@cotal-ai/cli 0.27.0 → 0.28.0-hack-20260823204333

package/dist/commands/meshes-add.d.ts

@@ -1,6 +1,6 @@
 import { type SpaceAuth } from "@cotal-ai/core";
-import { type JoinTarget } from "../lib/join-target.js";
-import { type MeshEntry, type MeshTarget, type PreflightFailure } from "@cotal-ai/workspace";
+import { type DialPolicy, type JoinTarget } from "../lib/join-target.js";
+import { type MeshEntry, type MeshTarget, type PreflightFailure, type UserAuthInfo } from "@cotal-ai/workspace";
 /**
  * The rules behind `cotal meshes add`, as decisions rather than side effects.
  *
@@ -38,24 +38,38 @@ export declare function checkServer(raw: string): Check<string>;
  * Registering a mesh is how a machine joins a broker it does not run, and every later command then
  * dials that address with an agent credential in the CONNECT line. NATS sends the initial INFO in
  * plaintext and unauthenticated, so an on-path attacker forges one that does not set
- * `tls_required` and reads the credential; the client side is the only fence, and this build has
- * no client-TLS surface yet. So the address itself is the gate. See {@link classifyJoinTarget} for
- * the ranges and for why hostnames are refused even when they resolve somewhere permitted.
+ * `tls_required` and reads the credential; the client side is the only fence. The address class
+ * and the RECORDED TLS INTENT together are the gate: see {@link classifyJoinTarget} for the
+ * ranges, why hostnames need required TLS, and why RFC1918 is refused in both modes.
+ *
+ * `policy.tlsRequired` is the strictness this registration will record — sourced from `--tls` or
+ * a `tls://` scheme ({@link tlsIntent}) — and it is what the dial will ENFORCE, because the
+ * candidate target and the written record carry the same value and preflight requires the
+ * handshake off it.
  *
  * This is a SAFETY rule, not a liveness check, which is why it sits with {@link checkServer} above
  * the `--force` branch rather than inside it. `--force` exists to register a mesh that is *down*
  * right now; it must not double as permission to ship credentials across an untrusted network,
  * where there is nothing to verify later and no error to come back and fix.
  */
-export declare function checkDialPolicy(server: string, allowUnencryptedOverlay?: boolean): Check<JoinTarget>;
+export declare function checkDialPolicy(server: string, policy: DialPolicy): Check<JoinTarget>;
+/** The TLS intent this registration records, from its two sources: the explicit `--tls` flag, or
+ *  a `tls://` scheme. The scheme is typed intent — and today nats.js connects PLAINTEXT to
+ *  `tls://host` with empty options, so honoring it here is what converts typed-but-unenforced
+ *  intent into enforcement: the record carries `tlsRequired: true`, and every dial resolved
+ *  through it requires the handshake rather than tolerating plaintext. */
+export declare function tlsIntent(server: string, tlsFlag: boolean): boolean;
 /** Where this mesh's local trust + personas live. An explicit path must be an existing directory
  *  (the record's whole job is to point at `.cotal/auth` and `.cotal/agents` under it). With no
  *  flag, the nearest genuine project up-tree — and `findCotalRoot` returns its STARTING directory
  *  when it finds none, so the inferred case must prove the `.cotal` is really there. */
 export declare function checkRoot(flag: string | undefined, cwd: string): Check<string>;
 /** The recorded auth mode: what the operator said, or what `--root` proves. A root holding this
- *  space's account record means auth; anything else is an open broker. */
-export declare function checkMode(space: string, root: string, accounts: string[], flag: string | undefined): Check<MeshEntry["mode"]>;
+ *  space's account record means auth; anything else is an open broker. `--mode user` is permitted
+ *  IFF the pinned trust was SUPPLIED (`userTrustSupplied`) — the old blanket refusal reasoned
+ *  that IdP pins must be established, never guessed, and supplying them (a bundle exported where
+ *  the mesh runs, or a confirmed HTTPS discovery document) satisfies exactly that reasoning. */
+export declare function checkMode(space: string, root: string, accounts: string[], flag: string | undefined, userTrustSupplied?: boolean): Check<MeshEntry["mode"]>;
 /** For an AUTH registration the root must yield trust that actually COMPOSES. An account record on
  *  disk only proves the space was known here: `loadSpaceAuth` still returns undefined when the
  *  broker record or the signing material is missing, and recording that as `auth` produces a record
@@ -68,11 +82,63 @@ export declare function checkTrust(mode: MeshEntry["mode"], root: string, space:
  *  promises JWT/ACL protection that is not there. An auth broker refuses a bare connect; an open
  *  one lets us straight in. */
 export declare function probeEnforcement(server: string): Promise<"auth" | "open" | "unreachable">;
-/** The claimed mode must match what the broker actually enforces, in both directions. */
+/** The claimed mode must match what the broker actually enforces, in both directions. The USER
+ *  arm reads the refusal as the evidence: a user-mode target has no probe credential by design,
+ *  so a credless probe against a user-auth broker reporting auth-required IS the pass — the one
+ *  fact a bare connect can prove about a broker whose admission runs through the callout. */
 export declare function checkEnforcement(mode: MeshEntry["mode"], enforces: "auth" | "open" | "unreachable", server: string, space: string, root: string): Check<void>;
+/** What a remote user-auth registration supplies: the pins nothing on this machine could derive.
+ *  Exported where the mesh runs; carried by `--user-auth-file`, or served at the space's
+ *  `/.well-known/cotal-mesh` for `--from`. */
+export interface UserBundle {
+    space: string;
+    server: string;
+    tlsRequired: boolean;
+    userAuth: UserAuthInfo;
+    /** The sentinel creds blob. IN THE BUNDLE ONLY — registration lands it in a 0600 file under
+     *  the entry's root and records the PATH; the registry document never carries the blob. */
+    sentinelCreds: string;
+}
+/** Validate a user-auth bundle, fail-loud on every missing pin. The `userAuth` arm goes through
+ *  {@link assertUserAuthInfo} — the same boundary every provider blob crosses — and additionally
+ *  requires the pinned exchange URL: for a remote entry the endpoints are a trust position, not a
+ *  convenience, because no local `up` exists to re-derive them. */
+export declare function checkUserBundle(raw: string): Check<UserBundle>;
+/**
+ * Fetch that CANNOT be walked off HTTPS.
+ *
+ * `fetch` follows redirects by default and will happily follow `https://` → `http://`, so a
+ * 302 from anyone on the path turns a pinned, encrypted fetch into a plaintext one — and the
+ * document being fetched IS the trust being adopted. `redirect: "manual"` stops the hop here;
+ * a redirect is then reported as the refusal it is, rather than silently followed.
+ *
+ * Loopback `http://` stays usable for tests and for an exchange on this machine (nothing leaves
+ * the box), which is also what keeps the suites honest without a TLS fixture. Everything else
+ * must be `https:`.
+ */
+export declare function assertPinnedFetchUrl(u: URL, what: string): string | undefined;
+/** The pinned-fetch policy's verdict for ONE url, as data — so a suite can assert WHY a fetch was
+ *  refused rather than only that something failed. A cert error, a timeout and a refused redirect
+ *  are all "it did not work"; only this distinguishes them. Test seam, no production caller. */
+export declare function pinnedFetchProbe(target: string): Promise<{
+    refused: boolean;
+    message: string;
+}>;
+/** The user arm of trust composition: the pinned exchange must ANSWER, and answer as itself.
+ *  `/health` must report the pinned issuer (a base that answers with a foreign issuer is a
+ *  different authority, however reachable) and `/jwks` must serve a non-empty key set (the
+ *  verification material the pins promise). Nothing here trusts the response beyond consistency
+ *  with the pins the operator supplied. */
+export declare function verifyUserExchange(base: string, issuer: string): Promise<Check<void>>;
+/** Land the sentinel and write the remote user entry — ONE writer for both front ends, so the
+ *  wizard cannot drift from the flag form on what a remote record looks like. The sentinel blob
+ *  goes into a 0600 file under the entry's own root (its space-scoped user-auth state dir) and
+ *  the record carries the PATH: the registry document is echoed by `cotal meshes` and `status`,
+ *  and secret material must never ride a file that gets printed. */
+export declare function persistRemoteUserEntry(space: string, server: string, root: string, bundle: UserBundle, tlsRequired: boolean, overlayConsent: boolean): ReturnType<typeof writeRecord>;
 /** The target this registration would resolve to. `flag-server` is the source that can never
  *  classify as a prune — nothing is recorded yet, so no entry may be blamed for a failure. */
-export declare function candidateTarget(space: string, server: string, root: string, mode: MeshEntry["mode"], auth: SpaceAuth | undefined): MeshTarget;
+export declare function candidateTarget(space: string, server: string, root: string, mode: MeshEntry["mode"], auth: SpaceAuth | undefined, tlsRequired: boolean): MeshTarget;
 /** The registration-time wording for a failed probe. Deliberately NOT the shared preflight copy:
  *  that speaks to a mesh already in the registry ("stale entry", "re-run `cotal up`"), and here
  *  nothing is recorded yet — the operator is being told what to fix in the command they just ran. */

package/dist/commands/meshes-add.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-add.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAYL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AAEH,uGAAuG;AACvG,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAiB/E;;kEAEkE;AAClE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAgBtD;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,uBAAuB,UAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAiBlG;AAED;;;wFAGwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAW9E;AAED;0EAC0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAY7H;AAED;;;gFAGgF;AAChF,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAM7G;AAOD;;;;;+BAK+B;AAC/B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,CAI/F;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAM7J;AAED;8FAC8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,CA+B7I;AAED;;qGAEqG;AACrG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAehH;AAED;kCACkC;AAClC,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAG3E;AAED;8FAC8F;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAS/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAM1D"}
+{"version":3,"file":"meshes-add.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoD,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAClG,OAAO,EAAsC,KAAK,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAC7G,OAAO,EAcL,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;GASG;AAEH,uGAAuG;AACvG,MAAM,MAAM,KAAK,CAAC,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAiB/E;;kEAEkE;AAClE,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAM3C;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAgBtD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,CAMrF;AAED;;;;0EAI0E;AAC1E,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAUnE;AAED;;;wFAGwF;AACxF,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAW9E;AAED;;;;gGAIgG;AAChG,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,iBAAiB,UAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAUxJ;AAED;;;gFAGgF;AAChF,wBAAgB,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC,CAM7G;AAOD;;;;;+BAK+B;AAC/B,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,GAAG,aAAa,CAAC,CAI/F;AAED;;;6FAG6F;AAC7F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAU7J;AAID;;8CAE8C;AAC9C,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,YAAY,CAAC;IACvB;+FAC2F;IAC3F,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;mEAGmE;AACnE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC,CAsB9D;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAiB7E;AAED;;gGAEgG;AAChG,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAOrG;AAeD;;;;2CAI2C;AAC3C,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAkC3F;AAED;;;;oEAIoE;AACpE,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,UAAU,EAClB,WAAW,EAAE,OAAO,EACpB,cAAc,EAAE,OAAO,GACtB,UAAU,CAAC,OAAO,WAAW,CAAC,CAgBhC;AAED;8FAC8F;AAC9F,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,GAAG,SAAS,EAAE,WAAW,EAAE,OAAO,GAAG,UAAU,CAgBnK;AAED;;qGAEqG;AACrG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAehH;AAED;kCACkC;AAClC,wBAAsB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAG3E;AAED;8FAC8F;AAC9F,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,GAAG;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAS/F;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAM1D"}

package/dist/commands/meshes-add.js

@@ -1,8 +1,8 @@
 import { statSync } from "node:fs";
 import { join, resolve } from "node:path";
-import { probeConnect } from "@cotal-ai/core";
-import { classifyJoinTarget } from "../lib/join-target.js";
-import { authDir, findCotalRoot, findMesh, getCurrent, homeCotalDir, listSpaceAccounts, loadSpaceAuth, personaDir, preflightTarget, recordMesh, setCurrent, } from "@cotal-ai/workspace";
+import { mkSecretDir, probeConnect, writeSecretFileAtomic } from "@cotal-ai/core";
+import { classifyJoinTarget, isLoopbackHost } from "../lib/join-target.js";
+import { authDir, findCotalRoot, findMesh, getCurrent, homeCotalDir, listSpaceAccounts, loadSpaceAuth, assertUserAuthInfo, personaDir, preflightTarget, recordMesh, setCurrent, userAuthStateDir, } from "@cotal-ai/workspace";
 const bad = (message) => ({ ok: false, message });
 /** The cost of the copy every "copy the mesh's auth here" recovery asks the operator to make.
  *
@@ -60,34 +60,46 @@ export function checkServer(raw) {
  * Registering a mesh is how a machine joins a broker it does not run, and every later command then
  * dials that address with an agent credential in the CONNECT line. NATS sends the initial INFO in
  * plaintext and unauthenticated, so an on-path attacker forges one that does not set
- * `tls_required` and reads the credential; the client side is the only fence, and this build has
- * no client-TLS surface yet. So the address itself is the gate. See {@link classifyJoinTarget} for
- * the ranges and for why hostnames are refused even when they resolve somewhere permitted.
+ * `tls_required` and reads the credential; the client side is the only fence. The address class
+ * and the RECORDED TLS INTENT together are the gate: see {@link classifyJoinTarget} for the
+ * ranges, why hostnames need required TLS, and why RFC1918 is refused in both modes.
+ *
+ * `policy.tlsRequired` is the strictness this registration will record — sourced from `--tls` or
+ * a `tls://` scheme ({@link tlsIntent}) — and it is what the dial will ENFORCE, because the
+ * candidate target and the written record carry the same value and preflight requires the
+ * handshake off it.
  *
  * This is a SAFETY rule, not a liveness check, which is why it sits with {@link checkServer} above
  * the `--force` branch rather than inside it. `--force` exists to register a mesh that is *down*
  * right now; it must not double as permission to ship credentials across an untrusted network,
  * where there is nothing to verify later and no error to come back and fix.
  */
-export function checkDialPolicy(server, allowUnencryptedOverlay = false) {
+export function checkDialPolicy(server, policy) {
     try {
-        // WHEN THE RECORD CAN CARRY TLS INTENT, THIS LINE CHANGES AND THIS COMMENT GOES.
-        // `tlsRequired` is a property of the connection this registration will produce, and no field
-        // records it yet; it arrives with the work that teaches the broker to serve TLS. Passing a
-        // hardcoded `false` is honest rather than lazy: today no dial can require TLS.
-        //
-        // What that means CONCRETELY: public addresses, ordinary private ranges and hostnames are
-        // refused outright. An overlay literal is refused TOO unless the operator passed the explicit
-        // opt-in, because a printed warning is not a fence — stderr is not read by scripts, and the
-        // warning was never persisted, so nothing repeated it at the dials that followed. With the
-        // opt-in it is permitted and returns a residual, which the caller both prints AND records as
-        // consent. When the TLS field exists this passes the record's real intent and the opt-in goes.
-        return good(classifyJoinTarget(server, { tlsRequired: false, allowUnencryptedOverlay }));
+        return good(classifyJoinTarget(server, policy));
     }
     catch (e) {
         return bad(`✗ ${e.message}`);
     }
 }
+/** The TLS intent this registration records, from its two sources: the explicit `--tls` flag, or
+ *  a `tls://` scheme. The scheme is typed intent — and today nats.js connects PLAINTEXT to
+ *  `tls://host` with empty options, so honoring it here is what converts typed-but-unenforced
+ *  intent into enforcement: the record carries `tlsRequired: true`, and every dial resolved
+ *  through it requires the handshake rather than tolerating plaintext. */
+export function tlsIntent(server, tlsFlag) {
+    if (tlsFlag)
+        return true;
+    try {
+        const p = new URL(server).protocol;
+        // `wss:` is typed intent the same way `tls:` is - the websocket transport performs the TLS
+        // handshake itself, so recording it strict is stating what the dial already enforces.
+        return p === "tls:" || p === "wss:";
+    }
+    catch {
+        return false; // checkServer refuses the malformed URL; this never decides anything for it
+    }
+}
 /** Where this mesh's local trust + personas live. An explicit path must be an existing directory
  *  (the record's whole job is to point at `.cotal/auth` and `.cotal/agents` under it). With no
  *  flag, the nearest genuine project up-tree — and `findCotalRoot` returns its STARTING directory
@@ -105,15 +117,17 @@ export function checkRoot(flag, cwd) {
     return good(root);
 }
 /** The recorded auth mode: what the operator said, or what `--root` proves. A root holding this
- *  space's account record means auth; anything else is an open broker. */
-export function checkMode(space, root, accounts, flag) {
+ *  space's account record means auth; anything else is an open broker. `--mode user` is permitted
+ *  IFF the pinned trust was SUPPLIED (`userTrustSupplied`) — the old blanket refusal reasoned
+ *  that IdP pins must be established, never guessed, and supplying them (a bundle exported where
+ *  the mesh runs, or a confirmed HTTPS discovery document) satisfies exactly that reasoning. */
+export function checkMode(space, root, accounts, flag, userTrustSupplied = false) {
     if (flag !== undefined && flag !== "auth" && flag !== "open" && flag !== "user")
-        return bad(`✗ --mode must be auth or open (got "${flag}")`);
-    // A user-auth mesh is registered by the login/exchange trust it was configured with — an issuer,
-    // an audience and an IdP URL pinned at `cotal up --user-auth`, not derivable from a broker URL.
-    // Guessing them would be inventing trust.
+        return bad(`✗ --mode must be auth, open or user (got "${flag}")`);
+    if (flag === "user" && !userTrustSupplied)
+        return bad(`✗ --mode user needs its pinned trust SUPPLIED, never guessed - a user-auth space carries IdP pins (issuer, audience, login URL) established where the mesh runs. Pass --user-auth-file <bundle.json> exported there, or --from <https://…/.well-known/cotal-mesh> to fetch, review and confirm them`);
     if (flag === "user")
-        return bad(`✗ --mode user cannot be registered by hand - a user-auth space carries pinned IdP trust (issuer, audience, login URL) that only \`cotal up --user-auth\` establishes, in the root where its broker runs`);
+        return good("user");
     const mode = flag ?? (accounts.includes(space) ? "auth" : "open");
     if (mode === "auth" && !accounts.includes(space))
         return bad(`✗ --mode auth needs "${space}"'s trust material under ${authDir(root)}${accounts.length ? ` (it holds "${accounts.join('", "')}")` : " (it holds none)"} - copy the mesh's account + creds there, point --root at where they already are, or register it --mode open` + CA_COST);
@@ -147,43 +161,194 @@ export async function probeEnforcement(server) {
         return "open";
     return bare.reason === "auth-required" ? "auth" : "unreachable";
 }
-/** The claimed mode must match what the broker actually enforces, in both directions. */
+/** The claimed mode must match what the broker actually enforces, in both directions. The USER
+ *  arm reads the refusal as the evidence: a user-mode target has no probe credential by design,
+ *  so a credless probe against a user-auth broker reporting auth-required IS the pass — the one
+ *  fact a bare connect can prove about a broker whose admission runs through the callout. */
 export function checkEnforcement(mode, enforces, server, space, root) {
     if (mode === "auth" && enforces === "open")
         return bad(`✗ the broker at ${server} accepts unauthenticated connections, so it cannot be registered as an auth mesh - it enforces no credentials; register it \`--mode open\`, or point --server at the authenticated broker for "${space}"`);
     if (mode === "open" && enforces === "auth")
         return bad(`✗ the broker at ${server} requires auth, so it cannot be registered as an open mesh - copy that mesh's account + creds under ${authDir(root)} and re-run with --mode auth` + CA_COST);
+    if (mode === "user" && enforces === "open")
+        return bad(`✗ the broker at ${server} accepts unauthenticated connections, so it cannot be registered as a user-auth mesh - user auth means the broker REFUSES a bare connect and admits only exchanged bearers; check that the bundle's server points at the user-auth broker for "${space}"`);
+    if (mode === "user" && enforces === "unreachable")
+        return bad(`✗ no broker answered at ${server} - a user-auth registration is verified by the broker's own auth-required refusal, so it cannot be recorded while the broker is unreachable`);
+    return good(undefined);
+}
+/** Validate a user-auth bundle, fail-loud on every missing pin. The `userAuth` arm goes through
+ *  {@link assertUserAuthInfo} — the same boundary every provider blob crosses — and additionally
+ *  requires the pinned exchange URL: for a remote entry the endpoints are a trust position, not a
+ *  convenience, because no local `up` exists to re-derive them. */
+export function checkUserBundle(raw) {
+    let doc;
+    try {
+        doc = JSON.parse(raw);
+    }
+    catch {
+        return bad("✗ the user-auth bundle is not JSON - export it where the mesh runs and pass the file unmodified");
+    }
+    if (doc === null || typeof doc !== "object")
+        return bad("✗ the user-auth bundle must be a JSON object");
+    if (typeof doc.space !== "string" || !doc.space)
+        return bad("✗ the user-auth bundle names no space");
+    if (typeof doc.server !== "string" || !doc.server)
+        return bad("✗ the user-auth bundle names no broker server");
+    if (typeof doc.tlsRequired !== "boolean")
+        return bad("✗ the user-auth bundle must state tlsRequired explicitly (true or false) - transport strictness is part of what the export pins");
+    let userAuth;
+    try {
+        userAuth = assertUserAuthInfo(doc.userAuth);
+    }
+    catch (e) {
+        return bad(`✗ user-auth bundle: ${e.message}`);
+    }
+    if (!userAuth.endpoints?.url)
+        return bad("✗ the user-auth bundle pins no exchange endpoint (userAuth.endpoints.url) - for a remote registration that URL is trust, and it must come from the export, never be guessed");
+    if (typeof doc.sentinelCreds !== "string" || !doc.sentinelCreds)
+        return bad("✗ the user-auth bundle carries no sentinelCreds - the sentinel identity is part of the export");
+    return good({ space: doc.space, server: doc.server, tlsRequired: doc.tlsRequired, userAuth, sentinelCreds: doc.sentinelCreds });
+}
+/** Budget for the exchange trust probe — same posture as the mode probe above: run once, at
+ *  registration, where patience is cheaper than a wrong record. */
+const EXCHANGE_PROBE_TIMEOUT_MS = 5_000;
+/**
+ * Fetch that CANNOT be walked off HTTPS.
+ *
+ * `fetch` follows redirects by default and will happily follow `https://` → `http://`, so a
+ * 302 from anyone on the path turns a pinned, encrypted fetch into a plaintext one — and the
+ * document being fetched IS the trust being adopted. `redirect: "manual"` stops the hop here;
+ * a redirect is then reported as the refusal it is, rather than silently followed.
+ *
+ * Loopback `http://` stays usable for tests and for an exchange on this machine (nothing leaves
+ * the box), which is also what keeps the suites honest without a TLS fixture. Everything else
+ * must be `https:`.
+ */
+export function assertPinnedFetchUrl(u, what) {
+    if (u.protocol === "https:")
+        return undefined;
+    // The loopback exception is decided by PARSING the host as an address, never by how the text
+    // begins: `/^127\./` also matched `127.evil.com`, `127.0.0.1.nip.io` and `127.com`, which anyone
+    // can register, and it missed real spellings like `0177.0.0.1`. `isLoopbackHost` is the one
+    // authority for the question, canonicalization included. A name that does not parse as an IP is
+    // a NAME and gets no exception, however it starts — `localhost` included, since a hosts entry or
+    // a poisoned lookup can point it anywhere.
+    if (u.protocol === "http:" && isLoopbackHost(u.hostname))
+        return undefined;
+    // Name the ACTUAL rule. "must be https://" alone misleads the developer whose local flow used
+    // http://localhost: it blames the scheme, when the same scheme on 127.0.0.1 would have passed.
+    return (`✗ ${what} must be https:// (got ${u.protocol}//) - the pins this registration adopts cannot be fetched over a channel the network can rewrite` +
+        (u.protocol === "http:"
+            ? `. Plain http is accepted only for a loopback LITERAL (127.0.0.1, ::1), where nothing leaves this machine - "${u.hostname}" is a name, and a hosts entry or a poisoned lookup could point it anywhere, so use the literal`
+            : ""));
+}
+/** The pinned-fetch policy's verdict for ONE url, as data — so a suite can assert WHY a fetch was
+ *  refused rather than only that something failed. A cert error, a timeout and a refused redirect
+ *  are all "it did not work"; only this distinguishes them. Test seam, no production caller. */
+export async function pinnedFetchProbe(target) {
+    try {
+        await pinnedFetch(target, "the pinned exchange");
+        return { refused: false, message: "" };
+    }
+    catch (e) {
+        return { refused: true, message: e.message };
+    }
+}
+/** One hop, no downgrade, no redirect-following. */
+async function pinnedFetch(target, what) {
+    const u = new URL(target);
+    const bad = assertPinnedFetchUrl(u, what);
+    if (bad)
+        throw new Error(bad);
+    const res = await fetch(u, { redirect: "manual", signal: AbortSignal.timeout(EXCHANGE_PROBE_TIMEOUT_MS) });
+    if (res.status >= 300 && res.status < 400)
+        throw new Error(`✗ ${what} answered ${res.status} (a redirect to ${JSON.stringify(res.headers.get("location") ?? "")}) - a redirect can move a pinned fetch onto plaintext or onto another host, so it is refused rather than followed; publish the document at the pinned URL itself`);
+    return res;
+}
+/** The user arm of trust composition: the pinned exchange must ANSWER, and answer as itself.
+ *  `/health` must report the pinned issuer (a base that answers with a foreign issuer is a
+ *  different authority, however reachable) and `/jwks` must serve a non-empty key set (the
+ *  verification material the pins promise). Nothing here trusts the response beyond consistency
+ *  with the pins the operator supplied. */
+export async function verifyUserExchange(base, issuer) {
+    const url = (p) => new URL(p, base.endsWith("/") ? base : `${base}/`).toString();
+    // The exchange base is a PIN. It must be an https URL (or loopback), and neither probe below
+    // may be redirected off it — otherwise the "pinned" exchange is whatever a 302 chooses.
+    try {
+        const badBase = assertPinnedFetchUrl(new URL(base), `the pinned exchange at ${base}`);
+        if (badBase)
+            return bad(badBase);
+    }
+    catch {
+        return bad(`✗ the bundle's pinned exchange endpoint ${JSON.stringify(base)} is not a URL`);
+    }
+    let health;
+    try {
+        const res = await pinnedFetch(url("health"), `the pinned exchange at ${base}`);
+        if (!res.ok)
+            return bad(`✗ the pinned exchange at ${base} answered /health with ${res.status} - it is not serving as the bundle promises`);
+        health = (await res.json());
+    }
+    catch (e) {
+        const m = e.message;
+        if (m.startsWith("✗"))
+            return bad(m);
+        return bad(`✗ the pinned exchange at ${base} did not answer /health (${m}) - the bundle's endpoint must be reachable to register against it`);
+    }
+    if (health.issuer !== issuer)
+        return bad(`✗ the exchange at ${base} answers for issuer ${JSON.stringify(health.issuer)} but the bundle pins ${JSON.stringify(issuer)} - a different issuer is a different authority; nothing was registered`);
+    try {
+        const res = await pinnedFetch(url("jwks"), `the pinned exchange at ${base}`);
+        if (!res.ok)
+            return bad(`✗ the pinned exchange at ${base} answered /jwks with ${res.status}`);
+        const jwks = (await res.json());
+        if (!Array.isArray(jwks.keys) || jwks.keys.length === 0)
+            return bad(`✗ the pinned exchange at ${base} serves an empty /jwks - it holds no verification keys for the trust the bundle pins`);
+    }
+    catch (e) {
+        const m = e.message;
+        if (m.startsWith("✗"))
+            return bad(m);
+        return bad(`✗ the pinned exchange at ${base} did not answer /jwks (${m})`);
+    }
     return good(undefined);
 }
+/** Land the sentinel and write the remote user entry — ONE writer for both front ends, so the
+ *  wizard cannot drift from the flag form on what a remote record looks like. The sentinel blob
+ *  goes into a 0600 file under the entry's own root (its space-scoped user-auth state dir) and
+ *  the record carries the PATH: the registry document is echoed by `cotal meshes` and `status`,
+ *  and secret material must never ride a file that gets printed. */
+export function persistRemoteUserEntry(space, server, root, bundle, tlsRequired, overlayConsent) {
+    const dir = userAuthStateDir(root, space);
+    mkSecretDir(dir);
+    const sentinelCredsPath = join(dir, "sentinel.creds");
+    writeSecretFileAtomic(sentinelCredsPath, bundle.sentinelCreds);
+    return writeRecord({
+        space,
+        server,
+        root,
+        mode: "user",
+        origin: "manual",
+        ...(tlsRequired ? { tlsRequired: true } : {}),
+        ...(overlayConsent ? { unencryptedOverlay: true } : {}),
+        userAuth: { ...bundle.userAuth, remote: true, sentinelCredsPath },
+        ts: new Date().toISOString(),
+    });
+}
 /** The target this registration would resolve to. `flag-server` is the source that can never
  *  classify as a prune — nothing is recorded yet, so no entry may be blamed for a failure. */
-export function candidateTarget(space, server, root, mode, auth) {
+export function candidateTarget(space, server, root, mode, auth, tlsRequired) {
     return {
         root,
         server,
         space,
         mode,
-        // A probe target for a registration that has not happened yet, so there is no recorded
-        // transport to honour and this stays non-strict. That reason stands on its own and is the
-        // whole justification.
-        //
-        // WHAT USED TO BE WRITTEN HERE WAS FALSE, and it is worth saying so rather than quietly
-        // deleting it. This comment claimed the scheme could not enforce because "`MeshEntry` cannot
-        // persist the intent" — a constraint removed three commits earlier by adding
-        // `MeshEntry.tlsRequired`. A dead premise was holding a live decision in place, and it is
-        // exactly why that field had no writers.
-        //
-        // The open question is now genuinely open: `tls://` is COSMETIC at the client (nats.js connects
-        // plaintext to `tls://host` with empty options; only the explicit `tls` option refuses), so an
-        // operator who types `tls://` today gets a record that resolves to a plaintext-tolerant client.
-        // Deriving `tlsRequired` from the scheme would make that typed intent real.
-        //
-        // It is deliberately NOT done in this change, for a reason that is true: it converts `meshes
-        // add tls://…` against a plaintext broker from a successful registration into a refusal. That
-        // is a behaviour change to this command's accept/refuse contract, it belongs with the dial-policy
-        // work being done in this file by another lane, and it is not one of the downgrades this branch
-        // exists to close. Tracked, owned, and not smuggled in beside them.
-        tlsRequired: false,
+        // The SAME source the dial policy read ({@link tlsIntent}) — the decision the old comment here
+        // reserved for the dial-policy work, now taken. A candidate that probed non-strict while the
+        // record it vouched for said strict would verify a connection the record's own dials refuse;
+        // carrying the real intent means `meshes add tls://…` against a plaintext broker is a REFUSAL
+        // at registration, not a surprise at the first spawn.
+        tlsRequired,
         ...(auth ? { auth } : {}),
         personaRoot: personaDir(root),
         source: "flag-server",

package/dist/commands/meshes-add.js.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-add.js","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAkB,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAmB,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EACL,OAAO,EACP,aAAa,EACb,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,UAAU,EACV,eAAe,EACf,UAAU,EACV,UAAU,GAIX,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAExE;;;;;;uDAMuD;AACvD,MAAM,OAAO,GACX,uGAAuG;IACvG,wGAAwG;IACxG,2DAA2D,CAAC;AAC9D,MAAM,IAAI,GAAG,CAAI,KAAQ,EAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9D;;kEAEkE;AAClE,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,OAAO,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,iEAAiE,CAAC,CAAC;IACjI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAC1B,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC,QAAQ,uGAAuG,CAAC,CAAC;IAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QACpB,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,uBAAuB,GAAG,KAAK;IAC7E,IAAI,CAAC;QACH,iFAAiF;QACjF,6FAA6F;QAC7F,2FAA2F;QAC3F,+EAA+E;QAC/E,EAAE;QACF,0FAA0F;QAC1F,8FAA8F;QAC9F,4FAA4F;QAC5F,2FAA2F;QAC3F,6FAA6F;QAC7F,+FAA+F;QAC/F,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC;IAC3F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;wFAGwF;AACxF,MAAM,UAAU,SAAS,CAAC,IAAwB,EAAE,GAAW;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,YAAY,GAAG,+FAA+F,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC,iKAAiK,CAAC,CAAC;IAChL,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;0EAC0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,QAAkB,EAAE,IAAwB;IACjG,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAC7E,OAAO,GAAG,CAAC,uCAAuC,IAAI,IAAI,CAAC,CAAC;IAC9D,iGAAiG;IACjG,gGAAgG;IAChG,0CAA0C;IAC1C,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,GAAG,CAAC,yMAAyM,CAAC,CAAC;IACxN,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,OAAO,GAAG,CAAC,wBAAwB,KAAK,4BAA4B,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,8GAA8G,GAAG,OAAO,CAAC,CAAC;IAC/R,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAuB,EAAE,IAAY,EAAE,KAAa;IAC7E,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,sKAAsK,GAAG,OAAO,CAAC,CAAC;AACrP,CAAC;AAED;;iEAEiE;AACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;+BAK+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAClE,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,IAAuB,EAAE,QAAyC,EAAE,MAAc,EAAE,KAAa,EAAE,IAAY;IAC9I,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,kMAAkM,KAAK,GAAG,CAAC,CAAC;IAClP,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,uGAAuG,OAAO,CAAC,IAAI,CAAC,8BAA8B,GAAG,OAAO,CAAC,CAAC;IACpM,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAuB,EAAE,IAA2B;IAC/H,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK;QACL,IAAI;QACJ,uFAAuF;QACvF,0FAA0F;QAC1F,uBAAuB;QACvB,EAAE;QACF,wFAAwF;QACxF,6FAA6F;QAC7F,6EAA6E;QAC7E,0FAA0F;QAC1F,yCAAyC;QACzC,EAAE;QACF,gGAAgG;QAChG,+FAA+F;QAC/F,gGAAgG;QAChG,4EAA4E;QAC5E,EAAE;QACF,6FAA6F;QAC7F,8FAA8F;QAC9F,kGAAkG;QAClG,gGAAgG;QAChG,oEAAoE;QACpE,WAAW,EAAE,KAAK;QAClB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED;;qGAEqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACtG,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,MAAM,8DAA8D,CAAC;QACzG,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB;YAC5B,OAAO,mBAAmB,MAAM,kCAAkC,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC;QACnL,KAAK,iBAAiB,CAAC;QACvB,KAAK,wBAAwB;YAC3B,OAAO,mBAAmB,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,uEAAuE,GAAG,OAAO,CAAC;QACvL,KAAK,YAAY;YACf,OAAO,0BAA0B,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC;QAC7I,KAAK,WAAW;YACd,OAAO,mBAAmB,MAAM,yKAAyK,CAAC;IAC9M,CAAC;AACH,CAAC;AAED;kCACkC;AAClC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,2BAA2B;IACzF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,oBAAqB,CAAW,CAAC,OAAO,2FAA2F,CAAC,CAAC;IACpK,CAAC;AACH,CAAC"}
+{"version":3,"file":"meshes-add.js","sourceRoot":"","sources":["../../src/commands/meshes-add.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,qBAAqB,EAAkB,MAAM,gBAAgB,CAAC;AAClG,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAoC,MAAM,uBAAuB,CAAC;AAC7G,OAAO,EACL,OAAO,EACP,aAAa,EACb,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,eAAe,EACf,UAAU,EACV,UAAU,EACV,gBAAgB,GAKjB,MAAM,qBAAqB,CAAC;AAgB7B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAExE;;;;;;uDAMuD;AACvD,MAAM,OAAO,GACX,uGAAuG;IACvG,wGAAwG;IACxG,2DAA2D,CAAC;AAC9D,MAAM,IAAI,GAAG,CAAI,KAAQ,EAAY,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAE9D;;kEAEkE;AAClE,MAAM,UAAU,KAAK,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,IAAI,CAAM,CAAC;IACX,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,+EAA+E,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxD,OAAO,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,iEAAiE,CAAC,CAAC;IACjI,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;QAC1B,OAAO,GAAG,CAAC,2CAA2C,CAAC,CAAC,QAAQ,uGAAuG,CAAC,CAAC;IAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI;QACpB,OAAO,GAAG,CAAC,mDAAmD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACzG,IAAI,CAAC,CAAC,CAAC,QAAQ;QAAE,OAAO,GAAG,CAAC,gFAAgF,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,MAAkB;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED;;;;0EAI0E;AAC1E,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,OAAgB;IACxD,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;QACnC,2FAA2F;QAC3F,sFAAsF;QACtF,OAAO,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,MAAM,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,4EAA4E;IAC5F,CAAC;AACH,CAAC;AAED;;;wFAGwF;AACxF,MAAM,UAAU,SAAS,CAAC,IAAwB,EAAE,GAAW;IAC7D,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,KAAK,CAAC,GAAG,CAAC;YACf,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,YAAY,GAAG,+FAA+F,CAAC,CAAC;IAC1H,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;QACrF,OAAO,GAAG,CAAC,iKAAiK,CAAC,CAAC;IAChL,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;;gGAIgG;AAChG,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,IAAY,EAAE,QAAkB,EAAE,IAAwB,EAAE,iBAAiB,GAAG,KAAK;IAC5H,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,MAAM;QAC7E,OAAO,GAAG,CAAC,6CAA6C,IAAI,IAAI,CAAC,CAAC;IACpE,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,iBAAiB;QACvC,OAAO,GAAG,CAAC,qSAAqS,CAAC,CAAC;IACpT,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC9C,OAAO,GAAG,CAAC,wBAAwB,KAAK,4BAA4B,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,8GAA8G,GAAG,OAAO,CAAC,CAAC;IAC/R,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAED;;;gFAGgF;AAChF,MAAM,UAAU,UAAU,CAAC,IAAuB,EAAE,IAAY,EAAE,KAAa;IAC7E,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,OAAO,IAAI;QACT,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACZ,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,sKAAsK,GAAG,OAAO,CAAC,CAAC;AACrP,CAAC;AAED;;iEAEiE;AACjE,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;;;+BAK+B;AAC/B,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC;IAC3B,OAAO,IAAI,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC;AAClE,CAAC;AAED;;;6FAG6F;AAC7F,MAAM,UAAU,gBAAgB,CAAC,IAAuB,EAAE,QAAyC,EAAE,MAAc,EAAE,KAAa,EAAE,IAAY;IAC9I,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,kMAAkM,KAAK,GAAG,CAAC,CAAC;IAClP,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,uGAAuG,OAAO,CAAC,IAAI,CAAC,8BAA8B,GAAG,OAAO,CAAC,CAAC;IACpM,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,MAAM;QACxC,OAAO,GAAG,CAAC,mBAAmB,MAAM,kPAAkP,KAAK,GAAG,CAAC,CAAC;IAClS,IAAI,IAAI,KAAK,MAAM,IAAI,QAAQ,KAAK,aAAa;QAC/C,OAAO,GAAG,CAAC,2BAA2B,MAAM,6IAA6I,CAAC,CAAC;IAC7L,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAiBD;;;mEAGmE;AACnE,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,GAAiD,CAAC;IACtD,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAU,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,iGAAiG,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACxG,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,KAAK;QAAE,OAAO,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACrG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC/G,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,iIAAiI,CAAC,CAAC;IACxL,IAAI,QAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,uBAAwB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG;QAC1B,OAAO,GAAG,CAAC,6KAA6K,CAAC,CAAC;IAC5L,IAAI,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa;QAC7D,OAAO,GAAG,CAAC,+FAA+F,CAAC,CAAC;IAC9G,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;AAClI,CAAC;AAED;mEACmE;AACnE,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAExC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAAC,CAAM,EAAE,IAAY;IACvD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,6FAA6F;IAC7F,iGAAiG;IACjG,4FAA4F;IAC5F,gGAAgG;IAChG,iGAAiG;IACjG,2CAA2C;IAC3C,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,IAAI,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3E,8FAA8F;IAC9F,+FAA+F;IAC/F,OAAO,CACL,KAAK,IAAI,0BAA0B,CAAC,CAAC,QAAQ,kGAAkG;QAC/I,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO;YACrB,CAAC,CAAC,+GAA+G,CAAC,CAAC,QAAQ,iGAAiG;YAC5N,CAAC,CAAC,EAAE,CAAC,CACR,CAAC;AACJ,CAAC;AAED;;gGAEgG;AAChG,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAc;IACnD,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,KAAK,UAAU,WAAW,CAAC,MAAc,EAAE,IAAY;IACrD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,oBAAoB,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;IAC3G,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG;QACvC,MAAM,IAAI,KAAK,CACb,KAAK,IAAI,aAAa,GAAG,CAAC,MAAM,mBAAmB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,kKAAkK,CACvQ,CAAC;IACJ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;2CAI2C;AAC3C,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAY,EAAE,MAAc;IACnE,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzF,6FAA6F;IAC7F,wFAAwF;IACxF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;QACtF,IAAI,OAAO;YAAE,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,2CAA2C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,MAAyC,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,4BAA4B,IAAI,0BAA0B,GAAG,CAAC,MAAM,6CAA6C,CAAC,CAAC;QAC3I,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAU,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAI,CAAW,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,4BAA4B,IAAI,4BAA4B,CAAC,oEAAoE,CAAC,CAAC;IAChJ,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM;QAC1B,OAAO,GAAG,CAAC,qBAAqB,IAAI,uBAAuB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,wEAAwE,CAAC,CAAC;IAClN,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,GAAG,CAAC,4BAA4B,IAAI,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAyB,CAAC;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YACrD,OAAO,GAAG,CAAC,4BAA4B,IAAI,sFAAsF,CAAC,CAAC;IACvI,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,GAAI,CAAW,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,4BAA4B,IAAI,0BAA0B,CAAC,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC;AACzB,CAAC;AAED;;;;oEAIoE;AACpE,MAAM,UAAU,sBAAsB,CACpC,KAAa,EACb,MAAc,EACd,IAAY,EACZ,MAAkB,EAClB,WAAoB,EACpB,cAAuB;IAEvB,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1C,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACtD,qBAAqB,CAAC,iBAAiB,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC/D,OAAO,WAAW,CAAC;QACjB,KAAK;QACL,MAAM;QACN,IAAI;QACJ,IAAI,EAAE,MAAM;QACZ,MAAM,EAAE,QAAQ;QAChB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE;QACjE,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAC7B,CAAC,CAAC;AACL,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc,EAAE,IAAY,EAAE,IAAuB,EAAE,IAA2B,EAAE,WAAoB;IACrJ,OAAO;QACL,IAAI;QACJ,MAAM;QACN,KAAK;QACL,IAAI;QACJ,+FAA+F;QAC/F,6FAA6F;QAC7F,6FAA6F;QAC7F,8FAA8F;QAC9F,sDAAsD;QACtD,WAAW;QACX,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzB,WAAW,EAAE,UAAU,CAAC,IAAI,CAAC;QAC7B,MAAM,EAAE,aAAa;KACtB,CAAC;AACJ,CAAC;AAED;;qGAEqG;AACrG,MAAM,UAAU,oBAAoB,CAAC,IAAsB,EAAE,KAAa,EAAE,MAAc,EAAE,IAAY;IACtG,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,aAAa;YAChB,OAAO,2BAA2B,MAAM,8DAA8D,CAAC;QACzG,KAAK,gBAAgB,CAAC;QACtB,KAAK,yBAAyB;YAC5B,OAAO,mBAAmB,MAAM,kCAAkC,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,iFAAiF,CAAC;QACnL,KAAK,iBAAiB,CAAC;QACvB,KAAK,wBAAwB;YAC3B,OAAO,mBAAmB,MAAM,qCAAqC,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,uEAAuE,GAAG,OAAO,CAAC;QACvL,KAAK,YAAY;YACf,OAAO,0BAA0B,KAAK,WAAW,OAAO,CAAC,IAAI,CAAC,4EAA4E,CAAC;QAC7I,KAAK,WAAW;YACd,OAAO,mBAAmB,MAAM,yKAAyK,CAAC;IAC9M,CAAC;AACH,CAAC;AAED;kCACkC;AAClC,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAkB;IACnD,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;8FAC8F;AAC9F,MAAM,UAAU,WAAW,CAAC,KAAgB;IAC1C,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,aAAa,GAAG,GAAG,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,2BAA2B;IACzF,UAAU,CAAC,KAAK,CAAC,CAAC;IAClB,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,oBAAqB,CAAW,CAAC,OAAO,2FAA2F,CAAC,CAAC;IACpK,CAAC;AACH,CAAC"}

package/dist/commands/meshes-wizard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meshes-wizard.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-wizard.ts"],"names":[],"mappings":"AAmBA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE;QAAE,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9E,OAAO,IAAI;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED;0EAC0E;AAC1E,wBAAgB,OAAO,IAAI,QAAQ,CAmBlC;AAED;;kCAEkC;AAClC,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;wCACwC;AACxC,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;oCACoC;AACpC,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkSzG"}
+{"version":3,"file":"meshes-wizard.d.ts","sourceRoot":"","sources":["../../src/commands/meshes-wizard.ts"],"names":[],"mappings":"AAwBA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;GASG;AACH,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,GAAG,EAAE;QAAE,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC9E,OAAO,IAAI;QAAE,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,GAAG,SAAS,KAAK,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjI,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE;YAAE,KAAK,EAAE,CAAC,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E;AAED;0EAC0E;AAC1E,wBAAgB,OAAO,IAAI,QAAQ,CAmBlC;AAED;;kCAEkC;AAClC,wBAAgB,SAAS,IAAI,OAAO,CAEnC;AAED;wCACwC;AACxC,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,8FAA8F;IAC9F,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED;oCACoC;AACpC,wBAAsB,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkVzG"}