@atlasauth/cli 0.25.0 → 0.26.0

package/dist/commands/project-commands.js

@@ -0,0 +1,431 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.instanceCredential = instanceCredential;
+exports.preflight = preflight;
+exports.doctor = doctor;
+exports.envCommand = envCommand;
+exports.k8sManifest = k8sManifest;
+exports.client = client;
+const node_path_1 = require("node:path");
+const backend_1 = require("@atlasauth/backend");
+const args_1 = require("../args");
+const errors_1 = require("../errors");
+const context_1 = require("../context");
+const output_1 = require("../output");
+const redact_1 = require("../redact");
+const project_1 = require("../project");
+const secrets_1 = require("../secrets");
+const shared_1 = require("./shared");
+const golive_1 = require("./golive");
+const doctor_scan_1 = require("./doctor-scan");
+/**
+ * The project commands that sit beside `atlas init`: `preflight` (a CI gate),
+ * `env` (deploy variables without secrets) and `client rotate` (a new OAuth
+ * client secret, written straight to its file).
+ */
+/**
+ * The instance credential a project command runs with:
+ *  - `--instance <id>`: the instance's secret file from a project manifest;
+ *  - `--product <name>` [`--instance-env`]: that project's instance;
+ *  - otherwise the profile / ATLAS_SECRET_KEY, as every other command.
+ */
+function instanceCredential(ctx, args) {
+    const v = args.values;
+    const instanceId = (0, args_1.str)(v, 'instance');
+    const product = (0, args_1.str)(v, 'product');
+    if (instanceId) {
+        const found = (0, project_1.findInstance)(ctx.env, instanceId, product);
+        if (!found) {
+            throw new errors_1.CliError(`No project manifest knows instance ${instanceId}${product ? ` (product '${product}')` : ''}. Run 'atlas init' for it, or use ATLAS_SECRET_KEY.`);
+        }
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(found.instance),
+            apiUrl: (0, shared_1.envApiUrl)(ctx.env) || found.manifest.api_url,
+            manifest: found.manifest,
+            instance: found.instance,
+        };
+    }
+    if (product) {
+        const { manifest, instance } = projectInstance(ctx, args, product);
+        return {
+            secretKey: (0, project_1.instanceSecretFromFile)(instance),
+            apiUrl: (0, shared_1.envApiUrl)(ctx.env) || manifest.api_url,
+            manifest,
+            instance,
+        };
+    }
+    const auth = (0, shared_1.resolveAuth)(ctx, v);
+    return { secretKey: auth.secretKey, apiUrl: auth.apiUrl };
+}
+/** The manifest instance for `--product` + `--instance-env` (default: production, else the only one). */
+function projectInstance(ctx, args, product) {
+    const manifest = (0, project_1.readManifest)(ctx.env, product);
+    if (!manifest) {
+        throw new errors_1.CliError(`No project '${product}' at ${(0, secrets_1.productDir)(ctx.env, product)}. Run 'atlas init --product ${product}' first.`);
+    }
+    const requested = (0, args_1.str)(args.values, 'instance-env');
+    const envs = Object.keys(manifest.instances);
+    const env = requested
+        ? (0, project_1.parseInstanceEnv)(requested, 'production')
+        : manifest.instances.production
+            ? 'production'
+            : envs.length === 1
+                ? envs[0]
+                : 'production';
+    const instance = manifest.instances[env];
+    if (!instance)
+        throw new errors_1.CliError(`Project '${product}' has no ${env} instance. Run 'atlas init --product ${product} --instance-env ${env}'.`);
+    return { manifest, instance };
+}
+/** The only calls `--fix` makes: marked safe by the server, a write, on the Backend API. */
+function canAutofix(f) {
+    const call = f.fix_call;
+    return (f.safe_to_autofix === true &&
+        !f.acknowledged &&
+        !!call &&
+        typeof call.path === 'string' &&
+        ['POST', 'PUT', 'PATCH', 'DELETE'].includes(String(call.method).toUpperCase()) &&
+        call.path.startsWith('/v1/') &&
+        !call.path.includes('..'));
+}
+/** `--fix`: offer each safe finding, apply what is confirmed. A refused call does not stop the rest. */
+async function applyFixes(ctx, api, findings, yes, log) {
+    const fixable = findings.filter(canAutofix);
+    if (!fixable.length) {
+        log('Nothing here can be fixed automatically.');
+        return;
+    }
+    log(`${fixable.length} finding(s) can be fixed:`);
+    for (const f of fixable)
+        log(`  ${f.code}: ${f.fix_call.method} ${f.fix_call.path}`);
+    for (const f of fixable) {
+        const call = f.fix_call;
+        if (!yes) {
+            const answer = (await ctx.prompt.text(`Fix ${f.code} with ${call.method} ${call.path}? [y/N]`, { default: 'n' })).trim().toLowerCase();
+            if (answer !== 'y' && answer !== 'yes')
+                continue;
+        }
+        try {
+            const method = call.method.toUpperCase();
+            if (method === 'POST')
+                await api.post(call.path, call.body ?? {});
+            else if (method === 'PUT')
+                await api.put(call.path, call.body ?? {});
+            else if (method === 'PATCH')
+                await api.patch(call.path, call.body ?? {});
+            else
+                await api.delete(call.path, call.body);
+            log(`Fixed ${f.code}.`);
+        }
+        catch (err) {
+            if (!(err instanceof backend_1.AtlasApiError))
+                throw err;
+            log(`Could not fix ${f.code}: ${err.message}`);
+        }
+    }
+}
+const FINDING_COLUMNS = [
+    { header: 'SEVERITY', get: (f) => f.severity },
+    { header: 'CODE', get: (f) => f.code },
+    { header: 'MESSAGE', get: (f) => f.message },
+];
+/** `atlas preflight` — run the instance's setup checks; exit 1 on errors (or warnings with --fail-on warning). */
+async function preflight(ctx, args) {
+    const failOn = (0, args_1.str)(args.values, 'fail-on') ?? 'error';
+    if (failOn !== 'error' && failOn !== 'warning') {
+        throw new errors_1.CliError(`--fail-on must be error or warning, got '${failOn}'.`);
+    }
+    const fix = args.values.fix === true;
+    const tty = (0, context_1.ttyOf)(ctx);
+    if (fix && args.values.yes !== true && !(tty.stdin && tty.stdout)) {
+        throw new errors_1.CliError('preflight --fix asks before each fix and there is no terminal here. Review the findings, then pass --yes.');
+    }
+    const cred = instanceCredential(ctx, args);
+    const api = (0, project_1.httpFor)(ctx, cred);
+    let raw = await api.get('/v1/instance/preflight');
+    if (fix) {
+        await applyFixes(ctx, api, raw.findings ?? [], args.values.yes === true, (l) => ((0, shared_1.wantsJson)(args.values) ? ctx.io.err(l) : ctx.io.out(l)));
+        raw = await api.get('/v1/instance/preflight');
+    }
+    // Fixes above use the raw calls; everything printed from here on is redacted.
+    const report = (0, redact_1.redactDeep)(raw);
+    const findings = report.findings ?? [];
+    const counted = findings.filter((f) => !f.acknowledged);
+    const errors = counted.filter((f) => f.severity === 'error').length;
+    const warnings = counted.filter((f) => f.severity === 'warning').length;
+    const acknowledged = findings.length - counted.length;
+    const failed = errors > 0 || (failOn === 'warning' && warnings > 0);
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, report);
+    }
+    else if (findings.length === 0) {
+        ctx.io.out('Preflight passed: no findings.');
+    }
+    else {
+        ctx.io.out((0, output_1.renderTable)(FINDING_COLUMNS, findings));
+        ctx.io.out('');
+        for (const f of counted.filter((x) => x.severity !== 'info')) {
+            ctx.io.out(`${f.code}: ${f.fix}`);
+            if (f.fix_call)
+                ctx.io.out(`  call: ${f.fix_call.method} ${f.fix_call.path}${f.fix_call.body === undefined ? '' : ` ${JSON.stringify(f.fix_call.body)}`}`);
+        }
+        for (const f of findings.filter((x) => x.acknowledged)) {
+            ctx.io.out(`${f.code}: acknowledged (${f.acknowledged.reason})`);
+        }
+        ctx.io.out('');
+        ctx.io.out(`${errors} error(s), ${warnings} warning(s), ${counted.length - errors - warnings} info${acknowledged ? `, ${acknowledged} acknowledged` : ''}.`);
+    }
+    if (failed) {
+        ctx.io.err(`atlas: preflight failed (${errors} error(s)${failOn === 'warning' ? `, ${warnings} warning(s)` : ''}).`);
+        return 1;
+    }
+    return 0;
+}
+const HEALTH_COLUMNS = [
+    { header: 'STATE', get: (c) => (c.ok === true ? 'ok' : c.ok === false ? 'FAIL' : '-') },
+    { header: 'CHECK', get: (c) => c.id },
+    { header: 'HOP', get: (c) => c.hop ?? '' },
+    { header: 'DETAIL', get: (c) => c.detail },
+];
+/** `atlas doctor` — the integration-health report; exit 1 when a check fails. */
+async function doctor(ctx, args) {
+    const scanDir = (0, args_1.str)(args.values, 'scan-dir');
+    const scanImage = (0, args_1.str)(args.values, 'scan-image');
+    if (scanDir !== undefined || scanImage !== undefined)
+        return (0, doctor_scan_1.scanForSecrets)(ctx, { dir: scanDir, image: scanImage, json: (0, shared_1.wantsJson)(args.values) });
+    const cred = instanceCredential(ctx, args);
+    const q = new URLSearchParams();
+    const only = (0, args_1.str)(args.values, 'only');
+    if (only)
+        q.set('only', only);
+    if (args.values['no-probe'] === true)
+        q.set('probe', 'false');
+    const qs = q.toString();
+    const api = (0, project_1.httpFor)(ctx, cred);
+    const report = (0, redact_1.redactDeep)(await api.get(`/v1/integration-health${qs ? `?${qs}` : ''}`));
+    // --origin: the go-live checks for that origin join the same report.
+    const originRaw = (0, args_1.str)(args.values, 'origin');
+    if (originRaw) {
+        const origin = (0, golive_1.parseOrigin)(originRaw, 'doctor');
+        const extra = await Promise.all([
+            (0, golive_1.preflightCheck)(api),
+            (0, golive_1.loginReadinessCheck)(api, origin.origin),
+            (0, golive_1.pathMountCheck)(api, origin.host),
+            (0, golive_1.declaredCookiesCheck)(api),
+        ]);
+        for (const c of extra) {
+            report.checks.push({ id: c.id, ok: c.ok, detail: c.detail, fix: c.fix ?? null, source: 'origin' });
+            report.summary[c.ok ? 'passing' : 'failing'] += 1;
+        }
+        if (extra.some((c) => !c.ok))
+            report.ok = false;
+    }
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, report);
+    }
+    else {
+        const rows = [...report.checks].sort((a, b) => (a.ok === false ? 0 : a.ok === null ? 2 : 1) - (b.ok === false ? 0 : b.ok === null ? 2 : 1));
+        ctx.io.out((0, output_1.renderTable)(HEALTH_COLUMNS, rows));
+        const failing = rows.filter((c) => c.ok === false && c.fix);
+        if (failing.length) {
+            ctx.io.out('');
+            for (const c of failing)
+                ctx.io.out(`${c.id}: ${c.fix}`);
+        }
+        ctx.io.out('');
+        ctx.io.out(`${report.summary.failing} failing, ${report.summary.passing} passing, ${report.summary.unknown} not known or not configured.`);
+    }
+    if (!report.ok) {
+        ctx.io.err(`atlas: ${report.summary.failing} integration check(s) failing.`);
+        return 1;
+    }
+    return 0;
+}
+// ---- atlas env ----------------------------------------------------------------
+const FORMATS = ['dotenv', 'coolify', 'vercel', 'k8s'];
+/** Public values, then each secret as a reference to its file — never the value. */
+async function envCommand(ctx, args) {
+    const format = ((0, args_1.str)(args.values, 'format') ?? 'dotenv');
+    if (!FORMATS.includes(format))
+        throw new errors_1.CliError(`--format must be one of: ${FORMATS.join(', ')} (got '${format}').`);
+    const product = (0, args_1.str)(args.values, 'product');
+    const pub = {};
+    const secrets = [];
+    let environment;
+    let label;
+    if (product) {
+        const { manifest, instance } = projectInstance(ctx, args, product);
+        environment = instance.environment;
+        label = product;
+        pub.ATLAS_PUBLISHABLE_KEY = instance.publishable_key;
+        pub.ATLAS_API_BASE = manifest.api_url;
+        pub.ATLAS_API_URL = manifest.api_url;
+        if (instance.frontend_api_host)
+            pub.ATLAS_FRONTEND_API = `https://${instance.frontend_api_host}`;
+        if (instance.issuer)
+            pub.ATLAS_ISSUER = instance.issuer;
+        if (instance.discovery_url)
+            pub.ATLAS_DISCOVERY_URL = instance.discovery_url;
+        if (instance.jwks_uri)
+            pub.ATLAS_JWKS_URI = instance.jwks_uri;
+        if (instance.oauth_client)
+            pub.ATLAS_CLIENT_ID = instance.oauth_client.client_id;
+        secrets.push({ key: 'ATLAS_SECRET_KEY', file: instance.secret_file });
+        if (instance.oauth_client?.secret_file)
+            secrets.push({ key: 'ATLAS_CLIENT_SECRET', file: instance.oauth_client.secret_file });
+        if (instance.webhook?.secret_file)
+            secrets.push({ key: 'ATLAS_WEBHOOK_SECRET', file: instance.webhook.secret_file });
+    }
+    else {
+        // No project manifest: read the public values straight from the instance the credential belongs to.
+        const cred = instanceCredential(ctx, args);
+        const live = await (0, project_1.httpFor)(ctx, cred).get('/v1/instance');
+        environment = live.environment;
+        label = live.id;
+        pub.ATLAS_PUBLISHABLE_KEY = live.publishable_key;
+        pub.ATLAS_API_BASE = cred.apiUrl;
+        pub.ATLAS_API_URL = cred.apiUrl;
+        if (live.frontend_api_host)
+            pub.ATLAS_FRONTEND_API = `https://${live.frontend_api_host}`;
+        if (live.issuer)
+            pub.ATLAS_ISSUER = live.issuer;
+        if (live.discovery_url)
+            pub.ATLAS_DISCOVERY_URL = live.discovery_url;
+        if (live.jwks_uri)
+            pub.ATLAS_JWKS_URI = live.jwks_uri;
+    }
+    if ((0, shared_1.wantsJson)(args.values)) {
+        (0, output_1.printJson)(ctx.io, { product: product ?? null, environment, public: pub, secret_files: Object.fromEntries(secrets.map((s) => [s.key, s.file])) });
+        return 0;
+    }
+    const out = (l) => ctx.io.out(l);
+    if (format === 'dotenv') {
+        out(`# ${label} (${environment}): public values`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets are not printed. Each *_FILE variable names the 0600 file that holds it.');
+        for (const s of secrets)
+            out(`${s.key}_FILE=${s.file}`);
+    }
+    else if (format === 'coolify') {
+        out(`# ${label} (${environment}): paste into Coolify → Environment Variables (Developer view).`);
+        for (const [k, v] of Object.entries(pub))
+            out(`${k}=${v}`);
+        out('# Secrets: copy each value from its file (mark them as secret in Coolify):');
+        for (const s of secrets)
+            out(`${s.key}=@${s.file}`);
+    }
+    else if (format === 'k8s') {
+        out(k8sManifest(label, environment, pub, secrets));
+    }
+    else {
+        out(`# ${label} (${environment}): Vercel CLI commands. Secrets are piped from their files, never echoed.`);
+        const target = environment === 'production' ? 'production' : 'preview';
+        for (const [k, v] of Object.entries(pub))
+            out(`printf '%s' '${v.replace(/'/g, "'\\''")}' | vercel env add ${k} ${target}`);
+        for (const s of secrets)
+            out(`sed -n 's/^${s.key}=//p' '${s.file}' | tr -d '\\n' | vercel env add ${s.key} ${target}`);
+    }
+    return 0;
+}
+/** DNS-1123 name fragment for a Kubernetes resource. */
+function k8sName(raw) {
+    return raw.toLowerCase().replace(/[^a-z0-9-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 40) || 'atlas';
+}
+/** YAML double-quoted scalar (JSON strings are valid YAML). */
+const yamlStr = (v) => JSON.stringify(v);
+/**
+ * Kubernetes output: a ConfigMap with the public values, `kubectl create secret`
+ * commands that read each secret straight from its 0600 file (so a value never
+ * passes through this output), and the container `envFrom` / `secretKeyRef`
+ * snippet that wires both in.
+ */
+function k8sManifest(product, environment, pub, secrets) {
+    const base = `${k8sName(product)}-atlas`;
+    const lines = [
+        `# ${product} (${environment}): Kubernetes. Public values go in a ConfigMap; secrets are created from their 0600 files.`,
+        'apiVersion: v1',
+        'kind: ConfigMap',
+        'metadata:',
+        `  name: ${base}`,
+        'data:',
+        ...Object.entries(pub).map(([k, v]) => `  ${k}: ${yamlStr(v)}`),
+        '---',
+        '# Create each secret from its file (nothing is printed or stored in this manifest):',
+    ];
+    for (const s of secrets) {
+        lines.push(`#   kubectl create secret generic ${base}-${k8sName(s.key)} --from-env-file='${s.file.replace(/'/g, "'\\''")}'`);
+    }
+    lines.push('---', '# Container spec fragment:', '#   envFrom:', `#     - configMapRef: { name: ${base} }`, '#   env:');
+    for (const s of secrets) {
+        lines.push(`#     - name: ${s.key}`, `#       valueFrom: { secretKeyRef: { name: ${base}-${k8sName(s.key)}, key: ${s.key} } }`);
+    }
+    return lines.join('\n');
+}
+// ---- atlas client rotate ----------------------------------------------------------
+/** `atlas client rotate <id> [--now | --overlap <seconds>]` — the new secret goes straight to its file. */
+async function client(ctx, args) {
+    const sub = args.positionals[1];
+    if (sub !== 'rotate') {
+        throw new errors_1.CliError(sub ? `Unknown subcommand 'client ${sub}'. Try: rotate.` : 'client needs a subcommand: rotate.');
+    }
+    const ref = (0, shared_1.requireArg)(args.positionals, 2, 'client-id');
+    const v = args.values;
+    const overlapRaw = (0, args_1.str)(v, 'overlap');
+    if (v.now === true && overlapRaw !== undefined)
+        throw new errors_1.CliError('Pass --now or --overlap, not both.');
+    let overlapSeconds;
+    if (v.now === true)
+        overlapSeconds = 0;
+    else if (overlapRaw !== undefined) {
+        const n = Number(overlapRaw);
+        if (!Number.isInteger(n) || n < 0)
+            throw new errors_1.CliError(`--overlap must be a whole number of seconds, got '${overlapRaw}'.`);
+        overlapSeconds = n;
+    }
+    const cred = instanceCredential(ctx, args);
+    const api = (0, project_1.httpFor)(ctx, cred);
+    // Accept the internal id or the public client_id.
+    let id = ref;
+    if (ref.startsWith('client_')) {
+        const rows = (await api.get('/v1/oauth_clients')).data ?? [];
+        const match = rows.find((c) => c.client_id === ref);
+        if (!match)
+            throw new errors_1.CliError(`No OAuth client with client_id ${ref} on this instance.`);
+        id = match.id;
+    }
+    let res;
+    try {
+        res = await api.post(`/v1/oauth_clients/${id}/rotate_secret`, overlapSeconds === undefined ? {} : { overlap_seconds: overlapSeconds });
+    }
+    catch (err) {
+        if (err instanceof backend_1.AtlasApiError && err.status === 404)
+            throw new errors_1.CliError(`No OAuth client ${ref} on this instance.`);
+        throw err;
+    }
+    const product = (0, args_1.str)(v, 'product') ?? cred.manifest?.product;
+    const env = cred.instance?.environment;
+    const known = cred.instance?.oauth_client?.id === res.id ? cred.instance.oauth_client.secret_file : null;
+    const fileName = known ? (0, node_path_1.basename)(known) : product && env && cred.instance?.oauth_client?.id === res.id ? `${env}-oauth-client.env` : `oauth-client-${res.id}.env`;
+    const entries = { ATLAS_CLIENT_ID: res.client_id, ATLAS_CLIENT_SECRET: res.client_secret };
+    if (v['print-secret'] === true) {
+        (0, secrets_1.deliverSecret)({ io: ctx.io, env: ctx.env, product: product ?? 'atlasauth', fileName, entries, label: 'The new client secret', printSecret: true });
+    }
+    else {
+        // A rotation replaces the file by design: the old secret is the one being retired.
+        const { path } = (0, secrets_1.writeSecretFile)(known ? (0, node_path_1.dirname)(known) : (0, secrets_1.productDir)(ctx.env, product ?? 'atlasauth'), fileName, entries, {
+            force: true,
+            comment: `OAuth client ${res.id}. Server-side only.`,
+        });
+        ctx.io.out(`New client secret for ${res.client_id} written to ${path} (mode 0600).`);
+    }
+    const expires = res.previous_secret_expires_at;
+    if (overlapSeconds === 0 || expires === null)
+        ctx.io.out('The previous secret stopped working immediately.');
+    else if (typeof expires === 'number')
+        ctx.io.out(`The previous secret keeps working until ${new Date(expires).toISOString()}.`);
+    else
+        ctx.io.out('The API did not say when the previous secret stops working; assume immediately and deploy the new one now.');
+    return 0;
+}
+//# sourceMappingURL=project-commands.js.map

package/dist/commands/project-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-commands.js","sourceRoot":"","sources":["../../src/commands/project-commands.ts"],"names":[],"mappings":";;AAmCA,gDAgCC;AA4FD,8BAoDC;AAqBD,wBAgDC;AAQD,gCAwEC;AAgBD,kCAgCC;AAKD,wBA0DC;AAvdD,yCAA8C;AAC9C,gDAAmD;AACnD,kCAA+C;AAE/C,sCAAqC;AAErC,wCAAmC;AACnC,sCAAgE;AAChE,sCAAuC;AACvC,wCAQoB;AACpB,wCAAwE;AACxE,qCAAyE;AACzE,qCAAkH;AAClH,+CAA+C;AAE/C;;;;GAIG;AAEH;;;;;GAKG;AACH,SAAgB,kBAAkB,CAChC,GAAe,EACf,IAAgB;IAEhB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAClC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QACzD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,iBAAQ,CAChB,sCAAsC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,qDAAqD,CACjJ,CAAC;QACJ,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,KAAK,CAAC,QAAQ,CAAC;YACjD,MAAM,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpD,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;SACzB,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnE,OAAO;YACL,SAAS,EAAE,IAAA,gCAAsB,EAAC,QAAQ,CAAC;YAC3C,MAAM,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,OAAO;YAC9C,QAAQ;YACR,QAAQ;SACT,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACjC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,yGAAyG;AACzG,SAAS,eAAe,CACtB,GAAe,EACf,IAAgB,EAChB,OAAe;IAEf,MAAM,QAAQ,GAAG,IAAA,sBAAY,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,iBAAQ,CAAC,eAAe,OAAO,QAAQ,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,+BAA+B,OAAO,UAAU,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAA8C,CAAC;IAC1F,MAAM,GAAG,GAAG,SAAS;QACnB,CAAC,CAAC,IAAA,0BAAgB,EAAC,SAAS,EAAE,YAAY,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU;YAC7B,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE;gBACV,CAAC,CAAC,YAAY,CAAC;IACrB,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,iBAAQ,CAAC,YAAY,OAAO,YAAY,GAAG,wCAAwC,OAAO,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC/I,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAkBD,4FAA4F;AAC5F,SAAS,UAAU,CAAC,CAAmB;IACrC,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;IACxB,OAAO,CACL,CAAC,CAAC,eAAe,KAAK,IAAI;QAC1B,CAAC,CAAC,CAAC,YAAY;QACf,CAAC,CAAC,IAAI;QACN,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAC7B,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,wGAAwG;AACxG,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,GAAe,EAAE,QAA4B,EAAE,GAAY,EAAE,GAAwB;IAC9H,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,2BAA2B,CAAC,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAS,CAAC,MAAM,IAAI,CAAC,CAAC,QAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IACvF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,QAAS,CAAC;QACzB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,SAAS,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,SAAS,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YACvI,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK;gBAAE,SAAS;QACnD,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,MAAM;gBAAE,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;iBAC7D,IAAI,MAAM,KAAK,KAAK;gBAAE,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;iBAChE,IAAI,MAAM,KAAK,OAAO;gBAAE,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;;gBACpE,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,uBAAa,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC/C,GAAG,CAAC,iBAAiB,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAA+B;IAClD,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC9C,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE;CAC7C,CAAC;AAEF,kHAAkH;AAC3G,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,IAAgB;IAC/D,MAAM,MAAM,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,OAAO,CAAC;IACtD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,iBAAQ,CAAC,4CAA4C,MAAM,IAAI,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,IAAA,eAAK,EAAC,GAAG,CAAC,CAAC;IACvB,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,iBAAQ,CAAC,2GAA2G,CAAC,CAAC;IAClI,CAAC;IACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAgD,wBAAwB,CAAC,CAAC;IACjG,IAAI,GAAG,EAAE,CAAC;QACR,MAAM,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1I,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,CAAgD,wBAAwB,CAAC,CAAC;IAC/F,CAAC;IACD,8EAA8E;IAC9E,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,MAAM,CAAC;IACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACxE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;IAEpE,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;SAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IAC/C,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,eAAe,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,CAAC,QAAQ;gBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7J,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC;YACvD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,mBAAmB,CAAC,CAAC,YAAa,CAAC,MAAM,GAAG,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,GAAG,MAAM,cAAc,QAAQ,gBAAgB,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,QAAQ,QAAQ,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,CACjJ,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,4BAA4B,MAAM,YAAY,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,QAAQ,aAAa,CAAC,CAAC,CAAC,EAAE,IAAI,CACzG,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAaD,MAAM,cAAc,GAA6B;IAC/C,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE;IACvF,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IACrC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE;IAC1C,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;CAC3C,CAAC;AAEF,iFAAiF;AAC1E,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAA,4BAAc,EAAC,GAAG,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnJ,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,IAAI;QAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAA,mBAAU,EACvB,MAAM,GAAG,CAAC,GAAG,CAA4G,yBAAyB,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CACxK,CAAC;IACF,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC7C,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9B,IAAA,uBAAc,EAAC,GAAG,CAAC;YACnB,IAAA,4BAAmB,EAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC;YACvC,IAAA,uBAAc,EAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC;YAChC,IAAA,6BAAoB,EAAC,GAAG,CAAC;SAC1B,CAAC,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;YACnG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAAE,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5I,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,aAAa,MAAM,CAAC,OAAO,CAAC,OAAO,aAAa,MAAM,CAAC,OAAO,CAAC,OAAO,+BAA+B,CAAC,CAAC;IAC7I,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,OAAO,CAAC,OAAO,gCAAgC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAGhE,oFAAoF;AAC7E,KAAK,UAAU,UAAU,CAAC,GAAe,EAAE,IAAgB;IAChE,MAAM,MAAM,GAAG,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAc,CAAC;IACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,CAAC;IACvH,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC5C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,OAAO,GAAyC,EAAE,CAAC;IACzD,IAAI,WAAmB,CAAC;IACxB,IAAI,KAAa,CAAC;IAElB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACnE,WAAW,GAAG,QAAQ,CAAC,WAAW,CAAC;QACnC,KAAK,GAAG,OAAO,CAAC;QAChB,GAAG,CAAC,qBAAqB,GAAG,QAAQ,CAAC,eAAe,CAAC;QACrD,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC;QACtC,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC;QACrC,IAAI,QAAQ,CAAC,iBAAiB;YAAE,GAAG,CAAC,kBAAkB,GAAG,WAAW,QAAQ,CAAC,iBAAiB,EAAE,CAAC;QACjG,IAAI,QAAQ,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC;QACxD,IAAI,QAAQ,CAAC,aAAa;YAAE,GAAG,CAAC,mBAAmB,GAAG,QAAQ,CAAC,aAAa,CAAC;QAC7E,IAAI,QAAQ,CAAC,QAAQ;YAAE,GAAG,CAAC,cAAc,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAC9D,IAAI,QAAQ,CAAC,YAAY;YAAE,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,YAAY,EAAE,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,OAAO,EAAE,WAAW;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACvH,CAAC;SAAM,CAAC;QACN,oGAAoG;QACpG,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAQtC,cAAc,CAAC,CAAC;QACnB,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QAC/B,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;QAChB,GAAG,CAAC,qBAAqB,GAAG,IAAI,CAAC,eAAe,CAAC;QACjD,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC;QACjC,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;QAChC,IAAI,IAAI,CAAC,iBAAiB;YAAE,GAAG,CAAC,kBAAkB,GAAG,WAAW,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACzF,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC;QAChD,IAAI,IAAI,CAAC,aAAa;YAAE,GAAG,CAAC,mBAAmB,GAAG,IAAI,CAAC,aAAa,CAAC;QACrE,IAAI,IAAI,CAAC,QAAQ;YAAE,GAAG,CAAC,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxD,CAAC;IAED,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACjJ,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACzC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,GAAG,CAAC,KAAK,KAAK,KAAK,WAAW,kBAAkB,CAAC,CAAC;QAClD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,oFAAoF,CAAC,CAAC;QAC1F,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,GAAG,CAAC,KAAK,KAAK,KAAK,WAAW,iEAAiE,CAAC,CAAC;QACjG,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC3D,GAAG,CAAC,4EAA4E,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,GAAG,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACrD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,KAAK,KAAK,WAAW,2EAA2E,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,WAAW,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,sBAAsB,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;QAC3H,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,oCAAoC,CAAC,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,wDAAwD;AACxD,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC;AACxG,CAAC;AAED,+DAA+D;AAC/D,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,SAAgB,WAAW,CACzB,OAAe,EACf,WAAmB,EACnB,GAA2B,EAC3B,OAA6C;IAE7C,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzC,MAAM,KAAK,GAAa;QACtB,KAAK,OAAO,KAAK,WAAW,4FAA4F;QACxH,gBAAgB;QAChB,iBAAiB;QACjB,WAAW;QACX,WAAW,IAAI,EAAE;QACjB,OAAO;QACP,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,KAAK;QACL,qFAAqF;KACtF,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,qCAAqC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/H,CAAC;IACD,KAAK,CAAC,IAAI,CACR,KAAK,EACL,4BAA4B,EAC5B,cAAc,EACd,iCAAiC,IAAI,IAAI,EACzC,UAAU,CACX,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE,8CAA8C,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;IAClI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,sFAAsF;AAEtF,2GAA2G;AACpG,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,iBAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,GAAG,iBAAiB,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC;IACtH,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC;IACtB,MAAM,UAAU,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACrC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,oCAAoC,CAAC,CAAC;IACzG,IAAI,cAAkC,CAAC;IACvC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;QAAE,cAAc,GAAG,CAAC,CAAC;SAClC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,iBAAQ,CAAC,qDAAqD,UAAU,IAAI,CAAC,CAAC;QAC3H,cAAc,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAA,iBAAO,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAE/B,kDAAkD;IAClD,IAAI,EAAE,GAAG,GAAG,CAAC;IACb,IAAI,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAsD,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAClH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,iBAAQ,CAAC,kCAAkC,GAAG,oBAAoB,CAAC,CAAC;QAC1F,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;IAChB,CAAC;IAED,IAAI,GAAyG,CAAC;IAC9G,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,gBAAgB,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,GAAG,oBAAoB,CAAC,CAAC;QACvH,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,CAAC,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IACzG,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAA,oBAAQ,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;IACnK,MAAM,OAAO,GAAG,EAAE,eAAe,EAAE,GAAG,CAAC,SAAS,EAAE,mBAAmB,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;IAC3F,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAA,uBAAa,EAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACrJ,CAAC;SAAM,CAAC;QACN,mFAAmF;QACnF,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAAC,KAAK,CAAC,CAAC,CAAC,IAAA,mBAAO,EAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE;YACxH,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,gBAAgB,GAAG,CAAC,EAAE,qBAAqB;SACrD,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,yBAAyB,GAAG,CAAC,SAAS,eAAe,IAAI,eAAe,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,0BAA0B,CAAC;IAC/C,IAAI,cAAc,KAAK,CAAC,IAAI,OAAO,KAAK,IAAI;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;SACxG,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,2CAA2C,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;;QAC3H,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,4GAA4G,CAAC,CAAC;IAC9H,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/referrals.d.ts

@@ -0,0 +1,69 @@
+import { type ParsedArgs } from '../args';
+import type { RunContext } from '../context';
+/**
+ * `atlas referrals connect | backfill | resync | status`: referral attribution from the
+ * terminal.
+ *
+ * `connect --provider referalli` is bring-your-own-key: the Referalli merchant
+ * key is used for one call (it creates the Atlas connection on Referalli) and
+ * is never stored or printed. The connection id and secret Referalli returns
+ * go straight onto the instance; the secret is never printed either.
+ */
+/** The Referalli API version pinned on every call. */
+export declare const REFERALLI_VERSION = "2026-10-21";
+interface PingRead {
+    ok?: boolean;
+    org_name?: string | null;
+    program_name?: string | null;
+    program_id?: string | null;
+    auto_enroll_users?: boolean | null;
+    server_time?: string | number | null;
+    clock_skew_ms?: number | null;
+}
+interface TestRead {
+    ok: boolean;
+    http_status?: number | null;
+    latency_ms?: number | null;
+    error?: {
+        code: string;
+        message: string;
+    } | null;
+    ping?: PingRead | null;
+}
+/** Platform clock minus ours, in ms, from a ping. */
+export declare function pingSkewMs(ping: PingRead, receivedAt: number, latencyMs?: number | null): number | null;
+/** Lines describing a connection test (a ping where the provider supports it). */
+export declare function describeTestLines(test: TestRead, receivedAt: number): string[];
+/** A `customerRef,code` CSV → map; throws on a bad line. A header row is skipped. */
+export declare function parseCodeCsv(text: string, flag?: string): Record<string, string>;
+/** The exact origins of an instance's app: its allowed origins (no wildcards) and its Frontend API host. */
+export declare function appOrigins(instance: {
+    allowed_origins?: unknown[];
+    frontend_api_host?: string | null;
+}): string[];
+/** The Referalli topics two-way sync subscribes to (changes to a referral after sign-up). */
+export declare const REFERALLI_SYNC_TOPICS: readonly ["referral.created", "referral.held", "referral.paused", "referral.resumed", "referral.approved", "referral.voided", "referral.reassigned"];
+/**
+ * Whether the merchant key reaches live or test data: the org's `livemode`,
+ * else the key prefix (rk_test_ = test; rk_live_ and older rk_ keys = live).
+ * `known` is false when Referalli reports no mode (no test mode there).
+ */
+export declare function referalliKeyMode(ctx: RunContext, input: {
+    baseUrl: string;
+    key: string;
+}): Promise<{
+    live: boolean;
+    known: boolean;
+    org: Record<string, unknown> | null;
+}>;
+/** A Referalli list answer: a plain array (API version 2026-10-21) or a `{ data: [...] }` page. */
+export declare function referalliList(body: unknown): Record<string, unknown>[];
+/** Referalli's public tracked link for a code: `{host}/go/{trackingToken}/{code}`, on the org's link domain once it is active. */
+export declare function referalliLinkTemplate(baseUrl: string, trackingToken: string, branding: Record<string, unknown> | null): string;
+/** The `programIds` a Referalli webhook endpoint is limited to: null or [] means every program in the organization. */
+export declare function webhookScope(endpoint: Record<string, unknown> | null): {
+    scope: 'program' | 'all_programs' | 'unknown';
+    program_ids: string[] | null;
+};
+export declare function referrals(ctx: RunContext, args: ParsedArgs): Promise<number>;
+export {};