@mesh-tech/mesh-cli 0.1.1 → 0.12.0

package/dist/src/commands/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAGL,kBAAkB,EACnB,MAAM,4BAA4B,CAAC;AAMpC,KAAK,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAE5C,UAAU,WAAW;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAgCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAM7E;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAClC,kDAAkD;IAClD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAqFzB;AA6HD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8G3D"}

package/dist/src/commands/init.js

@@ -0,0 +1,370 @@
+/**
+ * mesh init app-tenant — the doctor for a tenant apps repo (design §3.1,
+ * AC A1–A3).
+ *
+ * Runs a read-only check pipeline; every failure names the exact `mesh`
+ * command that fixes it (never a person — A2). Re-running IS the doctor
+ * (A3): exit 0 iff everything passes. `--json` is the agent surface (A5);
+ * `--fix` applies the developer-scope fixes directly (registry token
+ * refresh, skills sync) and leaves operator actions as remediations.
+ *
+ * Checks (API-first; local platform = the same Hub API on localhost):
+ *   1. CLI auth        — cached `mesh login` credentials for the context
+ *   2. Registry access — the CodeArtifact token in ~/.npmrc is accepted by the
+ *                        registry (a live probe, not a substring match — an
+ *                        expired token used to report `pass`); local: skipped
+ *   2b. Public npm not hijacked — no unscoped `registry=<codeartifact>` in
+ *                        ~/.npmrc making CodeArtifact the DEFAULT registry
+ *   3. Platform tenant — Hub API /tenants (the platform registry)
+ *   4. App tenant      — tenant present in the Hub registry
+ *   5. Deployer role   — mesh:deployerRole config present (cloud contexts)
+ *   6. Repo shape      — pnpm workspace + apps layout create-app expects
+ *   7. Skills wired    — `mesh skills sync --check`
+ */
+import chalk from "chalk";
+import * as fs from "fs";
+import * as path from "path";
+import { logInfo } from "../utils/log.js";
+import { MeshCliError, emitJsonPayload } from "../utils/errors.js";
+import { findUnscopedCodeArtifactRegistry, homeNpmrcPath, probeRegistryToken, } from "../utils/auth-preflight.js";
+import { readCredentials } from "./login.js";
+import { resolveTargetRoot, syncSkills } from "./skills.js";
+import { detectLocalTenant } from "./local/dev-local.js";
+import { LOGIN_CONTEXT } from "./local/seed-zitadel.js";
+const LOCAL_HUB_API = "http://localhost:4568";
+function isLocalContext(context) {
+    return context === LOGIN_CONTEXT;
+}
+async function probeHubTenants(hubUrl, accessToken) {
+    try {
+        const response = await fetch(`${hubUrl}/tenants`, {
+            headers: accessToken ? { Authorization: `Bearer ${accessToken}` } : {},
+            signal: AbortSignal.timeout(5000),
+        });
+        if (response.status === 401)
+            return { ok: false, reason: "unauthenticated against the Hub API" };
+        if (!response.ok)
+            return { ok: false, reason: `Hub API returned ${response.status}` };
+        return { ok: true, tenants: (await response.json()) };
+    }
+    catch {
+        return { ok: false, reason: `Hub API unreachable at ${hubUrl}` };
+    }
+}
+function readHomeNpmrc() {
+    try {
+        return fs.readFileSync(homeNpmrcPath(), "utf-8");
+    }
+    catch {
+        return "";
+    }
+}
+/**
+ * The remediation string the doctor prints for a registry fault. It must render
+ * the command `--fix` actually executes: `runRegistryLogin` is called with the
+ * doctor's own `--profile` (or none), so advertising a hardcoded
+ * `--profile mesh-dev` would be a command the doctor never runs.
+ */
+export function registryFixCommand(profile, context) {
+    // Context first: `--fix` calls runRegistryLogin(ctx, …), and a context-less
+    // `mesh registry login` skips the broker entirely — so advertising the bare
+    // form sends someone with no AWS account to a command that cannot work.
+    const base = context ? `mesh registry login ${context}` : "mesh registry login";
+    return profile ? `${base} --profile ${profile}` : base;
+}
+/**
+ * The two registry checks, exported for tests.
+ *
+ * 1. **Registry access** — does the token in ~/.npmrc actually work? The old
+ *    check was `content.includes("codeartifact")`, which reports `pass` for a
+ *    token that expired two days ago. `probeRegistryToken` asks the registry.
+ * 2. **Public npm not hijacked** — is there an *unscoped* `registry=` line
+ *    pointing at CodeArtifact? A bare `aws codeartifact login` (no
+ *    `--namespace @mesh-tech`) writes one, which routes every public package
+ *    through CodeArtifact and makes the whole of npm 401 at the 12h token
+ *    expiry. `mesh registry login` now removes it, so it is the fix for both.
+ */
+export async function registryChecks(args) {
+    const { context, fix, profile } = args;
+    const probe = args.probe ?? probeRegistryToken;
+    const login = args.login ??
+        (async (ctx) => {
+            const { runRegistryLogin } = await import("./registry.js");
+            await runRegistryLogin(ctx, profile ? { profile } : {});
+        });
+    // The command we ADVERTISE must be the command `--fix` RUNS — otherwise the
+    // doctor tells you to pass a profile it then silently drops.
+    const REGISTRY_FIX = registryFixCommand(profile, context);
+    let tokenState = await probe({ npmrcPath: homeNpmrcPath() });
+    let hijack = findUnscopedCodeArtifactRegistry(readHomeNpmrc());
+    let repaired = false;
+    let loginError = null;
+    // One login repairs both: it refreshes the token AND strips the unscoped line.
+    if (fix && (tokenState.state === "expired" || tokenState.state === "missing" || hijack)) {
+        try {
+            await login(context);
+            repaired = true;
+            tokenState = await probe({ npmrcPath: homeNpmrcPath() });
+            hijack = findUnscopedCodeArtifactRegistry(readHomeNpmrc());
+        }
+        catch (err) {
+            loginError = err instanceof Error ? err.message : String(err);
+        }
+    }
+    const suffix = repaired ? " (--fix)" : "";
+    const checks = [];
+    if (loginError) {
+        checks.push({
+            name: "Registry access",
+            status: "fail",
+            detail: `token refresh failed: ${loginError}`,
+            fix: REGISTRY_FIX,
+        });
+    }
+    else if (tokenState.state === "fresh") {
+        checks.push({
+            name: "Registry access",
+            status: "pass",
+            detail: `CodeArtifact token in ~/.npmrc is accepted by the registry${suffix}`,
+        });
+    }
+    else if (tokenState.state === "unreachable") {
+        // A network fault is not an auth fault — don't send someone to `aws sso login`.
+        checks.push({
+            name: "Registry access",
+            status: "warn",
+            detail: `could not reach the registry to verify the token (${tokenState.detail ?? "unknown error"})`,
+            fix: REGISTRY_FIX,
+        });
+    }
+    else {
+        checks.push({
+            name: "Registry access",
+            status: "fail",
+            detail: tokenState.state === "expired"
+                ? `the CodeArtifact token in ~/.npmrc is expired (${tokenState.detail ?? "rejected by the registry"})`
+                : "no CodeArtifact token in ~/.npmrc",
+            fix: REGISTRY_FIX,
+        });
+    }
+    checks.push(hijack
+        ? {
+            name: "Public npm not hijacked",
+            status: "fail",
+            detail: `~/.npmrc makes CodeArtifact the DEFAULT registry (${hijack.trim()}) — every public ` +
+                "package resolves through it and 401s when the 12h token expires",
+            fix: REGISTRY_FIX,
+        }
+        : {
+            name: "Public npm not hijacked",
+            status: "pass",
+            detail: `no unscoped CodeArtifact registry= in ~/.npmrc${repaired ? " (--fix removed it)" : ""}`,
+        });
+    return checks;
+}
+async function runChecks(args) {
+    const { root, tenant, context, hubUrl, fix, profile } = args;
+    const checks = [];
+    const local = isLocalContext(context);
+    // 1. CLI auth
+    const creds = readCredentials(context);
+    const expired = creds ? new Date(creds.expiresAt).getTime() < Date.now() : true;
+    checks.push(creds && !expired
+        ? { name: "CLI auth", status: "pass", detail: `logged in (${context}${creds.email ? `, ${creds.email}` : ""})` }
+        : {
+            name: "CLI auth",
+            status: "fail",
+            detail: creds ? `credentials for '${context}' are expired` : `no credentials for context '${context}'`,
+            fix: `mesh login ${context}`,
+        });
+    const accessToken = creds && !expired ? creds.accessToken : null;
+    // 2 + 2b. Registry access (CodeArtifact) — the local platform has no registry
+    if (local) {
+        checks.push({ name: "Registry access", status: "pass", detail: "local context — no registry required" });
+        checks.push({ name: "Public npm not hijacked", status: "pass", detail: "local context — no registry required" });
+    }
+    else {
+        checks.push(...(await registryChecks({ context, fix, profile })));
+    }
+    // 3 + 4. Platform tenant + app tenant via the Hub API (the registry)
+    const hub = await probeHubTenants(hubUrl, accessToken);
+    if (!hub.ok) {
+        const fixCmd = local ? "mesh start" : `mesh login ${context}`;
+        checks.push({ name: "Platform reachable", status: "fail", detail: hub.reason, fix: fixCmd });
+        checks.push({
+            name: `App tenant '${tenant}'`,
+            status: "warn",
+            detail: "not verifiable while the platform registry is unreachable",
+            fix: fixCmd,
+        });
+    }
+    else {
+        checks.push({
+            name: "Platform reachable",
+            status: "pass",
+            detail: `Hub API at ${hubUrl} (${hub.tenants.length} tenant(s) registered)`,
+        });
+        const registered = hub.tenants.some((t) => t.name === tenant);
+        checks.push(registered
+            ? { name: `App tenant '${tenant}'`, status: "pass", detail: "registered in the platform registry" }
+            : {
+                name: `App tenant '${tenant}'`,
+                status: local ? "warn" : "fail",
+                detail: local
+                    ? "not registered yet — auto-created on the first `mesh dev` run of an app in this repo"
+                    : "not registered — register it on the platform stack and deploy",
+                fix: local ? "mesh dev" : `mesh tenant add ${tenant}   # in the platform repo, then: mesh deploy up`,
+            });
+    }
+    // 5. Deployer role (cloud contexts only — local has no IAM)
+    if (local) {
+        checks.push({ name: "Deployer role", status: "pass", detail: "local context — no deployer role required" });
+    }
+    else {
+        const stackFiles = fs.existsSync(root)
+            ? fs.readdirSync(root).filter((f) => /^Pulumi\..*\.yaml$/.test(f))
+            : [];
+        const hasRole = stackFiles.some((f) => /mesh:deployerRole/.test(fs.readFileSync(path.join(root, f), "utf-8")));
+        checks.push(hasRole
+            ? { name: "Deployer role", status: "pass", detail: "mesh:deployerRole configured in stack config" }
+            : {
+                name: "Deployer role",
+                status: "warn",
+                detail: "no mesh:deployerRole in Pulumi.*.yaml — `mesh deploy` will not be able to assume a role",
+                fix: "mesh create-app   # scaffolds stack config with the deployer role",
+            });
+    }
+    // 6. Repo shape (what create-app/mesh dev expect)
+    const shapeProblems = [];
+    if (!fs.existsSync(path.join(root, "package.json")))
+        shapeProblems.push("package.json");
+    const hasWorkspace = fs.existsSync(path.join(root, "pnpm-workspace.yaml")) ||
+        fs.existsSync(path.join(root, "pnpm-lock.yaml"));
+    if (!hasWorkspace)
+        shapeProblems.push("pnpm-workspace.yaml");
+    checks.push(shapeProblems.length === 0
+        ? { name: "Repo shape", status: "pass", detail: "pnpm workspace layout present" }
+        : {
+            name: "Repo shape",
+            status: "warn",
+            detail: `missing: ${shapeProblems.join(", ")}`,
+            fix: "mesh create-app   # scaffold an app (workspace files included)",
+        });
+    // 7. Skills wired
+    const skillsOk = fix ? syncSkills(root) : syncSkills(root, { check: true });
+    checks.push(skillsOk
+        ? { name: "Agent skills", status: "pass", detail: "base skills + Intent discovery in sync" }
+        : {
+            name: "Agent skills",
+            status: fix ? "pass" : "fail",
+            detail: fix ? "synced (--fix)" : "missing or stale",
+            fix: "mesh skills sync",
+        });
+    return checks;
+}
+export function registerInitCommands(program) {
+    const init = program.command("init").description("Initialize / diagnose a repo against the Mesh platform");
+    init
+        .command("platform <tenant>")
+        .description("Scaffold a tenant PLATFORM repo (core + platform Pulumi layers on @mesh-tech/infra-components) that deploys with `mesh deploy` unmodified — the proven mesh-sandbox shape, annotated.")
+        .option("--env <env>", "environment the first stack targets", "dev")
+        .option("--region <region>", "AWS region", "us-east-2")
+        .option("--domain <domain>", "base public domain (ingress zone becomes {env}.{domain})", "example.com")
+        .option("--profile <profile>", "AWS profile the stack config references", "default")
+        .option("--state-bucket <bucket>", "Pulumi state S3 bucket (created by an operator)", undefined)
+        .option("--dir <path>", "target directory (default: ./{tenant}-mesh-platform)")
+        .action(async (tenant, opts) => {
+        if (!/^[a-z][a-z0-9-]*$/.test(tenant)) {
+            throw new MeshCliError(`Invalid tenant name '${tenant}' (lowercase alphanumeric + dashes).`);
+        }
+        const targetDir = path.resolve(opts.dir ?? `${tenant}-mesh-platform`);
+        if (fs.existsSync(targetDir) && fs.readdirSync(targetDir).length > 0) {
+            throw new MeshCliError(`Target directory is not empty: ${targetDir}`, {
+                remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` },
+            });
+        }
+        const { copyTemplate } = await import("./create-app.js");
+        const { findPackageRoot } = await import("./local/stack.js");
+        const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
+        const context = {
+            tenant,
+            env: opts.env,
+            region: opts.region,
+            domain: opts.domain,
+            profile: opts.profile,
+            stateBucket: opts.stateBucket ?? `${tenant}-mesh-platform-pulumi-state`,
+        };
+        fs.mkdirSync(targetDir, { recursive: true });
+        copyTemplate(templateDir, targetDir, context);
+        syncSkills(targetDir);
+        logInfo(`Platform repo scaffolded at ${targetDir}`);
+        console.log("");
+        console.log("Next steps:");
+        console.log(`  cd ${path.relative(process.cwd(), targetDir) || "."}`);
+        console.log(`  mesh login ${tenant}.${opts.env}     # or an operator context with access`);
+        console.log("  pnpm install");
+        console.log("  cd core && mesh deploy up");
+        console.log("  cd ../platform && mesh deploy up");
+        console.log("");
+        logInfo(`Review the annotated stack configs (Pulumi.${tenant}-${opts.env}.yaml) before the first deploy.`);
+    });
+    init
+        .command("app-tenant")
+        .description("Check (and with --fix, repair) everything an app-tenant repo needs: auth, registry, tenant registration, repo shape, agent skills. Re-run any time — it is the doctor.")
+        .option("--tenant <name>", "app tenant (default: mesh:tenant from Pulumi config, else 'local')")
+        .option("--context <ctx>", "login context to check against (default: 'local' when the local platform is targeted)", LOGIN_CONTEXT)
+        .option("--hub-url <url>", "platform Hub API base URL", LOCAL_HUB_API)
+        .option("--fix", "apply developer-scope fixes (registry token, skills sync)", false)
+        .option("--profile <profile>", "AWS SSO profile --fix logs into CodeArtifact with (e.g. mesh-dev)")
+        .option("--json", "machine-readable output", false)
+        .action(async (opts) => {
+        const root = resolveTargetRoot();
+        const tenant = opts.tenant ?? detectLocalTenant(root);
+        if (!opts.json) {
+            logInfo(`Checking app-tenant repo ${root} (tenant '${tenant}', context '${opts.context}')…`);
+        }
+        // Under --json, stdout is the machine surface (A5): route the check
+        // helpers' human chatter (syncSkills / registry login logInfo etc.) to
+        // stderr so stdout stays pure parseable JSON.
+        const origLog = console.log;
+        if (opts.json)
+            console.log = (...a) => console.error(...a);
+        let checks;
+        try {
+            checks = await runChecks({
+                root,
+                tenant,
+                context: opts.context,
+                hubUrl: opts.hubUrl.replace(/\/+$/, ""),
+                fix: opts.fix,
+                profile: opts.profile,
+            });
+        }
+        finally {
+            console.log = origLog;
+        }
+        // Warns are advisory (expected on a fresh repo pre-`mesh dev`): only
+        // hard failures gate the exit code (A3). `ok` mirrors that contract.
+        const ok = !checks.some((c) => c.status === "fail");
+        if (opts.json) {
+            emitJsonPayload({ ok, root, tenant, context: opts.context, checks });
+        }
+        else {
+            console.log("");
+            for (const check of checks) {
+                const icon = check.status === "pass" ? chalk.green("✔") : check.status === "warn" ? chalk.yellow("▲") : chalk.red("✘");
+                console.log(`  ${icon} ${check.name.padEnd(24)} ${check.detail}`);
+                if (check.fix && check.status !== "pass") {
+                    console.log(`    ${chalk.dim("→ run:")} ${chalk.cyan(check.fix)}`);
+                }
+            }
+            console.log("");
+        }
+        if (!ok) {
+            throw new MeshCliError("app-tenant checks failed — apply the fixes above and re-run.", {
+                remediation: { command: "mesh init app-tenant --fix" },
+            });
+        }
+    });
+}
+//# sourceMappingURL=init.js.map

package/dist/src/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../../src/commands/init.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAYxD,MAAM,aAAa,GAAG,uBAAuB,CAAC;AAE9C,SAAS,cAAc,CAAC,OAAe;IACrC,OAAO,OAAO,KAAK,aAAa,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,WAA0B;IAGvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,UAAU,EAAE;YAChD,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YACtE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QACjG,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,EAAE,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,MAAM,EAAE,EAAE,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAgB,EAAE,OAAgB;IACnE,4EAA4E;IAC5E,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,uBAAuB,OAAO,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC;IAChF,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IASpC;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC;IAC/C,MAAM,KAAK,GACT,IAAI,CAAC,KAAK;QACV,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;YACrB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC3D,MAAM,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,YAAY,GAAG,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE1D,IAAI,UAAU,GAAG,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,GAAG,gCAAgC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,UAAU,GAAkB,IAAI,CAAC;IAErC,+EAA+E;IAC/E,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,UAAU,GAAG,MAAM,KAAK,CAAC,EAAE,SAAS,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;YACzD,MAAM,GAAG,gCAAgC,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,UAAU,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,yBAAyB,UAAU,EAAE;YAC7C,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,6DAA6D,MAAM,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,UAAU,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;QAC9C,gFAAgF;QAChF,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,qDAAqD,UAAU,CAAC,MAAM,IAAI,eAAe,GAAG;YACpG,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,iBAAiB;YACvB,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,UAAU,CAAC,KAAK,KAAK,SAAS;gBAC5B,CAAC,CAAC,kDAAkD,UAAU,CAAC,MAAM,IAAI,0BAA0B,GAAG;gBACtG,CAAC,CAAC,mCAAmC;YACzC,GAAG,EAAE,YAAY;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CACT,MAAM;QACJ,CAAC,CAAC;YACE,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EACJ,qDAAqD,MAAM,CAAC,IAAI,EAAE,mBAAmB;gBACrF,iEAAiE;YACnE,GAAG,EAAE,YAAY;SAClB;QACH,CAAC,CAAC;YACE,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,iDAAiD,QAAQ,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,EAAE;SACjG,CACN,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAOxB;IACC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,cAAc;IACd,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChF,MAAM,CAAC,IAAI,CACT,KAAK,IAAI,CAAC,OAAO;QACf,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE;QAChH,CAAC,CAAC;YACE,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,oBAAoB,OAAO,eAAe,CAAC,CAAC,CAAC,+BAA+B,OAAO,GAAG;YACtG,GAAG,EAAE,cAAc,OAAO,EAAE;SAC7B,CACN,CAAC;IACF,MAAM,WAAW,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;IAEjE,8EAA8E;IAC9E,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;QACzG,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAC;IACnH,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,qEAAqE;IACrE,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,eAAe,MAAM,GAAG;YAC9B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,2DAA2D;YACnE,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,cAAc,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,wBAAwB;SAC5E,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CACT,UAAU;YACR,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,MAAM,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,qCAAqC,EAAE;YACnG,CAAC,CAAC;gBACE,IAAI,EAAE,eAAe,MAAM,GAAG;gBAC9B,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAC/B,MAAM,EAAE,KAAK;oBACX,CAAC,CAAC,sFAAsF;oBACxF,CAAC,CAAC,+DAA+D;gBACnE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,MAAM,iDAAiD;aACrG,CACN,CAAC;IACJ,CAAC;IAED,4DAA4D;IAC5D,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACN,MAAM,UAAU,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACpC,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CACvE,CAAC;QACF,MAAM,CAAC,IAAI,CACT,OAAO;YACL,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,8CAA8C,EAAE;YACnG,CAAC,CAAC;gBACE,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,yFAAyF;gBACjG,GAAG,EAAE,mEAAmE;aACzE,CACN,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QAAE,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxF,MAAM,YAAY,GAChB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACrD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,YAAY;QAAE,aAAa,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,CACT,aAAa,CAAC,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,+BAA+B,EAAE;QACjF,CAAC,CAAC;YACE,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,YAAY,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC9C,GAAG,EAAE,gEAAgE;SACtE,CACN,CAAC;IAEF,kBAAkB;IAClB,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,MAAM,CAAC,IAAI,CACT,QAAQ;QACN,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,wCAAwC,EAAE;QAC5F,CAAC,CAAC;YACE,IAAI,EAAE,cAAc;YACpB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC7B,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB;YACnD,GAAG,EAAE,kBAAkB;SACxB,CACN,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,wDAAwD,CAAC,CAAC;IAE3G,IAAI;SACD,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,uLAAuL,CACxL;SACA,MAAM,CAAC,aAAa,EAAE,qCAAqC,EAAE,KAAK,CAAC;SACnE,MAAM,CAAC,mBAAmB,EAAE,YAAY,EAAE,WAAW,CAAC;SACtD,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,EAAE,aAAa,CAAC;SACtG,MAAM,CAAC,qBAAqB,EAAE,yCAAyC,EAAE,SAAS,CAAC;SACnF,MAAM,CAAC,yBAAyB,EAAE,iDAAiD,EAAE,SAAS,CAAC;SAC/F,MAAM,CAAC,cAAc,EAAE,sDAAsD,CAAC;SAC9E,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,IAA0G,EAAE,EAAE;QAC3I,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,YAAY,CAAC,wBAAwB,MAAM,sCAAsC,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,MAAM,gBAAgB,CAAC,CAAC;QACtE,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,IAAI,YAAY,CAAC,kCAAkC,SAAS,EAAE,EAAE;gBACpE,WAAW,EAAE,EAAE,OAAO,EAAE,sBAAsB,MAAM,oBAAoB,EAAE;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG;YACd,MAAM;YACN,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,GAAG,MAAM,6BAA6B;SACxE,CAAC;QACF,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,YAAY,CAAC,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC9C,UAAU,CAAC,SAAS,CAAC,CAAC;QACtB,OAAO,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,SAAS,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,IAAI,IAAI,CAAC,GAAG,2CAA2C,CAAC,CAAC;QAC3F,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,8CAA8C,MAAM,IAAI,IAAI,CAAC,GAAG,iCAAiC,CAAC,CAAC;IAC7G,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,wKAAwK,CACzK;SACA,MAAM,CAAC,iBAAiB,EAAE,oEAAoE,CAAC;SAC/F,MAAM,CAAC,iBAAiB,EAAE,uFAAuF,EAAE,aAAa,CAAC;SACjI,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,EAAE,aAAa,CAAC;SACrE,MAAM,CAAC,OAAO,EAAE,2DAA2D,EAAE,KAAK,CAAC;SACnF,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;SAClG,MAAM,CAAC,QAAQ,EAAE,yBAAyB,EAAE,KAAK,CAAC;SAClD,MAAM,CAAC,KAAK,EAAE,IAAyG,EAAE,EAAE;QAC1H,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,CAAC,4BAA4B,IAAI,aAAa,MAAM,eAAe,IAAI,CAAC,OAAO,KAAK,CAAC,CAAC;QAC/F,CAAC;QACD,oEAAoE;QACpE,uEAAuE;QACvE,8CAA8C;QAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,IAAI,MAA6C,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC;gBACvB,IAAI;gBACJ,MAAM;gBACN,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;gBACvC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;QACxB,CAAC;QACD,qEAAqE;QACrE,qEAAqE;QACrE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;QAEpD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,eAAe,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,IAAI,GACR,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAC5G,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBAClE,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACzC,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,YAAY,CAAC,8DAA8D,EAAE;gBACrF,WAAW,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE;aACvD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/install-shim.d.ts

@@ -0,0 +1,21 @@
+import { Command } from "commander";
+/**
+ * `mesh install-shim` — make bare `mesh` work on the PATH without a build.
+ *
+ * People and agents reach for `mesh dev`, not `pnpm exec mesh dev`. Getting a
+ * bare `mesh` onto the PATH inherently needs one PATH entry — but it can be a
+ * build-free, cwd-aware resolver: a tiny shell script that, on each run, walks
+ * up from the current directory to the nearest workspace `node_modules/.bin/mesh`
+ * and execs it. That `.bin/mesh` is the `bin/mesh.mjs` launcher, which runs the
+ * CLI from TypeScript source — so bare `mesh` always runs the LOCAL source of
+ * whatever worktree/app you are in, with no build and nothing global to keep in
+ * sync (MESH-2261). Run this once; it survives worktree switches and pulls.
+ */
+/** The cwd-aware resolver written to the PATH. Pure so it can be unit-tested. */
+export declare function shimScript(): string;
+/** Default install target: ~/.local/bin (conventional per-user PATH dir). */
+export declare function defaultShimDir(): string;
+/** True if `dir` is a component of the PATH env string. */
+export declare function dirOnPath(dir: string, pathEnv: string | undefined): boolean;
+export declare function registerInstallShimCommand(program: Command): void;
+//# sourceMappingURL=install-shim.d.ts.map

package/dist/src/commands/install-shim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-shim.d.ts","sourceRoot":"","sources":["../../../src/commands/install-shim.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,wBAAgB,UAAU,IAAI,MAAM,CAkBnC;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,2DAA2D;AAC3D,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAG3E;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAmFjE"}

package/dist/src/commands/install-shim.js

@@ -0,0 +1,132 @@
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { logError, logInfo, logSuccess, logWarn } from "../utils/log.js";
+/**
+ * `mesh install-shim` — make bare `mesh` work on the PATH without a build.
+ *
+ * People and agents reach for `mesh dev`, not `pnpm exec mesh dev`. Getting a
+ * bare `mesh` onto the PATH inherently needs one PATH entry — but it can be a
+ * build-free, cwd-aware resolver: a tiny shell script that, on each run, walks
+ * up from the current directory to the nearest workspace `node_modules/.bin/mesh`
+ * and execs it. That `.bin/mesh` is the `bin/mesh.mjs` launcher, which runs the
+ * CLI from TypeScript source — so bare `mesh` always runs the LOCAL source of
+ * whatever worktree/app you are in, with no build and nothing global to keep in
+ * sync (MESH-2261). Run this once; it survives worktree switches and pulls.
+ */
+/** The cwd-aware resolver written to the PATH. Pure so it can be unit-tested. */
+export function shimScript() {
+    return `#!/bin/sh
+# mesh — canonical launcher shim (installed by \`mesh install-shim\`, MESH-2261).
+# Walks up from the current directory to the nearest workspace mesh CLI and runs
+# it. That resolves to bin/mesh.mjs, which runs the CLI from TypeScript source —
+# so this always runs the LOCAL source of whatever worktree/app you are in, with
+# no build step. Nothing here is version-pinned; do not edit by hand.
+dir=$(pwd)
+while [ "$dir" != "/" ]; do
+  if [ -x "$dir/node_modules/.bin/mesh" ]; then
+    exec "$dir/node_modules/.bin/mesh" "$@"
+  fi
+  dir=$(dirname "$dir")
+done
+echo "mesh: not inside a Mesh workspace (no node_modules/.bin/mesh found)." >&2
+echo "      cd into your app/repo (after 'pnpm install'), or run 'pnpm exec mesh'." >&2
+exit 1
+`;
+}
+/** Default install target: ~/.local/bin (conventional per-user PATH dir). */
+export function defaultShimDir() {
+    return path.join(os.homedir(), ".local", "bin");
+}
+/** True if `dir` is a component of the PATH env string. */
+export function dirOnPath(dir, pathEnv) {
+    if (!pathEnv)
+        return false;
+    return pathEnv.split(path.delimiter).some((p) => p === dir);
+}
+export function registerInstallShimCommand(program) {
+    program
+        .command("install-shim")
+        .description("Install a build-free `mesh` shim on your PATH so bare `mesh` runs the local source")
+        .option("--dir <dir>", "Directory to install into (must be on your PATH)", defaultShimDir())
+        .option("-f, --force", "Overwrite an existing file at the target path", false)
+        .action((opts) => {
+        const dir = path.resolve(opts.dir);
+        const target = path.join(dir, "mesh");
+        if (fs.existsSync(target) && !opts.force) {
+            logWarn(`A file already exists at ${target}.`);
+            logInfo("Re-run with --force to overwrite it, or pass --dir <other-path-on-PATH>.");
+            return;
+        }
+        try {
+            fs.mkdirSync(dir, { recursive: true });
+            fs.writeFileSync(target, shimScript(), { mode: 0o755 });
+            fs.chmodSync(target, 0o755);
+        }
+        catch (err) {
+            logError(`Could not write the shim to ${target}: ${err.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        logSuccess(`Installed mesh shim → ${target}`);
+        if (!dirOnPath(dir, process.env.PATH)) {
+            logWarn(`${dir} is not on your PATH.`);
+            logInfo(`Add it, e.g.:  echo 'export PATH="${dir}:$PATH"' >> ~/.zshrc && source ~/.zshrc`);
+        }
+        else {
+            logInfo("Bare `mesh <cmd>` now runs the local source of whatever workspace you're in.");
+        }
+        // Post-install self-test: run the freshly installed shim and record a full
+        // diagnostic (env + stdout/stderr + exit) to a file, so a failure is
+        // debuggable without copy-pasting terminal output.
+        const diagPath = path.join(os.tmpdir(), "mesh-shim-selftest.log");
+        let stdout = "";
+        let stderr = "";
+        let status = 0;
+        let ok = true;
+        try {
+            stdout = execFileSync(target, ["--help"], {
+                cwd: process.cwd(),
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+        }
+        catch (err) {
+            ok = false;
+            const e = err;
+            status = typeof e.status === "number" ? e.status : 1;
+            stdout = e.stdout?.toString?.() ?? "";
+            stderr = e.stderr?.toString?.() ?? String(e.message ?? err);
+        }
+        const diag = [
+            `mesh install-shim self-test — ${new Date().toISOString()}`,
+            `cwd:     ${process.cwd()}`,
+            `shim:    ${target}`,
+            `node:    ${process.execPath} (${process.version})`,
+            `PATH:    ${process.env.PATH ?? ""}`,
+            `command: mesh --help`,
+            `exit:    ${status}`,
+            `--- stdout (${stdout.length} bytes) ---`,
+            stdout,
+            `--- stderr (${stderr.length} bytes) ---`,
+            stderr,
+            "",
+        ].join("\n");
+        try {
+            fs.writeFileSync(diagPath, diag);
+        }
+        catch {
+            /* diagnostics are best-effort */
+        }
+        if (ok && /Commands:|Usage:/.test(stdout)) {
+            logSuccess(`Self-test passed: \`mesh --help\` ran cleanly. Diagnostic: ${diagPath}`);
+        }
+        else {
+            logError(`Self-test FAILED (exit ${status}). Full diagnostic written to:`);
+            logError(`  ${diagPath}`);
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=install-shim.js.map

package/dist/src/commands/install-shim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-shim.js","sourceRoot":"","sources":["../../../src/commands/install-shim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEzE;;;;;;;;;;;GAWG;AAEH,iFAAiF;AACjF,MAAM,UAAU,UAAU;IACxB,OAAO;;;;;;;;;;;;;;;;CAgBR,CAAC;AACF,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc;IAC5B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;AAClD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,OAA2B;IAChE,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,oFAAoF,CAAC;SACjG,MAAM,CAAC,aAAa,EAAE,kDAAkD,EAAE,cAAc,EAAE,CAAC;SAC3F,MAAM,CAAC,aAAa,EAAE,+CAA+C,EAAE,KAAK,CAAC;SAC7E,MAAM,CAAC,CAAC,IAAqC,EAAE,EAAE;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAEtC,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,OAAO,CAAC,4BAA4B,MAAM,GAAG,CAAC,CAAC;YAC/C,OAAO,CAAC,0EAA0E,CAAC,CAAC;YACpF,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,QAAQ,CAAC,+BAA+B,MAAM,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,UAAU,CAAC,yBAAyB,MAAM,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,GAAG,uBAAuB,CAAC,CAAC;YACvC,OAAO,CAAC,qCAAqC,GAAG,yCAAyC,CAAC,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,8EAA8E,CAAC,CAAC;QAC1F,CAAC;QAED,2EAA2E;QAC3E,qEAAqE;QACrE,mDAAmD;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,wBAAwB,CAAC,CAAC;QAClE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,EAAE,GAAG,IAAI,CAAC;QACd,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;gBACxC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE;gBAClB,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,EAAE,GAAG,KAAK,CAAC;YACX,MAAM,CAAC,GAAG,GAAkF,CAAC;YAC7F,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;QAC9D,CAAC;QACD,MAAM,IAAI,GAAG;YACX,iCAAiC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE;YAC3D,YAAY,OAAO,CAAC,GAAG,EAAE,EAAE;YAC3B,YAAY,MAAM,EAAE;YACpB,YAAY,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,OAAO,GAAG;YACnD,YAAY,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE;YACpC,sBAAsB;YACtB,YAAY,MAAM,EAAE;YACpB,eAAe,MAAM,CAAC,MAAM,aAAa;YACzC,MAAM;YACN,eAAe,MAAM,CAAC,MAAM,aAAa;YACzC,MAAM;YACN,EAAE;SACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;QAED,IAAI,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,UAAU,CAAC,8DAA8D,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,0BAA0B,MAAM,gCAAgC,CAAC,CAAC;YAC3E,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;YAC1B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/commands/local/auth-provision.d.ts

@@ -0,0 +1,71 @@
+/**
+ * App-tenant auth auto-provisioning for the local platform — the local analog
+ * of what the Pulumi components do in the cloud, per the approved Zitadel
+ * tenant-auth pattern (Org / Project / Application / Service User):
+ *
+ *   Org         = app tenant                  (ZitadelTenantIdentity parity)
+ *   Project     = one per app,                 (ZitadelAppIdentity parity —
+ *                 name = authz schema namespace  the app IS the authz boundary)
+ *   Application = one per service inside it    (API app, Basic creds)
+ *   Secret      = mesh/{tenant}/{env}/apps/{app}/zitadel/{service}
+ *                 (ministack Secrets Manager — same canonical path as cloud)
+ *
+ * `mesh dev --local` calls this on startup so scaffolding + running an app
+ * auto-creates its auth config — no Pulumi deploy, no manual Zitadel steps.
+ * Idempotent: search-before-create everywhere; the credential secret is only
+ * written when the application is first created (Zitadel returns the secret
+ * once).
+ */
+export interface AppTenantAuthArgs {
+    /** App tenant (org name), e.g. "acme" */
+    tenant: string;
+    /** App name = project name = authz schema namespace */
+    app: string;
+    /** Service names → one API application each (api, worker, …) */
+    services: string[];
+    /**
+     * App-declared project roles (package.json → mesh.auth.roles). Created on
+     * the app's Zitadel project and granted to the local `{app}-m2m` caller so
+     * role-scoped services (roles claim → scopes) accept its tokens.
+     */
+    roles?: string[];
+}
+export interface ProvisionedAuth {
+    orgId: string;
+    projectId: string;
+    /** Services whose application (and secret) was created this run */
+    created: string[];
+}
+export declare function authSecretPath(tenant: string, app: string, service: string): string;
+/**
+ * Register the running app in the local platform registry — the same
+ * self-registration path deployed apps use (/mesh-platform/{tenant}/{env}/
+ * apps/{app}/meta), so StackPort (and the local Hub once its images land)
+ * can visualize local apps.
+ */
+export declare function registerLocalApp(args: AppTenantAuthArgs & {
+    ports?: Record<string, number>;
+    /** ExternalService names the app's services consume (ExternalService.link()
+     * parity) — the Hub derives Integrations consumers + uptime from these. */
+    links?: string[];
+}): Promise<string>;
+/**
+ * Reconcile the platform registry from Zitadel — every app-tenant org (and
+ * its projects = apps, applications = services) provisioned in Zitadel gets
+ * a Hub-readable registration, even if the app hasn't been run since it was
+ * provisioned. Zitadel is the auth source of truth; the registry mirrors it,
+ * exactly like the cloud where ZitadelTenantIdentity/ZitadelAppIdentity and
+ * the app's self-registration both flow from the same deploy. Idempotent:
+ * existing per-stack registrations (which carry live ports/URLs from
+ * `mesh dev --local`) are never overwritten.
+ */
+export declare function reconcileRegistryFromZitadel(): Promise<{
+    tenants: string[];
+    apps: number;
+}>;
+/**
+ * Ensure the app tenant's full auth config exists (org → project →
+ * application-per-service → credential secrets).
+ */
+export declare function ensureAppTenantAuth(args: AppTenantAuthArgs): Promise<ProvisionedAuth>;
+//# sourceMappingURL=auth-provision.d.ts.map

package/dist/src/commands/local/auth-provision.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provision.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/auth-provision.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAOH,MAAM,WAAW,iBAAiB;IAChC,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnF;AA6KD;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,iBAAiB,GAAG;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;+EAC2E;IAC3E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,GACA,OAAO,CAAC,MAAM,CAAC,CA2DjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAsEjG;AAED;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA+C3F"}