@mesh-tech/mesh-cli 0.1.0 → 0.12.0

package/dist/src/utils/aws-auth.js

@@ -0,0 +1,527 @@
+/**
+ * Shared AWS credential resolution for mesh CLI commands.
+ *
+ * Three-tier resolution:
+ *   1. Existing AWS credentials in environment (CI/CD) → use directly
+ *   2. Zitadel JWT via `mesh login` → AssumeRoleWithWebIdentity
+ *   3. Fallback → AssumeRole via current AWS session (SSO)
+ *
+ * Uses @aws-sdk/client-sts directly — does NOT shell out to the `aws` CLI
+ * binary, so the binary is not a runtime requirement.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import { AssumeRoleCommand, AssumeRoleWithWebIdentityCommand, GetCallerIdentityCommand, STSClient, } from "@aws-sdk/client-sts";
+import { logInfo, logSuccess, logWarn } from "./log.js";
+import { isExpiredAwsTokenMessage, SSO_LOGIN_FIX } from "./auth-preflight.js";
+import { ensureLogin } from "../commands/login.js";
+const DEFAULT_REGION = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
+/**
+ * Derive the platform context key (e.g., "mesh.dev") from a Pulumi stack config.
+ *
+ * Reads `mesh:platform` from Pulumi.<stack>.yaml. Supports both formats:
+ *   mesh:platform: '{"env":"dev","name":"mesh"}'    → "mesh.dev"
+ *   mesh:platform:
+ *     name: mesh
+ *     env: dev                                       → "mesh.dev"
+ */
+export function derivePlatformContext(appRoot, stack) {
+    const configFile = path.join(appRoot, `Pulumi.${stack}.yaml`);
+    if (!fs.existsSync(configFile))
+        return null;
+    const content = fs.readFileSync(configFile, "utf-8");
+    // Try JSON-encoded string first
+    const jsonMatch = content.match(/mesh:platform:\s*'(\{[^']+\})'/);
+    if (jsonMatch) {
+        try {
+            const parsed = JSON.parse(jsonMatch[1]);
+            if (parsed.name && parsed.env)
+                return `${parsed.name}.${parsed.env}`;
+        }
+        catch {
+            // fall through
+        }
+    }
+    // Try YAML block format
+    const nameMatch = content.match(/mesh:platform:[\s\S]*?name:\s*(\S+)/);
+    const envMatch = content.match(/mesh:platform:[\s\S]*?env:\s*(\S+)/);
+    if (nameMatch && envMatch) {
+        return `${nameMatch[1]}.${envMatch[1]}`;
+    }
+    return null;
+}
+/**
+ * Quote a `credential_process` command token for AWS config-file syntax: the
+ * AWS SDK/CLI split the value on spaces, honoring double quotes — so any
+ * token containing whitespace (e.g. a mesh binary under "Application
+ * Support") must be wrapped in double quotes or the command is mis-split.
+ * Tokens without whitespace are left bare (byte-identical to the historic
+ * output).
+ */
+function quoteCredProcessToken(token) {
+    return /\s/.test(token) ? `"${token}"` : token;
+}
+/**
+ * Resolve a STABLE absolute path to the running `mesh` entrypoint for
+ * embedding in a `credential_process` line — or fall back to plain `mesh`
+ * (PATH lookup) when `argv1` is missing, doesn't exist on disk, or lives in
+ * a transient location (`npx` cache / OS temp dir): a profile pointing at a
+ * path that evaporates breaks every later AWS call with a cryptic
+ * credential_process error. The fallback is announced via `logWarn` so the
+ * user knows to install mesh-cli globally.
+ */
+export function resolveStableMeshBin(argv1, deps = {}) {
+    const exists = deps.exists ?? fs.existsSync;
+    const warn = deps.warn ?? logWarn;
+    let resolved = argv1 ? path.resolve(argv1) : undefined;
+    // Under the source launcher the CLI process's argv[1] is a TypeScript entry
+    // (bin/mesh.ts), which plain node cannot execute (type-stripped .js-suffixed
+    // imports fail with ERR_MODULE_NOT_FOUND). Point the profile at the sibling
+    // .mjs launcher instead — it bootstraps tsx itself, from any cwd/env. Keyed on
+    // the `.ts` extension + a derived sibling (not the literal `mesh.ts`), so a
+    // rename of the source entry doesn't silently revert to a broken value. Assign
+    // unconditionally: if the sibling is absent the existing !exists guard below
+    // reports it by name (rather than collapsing into the "argv1 missing" branch).
+    if (resolved && /\.ts$/.test(resolved)) {
+        resolved = path.join(path.dirname(resolved), path.basename(resolved, ".ts") + ".mjs");
+    }
+    const transient = resolved !== undefined &&
+        (/[\\/]_npx[\\/]/.test(resolved) || /^\/(?:private\/)?(?:tmp|var\/folders)\//.test(resolved));
+    if (!resolved || !exists(resolved) || transient) {
+        warn(`credential_process cannot reference a stable mesh binary` +
+            (resolved ? ` (${resolved} is transient or missing)` : "") +
+            ` — falling back to \`mesh\` on PATH. Install mesh-cli globally so the profile keeps refreshing.`);
+        return "mesh";
+    }
+    return resolved;
+}
+/**
+ * Render an AWS config-file `[profile …]` block whose `credential_process`
+ * re-invokes `mesh login … --credential-process`, so the AWS SDK's default
+ * provider chain auto-refreshes the underlying STS triple (the `mesh login`
+ * process re-issues the Zitadel token as needed).
+ *
+ * Shared by `mesh dev` (child services) and `mesh login --export` so both
+ * produce byte-identical profiles. Pure — no I/O. The `region` line is
+ * emitted only when `region` is a non-empty string. Includes a trailing
+ * newline. The binary path and role ARN are double-quoted when they contain
+ * whitespace (AWS config command-splitting rules).
+ */
+export function renderCredentialProcessProfile(args) {
+    const lines = [
+        `[profile ${args.profileName}]`,
+        `credential_process = ${quoteCredProcessToken(args.meshBin)} login ${quoteCredProcessToken(args.context)} --credential-process --role ${quoteCredProcessToken(args.roleArn)}`,
+    ];
+    if (args.region)
+        lines.push(`region = ${args.region}`);
+    return lines.join("\n") + "\n";
+}
+// Marker lines delimiting the mesh-managed section of the user's AWS config
+// file. Follows the `conda init` / `nvm` managed-block convention so the
+// section is discoverable and safely re-writable. The START marker carries
+// the context (one managed section per context); the END marker is shared.
+const MANAGED_START_PREFIX = `# >>> mesh-cli managed profile `;
+const MANAGED_START = (context) => `${MANAGED_START_PREFIX}${context} >>>`;
+const MANAGED_END = `# <<< mesh-cli managed <<<`;
+/**
+ * Given a managed START marker for OUR context whose matching END is missing
+ * (orphaned — e.g. the user deleted the END line), find the index of the first
+ * character we should NOT reclaim. Conservative by construction: because
+ * `MANAGED_END` is a shared literal across contexts, an END found further down
+ * may belong to ANOTHER context's healthy section — so we never scan to a
+ * distant END or to EOF. We only reclaim the lines the mesh CLI provably
+ * wrote (see `renderCredentialProcessProfile`): one `[profile …]` header
+ * followed by contiguous `key = value` lines, stopping at the first blank
+ * line, comment/marker, second profile header, or `boundIdx` (the next
+ * managed START of any context), whichever comes first.
+ *
+ * @param afterStart index just past OUR START marker text (before its newline)
+ * @param boundIdx   index of the next managed START marker after ours, or -1
+ */
+function orphanedSectionTail(existing, afterStart, boundIdx) {
+    const limit = boundIdx === -1 ? existing.length : boundIdx;
+    let idx = afterStart;
+    if (idx >= limit || existing[idx] !== "\n")
+        return Math.min(idx, limit);
+    idx++; // consume the newline terminating our START marker line
+    let claimedHeader = false;
+    while (idx < limit) {
+        const nl = existing.indexOf("\n", idx);
+        const lineEnd = nl === -1 || nl > limit ? limit : nl;
+        const line = existing.slice(idx, lineEnd);
+        const ours = claimedHeader
+            ? /^[A-Za-z_][A-Za-z0-9_]*\s*=/.test(line) // key = value continuation
+            : /^\[profile [^\]]+\]\s*$/.test(line); // exactly one profile header
+        if (!ours)
+            return idx;
+        claimedHeader = true;
+        idx = lineEnd >= limit ? limit : lineEnd + 1;
+    }
+    return limit;
+}
+/**
+ * Insert or replace the mesh-managed `[profile …]` section for `context` in
+ * the user's AWS config content, preserving ALL other content byte-for-byte
+ * (this is the user's real ~/.aws/config — clobbering it breaks their other
+ * profiles). Pure — no I/O; exported for unit testing.
+ *
+ * - Existing managed section for this context → replaced in place.
+ * - Orphaned START (matching END lost) → only the contiguous profile block
+ *   that is provably ours is reclaimed; other contexts' sections and user
+ *   content below are preserved (see `orphanedSectionTail`).
+ * - No section → appended, separated by a single blank line (and a trailing
+ *   newline is added to the existing content if it lacks one).
+ */
+export function upsertManagedAwsConfigSection(existing, context, profileBlock) {
+    const body = profileBlock.endsWith("\n") ? profileBlock : profileBlock + "\n";
+    const section = `${MANAGED_START(context)}\n${body}${MANAGED_END}\n`;
+    const startIdx = existing.indexOf(MANAGED_START(context));
+    if (startIdx !== -1) {
+        const afterStart = startIdx + MANAGED_START(context).length;
+        const endIdx = existing.indexOf(MANAGED_END, afterStart);
+        // MANAGED_END is a shared literal across contexts, so the first END below
+        // our START is only OURS if no other context's START sits in between —
+        // otherwise that END closes the OTHER section and scanning to it would
+        // swallow that section whole.
+        const foreignIdx = existing.indexOf(MANAGED_START_PREFIX, afterStart);
+        let tail;
+        if (endIdx !== -1 && (foreignIdx === -1 || endIdx < foreignIdx)) {
+            // Healthy section: replace START..END. Swallow a single trailing
+            // newline of the old section so replacement is idempotent (the new
+            // section brings its own).
+            const tailIdx = endIdx + MANAGED_END.length;
+            tail = existing[tailIdx] === "\n" ? tailIdx + 1 : tailIdx;
+        }
+        else {
+            // Orphaned START (our END missing). Reclaim only the contiguous
+            // profile block that is provably ours — never foreign sections, user
+            // profiles below, or everything to EOF.
+            tail = orphanedSectionTail(existing, afterStart, foreignIdx);
+        }
+        return existing.slice(0, startIdx) + section + existing.slice(tail);
+    }
+    if (existing.length === 0)
+        return section;
+    const sep = existing.endsWith("\n\n") ? "" : existing.endsWith("\n") ? "\n" : "\n\n";
+    return existing + sep + section;
+}
+function newStsClient() {
+    return new STSClient({ region: DEFAULT_REGION });
+}
+/** Pull AWS env vars out of an STS Credentials struct; null if any field is missing. */
+function toEnv(credentials) {
+    const { AccessKeyId, SecretAccessKey, SessionToken } = credentials;
+    if (!AccessKeyId || !SecretAccessKey || !SessionToken)
+        return null;
+    return {
+        AWS_ACCESS_KEY_ID: AccessKeyId,
+        AWS_SECRET_ACCESS_KEY: SecretAccessKey,
+        AWS_SESSION_TOKEN: SessionToken,
+    };
+}
+/**
+ * IAM rejects a DurationSeconds higher than the role's MaxSessionDuration with
+ * a ValidationError. We detect that and fall back to a one-hour session.
+ */
+function isMaxSessionDurationError(err) {
+    if (!(err instanceof Error))
+        return false;
+    const message = err.message ?? "";
+    return (message.includes("MaxSessionDuration") ||
+        message.includes("DurationSeconds"));
+}
+/** Assume an IAM role via current AWS session and return credentials as env vars. */
+export async function assumeRole(roleArn, sessionName = "mesh-cli", durationSeconds = 43200) {
+    const sts = newStsClient();
+    for (const duration of [durationSeconds, 3600]) {
+        try {
+            const resp = await sts.send(new AssumeRoleCommand({
+                RoleArn: roleArn,
+                RoleSessionName: sessionName,
+                DurationSeconds: duration,
+            }));
+            if (!resp.Credentials)
+                return null;
+            return toEnv(resp.Credentials);
+        }
+        catch (err) {
+            if (!isMaxSessionDurationError(err) || duration === 3600) {
+                const message = err instanceof Error ? err.message : String(err);
+                logWarn(`AssumeRole failed: ${message}`);
+                // Name the SSO fix when the ambient session is the problem — the raw
+                // STS error never mentions `aws sso login` (MESH-2479).
+                if (isExpiredAwsTokenMessage(message)) {
+                    logWarn(`  Your AWS SSO session looks expired or missing — refresh with: ${SSO_LOGIN_FIX}`);
+                }
+                return null;
+            }
+            // Retry with shorter duration
+        }
+    }
+    return null;
+}
+/**
+ * Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity, returning
+ * the full STS credential struct (including `Expiration`) rather than the
+ * env-var shape. Used by callers that need to track/refresh expiry (e.g.
+ * `credential_process`).
+ */
+export async function assumeRoleCredentials(roleArn, idToken, sessionName, durationSeconds = 43200) {
+    // STS WebIdentity does not require ambient AWS credentials — the JWT proves identity.
+    const sts = newStsClient();
+    for (const duration of [durationSeconds, 3600]) {
+        try {
+            const resp = await sts.send(new AssumeRoleWithWebIdentityCommand({
+                RoleArn: roleArn,
+                RoleSessionName: sessionName,
+                WebIdentityToken: idToken,
+                DurationSeconds: duration,
+            }));
+            if (!resp.Credentials)
+                return null;
+            const env = toEnv(resp.Credentials);
+            if (!env)
+                return null;
+            return {
+                // `env` is a `Record<string, string>` (index-signature typed), so
+                // `noUncheckedIndexedAccess` widens these to `string | undefined`
+                // even though `toEnv` guarantees they're set — assert accordingly.
+                AccessKeyId: env.AWS_ACCESS_KEY_ID,
+                SecretAccessKey: env.AWS_SECRET_ACCESS_KEY,
+                SessionToken: env.AWS_SESSION_TOKEN,
+                Expiration: resp.Credentials.Expiration.toISOString(),
+            };
+        }
+        catch (err) {
+            if (!isMaxSessionDurationError(err) || duration === 3600) {
+                logWarn(`AssumeRoleWithWebIdentity failed: ${err instanceof Error ? err.message : String(err)}`);
+                return null;
+            }
+            // Retry with shorter duration
+        }
+    }
+    return null;
+}
+/** Assume role using a Zitadel JWT via AssumeRoleWithWebIdentity. */
+export async function assumeRoleWithWebIdentity(roleArn, idToken, sessionName, durationSeconds = 43200) {
+    const creds = await assumeRoleCredentials(roleArn, idToken, sessionName, durationSeconds);
+    if (!creds)
+        return null;
+    return toEnv(creds);
+}
+/**
+ * Extract the `iss` claim from a JWT without ever throwing — malformed or
+ * corrupt tokens (e.g. a damaged `~/.config/mesh/credentials.json`) yield
+ * `undefined`. The failure-diagnostic paths use this; a decode that throws
+ * there would crash before the diagnostic prints, which is exactly the
+ * failure class MESH-2515 removes.
+ */
+export function tokenIssuer(token) {
+    const iss = decodeJwtPayload(token)?.iss;
+    return typeof iss === "string" && iss ? iss : undefined;
+}
+/**
+ * Explain an AssumeRoleWithWebIdentity failure in platform terms: which login
+ * session (context + token issuer) tried to assume which role, in which AWS
+ * account. STS's "web identity token could not be validated" reads like an
+ * IAM/expiry problem, but the usual cause is a context whose issuer the role's
+ * account simply doesn't trust — e.g. a `mesh.dev` session against a role in a
+ * `trabian`-platform account (MESH-2515). stderr only — callers in
+ * `--credential-process` mode must keep stdout JSON-clean.
+ *
+ * `format: "inline"` renders the same facts as one line, for detail fields
+ * that get interpolated mid-sentence (the doctor/preflight cred probe). Both
+ * forms keep the `AssumeRoleWithWebIdentity failed` prefix the doctor plan
+ * documents as the detail capture.
+ */
+export function describeAssumeFailure(opts, format = "block") {
+    const account = /^arn:aws:iam::(\d+):/.exec(opts.roleArn)?.[1];
+    const head = `AssumeRoleWithWebIdentity failed for ${opts.roleArn}` +
+        (account ? ` (account ${account})` : "");
+    const session = opts.context
+        ? `mesh login context '${opts.context}'` + (opts.issuer ? ` (issuer ${opts.issuer})` : "")
+        : opts.issuer
+            ? `issuer ${opts.issuer}`
+            : undefined;
+    if (format === "inline") {
+        return (head +
+            (session ? ` via ${session}` : "") +
+            " — if the role's account doesn't trust this issuer, this is a context mismatch" +
+            " (wrong `mesh:platform`), not an IAM permission problem");
+    }
+    const lines = [head];
+    if (session)
+        lines.push(`  Session: ${session}`);
+    lines.push("  If the role's account does not trust this issuer, you are logged into the", "  wrong context for this stack — check `mesh:platform` in the app's Pulumi", "  config and `mesh login <platform>.<env>` accordingly. (This is a context", "  mismatch, not an IAM permission problem.)");
+    return lines.join("\n");
+}
+/** Format STS credentials as AWS `credential_process` JSON (Version 1). */
+export function toCredentialProcessJson(creds) {
+    return JSON.stringify({
+        Version: 1,
+        AccessKeyId: creds.AccessKeyId,
+        SecretAccessKey: creds.SecretAccessKey,
+        SessionToken: creds.SessionToken,
+        Expiration: creds.Expiration,
+    });
+}
+/**
+ * Ask "is there a working AWS connection right now?" — nothing more.
+ *
+ * Deliberately NOT `resolveAwsCredentials`: that one answers "get me credentials
+ * for role X" and has an opinion about how they were obtained. This one runs
+ * GetCallerIdentity through the SDK's default provider chain and reports whatever
+ * it finds, so a static key/secret pair in `~/.aws/credentials` counts exactly as
+ * much as an SSO session or a Zitadel-minted role. Returns null when the chain
+ * yields nothing usable.
+ */
+export async function probeAwsIdentity() {
+    try {
+        const out = await newStsClient().send(new GetCallerIdentityCommand({}));
+        if (!out.Arn || !out.Account)
+            return null;
+        return {
+            arn: out.Arn,
+            accountId: out.Account,
+            source: process.env.AWS_ACCESS_KEY_ID ? "environment" : "profile",
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode a Zitadel-issued JWT payload (no signature check — we only
+ * use it for role-selection hints in mesh-cli; the actual STS calls
+ * still verify against the OIDC provider). Returns null on malformed
+ * input.
+ */
+function decodeJwtPayload(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts[1])
+        return null;
+    try {
+        return JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Pick the AWS role ARN to assume based on Zitadel claims.
+ *
+ * Zitadel emits project roles under
+ * `urn:zitadel:iam:org:project:<projectId>:roles` as a nested object
+ * keyed by role name. We treat the presence of `mesh.platform:admin`
+ * (or any role listed in `meshcli.adminRoles` in config) as the
+ * signal to assume the broader admin role when the caller has
+ * configured one.
+ *
+ * Returns `defaultRole` when no admin role is configured, no admin
+ * claim is present, or the JWT can't be parsed. This keeps existing
+ * deployments working without a config change.
+ *
+ * The admin AWS role's IAM trust policy is expected to gate
+ * assumption on the same Zitadel claim in production (so the CLI
+ * preference can't be spoofed). That setup is its own change — see
+ * TODO(mesh-zitadel-aws-role-mapping).
+ */
+export function selectRoleForCaller(idToken, options) {
+    if (!options.adminRole || !idToken)
+        return options.defaultRole;
+    const adminRoles = options.adminClaimRoles ?? ["mesh.platform:admin"];
+    const claims = decodeJwtPayload(idToken);
+    if (!claims)
+        return options.defaultRole;
+    // Find the project-roles claim — key shape:
+    //   urn:zitadel:iam:org:project:<projectId>:roles
+    // Multiple projects can emit roles; we walk all matching keys.
+    for (const [key, value] of Object.entries(claims)) {
+        if (!key.startsWith("urn:zitadel:iam:org:project:"))
+            continue;
+        if (!key.endsWith(":roles"))
+            continue;
+        if (!value || typeof value !== "object")
+            continue;
+        const claimedRoles = Object.keys(value);
+        for (const target of adminRoles) {
+            if (claimedRoles.includes(target))
+                return options.adminRole;
+        }
+    }
+    return options.defaultRole;
+}
+/**
+ * Resolve AWS credentials using the three-tier strategy.
+ *
+ * @param roleArn       The IAM role to assume (from mesh:deployerRole)
+ * @param appRoot       Pulumi app root directory
+ * @param stack         Pulumi stack name
+ * @returns Resolved credentials, or null if all methods fail
+ *
+ * To inherit a broader role based on Zitadel claims, call
+ * `selectRoleForCaller` first and pass the result as `roleArn`.
+ */
+export async function resolveAwsCredentials(roleArn, appRoot, stack) {
+    const roleName = roleArn.split("/").pop() ?? roleArn;
+    // Path 1: Existing AWS credentials in environment (CI/CD)
+    if (process.env.AWS_ACCESS_KEY_ID && process.env.AWS_SESSION_TOKEN) {
+        logInfo("Using existing AWS credentials from environment");
+        return {
+            env: {
+                AWS_ACCESS_KEY_ID: process.env.AWS_ACCESS_KEY_ID,
+                AWS_SECRET_ACCESS_KEY: process.env.AWS_SECRET_ACCESS_KEY ?? "",
+                AWS_SESSION_TOKEN: process.env.AWS_SESSION_TOKEN,
+            },
+            method: "environment",
+        };
+    }
+    // Path 2: Zitadel JWT via mesh login → AssumeRoleWithWebIdentity.
+    // Non-interactive here: only a valid CACHED session is used. An interactive
+    // device-flow before the SSO fallback would stall headless runs (CI,
+    // `mesh dev` with a working AWS_PROFILE) for minutes polling device codes
+    // nobody sees — SSO gets its chance first; interactive login is Path 4.
+    const platformContext = derivePlatformContext(appRoot, stack);
+    if (platformContext) {
+        const meshCreds = await ensureLogin(platformContext, { interactive: false });
+        if (meshCreds) {
+            const sessionName = (meshCreds.email ?? "mesh-cli")
+                .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+                .slice(0, 64);
+            logInfo(`Assuming ${roleName} via Zitadel (${meshCreds.email ?? platformContext})`);
+            const creds = await assumeRoleWithWebIdentity(roleArn, meshCreds.idToken, sessionName);
+            if (creds) {
+                logSuccess(`Assumed ${roleName} via Zitadel`);
+                return { env: creds, method: "zitadel" };
+            }
+            logWarn("Zitadel JWT auth failed — falling back to AWS SSO.\n" +
+                `  (Try: mesh login ${platformContext})`);
+        }
+    }
+    // Path 3: Fallback — AssumeRole via current AWS session (SSO)
+    logInfo(`Assuming ${roleName} via AWS SSO`);
+    const creds = await assumeRole(roleArn, "mesh-cli");
+    if (creds) {
+        logSuccess(`Assumed ${roleName}`);
+        return { env: creds, method: "sso" };
+    }
+    // Path 4: Last resort — interactive Zitadel login (device/browser). Only
+    // reached when there's no env cred, no cached session, and no working SSO,
+    // i.e. a human at a terminal who genuinely needs to log in.
+    if (platformContext && process.stdout.isTTY) {
+        const meshCreds = await ensureLogin(platformContext);
+        if (meshCreds) {
+            const sessionName = (meshCreds.email ?? "mesh-cli")
+                .replace(/[^a-zA-Z0-9=,.@-]/g, "_")
+                .slice(0, 64);
+            logInfo(`Assuming ${roleName} via Zitadel (${meshCreds.email ?? platformContext})`);
+            const zCreds = await assumeRoleWithWebIdentity(roleArn, meshCreds.idToken, sessionName);
+            if (zCreds) {
+                logSuccess(`Assumed ${roleName} via Zitadel`);
+                return { env: zCreds, method: "zitadel" };
+            }
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=aws-auth.js.map

package/dist/src/utils/aws-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws-auth.js","sourceRoot":"","sources":["../../../src/utils/aws-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,iBAAiB,EACjB,gCAAgC,EAChC,wBAAwB,EACxB,SAAS,GACV,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEnD,MAAM,cAAc,GAClB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;AAE1E;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,KAAa;IAClE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAErD,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAClE,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG;gBAAE,OAAO,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACrE,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAyB,EACzB,OAA0E,EAAE;IAE5E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,UAAU,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;IAClC,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,6EAA6E;IAC7E,+EAA+E;IAC/E,IAAI,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvC,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,SAAS,GACb,QAAQ,KAAK,SAAS;QACtB,CAAC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,yCAAyC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QAChD,IAAI,CACF,0DAA0D;YACxD,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,iGAAiG,CACpG,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAM9C;IACC,MAAM,KAAK,GAAG;QACZ,YAAY,IAAI,CAAC,WAAW,GAAG;QAC/B,wBAAwB,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;KAC9K,CAAC;IACF,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACjC,CAAC;AAED,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAC/D,MAAM,aAAa,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,GAAG,oBAAoB,GAAG,OAAO,MAAM,CAAC;AACnF,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,SAAS,mBAAmB,CAAC,QAAgB,EAAE,UAAkB,EAAE,QAAgB;IACjF,MAAM,KAAK,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC3D,IAAI,GAAG,GAAG,UAAU,CAAC;IACrB,IAAI,GAAG,IAAI,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACxE,GAAG,EAAE,CAAC,CAAC,wDAAwD;IAC/D,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,OAAO,GAAG,GAAG,KAAK,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,aAAa;YACxB,CAAC,CAAC,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,2BAA2B;YACtE,CAAC,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,6BAA6B;QACvE,IAAI,CAAC,IAAI;YAAE,OAAO,GAAG,CAAC;QACtB,aAAa,GAAG,IAAI,CAAC;QACrB,GAAG,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAC3C,QAAgB,EAChB,OAAe,EACf,YAAoB;IAEpB,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,GAAG,IAAI,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,GAAG,WAAW,IAAI,CAAC;IAErE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACzD,0EAA0E;QAC1E,uEAAuE;QACvE,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC;QACtE,IAAI,IAAY,CAAC;QACjB,IAAI,MAAM,KAAK,CAAC,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;YAChE,iEAAiE;YACjE,mEAAmE;YACnE,2BAA2B;YAC3B,MAAM,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;YAC5C,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC5D,CAAC;aAAM,CAAC;YACN,gEAAgE;YAChE,qEAAqE;YACrE,wCAAwC;YACxC,IAAI,GAAG,mBAAmB,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IACrF,OAAO,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC;AAClC,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AACnD,CAAC;AAED,wFAAwF;AACxF,SAAS,KAAK,CAAC,WAId;IACC,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC;IACnE,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO;QACL,iBAAiB,EAAE,WAAW;QAC9B,qBAAqB,EAAE,eAAe;QACtC,iBAAiB,EAAE,YAAY;KAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,yBAAyB,CAAC,GAAY;IAC7C,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACtC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CACpC,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAe,EACf,cAAsB,UAAU,EAChC,kBAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CACzB,IAAI,iBAAiB,CAAC;gBACpB,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,WAAW;gBAC5B,eAAe,EAAE,QAAQ;aAC1B,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YACnC,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACzD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;gBACzC,qEAAqE;gBACrE,wDAAwD;gBACxD,IAAI,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO,CAAC,mEAAmE,aAAa,EAAE,CAAC,CAAC;gBAC9F,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAAe,EACf,WAAmB,EACnB,kBAA0B,KAAK;IAE/B,sFAAsF;IACtF,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,QAAQ,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CACzB,IAAI,gCAAgC,CAAC;gBACnC,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,WAAW;gBAC5B,gBAAgB,EAAE,OAAO;gBACzB,eAAe,EAAE,QAAQ;aAC1B,CAAC,CACH,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACpC,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO;gBACL,kEAAkE;gBAClE,kEAAkE;gBAClE,mEAAmE;gBACnE,WAAW,EAAE,GAAG,CAAC,iBAAkB;gBACnC,eAAe,EAAE,GAAG,CAAC,qBAAsB;gBAC3C,YAAY,EAAE,GAAG,CAAC,iBAAkB;gBACpC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,UAAW,CAAC,WAAW,EAAE;aACvD,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACzD,OAAO,CACL,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YACD,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,OAAe,EACf,WAAmB,EACnB,kBAA0B,KAAK;IAE/B,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;IAC1F,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAIC,EACD,SAA6B,OAAO;IAEpC,MAAM,OAAO,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,IAAI,GACR,wCAAwC,IAAI,CAAC,OAAO,EAAE;QACtD,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO;QAC1B,CAAC,CAAC,uBAAuB,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,CAAC,CAAC,IAAI,CAAC,MAAM;YACX,CAAC,CAAC,UAAU,IAAI,CAAC,MAAM,EAAE;YACzB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CACL,IAAI;YACJ,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClC,gFAAgF;YAChF,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CACR,6EAA6E,EAC7E,4EAA4E,EAC5E,4EAA4E,EAC5E,6CAA6C,CAC9C,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,uBAAuB,CAAC,KAAe;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,OAAO,EAAE,CAAC;QACV,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;AACL,CAAC;AAiBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC;QACxE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,GAAG,CAAC,OAAO;YACtB,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS;SAClE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,KAAa;IACrC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAsB,EACtB,OASC;IAED,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC;IAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,eAAe,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,WAAW,CAAC;IAExC,4CAA4C;IAC5C,kDAAkD;IAClD,+DAA+D;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,8BAA8B,CAAC;YAAE,SAAS;QAC9D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAgC,CAAC,CAAC;QACnE,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAChC,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,OAAO,CAAC,SAAS,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC;AAC7B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,OAAe,EACf,KAAa;IAEb,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;IAErD,0DAA0D;IAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;QACnE,OAAO,CAAC,iDAAiD,CAAC,CAAC;QAC3D,OAAO;YACL,GAAG,EAAE;gBACH,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;gBAChD,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE;gBAC9D,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB;aACjD;YACD,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,4EAA4E;IAC5E,qEAAqE;IACrE,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,eAAe,GAAG,qBAAqB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,UAAU,CAAC;iBAChD,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;iBAClC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,YAAY,QAAQ,iBAAiB,SAAS,CAAC,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;YAEpF,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACvF,IAAI,KAAK,EAAE,CAAC;gBACV,UAAU,CAAC,WAAW,QAAQ,cAAc,CAAC,CAAC;gBAC9C,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC3C,CAAC;YAED,OAAO,CACL,sDAAsD;gBACpD,sBAAsB,eAAe,GAAG,CAC3C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,OAAO,CAAC,YAAY,QAAQ,cAAc,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;QAClC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvC,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4DAA4D;IAC5D,IAAI,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,eAAe,CAAC,CAAC;QACrD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,UAAU,CAAC;iBAChD,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC;iBAClC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,YAAY,QAAQ,iBAAiB,SAAS,CAAC,KAAK,IAAI,eAAe,GAAG,CAAC,CAAC;YACpF,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YACxF,IAAI,MAAM,EAAE,CAAC;gBACX,UAAU,CAAC,WAAW,QAAQ,cAAc,CAAC,CAAC;gBAC9C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/src/utils/bastion.d.ts

@@ -32,7 +32,7 @@ export interface BastionInfo {
  * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
  * for backward compatibility.
  */
-export declare function getPlatformBastionInfo(tenant: string, platformEnv: string): Promise<PlatformBastionInfo>;
+export declare function getPlatformBastionInfo(tenant: string, platformEnv: string, region?: string): Promise<PlatformBastionInfo>;
 /**
  * Get bastion info from SSM parameter store (legacy format).
  * Reads from /mesh/{tenant}/{platformEnv}/platform-bastion and extracts RDS info.

package/dist/src/utils/bastion.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bastion.d.ts","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,mBAAmB,CAAC,CAyD9B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB"}
+{"version":3,"file":"bastion.d.ts","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,mBAAmB,CAAC,CA2F9B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC,CAatB"}

package/dist/src/utils/bastion.js

@@ -11,8 +11,13 @@ import { logInfo, logSuccess, logError } from "./log.js";
  * separate parameter at /mesh-platform/{tenant}/{platformEnv}/platform-bastion
  * for backward compatibility.
  */
-export async function getPlatformBastionInfo(tenant, platformEnv) {
-    const ssm = new SSMClient({});
+export async function getPlatformBastionInfo(tenant, platformEnv, region) {
+    const ssm = new SSMClient(region ? { region } : {});
+    // Captured so the final error can distinguish a CREDS failure (the common
+    // case — stale/expired ambient AWS creds, or creds lacking cross-tenant read
+    // on the hub param) from a genuinely missing bastion. Without this the read
+    // error is swallowed and every failure looks like "bastion not deployed".
+    let primaryError;
     // Primary: read from the platform export (platformBastion is a nested key)
     const platformPath = `/mesh-platform/${tenant}/${platformEnv}/platform`;
     logInfo(`Looking up platform bastion from ${platformPath}...`);
@@ -31,8 +36,10 @@ export async function getPlatformBastionInfo(tenant, platformEnv) {
             }
         }
     }
-    catch {
-        // Platform param not found or unreadable, try legacy path
+    catch (err) {
+        // Don't swallow: keep the real reason (AccessDenied / ExpiredToken / …) so
+        // the final error can be actionable. Then try the legacy path.
+        primaryError = err;
     }
     // Fallback: legacy separate parameter
     const legacyPath = `/mesh-platform/${tenant}/${platformEnv}/platform-bastion`;
@@ -50,10 +57,24 @@ export async function getPlatformBastionInfo(tenant, platformEnv) {
         }
         return info;
     }
-    catch (error) {
-        logError(`Platform bastion not found in ${platformPath} or ${legacyPath}`);
-        logInfo("Make sure platformBastion is enabled in your platform config and deployed.");
-        throw error;
+    catch (legacyError) {
+        // Classify on the PRIMARY read's error (the meaningful one) — the legacy
+        // path is usually just ParameterNotFound and hides the real cause.
+        const cause = primaryError ?? legacyError;
+        const name = cause?.name ?? "";
+        const credsProblem = /Expired|UnrecognizedClient|InvalidClientTokenId|InvalidSignature|CredentialsProviderError|AccessDenied/i.test(name);
+        if (credsProblem) {
+            logError(`Could not read the platform bastion from ${platformPath} — AWS error: ${name}.`);
+            logInfo("This is almost always a CREDENTIALS problem, not a missing bastion.");
+            logInfo("  • The read uses the ambient AWS creds of this process; they must be valid AND able to read the HUB param above.");
+            logInfo("  • Check: `aws sts get-caller-identity` (ExpiredToken → refresh; AccessDenied → those creds lack hub read — use InfraAdmin-grade creds).");
+            logInfo("  • Stale creds often hide in the tmux GLOBAL env (`tmux show-environment -g | grep AWS_`); a per-shell `unset` won't clear them.");
+        }
+        else {
+            logError(`Platform bastion not found in ${platformPath} or ${legacyPath}`);
+            logInfo("Make sure platformBastion is enabled in your platform config and deployed.");
+        }
+        throw cause;
     }
 }
 /**

package/dist/src/utils/bastion.js.map

@@ -1 +1 @@
-{"version":3,"file":"bastion.js","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4BzD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,EAAE,CAAC,CAAC;IAE9B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,kBAAkB,MAAM,IAAI,WAAW,WAAW,CAAC;IACxE,OAAO,CAAC,oCAAoC,YAAY,KAAK,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAChD,CAAC;QAEF,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAsC,CAAC;gBAC7D,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0DAA0D;IAC5D,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,kBAAkB,MAAM,IAAI,WAAW,mBAAmB,CAAC;IAC9E,OAAO,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9C,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAwB,CAAC;QACzE,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,QAAQ,CAAC,iCAAiC,YAAY,OAAO,UAAU,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACtF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EAAE,UAAU,CAAC,IAAI;KACzB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bastion.js","sourceRoot":"","sources":["../../../src/utils/bastion.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AA4BzD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,WAAmB,EACnB,MAAe;IAEf,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,6EAA6E;IAC7E,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,YAAqB,CAAC;IAE1B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,kBAAkB,MAAM,IAAI,WAAW,WAAW,CAAC;IACxE,OAAO,CAAC,oCAAoC,YAAY,KAAK,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAChD,CAAC;QAEF,IAAI,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;gBAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,eAAsC,CAAC;gBAC7D,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;gBAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC5D,CAAC;gBAED,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,2EAA2E;QAC3E,+DAA+D;QAC/D,YAAY,GAAG,GAAG,CAAC;IACrB,CAAC;IAED,sCAAsC;IACtC,MAAM,UAAU,GAAG,kBAAkB,MAAM,IAAI,WAAW,mBAAmB,CAAC;IAC9E,OAAO,CAAC,sBAAsB,UAAU,KAAK,CAAC,CAAC;IAE/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAC7B,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAC9C,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAwB,CAAC;QACzE,UAAU,CAAC,kBAAkB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAEhD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,uBAAuB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,WAAW,EAAE,CAAC;QACrB,yEAAyE;QACzE,mEAAmE;QACnE,MAAM,KAAK,GAAG,YAAY,IAAI,WAAW,CAAC;QAC1C,MAAM,IAAI,GAAI,KAA2B,EAAE,IAAI,IAAI,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,yGAAyG,CAAC,IAAI,CACjI,IAAI,CACL,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,QAAQ,CACN,4CAA4C,YAAY,iBAAiB,IAAI,GAAG,CACjF,CAAC;YACF,OAAO,CACL,qEAAqE,CACtE,CAAC;YACF,OAAO,CACL,mHAAmH,CACpH,CAAC;YACF,OAAO,CACL,2IAA2I,CAC5I,CAAC;YACF,OAAO,CACL,mIAAmI,CACpI,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,iCAAiC,YAAY,OAAO,UAAU,EAAE,CAAC,CAAC;YAC3E,OAAO,CAAC,4EAA4E,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,WAAmB;IAEnB,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE/D,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,WAAW,EAAE,UAAU,CAAC,IAAI;QAC5B,OAAO,EAAE,UAAU,CAAC,IAAI;KACzB,CAAC;AACJ,CAAC"}