@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/commands/local/auth-provision.js

@@ -0,0 +1,286 @@
+/**
+ * App-tenant auth auto-provisioning for the local platform — the local analog
+ * of what the Pulumi components do in the cloud, per the approved Zitadel
+ * tenant-auth pattern (Org / Project / Application / Service User):
+ *
+ *   Org         = app tenant                  (ZitadelTenantIdentity parity)
+ *   Project     = one per app,                 (ZitadelAppIdentity parity —
+ *                 name = authz schema namespace  the app IS the authz boundary)
+ *   Application = one per service inside it    (API app, Basic creds)
+ *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
+ *                 (ministack Secrets Manager — same canonical path as cloud)
+ *
+ * `mesh dev --local` calls this on startup so scaffolding + running an app
+ * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
+ * Idempotent: search-before-create everywhere; the credential secret is only
+ * written when the application is first created (Zitadel returns the secret
+ * once).
+ */
+import { logInfo, logSuccess } from "../../utils/log.js";
+import { LOCAL_ENV, LOCAL_AWS_CONFIG, registerTenantEnv } from "./seed.js";
+import { api, readSeederPat, PLATFORM_ORG, ensureZitadelProject, searchZitadelApp } from "./seed-zitadel.js";
+import { upsertLocalSecret } from "./helpers.js";
+export function authSecretPath(tenant, app, service) {
+    return `mesh/${tenant}/${LOCAL_ENV}/apps/${app}/zitadel/${service}`;
+}
+async function ensureOrg(pat, name) {
+    const search = await api(pat, "POST", "/admin/v1/orgs/_search", {
+        queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }],
+    });
+    const existing = search?.result?.[0]?.id;
+    if (existing)
+        return existing;
+    const created = await api(pat, "POST", "/v2/organizations", { name });
+    logSuccess(`Created Zitadel org '${name}' (app tenant)`);
+    return created.organizationId;
+}
+const ensureProject = (pat, orgId, name) => ensureZitadelProject(pat, name, { orgId, describe: "app" });
+/** Ensure the service's API application exists; returns fresh credentials
+ * when it was created this run. */
+async function ensureServiceApp(pat, orgId, projectId, service) {
+    const existing = await searchZitadelApp(pat, projectId, service, orgId);
+    if (existing) {
+        return { created: false, appId: existing.id, clientId: existing?.apiConfig?.clientId };
+    }
+    const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/api`, { name: service, authMethodType: "API_AUTH_METHOD_TYPE_BASIC" }, orgId);
+    logSuccess(`Created Zitadel application '${service}' (service)`);
+    return { created: true, clientId: created.clientId, clientSecret: created.clientSecret };
+}
+/** Ensure the app-declared project roles exist (idempotent). */
+async function ensureProjectRoles(pat, orgId, projectId, roles) {
+    if (roles.length === 0)
+        return;
+    const existing = await api(pat, "POST", `/management/v1/projects/${projectId}/roles/_search`, {}, orgId);
+    const have = new Set((existing?.result ?? []).map((r) => r.key));
+    for (const key of roles) {
+        if (have.has(key))
+            continue;
+        await api(pat, "POST", `/management/v1/projects/${projectId}/roles`, { roleKey: key, displayName: key }, orgId);
+        logSuccess(`Created project role '${key}'`);
+    }
+}
+/**
+ * Ensure the app's LOCAL M2M caller: a machine user (`{app}-m2m`) with a
+ * client-credentials secret, granted the app project (+ declared roles).
+ * API applications are resource servers — they cannot obtain tokens — so
+ * without this there is no way to mint a caller token against the local
+ * Zitadel at all. Secret stored at mesh/{tenant}/dev/apps/{app}/zitadel/m2m.
+ */
+async function ensureM2mCaller(pat, tenant, app, orgId, projectId, roles) {
+    const userName = `${app}-m2m`;
+    const search = await api(pat, "POST", "/management/v1/users/_search", { queries: [{ userNameQuery: { userName, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, orgId);
+    let userId = search?.result?.[0]?.id;
+    let createdUser = false;
+    if (!userId) {
+        const created = await api(pat, "POST", "/management/v1/users/machine", { userName, name: `${app} local M2M caller`, accessTokenType: "ACCESS_TOKEN_TYPE_BEARER" }, orgId);
+        userId = created.userId;
+        createdUser = true;
+        logSuccess(`Created machine user '${userName}' (local M2M caller)`);
+    }
+    // Grant the project (+ declared roles); on re-runs update the existing
+    // grant so newly-declared roles apply.
+    try {
+        await api(pat, "POST", `/management/v1/users/${userId}/grants`, { projectId, roleKeys: roles }, orgId);
+    }
+    catch (err) {
+        const e = err;
+        if (e.status !== 409 && !/already exists/i.test(String(e.message)))
+            throw err;
+        const grants = await api(pat, "POST", "/management/v1/users/grants/_search", { queries: [{ userIdQuery: { userId } }, { projectIdQuery: { projectId } }] }, orgId);
+        const grantId = grants?.result?.[0]?.id;
+        if (grantId && roles.length > 0) {
+            try {
+                await api(pat, "PUT", `/management/v1/users/${userId}/grants/${grantId}`, { roleKeys: roles }, orgId);
+            }
+            catch (updateErr) {
+                // Zitadel 400s a no-op update ("User grant has not been changed",
+                // COMMAND-Rs8fy) — the grant already carries the declared roles.
+                // Anything else is real. Must not throw here: aborting mid-provision
+                // skips the secret (re-)mint below and leaves callers without creds.
+                const ue = updateErr;
+                if (!/has not been changed/i.test(String(ue.message)))
+                    throw updateErr;
+            }
+        }
+    }
+    if (createdUser || !(await authSecretExists(tenant, app, "m2m"))) {
+        const secret = await api(pat, "PUT", `/management/v1/users/${userId}/secret`, {}, orgId);
+        await writeAuthSecret(tenant, app, "m2m", {
+            clientId: secret.clientId,
+            clientSecret: secret.clientSecret,
+            issuer: "http://localhost:8080",
+            orgId,
+            projectId,
+        });
+        return true;
+    }
+    return false;
+}
+async function authSecretExists(tenant, app, service) {
+    const { SecretsManagerClient, GetSecretValueCommand } = await import("@aws-sdk/client-secrets-manager");
+    const sm = new SecretsManagerClient(LOCAL_AWS_CONFIG);
+    return sm.send(new GetSecretValueCommand({ SecretId: authSecretPath(tenant, app, service) })).then(() => true, () => false);
+}
+async function writeAuthSecret(tenant, app, service, value) {
+    const name = authSecretPath(tenant, app, service);
+    await upsertLocalSecret(name, value);
+    logSuccess(`Stored service credentials → ${name}`);
+}
+/**
+ * Register the running app in the local platform registry — the same
+ * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
+ * apps/{app}/meta), so StackPort (and the local Hub once its images land)
+ * can visualize local apps.
+ */
+export async function registerLocalApp(args) {
+    const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(LOCAL_AWS_CONFIG);
+    const put = (name, value, description) => ssm.send(new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: JSON.stringify(value), Description: description }));
+    // The app's tenant + env must be registered for the Hub to list the app.
+    await registerTenantEnv(args.tenant);
+    // Per-stack registration in the exact shape hub-api's SSM assembler reads
+    // (stack "local" = the mesh dev --local runtime).
+    const namespace = `${args.tenant}-${LOCAL_ENV}-${args.app}`;
+    const base = `/mesh-platform/${args.tenant}/${LOCAL_ENV}/apps/${args.app}/stacks/local`;
+    await put(base, {
+        name: args.app,
+        tenant: args.tenant,
+        stack: "local",
+        namespace,
+        platform: { name: "local", env: LOCAL_ENV },
+    }, `Local app registration for ${args.tenant}/${args.app} (mesh dev --local)`);
+    for (const service of args.services) {
+        const port = args.ports?.[service];
+        const isMock = service.startsWith("mock-");
+        await put(`${base}/services/${service}`, {
+            ...(port ? { url: `http://localhost:${port}`, port } : {}),
+            replicas: 1,
+            tier: "core",
+            ...(!isMock && args.links?.length ? { links: args.links } : {}),
+        }, `Local service registration (${service})`);
+    }
+    // Worker registration — the shape deployed TemporalWorker components
+    // write; hub-api discovers a tenant's Temporal namespaces from these, so
+    // the tenant-wide workflows view finds local runs without an explicit
+    // namespace filter. Template convention: worker services are named so.
+    for (const service of args.services) {
+        if (!/worker/i.test(service))
+            continue;
+        await put(`${base}/workers/${service}`, { temporalNamespace: namespace, taskQueue: args.app }, `Local worker registration (${service})`);
+    }
+    await put(`${base}/meta`, { runtime: "mesh-dev-local", services: args.services, ports: args.ports ?? {} }, "Local run metadata (mesh dev --local)");
+    logSuccess(`Registered app in the local registry → ${base}`);
+    return base;
+}
+/**
+ * Reconcile the platform registry from Zitadel — every app-tenant org (and
+ * its projects = apps, applications = services) provisioned in Zitadel gets
+ * a Hub-readable registration, even if the app hasn't been run since it was
+ * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
+ * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
+ * the app's self-registration both flow from the same deploy. Idempotent:
+ * existing per-stack registrations (which carry live ports/URLs from
+ * `mesh dev --local`) are never overwritten.
+ */
+export async function reconcileRegistryFromZitadel() {
+    const pat = readSeederPat();
+    const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(LOCAL_AWS_CONFIG);
+    const orgs = await api(pat, "POST", "/admin/v1/orgs/_search", { query: { limit: 200 } });
+    const tenants = [];
+    let apps = 0;
+    for (const org of orgs?.result ?? []) {
+        const tenant = org?.name;
+        // The platform org holds platform-service auth config, not an app tenant.
+        if (!tenant || tenant === PLATFORM_ORG)
+            continue;
+        await registerTenantEnv(tenant);
+        tenants.push(tenant);
+        const projects = await api(pat, "POST", "/management/v1/projects/_search", { query: { limit: 200 } }, org.id);
+        for (const project of projects?.result ?? []) {
+            const app = project?.name;
+            if (!app)
+                continue;
+            apps++;
+            const base = `/mesh-platform/${tenant}/${LOCAL_ENV}/apps/${app}/stacks/local`;
+            const exists = await ssm.send(new GetParameterCommand({ Name: base })).then(() => true, () => false);
+            if (exists)
+                continue;
+            await ssm.send(new PutParameterCommand({
+                Name: base,
+                Type: "String",
+                Overwrite: true,
+                Value: JSON.stringify({
+                    name: app,
+                    tenant,
+                    stack: "local",
+                    namespace: `${tenant}-${LOCAL_ENV}-${app}`,
+                    platform: { name: "local", env: LOCAL_ENV },
+                }),
+                Description: `App registration reconciled from Zitadel (${tenant}/${app})`,
+            }));
+            const applications = await api(pat, "POST", `/management/v1/projects/${project.id}/apps/_search`, { query: { limit: 100 } }, org.id);
+            for (const application of applications?.result ?? []) {
+                const service = application?.name;
+                if (!service)
+                    continue;
+                await ssm.send(new PutParameterCommand({
+                    Name: `${base}/services/${service}`,
+                    Type: "String",
+                    Overwrite: true,
+                    Value: JSON.stringify({ replicas: 1, tier: "core" }),
+                    Description: `Service registration reconciled from Zitadel (${service})`,
+                }));
+            }
+        }
+    }
+    return { tenants, apps };
+}
+/**
+ * Ensure the app tenant's full auth config exists (org → project →
+ * application-per-service → credential secrets).
+ */
+export async function ensureAppTenantAuth(args) {
+    const pat = readSeederPat();
+    const orgId = await ensureOrg(pat, args.tenant);
+    const projectId = await ensureProject(pat, orgId, args.app);
+    const roles = args.roles ?? [];
+    await ensureProjectRoles(pat, orgId, projectId, roles);
+    const created = [];
+    for (const service of args.services) {
+        const result = await ensureServiceApp(pat, orgId, projectId, service);
+        if (result.created) {
+            await writeAuthSecret(args.tenant, args.app, service, {
+                clientId: result.clientId,
+                clientSecret: result.clientSecret,
+                issuer: "http://localhost:8080",
+                orgId,
+                projectId,
+            });
+            created.push(service);
+        }
+        else if (!(await authSecretExists(args.tenant, args.app, service))) {
+            // Zitadel persists across stack restarts but the local secret store is
+            // in-memory — heal the gap by regenerating the application's secret
+            // (Zitadel returns it only once, so a lost secret can't be re-read).
+            const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${result.appId}/api_config/_generate_client_secret`, {}, orgId);
+            await writeAuthSecret(args.tenant, args.app, service, {
+                clientId: result.clientId ?? "",
+                clientSecret: regenerated.clientSecret,
+                issuer: "http://localhost:8080",
+                orgId,
+                projectId,
+            });
+            logSuccess(`Regenerated credentials for '${service}' (local secret store was reset)`);
+            created.push(service);
+        }
+    }
+    if (await ensureM2mCaller(pat, args.tenant, args.app, orgId, projectId, roles)) {
+        created.push("m2m");
+    }
+    if (created.length === 0) {
+        logInfo(`Auth config for ${args.tenant}/${args.app} already provisioned`);
+    }
+    return { orgId, projectId, created };
+}
+//# sourceMappingURL=auth-provision.js.map

package/dist/src/commands/local/auth-provision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provision.js","sourceRoot":"","sources":["../../../../src/commands/local/auth-provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAwBjD,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IACzE,OAAO,QAAQ,MAAM,IAAI,SAAS,SAAS,GAAG,YAAY,OAAO,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY;IAChD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAC9D,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;KACvE,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,UAAU,CAAC,wBAAwB,IAAI,gBAAgB,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,cAAc,CAAC;AAChC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY,EAAmB,EAAE,CAClF,oBAAoB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;AAM9D;mCACmC;AACnC,KAAK,UAAU,gBAAgB,CAC7B,GAAW,EACX,KAAa,EACb,SAAiB,EACjB,OAAe;IAEf,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACxE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,WAAW,EAC/C,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,EAC/D,KAAK,CACN,CAAC;IACF,UAAU,CAAC,gCAAgC,OAAO,aAAa,CAAC,CAAC;IACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC3F,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,kBAAkB,CAC/B,GAAW,EACX,KAAa,EACb,SAAiB,EACjB,KAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,gBAAgB,EACpD,EAAE,EACF,KAAK,CACN,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,GAAG,CACP,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,QAAQ,EAC5C,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,EAClC,KAAK,CACN,CAAC;QACF,UAAU,CAAC,yBAAyB,GAAG,GAAG,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAW,EACX,MAAc,EACd,GAAW,EACX,KAAa,EACb,SAAiB,EACjB,KAAe;IAEf,MAAM,QAAQ,GAAG,GAAG,GAAG,MAAM,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,8BAA8B,EAC9B,EAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAClF,KAAK,CACN,CAAC;IACF,IAAI,MAAM,GAAuB,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzD,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,GAAG,EACH,MAAM,EACN,8BAA8B,EAC9B,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,GAAG,mBAAmB,EAAE,eAAe,EAAE,0BAA0B,EAAE,EAC1F,KAAK,CACN,CAAC;QACF,MAAM,GAAG,OAAO,CAAC,MAAgB,CAAC;QAClC,WAAW,GAAG,IAAI,CAAC;QACnB,UAAU,CAAC,yBAAyB,QAAQ,sBAAsB,CAAC,CAAC;IACtE,CAAC;IAED,uEAAuE;IACvE,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,MAAM,SAAS,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IACzG,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,GAA4C,CAAC;QACvD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,GAAG,CAAC;QAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,qCAAqC,EACrC,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAC7E,KAAK,CACN,CAAC;QACF,MAAM,OAAO,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAwB,MAAM,WAAW,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;YACxG,CAAC;YAAC,OAAO,SAAS,EAAE,CAAC;gBACnB,kEAAkE;gBAClE,iEAAiE;gBACjE,qEAAqE;gBACrE,qEAAqE;gBACrE,MAAM,EAAE,GAAG,SAAiC,CAAC;gBAC7C,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;oBAAE,MAAM,SAAS,CAAC;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,wBAAwB,MAAM,SAAS,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QACzF,MAAM,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,MAAM,EAAE,uBAAuB;YAC/B,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,GAAW,EAAE,OAAe;IAC1E,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACxG,MAAM,EAAE,GAAG,IAAI,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAChG,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,GAAW,EACX,OAAe,EACf,KAA6B;IAE7B,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,UAAU,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAKC;IAED,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,KAAc,EAAE,WAAmB,EAAE,EAAE,CAChE,GAAG,CAAC,IAAI,CACN,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CACjI,CAAC;IAEJ,yEAAyE;IACzE,MAAM,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAErC,0EAA0E;IAC1E,kDAAkD;IAClD,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,kBAAkB,IAAI,CAAC,MAAM,IAAI,SAAS,SAAS,IAAI,CAAC,GAAG,eAAe,CAAC;IACxF,MAAM,GAAG,CACP,IAAI,EACJ;QACE,IAAI,EAAE,IAAI,CAAC,GAAG;QACd,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,OAAO;QACd,SAAS;QACT,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;KAC5C,EACD,8BAA8B,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,qBAAqB,CAC3E,CAAC;IACF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,GAAG,CACP,GAAG,IAAI,aAAa,OAAO,EAAE,EAC7B;YACE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,oBAAoB,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,QAAQ,EAAE,CAAC;YACX,IAAI,EAAE,MAAM;YACZ,GAAG,CAAC,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE,EACD,+BAA+B,OAAO,GAAG,CAC1C,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,yEAAyE;IACzE,sEAAsE;IACtE,uEAAuE;IACvE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACvC,MAAM,GAAG,CACP,GAAG,IAAI,YAAY,OAAO,EAAE,EAC5B,EAAE,iBAAiB,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EACrD,8BAA8B,OAAO,GAAG,CACzC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,CACP,GAAG,IAAI,OAAO,EACd,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,EAAE,EAC/E,uCAAuC,CACxC,CAAC;IACF,UAAU,CAAC,0CAA0C,IAAI,EAAE,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B;IAChD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAE5C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IACzF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC;QACzB,0EAA0E;QAC1E,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,YAAY;YAAE,SAAS;QACjD,MAAM,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAErB,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,GAAG,EACH,MAAM,EACN,iCAAiC,EACjC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EACzB,GAAG,CAAC,EAAE,CACP,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC;YAC1B,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,kBAAkB,MAAM,IAAI,SAAS,SAAS,GAAG,eAAe,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CACzE,GAAG,EAAE,CAAC,IAAI,EACV,GAAG,EAAE,CAAC,KAAK,CACZ,CAAC;YACF,IAAI,MAAM;gBAAE,SAAS;YACrB,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,IAAI;gBACV,IAAI,EAAE,QAAQ;gBACd,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;oBACpB,IAAI,EAAE,GAAG;oBACT,MAAM;oBACN,KAAK,EAAE,OAAO;oBACd,SAAS,EAAE,GAAG,MAAM,IAAI,SAAS,IAAI,GAAG,EAAE;oBAC1C,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE;iBAC5C,CAAC;gBACF,WAAW,EAAE,6CAA6C,MAAM,IAAI,GAAG,GAAG;aAC3E,CAAC,CACH,CAAC;YACF,MAAM,YAAY,GAAG,MAAM,GAAG,CAC5B,GAAG,EACH,MAAM,EACN,2BAA2B,OAAO,CAAC,EAAE,eAAe,EACpD,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EACzB,GAAG,CAAC,EAAE,CACP,CAAC;YACF,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC;gBACrD,MAAM,OAAO,GAAG,WAAW,EAAE,IAAI,CAAC;gBAClC,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,GAAG,IAAI,aAAa,OAAO,EAAE;oBACnC,IAAI,EAAE,QAAQ;oBACd,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;oBACpD,WAAW,EAAE,iDAAiD,OAAO,GAAG;iBACzE,CAAC,CACH,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAuB;IAC/D,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE;gBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,MAAM,EAAE,uBAAuB;gBAC/B,KAAK;gBACL,SAAS;aACV,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;aAAM,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,MAAM,WAAW,GAAG,MAAM,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,SAAS,MAAM,CAAC,KAAK,qCAAqC,EAC9F,EAAE,EACF,KAAK,CACN,CAAC;YACF,MAAM,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE;gBACpD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,EAAE;gBAC/B,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,MAAM,EAAE,uBAAuB;gBAC/B,KAAK;gBACL,SAAS;aACV,CAAC,CAAC;YACH,UAAU,CAAC,gCAAgC,OAAO,kCAAkC,CAAC,CAAC;YACtF,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,mBAAmB,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACvC,CAAC"}

package/dist/src/commands/local/dev-local.d.ts

@@ -0,0 +1,97 @@
+/**
+ * Local DevOutput source for `mesh dev` (design §5.2, AC C1/C3).
+ *
+ * Instead of reading a deployed Pulumi stack, synthesize the same DevOutput
+ * shape from repo conventions and point every service at the running
+ * `mesh start` platform. Zero AWS credentials, zero VPN, zero Pulumi state —
+ * the app's code never knows it's local:
+ *   - Temporal → localhost:7233, namespace local-dev (seeded)
+ *   - Postgres → the local `app` database
+ *   - Zitadel  → http://localhost:8080 (seeded org/app/users)
+ *   - SpiceDB  → localhost:50051 (preshared key)
+ *   - AWS SDK  → ministack via AWS_ENDPOINT_URL (SSM/Secrets/S3 registry)
+ *
+ * Detection convention = what `mesh create-app` templates emit: immediate
+ * subdirectories of the app root whose package.json has a `dev` script
+ * (api/, worker/, web/, …); a single-package app root with its own `dev`
+ * script becomes one service.
+ */
+/** Matches dev.ts's DevEnvVar/DevService/DevOutput shapes (kept structural —
+ * dev.ts owns the canonical interfaces). */
+interface LocalDevEnvVar {
+    value: string;
+}
+interface LocalDevService {
+    src: string;
+    port: number;
+    command: string[];
+    env?: Record<string, LocalDevEnvVar>;
+}
+export interface LocalDevOutput {
+    platform: {
+        tenant: string;
+        env: string;
+    };
+    app?: string;
+    stack: string;
+    services: Record<string, LocalDevService>;
+    tunnels: Record<string, never>;
+}
+export declare const LOCAL_STACK_NAME = "local";
+/**
+ * The app's namespace, exactly the name the cloud gives it in K8s AND
+ * Temporal ({tenant}-{env}-{app}) — the Hub resolves both from this one
+ * convention, so local runs are addressable with zero translation.
+ */
+export declare function localAppNamespace(tenant: string, appName: string): string;
+/** The OTLP log shipper (assets/log-shipper.mjs) each local service's
+ * launch pipeline pipes through — ships stdout to the stack's collector
+ * with the hosted k8s_* attribution. */
+export declare function logShipperPath(): string;
+/**
+ * OTel SDK bootstrap — the local analog of the OTel Operator's pod
+ * injection: when the service ships `@opentelemetry/auto-instrumentations-
+ * node` (the templates declare it), the platform injects the `--import`
+ * register hook + exporter env, and HTTP/fetch/gRPC spans flow to the
+ * stack's collector → Tempo → the Hub's Traces views. Apps without the
+ * package run untouched.
+ */
+export declare function autoInstrumentationEnv(appRoot: string, src: string): Record<string, LocalDevEnvVar>;
+/** Hosted-parity resource attribution for a local service — what the
+ * in-cluster k8sattributes processor stamps. */
+export declare function otelEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
+/** Endpoints of the running `mesh start` platform, as service env. */
+export declare function localPlatformEnv(tenant: string, appName: string, serviceName: string): Record<string, LocalDevEnvVar>;
+/**
+ * Detect runnable services by template convention: immediate subdirectories
+ * with a package.json `dev` script; falls back to the app root itself when
+ * it is a single-package app.
+ */
+export declare function detectLocalServices(appRoot: string): Record<string, {
+    src: string;
+}>;
+/** Synthesize the DevOutput `mesh dev` would otherwise read from Pulumi.
+ * `tenant` is the app tenant (detectLocalTenant) — it scopes the app's
+ * namespace ({tenant}-{env}-{app}) for Temporal, logs, and traces.
+ * `opts.mocks` (mesh dev --externals) appends declared mock services and injects
+ * their ExternalService credential prefixes into every app service. */
+export declare function buildLocalDevOutput(appRoot: string, tenant: string, opts?: {
+    mocks?: Record<string, import("./mocks.js").LocalMockDecl>;
+}): LocalDevOutput;
+/**
+ * Whether the app is backed by a Pulumi program: its own (Pulumi.yaml or a
+ * Pulumi.<stack>.yaml stack config in the app dir), or a monorepo ROOT
+ * program above it (walk up to the repo boundary — .git/pnpm-workspace).
+ * Apps like apps/hub deploy via a root program and have no per-app
+ * Pulumi.yaml; they must NOT default into `mesh dev` local mode.
+ */
+export declare function hasStackBacking(appRoot: string): boolean;
+/**
+ * The app's tenant, for auth provisioning: `mesh:tenant` from the app's
+ * Pulumi stack config when present (templates write it), else "local".
+ */
+export declare function detectLocalTenant(appRoot: string): string;
+/** The local platform must be up before `mesh dev` can wire services to it. */
+export declare function ensureLocalPlatformRunning(): Promise<void>;
+export {};
+//# sourceMappingURL=dev-local.d.ts.map

package/dist/src/commands/local/dev-local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-local.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/dev-local.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAcH;4CAC4C;AAC5C,UAAU,cAAc;IACtB,KAAK,EAAE,MAAM,CAAC;CACf;AACD,UAAU,eAAe;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;CACtC;AACD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAChC;AAED,eAAO,MAAM,gBAAgB,UAAU,CAAC;AAGxC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED;;wCAEwC;AACxC,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAcnG;AAED;gDACgD;AAChD,wBAAgB,OAAO,CACrB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAShC;AAED,sEAAsE;AACtE,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAmChC;AAaD;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAYpF;AAED;;;;uEAIuE;AACvE,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,YAAY,EAAE,aAAa,CAAC,CAAA;CAAO,GACxE,cAAc,CA6GhB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAexD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASzD;AAED,+EAA+E;AAC/E,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,IAAI,CAAC,CAQhE"}