@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/hub/index.d.ts

@@ -0,0 +1,99 @@
+/**
+ * mesh hub dev — one-command local Hub over a running dev-local stack (MESH-2275).
+ *
+ * Launches the CURRENT-CODE Hub (apps/hub api + ui from a mesh-platform
+ * checkout) pointed at an existing `mesh dev` session's stack, auto-assembling
+ * the env that used to be hand-set (the FUB-demo runbook §6 recipe):
+ *
+ *   HUB_TENANT / HUB_SCOPE_ENV / HUB_SCOPE_TENANTS   from the session's platform context
+ *   TEMPORAL_ADDRESS                                 from the session's tunnel (VPN or SSM)
+ *   AWS_*                                            from the session's scratch credential_process profile
+ *   DEV_USER_* / DEV_USER_TOKEN_URL                  from the session's injected dev identity +
+ *                                                    per-session token-server (MESH-2039)
+ *
+ * The `mesh dev` session already resolved all of these — its tmux session
+ * environment and state file (`$TMPDIR/mesh-dev-sessions/<name>.json`) are the
+ * source of truth; this command only reads them and never mutates the app
+ * session.
+ *
+ * Scoped-tenant enumeration is validated up front: HUB_SCOPE_ENV without a
+ * non-empty HUB_SCOPE_TENANTS makes the Hub API silently return zero
+ * registrations (apps/hub/api/src/lib/ssm/reader.ts), so that combination is
+ * a loud error here, never an empty Hub.
+ */
+import { Command } from "commander";
+import { type SessionState } from "../dev.js";
+/** tmux session the Hub runs in — fixed, one local Hub at a time. */
+export declare const HUB_SESSION = "mesh-hub-dev";
+export declare const DEFAULT_HUB_UI_PORT: number;
+export declare const DEFAULT_HUB_API_PORT = 3002;
+export interface DiscoveredSession {
+    name: string;
+    state: SessionState;
+}
+export declare function devSessionsDir(): string;
+/** All persisted `mesh dev` session states (unparseable files skipped). */
+export declare function listDevSessions(dir?: string): DiscoveredSession[];
+/**
+ * Pick the dev session to point the Hub at.
+ *
+ *   1. --session <name> wins (error if its state file is missing).
+ *   2. The session whose appRoot equals the cwd's app root (both sides come
+ *      from findAppRoot, so exact equality is the right comparison).
+ *   3. A sole running session.
+ *
+ * Ambiguity (multiple sessions, none matching cwd) is an error listing the
+ * candidates — never a silent guess.
+ */
+export declare function pickDevSession(sessions: DiscoveredSession[], opts: {
+    session?: string;
+    cwdAppRoot?: string | null;
+}): DiscoveredSession;
+/** Parse `tmux show-environment` output (`KEY=value` lines; `-KEY` = unset). */
+export declare function parseTmuxEnv(output: string): Record<string, string>;
+export declare function forwardedSessionVars(sessionEnv: Record<string, string>): Record<string, string>;
+export interface HubDevEnvOptions {
+    /** Comma-separated tenant override (--tenants). */
+    tenants?: string;
+    uiPort: number;
+    apiPort: number;
+}
+export interface AssembledHubEnv {
+    apiEnv: Record<string, string>;
+    uiEnv: Record<string, string>;
+    /** Human-readable scope summary for the launch banner. */
+    scope: {
+        hubTenant: string;
+        scopeEnv: string;
+        scopeTenants: string[];
+    };
+    temporalAddress: string;
+    warnings: string[];
+    /** Informational — things the command is handling itself, not user problems. */
+    notes: string[];
+}
+/**
+ * Assemble the Hub api/ui env from a discovered dev session. Throws loudly on
+ * the combinations that today produce a silently-empty Hub.
+ */
+export declare function assembleHubEnv(session: DiscoveredSession, sessionEnv: Record<string, string>, opts: HubDevEnvOptions): AssembledHubEnv;
+/**
+ * Locate the mesh-platform checkout the Hub runs from:
+ * --platform-dir → $MESH_PLATFORM_DIR → walk up from cwd (monorepo case).
+ *
+ * An invalid `--platform-dir` is fatal (the user named it explicitly), but a
+ * stale `MESH_PLATFORM_DIR` left over in the shell only warns and falls through
+ * to the cwd walk-up — otherwise it would hard-fail runs made from inside a
+ * perfectly good checkout.
+ */
+export declare function resolvePlatformDir(explicit: string | undefined, cwd: string, env?: Record<string, string | undefined>): string;
+/**
+ * Parse a port option, naming its source in the error. Without this a typo'd
+ * `--port` (or a stale non-numeric `MESH_HUB_DEV_PORT` left in the shell) becomes
+ * `NaN`, lands in the env file as `PORT=NaN`, and reaches `net.connect` — which
+ * throws a raw `ERR_SOCKET_BAD_PORT` instead of an actionable CLI error.
+ */
+export declare function parsePort(raw: string | undefined, fallback: number, source: string): number;
+export declare function redactEnv(env: Record<string, string>): Record<string, string>;
+export declare function registerHubCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/commands/hub/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/hub/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAuB,KAAK,YAAY,EAAE,MAAM,WAAW,CAAC;AAMnE,qEAAqE;AACrE,eAAO,MAAM,WAAW,iBAAiB,CAAC;AAO1C,eAAO,MAAM,mBAAmB,QAA2B,CAAC;AAC5D,eAAO,MAAM,oBAAoB,OAAO,CAAC;AAIzC,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,SAAmB,GAAG,iBAAiB,EAAE,CAiB3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,iBAAiB,EAAE,EAC7B,IAAI,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrD,iBAAiB,CA+BnB;AAID,gFAAgF;AAChF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASnE;AA4BD,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM/F;AAED,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,0DAA0D;IAC1D,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IACvE,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,gFAAgF;IAChF,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,iBAAiB,EAC1B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,IAAI,EAAE,gBAAgB,GACrB,eAAe,CAsFjB;AAYD;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,GAAG,EAAE,MAAM,EACX,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CA+BR;AAuCD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAS3F;AAMD,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAQ7E;AAgKD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe1D"}

package/dist/src/commands/hub/index.js

@@ -0,0 +1,452 @@
+/**
+ * mesh hub dev — one-command local Hub over a running dev-local stack (MESH-2275).
+ *
+ * Launches the CURRENT-CODE Hub (apps/hub api + ui from a mesh-platform
+ * checkout) pointed at an existing `mesh dev` session's stack, auto-assembling
+ * the env that used to be hand-set (the FUB-demo runbook §6 recipe):
+ *
+ *   HUB_TENANT / HUB_SCOPE_ENV / HUB_SCOPE_TENANTS   from the session's platform context
+ *   TEMPORAL_ADDRESS                                 from the session's tunnel (VPN or SSM)
+ *   AWS_*                                            from the session's scratch credential_process profile
+ *   DEV_USER_* / DEV_USER_TOKEN_URL                  from the session's injected dev identity +
+ *                                                    per-session token-server (MESH-2039)
+ *
+ * The `mesh dev` session already resolved all of these — its tmux session
+ * environment and state file (`$TMPDIR/mesh-dev-sessions/<name>.json`) are the
+ * source of truth; this command only reads them and never mutates the app
+ * session.
+ *
+ * Scoped-tenant enumeration is validated up front: HUB_SCOPE_ENV without a
+ * non-empty HUB_SCOPE_TENANTS makes the Hub API silently return zero
+ * registrations (apps/hub/api/src/lib/ssm/reader.ts), so that combination is
+ * a loud error here, never an empty Hub.
+ */
+import { execFileSync } from "node:child_process";
+import * as fs from "node:fs";
+import * as net from "node:net";
+import * as os from "node:os";
+import * as path from "node:path";
+import chalk from "chalk";
+import { buildLaunchCommand, waitForPort, writeEnvFile } from "../dev-launch.js";
+import { tunnelClientAddress } from "../dev.js";
+import { MeshCliError } from "../../utils/errors.js";
+import { DEFAULT_HUB_PORT } from "../local/stack.js";
+import { logInfo, logSuccess, logWarn } from "../../utils/log.js";
+import { findAppRoot } from "../../utils/pulumi.js";
+/** tmux session the Hub runs in — fixed, one local Hub at a time. */
+export const HUB_SESSION = "mesh-hub-dev";
+// Same default as the containerized Hub (local/stack.ts DEFAULT_HUB_PORT),
+// but a SEPARATE override variable: MESH_HUB_PORT moves the containerized
+// Hub's published port, MESH_HUB_DEV_PORT moves this dev-server Hub. The two
+// are built to run side by side — one shared variable would make "move the
+// containerized Hub off 9000" also move the dev server onto the same port.
+export const DEFAULT_HUB_UI_PORT = Number(DEFAULT_HUB_PORT);
+export const DEFAULT_HUB_API_PORT = 3002;
+export function devSessionsDir() {
+    return path.join(os.tmpdir(), "mesh-dev-sessions");
+}
+/** All persisted `mesh dev` session states (unparseable files skipped). */
+export function listDevSessions(dir = devSessionsDir()) {
+    if (!fs.existsSync(dir))
+        return [];
+    const sessions = [];
+    for (const entry of fs.readdirSync(dir)) {
+        if (!entry.endsWith(".json"))
+            continue;
+        try {
+            const state = JSON.parse(fs.readFileSync(path.join(dir, entry), "utf-8"));
+            if (state && typeof state === "object" && state.devOutput) {
+                sessions.push({ name: entry.slice(0, -".json".length), state });
+            }
+        }
+        catch {
+            // stale/corrupt state file — not a candidate
+        }
+    }
+    return sessions;
+}
+/**
+ * Pick the dev session to point the Hub at.
+ *
+ *   1. --session <name> wins (error if its state file is missing).
+ *   2. The session whose appRoot equals the cwd's app root (both sides come
+ *      from findAppRoot, so exact equality is the right comparison).
+ *   3. A sole running session.
+ *
+ * Ambiguity (multiple sessions, none matching cwd) is an error listing the
+ * candidates — never a silent guess.
+ */
+export function pickDevSession(sessions, opts) {
+    if (opts.session) {
+        const match = sessions.find((s) => s.name === opts.session);
+        if (!match) {
+            throw new MeshCliError(`No dev session state found for '${opts.session}'. Known sessions: ${sessions.map((s) => s.name).join(", ") || "(none)"}`, { remediation: { command: "mesh dev  # from the app repo, to start the stack session" } });
+        }
+        return match;
+    }
+    if (sessions.length === 0) {
+        throw new MeshCliError("No running `mesh dev` session found — the Hub needs a dev-local stack to observe.", { remediation: { command: "mesh dev  # from your app repo, then re-run mesh hub dev" } });
+    }
+    if (opts.cwdAppRoot) {
+        const root = path.resolve(opts.cwdAppRoot);
+        const match = sessions.find((s) => path.resolve(s.state.appRoot) === root);
+        if (match)
+            return match;
+    }
+    if (sessions.length === 1)
+        return sessions[0];
+    throw new MeshCliError(`Multiple dev sessions found and none matches this directory: ${sessions
+        .map((s) => `${s.name} (${s.state.appRoot})`)
+        .join(", ")}`, { remediation: { command: "mesh hub dev --session <name>" } });
+}
+// ── tmux session env ─────────────────────────────────────────────────────────
+/** Parse `tmux show-environment` output (`KEY=value` lines; `-KEY` = unset). */
+export function parseTmuxEnv(output) {
+    const env = {};
+    for (const line of output.split("\n")) {
+        if (!line || line.startsWith("-"))
+            continue;
+        const eq = line.indexOf("=");
+        if (eq <= 0)
+            continue;
+        env[line.slice(0, eq)] = line.slice(eq + 1);
+    }
+    return env;
+}
+function readTmuxSessionEnv(sessionName) {
+    try {
+        const out = execFileSync("tmux", ["show-environment", "-t", sessionName], {
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        });
+        return parseTmuxEnv(out);
+    }
+    catch {
+        return {};
+    }
+}
+function tmuxSessionExists(sessionName) {
+    try {
+        execFileSync("tmux", ["has-session", "-t", sessionName], { stdio: "ignore" });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+// ── env assembly ─────────────────────────────────────────────────────────────
+/** Vars carried over verbatim from the dev session's tmux environment. */
+const FORWARD_PREFIXES = ["AWS_", "DEV_USER_"];
+export function forwardedSessionVars(sessionEnv) {
+    const out = {};
+    for (const [key, value] of Object.entries(sessionEnv)) {
+        if (FORWARD_PREFIXES.some((p) => key.startsWith(p)))
+            out[key] = value;
+    }
+    return out;
+}
+/**
+ * Assemble the Hub api/ui env from a discovered dev session. Throws loudly on
+ * the combinations that today produce a silently-empty Hub.
+ */
+export function assembleHubEnv(session, sessionEnv, opts) {
+    const warnings = [];
+    const notes = [];
+    const platform = session.state.devOutput.platform;
+    if (!platform) {
+        throw new MeshCliError(`Dev session '${session.name}' has no platform context in its state file — cannot derive the Hub scope.`, { remediation: { command: "mesh dev --kill && mesh dev  # relaunch to refresh session state" } });
+    }
+    if (platform.tenant === "local") {
+        throw new MeshCliError("This session runs on the full-local platform (`mesh start`) — use its containerized Hub instead of `mesh hub dev`.", { remediation: { command: "mesh start --with-hub  # MESH_HUB_PORT=<port> publishes it off 9000" } });
+    }
+    const hubTenant = platform.name ?? "mesh";
+    const scopeEnv = platform.env;
+    const scopeTenants = (opts.tenants ?? platform.tenant)
+        .split(",")
+        .map((t) => t.trim())
+        .filter(Boolean);
+    if (scopeTenants.length === 0) {
+        // The Hub API's scoped SSM reader returns [] with no error when
+        // HUB_SCOPE_ENV is set and HUB_SCOPE_TENANTS is empty — every page renders
+        // blank with nothing in the logs. Refuse to launch into that state.
+        throw new MeshCliError("Tenant scope resolved EMPTY (HUB_SCOPE_ENV set, no HUB_SCOPE_TENANTS) — the Hub would launch but show zero tenants everywhere.", { remediation: { command: "mesh hub dev --tenants <tenant>[,<tenant>…]" } });
+    }
+    const forwarded = forwardedSessionVars(sessionEnv);
+    if (!Object.keys(forwarded).some((k) => k.startsWith("AWS_"))) {
+        warnings.push("No AWS_* vars found in the dev session env — the Hub API will fall back to ambient credentials (SSM reads may 403).");
+    }
+    if (!forwarded.DEV_USER_ID_TOKEN && !forwarded.DEV_USER_ACCESS_TOKEN) {
+        warnings.push("No DEV_USER_* identity in the dev session env — the Hub will show an unauthenticated state. Run `mesh login mesh." +
+            `${scopeEnv}\` and relaunch \`mesh dev\`.`);
+    }
+    if (!forwarded.DEV_USER_TOKEN_URL) {
+        // Not a warning: the launch path starts a dedicated token-server for this
+        // case, so telling the user to restart `mesh dev` would contradict the
+        // `✔ Dev-user token-server: …` line printed moments later.
+        notes.push("Dev session predates the per-session token-server (MESH-2039) — starting a dedicated one so tokens stay fresh past ~1h.");
+    }
+    const temporalAddress = sessionEnv.TEMPORAL_ADDRESS ??
+        (session.state.devOutput.tunnels["temporal"]
+            ? tunnelClientAddress(session.state.devOutput.tunnels["temporal"])
+            : undefined);
+    if (!temporalAddress) {
+        throw new MeshCliError(`Dev session '${session.name}' exposes no Temporal tunnel — the Hub can't reach the stack's Temporal.`, { remediation: { command: "mesh dev  # relaunch; the session records tunnels.temporal in its state" } });
+    }
+    const apiEnv = {
+        ...forwarded,
+        PORT: String(opts.apiPort),
+        TEMPORAL_ADDRESS: temporalAddress,
+        HUB_TENANT: hubTenant,
+        HUB_SCOPE_ENV: scopeEnv,
+        HUB_SCOPE_TENANTS: scopeTenants.join(","),
+    };
+    const uiEnv = {
+        ...forwarded,
+        PORT: String(opts.uiPort),
+        API_URL: `http://localhost:${opts.apiPort}`,
+        HUB_TENANT: hubTenant,
+        // UI namespace parsing + session defaults land on the scoped tenant.
+        DEFAULT_ORG: scopeTenants[0],
+        DEFAULT_ENV: scopeEnv,
+    };
+    return { apiEnv, uiEnv, scope: { hubTenant, scopeEnv, scopeTenants }, temporalAddress, warnings, notes };
+}
+// ── platform checkout resolution ────────────────────────────────────────────
+/** Does `dir` look like a mesh-platform checkout root (has the Hub app)? */
+function isPlatformRoot(dir) {
+    return (fs.existsSync(path.join(dir, "apps", "hub", "api", "package.json")) &&
+        fs.existsSync(path.join(dir, "apps", "hub", "ui", "package.json")));
+}
+/**
+ * Locate the mesh-platform checkout the Hub runs from:
+ * --platform-dir → $MESH_PLATFORM_DIR → walk up from cwd (monorepo case).
+ *
+ * An invalid `--platform-dir` is fatal (the user named it explicitly), but a
+ * stale `MESH_PLATFORM_DIR` left over in the shell only warns and falls through
+ * to the cwd walk-up — otherwise it would hard-fail runs made from inside a
+ * perfectly good checkout.
+ */
+export function resolvePlatformDir(explicit, cwd, env = process.env) {
+    if (explicit) {
+        const resolved = path.resolve(explicit);
+        if (isPlatformRoot(resolved))
+            return resolved;
+        throw new MeshCliError(`'${resolved}' is not a mesh-platform checkout (apps/hub/{api,ui} not found).`, { remediation: { command: "mesh hub dev --platform-dir <path-to-mesh-platform>" } });
+    }
+    if (env.MESH_PLATFORM_DIR) {
+        const resolved = path.resolve(env.MESH_PLATFORM_DIR);
+        if (isPlatformRoot(resolved))
+            return resolved;
+        logWarn(`MESH_PLATFORM_DIR='${resolved}' is not a mesh-platform checkout (apps/hub/{api,ui} not found) — ignoring it.`);
+    }
+    let dir = path.resolve(cwd);
+    for (;;) {
+        if (isPlatformRoot(dir))
+            return dir;
+        const parent = path.dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    throw new MeshCliError("Can't find a mesh-platform checkout (the Hub's source). Run from inside one, or point at one explicitly.", {
+        remediation: {
+            command: "mesh hub dev --platform-dir <path-to-mesh-platform>   # or export MESH_PLATFORM_DIR",
+        },
+    });
+}
+// ── token server ─────────────────────────────────────────────────────────────
+async function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const server = net.createServer();
+        server.listen(0, "127.0.0.1", () => {
+            const address = server.address();
+            server.close(() => typeof address === "object" && address ? resolve(address.port) : reject(new Error("no port")));
+        });
+        server.on("error", reject);
+    });
+}
+function isPortListening(port) {
+    return new Promise((resolve) => {
+        const socket = net.connect({ host: "127.0.0.1", port, timeout: 400 });
+        const done = (ok) => {
+            socket.removeAllListeners();
+            socket.destroy();
+            resolve(ok);
+        };
+        socket.once("connect", () => done(true));
+        socket.once("timeout", () => done(false));
+        socket.once("error", () => done(false));
+    });
+}
+// ── env file dir ─────────────────────────────────────────────────────────────
+function hubEnvDir() {
+    return path.join(os.tmpdir(), "mesh-dev-sessions", HUB_SESSION);
+}
+// ── port parsing ─────────────────────────────────────────────────────────────
+/**
+ * Parse a port option, naming its source in the error. Without this a typo'd
+ * `--port` (or a stale non-numeric `MESH_HUB_DEV_PORT` left in the shell) becomes
+ * `NaN`, lands in the env file as `PORT=NaN`, and reaches `net.connect` — which
+ * throws a raw `ERR_SOCKET_BAD_PORT` instead of an actionable CLI error.
+ */
+export function parsePort(raw, fallback, source) {
+    if (raw === undefined)
+        return fallback;
+    const n = Number(raw);
+    if (!Number.isInteger(n) || n < 1 || n > 65535) {
+        throw new MeshCliError(`Invalid port '${raw}' from ${source} — expected an integer 1–65535.`, {
+            remediation: { command: `mesh hub dev ${source.startsWith("--") ? source : "--port"} <1-65535>` },
+        });
+    }
+    return n;
+}
+// ── redaction for --print-env ────────────────────────────────────────────────
+const SENSITIVE_RE = /TOKEN|SECRET|KEY|PASSWORD/i;
+export function redactEnv(env) {
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        // URLs named *_TOKEN_URL etc. are locators, not credentials.
+        const sensitive = SENSITIVE_RE.test(key) && !key.endsWith("_URL") && !key.endsWith("_FILE");
+        out[key] = sensitive ? `<redacted ${value.length} chars>` : value;
+    }
+    return out;
+}
+async function hubDevAction(opts) {
+    if (opts.kill) {
+        if (tmuxSessionExists(HUB_SESSION)) {
+            execFileSync("tmux", ["kill-session", "-t", HUB_SESSION], { stdio: "ignore" });
+            fs.rmSync(hubEnvDir(), { recursive: true, force: true });
+            logSuccess(`Killed Hub session '${HUB_SESSION}'.`);
+        }
+        else {
+            logInfo(`No '${HUB_SESSION}' tmux session running.`);
+        }
+        return;
+    }
+    const uiPort = opts.port
+        ? parsePort(opts.port, DEFAULT_HUB_UI_PORT, "--port")
+        : parsePort(process.env.MESH_HUB_DEV_PORT, DEFAULT_HUB_UI_PORT, "MESH_HUB_DEV_PORT");
+    const apiPort = parsePort(opts.apiPort, DEFAULT_HUB_API_PORT, "--api-port");
+    // 1. The Hub's source.
+    const platformDir = resolvePlatformDir(opts.platformDir, process.cwd());
+    // 2. The dev-local stack session to observe.
+    const cwdAppRoot = findAppRoot(process.cwd());
+    const session = pickDevSession(listDevSessions(), { session: opts.session, cwdAppRoot });
+    if (!tmuxSessionExists(session.name)) {
+        throw new MeshCliError(`Dev session '${session.name}' has a state file but no live tmux session — its tunnels and token-server are gone.`, { remediation: { command: `mesh dev  # from ${session.state.appRoot}` } });
+    }
+    const sessionEnv = readTmuxSessionEnv(session.name);
+    // 3. Assemble the env (loud failures instead of a silently-empty Hub).
+    const assembled = assembleHubEnv(session, sessionEnv, { tenants: opts.tenants, uiPort, apiPort });
+    if (opts.printEnv) {
+        console.log(chalk.bold("\nhub-api env:"));
+        for (const [k, v] of Object.entries(redactEnv(assembled.apiEnv)))
+            console.log(`  ${k}=${v}`);
+        console.log(chalk.bold("\nhub-ui env:"));
+        for (const [k, v] of Object.entries(redactEnv(assembled.uiEnv)))
+            console.log(`  ${k}=${v}`);
+        return;
+    }
+    if (tmuxSessionExists(HUB_SESSION)) {
+        throw new MeshCliError(`A '${HUB_SESSION}' tmux session is already running.`, {
+            remediation: { command: "mesh hub dev --kill   # then re-run mesh hub dev" },
+        });
+    }
+    // Pre-flight the ports. Without this, a port already owned by ANOTHER Hub
+    // (the containerized `mesh start` one is fixed at :9000, or a plain
+    // `mesh dev` from apps/hub holds :3002) makes the post-launch waitForPort
+    // succeed against that other process: vite has no strictPort in its config
+    // so the UI silently falls forward to the next free port, and we would then
+    // print "Hub → http://localhost:9000" pointing at someone else's Hub — the
+    // exact silently-wrong-Hub failure this command exists to remove.
+    for (const [label, port, flag] of [
+        ["API", apiPort, "--api-port"],
+        ["UI", uiPort, "--port"],
+    ]) {
+        if (await isPortListening(port)) {
+            throw new MeshCliError(`Hub ${label} port ${port} is already in use — another process (a \`mesh start\` Hub, or another \`mesh hub dev\`) is listening there.`, { remediation: { command: `mesh hub dev ${flag} <free-port>   # or free :${port} first` } });
+        }
+    }
+    logInfo(`Dev session : ${session.name} (${session.state.appRoot})`);
+    logInfo(`Hub source  : ${platformDir}`);
+    logInfo(`Scope       : HUB_TENANT=${assembled.scope.hubTenant} HUB_SCOPE_ENV=${assembled.scope.scopeEnv} HUB_SCOPE_TENANTS=${assembled.scope.scopeTenants.join(",")}`);
+    logInfo(`Temporal    : ${assembled.temporalAddress}`);
+    for (const note of assembled.notes)
+        logInfo(note);
+    for (const warning of assembled.warnings)
+        logWarn(warning);
+    const apiDir = path.join(platformDir, "apps", "hub", "api");
+    const uiDir = path.join(platformDir, "apps", "hub", "ui");
+    execFileSync("tmux", ["new-session", "-d", "-s", HUB_SESSION, "-n", "api", "-c", apiDir]);
+    // Fresh dev tokens: reuse the app session's token-server when it has one;
+    // otherwise run our own (MESH-2039 pattern) so the Hub survives past the
+    // ~1h Zitadel horizon either way.
+    if (!assembled.apiEnv.DEV_USER_TOKEN_URL && assembled.apiEnv.DEV_USER_ID_TOKEN) {
+        const platform = session.state.devOutput.platform;
+        const credContext = `mesh.${platform.env}`;
+        const tokenPort = await findFreePort();
+        const tokenUrl = `http://127.0.0.1:${tokenPort}`;
+        execFileSync("tmux", ["new-window", "-t", HUB_SESSION, "-n", "token-server", "-c", platformDir]);
+        execFileSync("tmux", ["set-option", "-t", `${HUB_SESSION}:token-server`, "remain-on-exit", "on"], {
+            stdio: "ignore",
+        });
+        execFileSync("tmux", [
+            "send-keys",
+            "-t",
+            `${HUB_SESSION}:token-server`,
+            `npx mesh dev __token-server ${tokenPort} ${credContext}`,
+            "Enter",
+        ]);
+        for (let i = 0; i < 15 && !(await isPortListening(tokenPort)); i++) {
+            await new Promise((r) => setTimeout(r, 200));
+        }
+        assembled.apiEnv.DEV_USER_TOKEN_URL = tokenUrl;
+        assembled.uiEnv.DEV_USER_TOKEN_URL = tokenUrl;
+        logSuccess(`Dev-user token-server: ${tokenUrl} (context ${credContext})`);
+    }
+    const launch = (window, dir, env, cmd, createWindow) => {
+        const envFile = path.join(hubEnvDir(), `${window}.env.sh`);
+        writeEnvFile(envFile, env);
+        if (createWindow) {
+            execFileSync("tmux", ["new-window", "-t", HUB_SESSION, "-n", window, "-c", dir]);
+        }
+        execFileSync("tmux", ["set-option", "-t", `${HUB_SESSION}:${window}`, "remain-on-exit", "on"], {
+            stdio: "ignore",
+        });
+        execFileSync("tmux", ["send-keys", "-t", `${HUB_SESSION}:${window}`, buildLaunchCommand(envFile, dir, cmd), "Enter"]);
+    };
+    launch("api", apiDir, assembled.apiEnv, "pnpm dev", false);
+    // --strictPort: the Hub UI's vite config sets `port` but NOT `strictPort`, so
+    // vite would silently fall forward to the next free port and we'd advertise a
+    // URL serving something else. Fail instead — the pre-flight above already
+    // rejects a taken port, this closes the race. (`host: true` is already in
+    // apps/hub/ui/vite.config.ts, so the tailnet binding needs no flag here.)
+    launch("ui", uiDir, assembled.uiEnv, `pnpm dev -- --port ${uiPort} --strictPort`, true);
+    logInfo("Waiting for the Hub to come up…");
+    const apiUp = await waitForPort("127.0.0.1", apiPort, 90_000);
+    const uiUp = apiUp && (await waitForPort("127.0.0.1", uiPort, 90_000));
+    if (!apiUp || !uiUp) {
+        throw new MeshCliError(`Hub ${apiUp ? "UI" : "API"} did not start listening (api :${apiPort}, ui :${uiPort}).`, { remediation: { command: `tmux attach -t ${HUB_SESSION}   # inspect the ${apiUp ? "ui" : "api"} window` } });
+    }
+    console.log("");
+    logSuccess(`Mesh Hub (dev-local scope ${assembled.scope.scopeTenants.join(",")} @ ${assembled.scope.scopeEnv})`);
+    console.log(`  ${chalk.bold.cyan(`http://localhost:${uiPort}`)}  (also reachable on your tailnet)`);
+    console.log(`  api  http://localhost:${apiPort}`);
+    console.log(`  logs tmux attach -t ${HUB_SESSION}`);
+    console.log(`  stop mesh hub dev --kill`);
+}
+export function registerHubCommands(program) {
+    const hub = program.command("hub").description("Local Hub over dev-local stacks");
+    hub
+        .command("dev")
+        .description("Launch the current-code Hub (api + ui) against a running `mesh dev` session — env auto-assembled, zero hand-set vars")
+        .option("--session <name>", "dev session to observe (default: auto-detect from cwd)")
+        .option("--tenants <list>", "comma-separated HUB_SCOPE_TENANTS override (default: the session's tenant)")
+        .option("--port <port>", `Hub UI host port (default: $MESH_HUB_DEV_PORT or ${DEFAULT_HUB_UI_PORT})`)
+        .option("--api-port <port>", `Hub API port (default: ${DEFAULT_HUB_API_PORT})`)
+        .option("--platform-dir <dir>", "mesh-platform checkout to run the Hub from (default: $MESH_PLATFORM_DIR or walk up from cwd)")
+        .option("--print-env", "print the assembled env (secrets redacted) and exit without launching")
+        .option("--kill", "tear down the running Hub session")
+        .action(hubDevAction);
+}
+//# sourceMappingURL=index.js.map

package/dist/src/commands/hub/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/hub/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAqB,MAAM,WAAW,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAE1C,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,CAAC;AASzC,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC,CAAC;AACrD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,GAAG,GAAG,cAAc,EAAE;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,OAAO,CAAC,CAChC,CAAC;YAClB,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6CAA6C;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,QAA6B,EAC7B,IAAsD;IAEtD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,YAAY,CACpB,mCAAmC,IAAI,CAAC,OAAO,sBAC7C,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAC5C,EAAE,EACF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,2DAA2D,EAAE,EAAE,CAC1F,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,YAAY,CACpB,mFAAmF,EACnF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,0DAA0D,EAAE,EAAE,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;QAC3E,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC,CAAC,CAAE,CAAC;IAC/C,MAAM,IAAI,YAAY,CACpB,gEAAgE,QAAQ;SACrE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC;SAC5C,IAAI,CAAC,IAAI,CAAC,EAAE,EACf,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,CAC9D,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,WAAmB;IAC7C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE;YACxE,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,IAAI,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,WAAW,CAAU,CAAC;AAExD,MAAM,UAAU,oBAAoB,CAAC,UAAkC;IACrE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACtD,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAoBD;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA0B,EAC1B,UAAkC,EAClC,IAAsB;IAEtB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,YAAY,CACpB,gBAAgB,OAAO,CAAC,IAAI,4EAA4E,EACxG,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,YAAY,CACpB,oHAAoH,EACpH,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,qEAAqE,EAAE,EAAE,CACpG,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,IAAI,MAAM,CAAC;IAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC;IAC9B,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC;SACnD,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,gEAAgE;QAChE,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,IAAI,YAAY,CACpB,gIAAgI,EAChI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,6CAA6C,EAAE,EAAE,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAC9D,QAAQ,CAAC,IAAI,CACX,qHAAqH,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,iBAAiB,IAAI,CAAC,SAAS,CAAC,qBAAqB,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CACX,mHAAmH;YACjH,GAAG,QAAQ,+BAA+B,CAC7C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAClC,0EAA0E;QAC1E,uEAAuE;QACvE,2DAA2D;QAC3D,KAAK,CAAC,IAAI,CACR,yHAAyH,CAC1H,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GACnB,UAAU,CAAC,gBAAgB;QAC3B,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAC,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAE,CAAC;YACnE,CAAC,CAAC,SAAS,CAAC,CAAC;IACjB,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,YAAY,CACpB,gBAAgB,OAAO,CAAC,IAAI,0EAA0E,EACtG,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,yEAAyE,EAAE,EAAE,CACxG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAA2B;QACrC,GAAG,SAAS;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;QAC1B,gBAAgB,EAAE,eAAe;QACjC,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,QAAQ;QACvB,iBAAiB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;KAC1C,CAAC;IAEF,MAAM,KAAK,GAA2B;QACpC,GAAG,SAAS;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,oBAAoB,IAAI,CAAC,OAAO,EAAE;QAC3C,UAAU,EAAE,SAAS;QACrB,qEAAqE;QACrE,WAAW,EAAE,YAAY,CAAC,CAAC,CAAE;QAC7B,WAAW,EAAE,QAAQ;KACtB,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC3G,CAAC;AAED,+EAA+E;AAE/E,4EAA4E;AAC5E,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,CACL,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;QACnE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CACnE,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,GAAW,EACX,MAA0C,OAAO,CAAC,GAAG;IAErD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,cAAc,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC9C,MAAM,IAAI,YAAY,CACpB,IAAI,QAAQ,kEAAkE,EAC9E,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,qDAAqD,EAAE,EAAE,CACpF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACrD,IAAI,cAAc,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;QAC9C,OAAO,CACL,sBAAsB,QAAQ,gFAAgF,CAC/G,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,SAAS,CAAC;QACR,IAAI,cAAc,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,YAAY,CACpB,0GAA0G,EAC1G;QACE,WAAW,EAAE;YACX,OAAO,EAAE,qFAAqF;SAC/F;KACF,CACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,YAAY;IACzB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAChB,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,SAAS,SAAS;IAChB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mBAAmB,EAAE,WAAW,CAAC,CAAC;AAClE,CAAC;AAED,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,GAAuB,EAAE,QAAgB,EAAE,MAAc;IACjF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,iBAAiB,GAAG,UAAU,MAAM,iCAAiC,EAAE;YAC5F,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,YAAY,EAAE;SAClG,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,gFAAgF;AAEhF,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAElD,MAAM,UAAU,SAAS,CAAC,GAA2B;IACnD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,6DAA6D;QAC7D,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5F,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAcD,KAAK,UAAU,YAAY,CAAC,IAAmB;IAC7C,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,MAAM,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC/E,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,UAAU,CAAC,uBAAuB,WAAW,IAAI,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,OAAO,WAAW,yBAAyB,CAAC,CAAC;QACvD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI;QACtB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,EAAE,QAAQ,CAAC;QACrD,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;IAE5E,uBAAuB;IACvB,MAAM,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAExE,6CAA6C;IAC7C,MAAM,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CACpB,gBAAgB,OAAO,CAAC,IAAI,sFAAsF,EAClH,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,oBAAoB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD,uEAAuE;IACvE,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAElG,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO;IACT,CAAC;IAED,IAAI,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,YAAY,CAAC,MAAM,WAAW,oCAAoC,EAAE;YAC5E,WAAW,EAAE,EAAE,OAAO,EAAE,kDAAkD,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,oEAAoE;IACpE,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,kEAAkE;IAClE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI;QAChC,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;QAC9B,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC;KAChB,EAAE,CAAC;QACX,IAAI,MAAM,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,YAAY,CACpB,OAAO,KAAK,SAAS,IAAI,8GAA8G,EACvI,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,gBAAgB,IAAI,6BAA6B,IAAI,QAAQ,EAAE,EAAE,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,CAAC,iBAAiB,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IACpE,OAAO,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAC;IACxC,OAAO,CACL,4BAA4B,SAAS,CAAC,KAAK,CAAC,SAAS,kBAAkB,SAAS,CAAC,KAAK,CAAC,QAAQ,sBAAsB,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC9J,CAAC;IACF,OAAO,CAAC,iBAAiB,SAAS,CAAC,eAAe,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,SAAS,CAAC,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAE1D,YAAY,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAE1F,0EAA0E;IAC1E,yEAAyE;IACzE,kCAAkC;IAClC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,IAAI,SAAS,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC/E,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,QAAS,CAAC;QACnD,MAAM,WAAW,GAAG,QAAQ,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,oBAAoB,SAAS,EAAE,CAAC;QACjD,YAAY,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;QACjG,YAAY,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,WAAW,eAAe,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YAChG,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,YAAY,CAAC,MAAM,EAAE;YACnB,WAAW;YACX,IAAI;YACJ,GAAG,WAAW,eAAe;YAC7B,+BAA+B,SAAS,IAAI,WAAW,EAAE;YACzD,OAAO;SACR,CAAC,CAAC;QACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACnE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,SAAS,CAAC,MAAM,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QAC/C,SAAS,CAAC,KAAK,CAAC,kBAAkB,GAAG,QAAQ,CAAC;QAC9C,UAAU,CAAC,0BAA0B,QAAQ,aAAa,WAAW,GAAG,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,GAA2B,EAAE,GAAW,EAAE,YAAqB,EAAE,EAAE;QAC9G,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,MAAM,SAAS,CAAC,CAAC;QAC3D,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3B,IAAI,YAAY,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,YAAY,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE,EAAE,gBAAgB,EAAE,IAAI,CAAC,EAAE;YAC7F,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,YAAY,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,WAAW,IAAI,MAAM,EAAE,EAAE,kBAAkB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACxH,CAAC,CAAC;IAEF,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC3D,8EAA8E;IAC9E,8EAA8E;IAC9E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,sBAAsB,MAAM,eAAe,EAAE,IAAI,CAAC,CAAC;IAExF,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,kCAAkC,OAAO,SAAS,MAAM,IAAI,EACvF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,kBAAkB,WAAW,oBAAoB,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,EAAE,CAC7G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,UAAU,CAAC,6BAA6B,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC;IACjH,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,MAAM,EAAE,CAAC,oCAAoC,CAAC,CAAC;IACpG,OAAO,CAAC,GAAG,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,yBAAyB,WAAW,EAAE,CAAC,CAAC;IACpD,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,iCAAiC,CAAC,CAAC;IAClF,GAAG;SACA,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,sHAAsH,CACvH;SACA,MAAM,CAAC,kBAAkB,EAAE,wDAAwD,CAAC;SACpF,MAAM,CAAC,kBAAkB,EAAE,4EAA4E,CAAC;SACxG,MAAM,CAAC,eAAe,EAAE,oDAAoD,mBAAmB,GAAG,CAAC;SACnG,MAAM,CAAC,mBAAmB,EAAE,0BAA0B,oBAAoB,GAAG,CAAC;SAC9E,MAAM,CAAC,sBAAsB,EAAE,8FAA8F,CAAC;SAC9H,MAAM,CAAC,aAAa,EAAE,uEAAuE,CAAC;SAC9F,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,YAAY,CAAC,CAAC;AAC1B,CAAC"}

package/dist/src/commands/init.d.ts

@@ -0,0 +1,65 @@
+/**
+ * mesh init app-tenant — the doctor for a tenant apps repo (design §3.1,
+ * AC A1–A3).
+ *
+ * Runs a read-only check pipeline; every failure names the exact `mesh`
+ * command that fixes it (never a person — A2). Re-running IS the doctor
+ * (A3): exit 0 iff everything passes. `--json` is the agent surface (A5);
+ * `--fix` applies the developer-scope fixes directly (registry token
+ * refresh, skills sync) and leaves operator actions as remediations.
+ *
+ * Checks (API-first; local platform = the same Hub API on localhost):
+ *   1. CLI auth        — cached `mesh login` credentials for the context
+ *   2. Registry access — the CodeArtifact token in ~/.npmrc is accepted by the
+ *                        registry (a live probe, not a substring match — an
+ *                        expired token used to report `pass`); local: skipped
+ *   2b. Public npm not hijacked — no unscoped `registry=<codeartifact>` in
+ *                        ~/.npmrc making CodeArtifact the DEFAULT registry
+ *   3. Platform tenant — Hub API /tenants (the platform registry)
+ *   4. App tenant      — tenant present in the Hub registry
+ *   5. Deployer role   — mesh:deployerRole config present (cloud contexts)
+ *   6. Repo shape      — pnpm workspace + apps layout create-app expects
+ *   7. Skills wired    — `mesh skills sync --check`
+ */
+import { Command } from "commander";
+import { probeRegistryToken } from "../utils/auth-preflight.js";
+type CheckStatus = "pass" | "warn" | "fail";
+interface CheckResult {
+    name: string;
+    status: CheckStatus;
+    detail: string;
+    /** The exact command that remediates (A2: commands, never people). */
+    fix?: string;
+}
+/**
+ * The remediation string the doctor prints for a registry fault. It must render
+ * the command `--fix` actually executes: `runRegistryLogin` is called with the
+ * doctor's own `--profile` (or none), so advertising a hardcoded
+ * `--profile mesh-dev` would be a command the doctor never runs.
+ */
+export declare function registryFixCommand(profile?: string, context?: string): string;
+/**
+ * The two registry checks, exported for tests.
+ *
+ * 1. **Registry access** — does the token in ~/.npmrc actually work? The old
+ *    check was `content.includes("codeartifact")`, which reports `pass` for a
+ *    token that expired two days ago. `probeRegistryToken` asks the registry.
+ * 2. **Public npm not hijacked** — is there an *unscoped* `registry=` line
+ *    pointing at CodeArtifact? A bare `aws codeartifact login` (no
+ *    `--namespace @mesh-tech`) writes one, which routes every public package
+ *    through CodeArtifact and makes the whole of npm 401 at the 12h token
+ *    expiry. `mesh registry login` now removes it, so it is the fix for both.
+ */
+export declare function registryChecks(args: {
+    context: string;
+    fix: boolean;
+    /** AWS SSO profile to log in with — threaded from `mesh init app-tenant --profile`. */
+    profile?: string;
+    /** Test seam — defaults to the real network probe against ~/.npmrc. */
+    probe?: typeof probeRegistryToken;
+    /** Test seam — defaults to `runRegistryLogin`. */
+    login?: (context: string) => Promise<void>;
+}): Promise<CheckResult[]>;
+export declare function registerInitCommands(program: Command): void;
+export {};
+//# sourceMappingURL=init.d.ts.map