each secret as a reference to its file — never the value. */
+export declare function envCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
+/** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
+export declare function client(ctx: RunContext, args: ParsedArgs): Promise<number>;