@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/commands/local/seed.d.ts

@@ -0,0 +1,106 @@
+/**
+ * First-boot seeding for the `mesh start` local platform.
+ *
+ * Registers tenant `local` / env `dev` in the local AWS fabric's (ministack)
+ * SSM registry with the same shape TenantEnvironments writes in the cloud
+ * (/mesh-platform/{tenant}/{env}/app-tenants → TenantEnvironmentsExports), and
+ * creates the tenant artifacts bucket. Idempotent — parameters are overwritten,
+ * the bucket create tolerates "already owned by you".
+ *
+ * Zitadel org/project/CLI-app + test-user seeding (the `mesh login local`
+ * path) is tracked as a follow-up on the mesh start epic.
+ */
+export declare const LOCAL_TENANT = "local";
+export declare const LOCAL_ENV = "dev";
+export declare const LOCAL_AWS_ENDPOINT = "http://localhost:4566";
+export declare const LOCAL_AWS_REGION = "us-east-2";
+export declare const ARTIFACTS_BUCKET = "mesh-local-artifacts";
+export declare const APP_TENANTS_PARAM = "/mesh-platform/local/dev/app-tenants";
+export declare const LOCAL_AWS_CONFIG: {
+    endpoint: string;
+    region: string;
+    credentials: {
+        accessKeyId: string;
+        secretAccessKey: string;
+    };
+};
+/**
+ * Env vars that point any AWS SDK process on the host at the local fabric —
+ * the SDK-native endpoint override (AWS_ENDPOINT_URL, supported since SDK JS
+ * v3 ~3.428), so no client-code changes are needed. `mesh dev` local mode
+ * injects these into app processes; humans can `eval` them from the
+ * `mesh start` output. In-network services get the same wiring with
+ * http://ministack:4566 (see the compose file's x-local-aws-env anchor).
+ */
+export declare function localAwsEnv(): Record<string, string>;
+/**
+ * The local tenant registration, shaped like TenantEnvironmentsExports
+ * (libs/infra-components …/platform/TenantEnvironments.ts) so consumers of the
+ * registry (Hub API, init checks) read local and cloud identically. AWS-only
+ * fields carry inert local placeholders.
+ */
+export declare function buildAppTenantsSeed(): {
+    hubTenant: string;
+    primaryTenant: {
+        albGroupName: string;
+        certificateArn: string;
+        baseDomain: string;
+        deployerRoleArn: string;
+        artifactsBucket: string;
+        spicedb: {
+            endpoint: string;
+            presharedKeySecret: string;
+        };
+        zitadel: {
+            orgId: string;
+            domain: string;
+            issuer: string;
+        };
+    };
+    sharedTenants: {};
+};
+export interface SeedResult {
+    parameter: string;
+    bucket: string;
+}
+export declare const FABRIC_CHECK_PATH = "/mesh-platform/local/dev/.fabric-check";
+/** The tenant's Temporal namespace, matching the cloud convention
+ * TemporalNamespaceProvisioner uses ({tenant}-{env}, e.g. "acme-dev"). */
+export declare const TEMPORAL_NAMESPACE = "local-dev";
+export declare const TEMPORAL_ADDRESS = "localhost:7233";
+/**
+ * Register the local tenant's Temporal namespace ({tenant}-{env} — the same
+ * name TemporalNamespaceProvisioner would create in the cloud). Idempotent:
+ * "already exists" is success. Dynamic import — @temporalio/client is an
+ * optionalDependency (same pattern as commands/temporal.ts).
+ */
+export declare function seedTemporalNamespace(): Promise<void>;
+/**
+ * Idempotently register a Temporal namespace. `mesh dev --local` uses this
+ * for the per-app namespaces ({tenant}-{env}-{app}) the cloud provisioner
+ * creates — the Hub's per-app workflow views resolve exactly that name.
+ */
+export declare function ensureTemporalNamespace(namespace: string, description?: string): Promise<void>;
+/**
+ * A deterministic >4 KB payload for the Advanced-tier round-trip. Standard
+ * SSM params cap at 4 KB; mesh.exports.Export writes tier "Advanced" values
+ * up to 8 KB (Export.ts), and the emulator's fidelity there is the one open
+ * question the design (§2.5) requires this check to answer on every boot.
+ */
+export declare function buildFabricCheckPayload(targetBytes?: number): string;
+/**
+ * Verify the local AWS fabric behaves like real SSM where the platform
+ * depends on it: an 8 KB Advanced-tier parameter round-trips intact, and
+ * child parameters under a path come back via GetParametersByPath (the
+ * shape mesh.exports.Export's splitKeys mode reads). Check params are
+ * removed afterwards.
+ */
+export declare function verifyFabric(): Promise<void>;
+/** Write the Hub-readable tenant + environment registrations (the shapes
+ * hub-api's SSM assembler requires: RawTenant at /{tenant}, RawEnvironment
+ * at /{tenant}/{env}). Exported for reuse by app-tenant provisioning. */
+export declare function registerTenantEnv(tenant: string, opts?: {
+    tier?: "hub" | "dedicated" | "shared";
+}): Promise<void>;
+export declare function seedLocalPlatform(): Promise<SeedResult>;
+//# sourceMappingURL=seed.d.ts.map

package/dist/src/commands/local/seed.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,eAAO,MAAM,YAAY,UAAU,CAAC;AACpC,eAAO,MAAM,SAAS,QAAQ,CAAC;AAC/B,eAAO,MAAM,kBAAkB,0BAA0B,CAAC;AAC1D,eAAO,MAAM,gBAAgB,cAAc,CAAC;AAC5C,eAAO,MAAM,gBAAgB,yBAAyB,CAAC;AACvD,eAAO,MAAM,iBAAiB,yCAA4D,CAAC;AAE3F,eAAO,MAAM,gBAAgB;;;;;;;CAI5B,CAAC;AAGF;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOpD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB;;;;;;;;;;;;;;;;;;;EAsBlC;AAED,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,iBAAiB,2CAA8D,CAAC;AAE7F;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,cAAiC,CAAC;AACjE,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD;;;;;GAKG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAK3D;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAsCpG;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,SAAQ,GAAG,MAAM,CAInE;AAED;;;;;;GAMG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CA0DlD;AAED;;yEAEyE;AACzE,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,KAAK,GAAG,WAAW,GAAG,QAAQ,CAAA;CAAO,GACnD,OAAO,CAAC,IAAI,CAAC,CA4Bf;AAED,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,UAAU,CAAC,CA+B7D"}

package/dist/src/commands/local/seed.js

@@ -0,0 +1,252 @@
+/**
+ * First-boot seeding for the `mesh start` local platform.
+ *
+ * Registers tenant `local` / env `dev` in the local AWS fabric's (ministack)
+ * SSM registry with the same shape TenantEnvironments writes in the cloud
+ * (/mesh-platform/{tenant}/{env}/app-tenants → TenantEnvironmentsExports), and
+ * creates the tenant artifacts bucket. Idempotent — parameters are overwritten,
+ * the bucket create tolerates "already owned by you".
+ *
+ * Zitadel org/project/CLI-app + test-user seeding (the `mesh login local`
+ * path) is tracked as a follow-up on the mesh start epic.
+ */
+import { logInfo, logSuccess } from "../../utils/log.js";
+import { MeshCliError } from "../../utils/errors.js";
+export const LOCAL_TENANT = "local";
+export const LOCAL_ENV = "dev";
+export const LOCAL_AWS_ENDPOINT = "http://localhost:4566";
+export const LOCAL_AWS_REGION = "us-east-2";
+export const ARTIFACTS_BUCKET = "mesh-local-artifacts";
+export const APP_TENANTS_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/app-tenants`;
+export const LOCAL_AWS_CONFIG = {
+    endpoint: LOCAL_AWS_ENDPOINT,
+    region: LOCAL_AWS_REGION,
+    credentials: { accessKeyId: "test", secretAccessKey: "test" },
+};
+const AWS_CONFIG = LOCAL_AWS_CONFIG;
+/**
+ * Env vars that point any AWS SDK process on the host at the local fabric —
+ * the SDK-native endpoint override (AWS_ENDPOINT_URL, supported since SDK JS
+ * v3 ~3.428), so no client-code changes are needed. `mesh dev` local mode
+ * injects these into app processes; humans can `eval` them from the
+ * `mesh start` output. In-network services get the same wiring with
+ * http://ministack:4566 (see the compose file's x-local-aws-env anchor).
+ */
+export function localAwsEnv() {
+    return {
+        AWS_ENDPOINT_URL: LOCAL_AWS_ENDPOINT,
+        AWS_REGION: LOCAL_AWS_REGION,
+        AWS_ACCESS_KEY_ID: "test",
+        AWS_SECRET_ACCESS_KEY: "test",
+    };
+}
+/**
+ * The local tenant registration, shaped like TenantEnvironmentsExports
+ * (libs/infra-components …/platform/TenantEnvironments.ts) so consumers of the
+ * registry (Hub API, init checks) read local and cloud identically. AWS-only
+ * fields carry inert local placeholders.
+ */
+export function buildAppTenantsSeed() {
+    const tenantExport = {
+        albGroupName: LOCAL_TENANT,
+        certificateArn: "",
+        baseDomain: "localhost",
+        deployerRoleArn: "arn:aws:iam::000000000000:role/local-dev-deployer",
+        artifactsBucket: ARTIFACTS_BUCKET,
+        spicedb: {
+            endpoint: "localhost:50051",
+            presharedKeySecret: "local-dev-key",
+        },
+        zitadel: {
+            orgId: "local",
+            domain: "localhost:8080",
+            issuer: "http://localhost:8080",
+        },
+    };
+    return {
+        hubTenant: LOCAL_TENANT,
+        primaryTenant: tenantExport,
+        sharedTenants: {},
+    };
+}
+export const FABRIC_CHECK_PATH = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/.fabric-check`;
+/** The tenant's Temporal namespace, matching the cloud convention
+ * TemporalNamespaceProvisioner uses ({tenant}-{env}, e.g. "acme-dev"). */
+export const TEMPORAL_NAMESPACE = `${LOCAL_TENANT}-${LOCAL_ENV}`;
+export const TEMPORAL_ADDRESS = "localhost:7233";
+/**
+ * Register the local tenant's Temporal namespace ({tenant}-{env} — the same
+ * name TemporalNamespaceProvisioner would create in the cloud). Idempotent:
+ * "already exists" is success. Dynamic import — @temporalio/client is an
+ * optionalDependency (same pattern as commands/temporal.ts).
+ */
+export async function seedTemporalNamespace() {
+    await ensureTemporalNamespace(TEMPORAL_NAMESPACE, `Mesh local tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' (seeded by mesh start)`);
+}
+/**
+ * Idempotently register a Temporal namespace. `mesh dev --local` uses this
+ * for the per-app namespaces ({tenant}-{env}-{app}) the cloud provisioner
+ * creates — the Hub's per-app workflow views resolve exactly that name.
+ */
+export async function ensureTemporalNamespace(namespace, description) {
+    const { Connection } = await import("@temporalio/client");
+    const connection = await Connection.connect({ address: TEMPORAL_ADDRESS });
+    try {
+        await connection.workflowService.registerNamespace({
+            namespace,
+            description: description ?? `Mesh local namespace '${namespace}'`,
+            // protobufjs accepts plain numbers for int64 at runtime; the generated
+            // typing insists on Long (whose package isn't a direct dep), hence any.
+            workflowExecutionRetentionPeriod: { seconds: (3 * 24 * 60 * 60) },
+        });
+        // A freshly registered namespace isn't usable until the frontend's
+        // namespace cache refreshes (~10s) — a worker connecting immediately
+        // would die on "Namespace not found". Wait it out once, here.
+        logInfo(`Registered Temporal namespace '${namespace}' — waiting for it to become active…`);
+        const deadline = Date.now() + 20_000;
+        while (Date.now() < deadline) {
+            try {
+                await connection.workflowService.describeTaskQueue({
+                    namespace,
+                    taskQueue: { name: "namespace-propagation-probe" },
+                    taskQueueType: 1,
+                });
+                break;
+            }
+            catch {
+                await new Promise((resolve) => setTimeout(resolve, 1_000));
+            }
+        }
+        logSuccess(`Temporal namespace '${namespace}' is active`);
+    }
+    catch (err) {
+        if (err?.name === "NamespaceAlreadyExistsError" || /already exists/i.test(err?.message ?? "")) {
+            logInfo(`Temporal namespace '${namespace}' already exists`);
+        }
+        else {
+            throw err;
+        }
+    }
+    finally {
+        await connection.close();
+    }
+}
+/**
+ * A deterministic >4 KB payload for the Advanced-tier round-trip. Standard
+ * SSM params cap at 4 KB; mesh.exports.Export writes tier "Advanced" values
+ * up to 8 KB (Export.ts), and the emulator's fidelity there is the one open
+ * question the design (§2.5) requires this check to answer on every boot.
+ */
+export function buildFabricCheckPayload(targetBytes = 8_000) {
+    const base = { probe: "advanced-tier-round-trip", tenant: LOCAL_TENANT, env: LOCAL_ENV, pad: "" };
+    const overhead = JSON.stringify(base).length;
+    return JSON.stringify({ ...base, pad: "x".repeat(Math.max(0, targetBytes - overhead)) });
+}
+/**
+ * Verify the local AWS fabric behaves like real SSM where the platform
+ * depends on it: an 8 KB Advanced-tier parameter round-trips intact, and
+ * child parameters under a path come back via GetParametersByPath (the
+ * shape mesh.exports.Export's splitKeys mode reads). Check params are
+ * removed afterwards.
+ */
+export async function verifyFabric() {
+    const { SSMClient, PutParameterCommand, GetParameterCommand, GetParametersByPathCommand, DeleteParametersCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(AWS_CONFIG);
+    const payload = buildFabricCheckPayload();
+    const mainParam = FABRIC_CHECK_PATH;
+    const childParams = [`${FABRIC_CHECK_PATH}/vpc`, `${FABRIC_CHECK_PATH}/eks`];
+    try {
+        await ssm.send(new PutParameterCommand({
+            Name: mainParam,
+            Type: "String",
+            Tier: "Advanced",
+            Overwrite: true,
+            Value: payload,
+        }));
+        for (const name of childParams) {
+            await ssm.send(new PutParameterCommand({ Name: name, Type: "String", Overwrite: true, Value: `{"probe":"${name}"}` }));
+        }
+        const roundTrip = await ssm.send(new GetParameterCommand({ Name: mainParam }));
+        if (roundTrip.Parameter?.Value !== payload) {
+            throw new MeshCliError(`Local AWS fabric failed the ${payload.length}-byte Advanced-tier SSM round-trip (got ${roundTrip.Parameter?.Value?.length ?? 0} bytes back).`, {
+                remediation: {
+                    docs: "libs/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
+                },
+            });
+        }
+        const byPath = await ssm.send(new GetParametersByPathCommand({ Path: FABRIC_CHECK_PATH, Recursive: true }));
+        const returned = new Set((byPath.Parameters ?? []).map((p) => p.Name));
+        const missing = childParams.filter((name) => !returned.has(name));
+        if (missing.length > 0) {
+            throw new MeshCliError(`Local AWS fabric's GetParametersByPath missed child parameter(s): ${missing.join(", ")} (splitKeys exports would not resolve).`, {
+                remediation: {
+                    docs: "libs/mesh-cli/stack/docker-compose.yml — swap the ministack image for motoserver/moto (design §2.5 fallback)",
+                },
+            });
+        }
+        logSuccess(`Fabric check passed: ${payload.length}-byte Advanced-tier round-trip + GetParametersByPath`);
+    }
+    finally {
+        await ssm
+            .send(new DeleteParametersCommand({ Names: [mainParam, ...childParams] }))
+            .catch(() => { });
+    }
+}
+/** Write the Hub-readable tenant + environment registrations (the shapes
+ * hub-api's SSM assembler requires: RawTenant at /{tenant}, RawEnvironment
+ * at /{tenant}/{env}). Exported for reuse by app-tenant provisioning. */
+export async function registerTenantEnv(tenant, opts = {}) {
+    const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(AWS_CONFIG);
+    await ssm.send(new PutParameterCommand({
+        Name: `/mesh-platform/${tenant}`,
+        Type: "String",
+        Overwrite: true,
+        Value: JSON.stringify({ name: tenant, tier: opts.tier ?? "shared", subdomain: tenant }),
+        Description: `Tenant registration (seeded by mesh CLI, local platform)`,
+    }));
+    await ssm.send(new PutParameterCommand({
+        Name: `/mesh-platform/${tenant}/${LOCAL_ENV}`,
+        Type: "String",
+        Overwrite: true,
+        Value: JSON.stringify({
+            env: LOCAL_ENV,
+            region: LOCAL_AWS_REGION,
+            baseDomain: "localhost",
+            // monitoring is true: the local stack runs the same Loki/Tempo/
+            // Prometheus backends the hosted platform provides.
+            services: { temporal: true, zitadel: true, monitoring: true },
+        }),
+        Description: `Environment registration (seeded by mesh CLI, local platform)`,
+    }));
+}
+export async function seedLocalPlatform() {
+    const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(AWS_CONFIG);
+    await ssm.send(new PutParameterCommand({
+        Name: APP_TENANTS_PARAM,
+        Type: "String",
+        Overwrite: true,
+        Value: JSON.stringify(buildAppTenantsSeed()),
+        Description: `TenantEnvironments exports for ${LOCAL_TENANT}-${LOCAL_ENV} (seeded by mesh start)`,
+    }));
+    await registerTenantEnv(LOCAL_TENANT, { tier: "hub" });
+    logSuccess(`Registered tenant '${LOCAL_TENANT}' env '${LOCAL_ENV}' → ${APP_TENANTS_PARAM}`);
+    const { S3Client, CreateBucketCommand } = await import("@aws-sdk/client-s3");
+    const s3 = new S3Client({ ...AWS_CONFIG, forcePathStyle: true });
+    try {
+        await s3.send(new CreateBucketCommand({ Bucket: ARTIFACTS_BUCKET }));
+        logSuccess(`Created artifacts bucket s3://${ARTIFACTS_BUCKET}`);
+    }
+    catch (err) {
+        if (err?.name === "BucketAlreadyOwnedByYou" || err?.name === "BucketAlreadyExists") {
+            logInfo(`Artifacts bucket s3://${ARTIFACTS_BUCKET} already exists`);
+        }
+        else {
+            throw err;
+        }
+    }
+    await seedTemporalNamespace();
+    return { parameter: APP_TENANTS_PARAM, bucket: ARTIFACTS_BUCKET };
+}
+//# sourceMappingURL=seed.js.map

package/dist/src/commands/local/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../../../src/commands/local/seed.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC;AACpC,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,CAAC;AAC/B,MAAM,CAAC,MAAM,kBAAkB,GAAG,uBAAuB,CAAC;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,YAAY,IAAI,SAAS,cAAc,CAAC;AAE3F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,EAAE,kBAAkB;IAC5B,MAAM,EAAE,gBAAgB;IACxB,WAAW,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE;CAC9D,CAAC;AACF,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,gBAAgB,EAAE,kBAAkB;QACpC,UAAU,EAAE,gBAAgB;QAC5B,iBAAiB,EAAE,MAAM;QACzB,qBAAqB,EAAE,MAAM;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,YAAY,GAAG;QACnB,YAAY,EAAE,YAAY;QAC1B,cAAc,EAAE,EAAE;QAClB,UAAU,EAAE,WAAW;QACvB,eAAe,EAAE,mDAAmD;QACpE,eAAe,EAAE,gBAAgB;QACjC,OAAO,EAAE;YACP,QAAQ,EAAE,iBAAiB;YAC3B,kBAAkB,EAAE,eAAe;SACpC;QACD,OAAO,EAAE;YACP,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,uBAAuB;SAChC;KACF,CAAC;IACF,OAAO;QACL,SAAS,EAAE,YAAY;QACvB,aAAa,EAAE,YAAY;QAC3B,aAAa,EAAE,EAAE;KAClB,CAAC;AACJ,CAAC;AAOD,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,YAAY,IAAI,SAAS,gBAAgB,CAAC;AAE7F;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,YAAY,IAAI,SAAS,EAAE,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,uBAAuB,CAC3B,kBAAkB,EAClB,sBAAsB,YAAY,UAAU,SAAS,0BAA0B,CAChF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,SAAiB,EAAE,WAAoB;IACnF,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC;QACH,MAAM,UAAU,CAAC,eAAe,CAAC,iBAAiB,CAAC;YACjD,SAAS;YACT,WAAW,EAAE,WAAW,IAAI,yBAAyB,SAAS,GAAG;YACjE,uEAAuE;YACvE,wEAAwE;YACxE,gCAAgC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAQ,EAAE;SACzE,CAAC,CAAC;QACH,mEAAmE;QACnE,qEAAqE;QACrE,8DAA8D;QAC9D,OAAO,CAAC,kCAAkC,SAAS,sCAAsC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,eAAe,CAAC,iBAAiB,CAAC;oBACjD,SAAS;oBACT,SAAS,EAAE,EAAE,IAAI,EAAE,6BAA6B,EAAE;oBAClD,aAAa,EAAE,CAAC;iBACV,CAAC,CAAC;gBACV,MAAM;YACR,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QACD,UAAU,CAAC,uBAAuB,SAAS,aAAa,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,6BAA6B,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC9F,OAAO,CAAC,uBAAuB,SAAS,kBAAkB,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,WAAW,GAAG,KAAK;IACzD,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;IAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,uBAAuB,EAAE,GAChH,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,uBAAuB,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,iBAAiB,CAAC;IACpC,MAAM,WAAW,GAAG,CAAC,GAAG,iBAAiB,MAAM,EAAE,GAAG,iBAAiB,MAAM,CAAC,CAAC;IAE7E,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,OAAO;SACf,CAAC,CACH,CAAC;QACF,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;YAC/B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI,EAAE,CAAC,CACvG,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAC/E,IAAI,SAAS,CAAC,SAAS,EAAE,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3C,MAAM,IAAI,YAAY,CACpB,+BAA+B,OAAO,CAAC,MAAM,2CAA2C,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,eAAe,EAC9I;gBACE,WAAW,EAAE;oBACX,IAAI,EAAE,8GAA8G;iBACrH;aACF,CACF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAC3B,IAAI,0BAA0B,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAC7E,CAAC;QACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,YAAY,CACpB,qEAAqE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,yCAAyC,EAChI;gBACE,WAAW,EAAE;oBACX,IAAI,EAAE,8GAA8G;iBACrH;aACF,CACF,CAAC;QACJ,CAAC;QAED,UAAU,CAAC,wBAAwB,OAAO,CAAC,MAAM,sDAAsD,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACT,MAAM,GAAG;aACN,IAAI,CAAC,IAAI,uBAAuB,CAAC,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;aACzE,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;yEAEyE;AACzE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,OAAkD,EAAE;IAEpD,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,kBAAkB,MAAM,EAAE;QAChC,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACvF,WAAW,EAAE,0DAA0D;KACxE,CAAC,CACH,CAAC;IACF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,kBAAkB,MAAM,IAAI,SAAS,EAAE;QAC7C,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,GAAG,EAAE,SAAS;YACd,MAAM,EAAE,gBAAgB;YACxB,UAAU,EAAE,WAAW;YACvB,gEAAgE;YAChE,oDAAoD;YACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE;SAC9D,CAAC;QACF,WAAW,EAAE,+DAA+D;KAC7E,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,EAAE,CAAC;QAC5C,WAAW,EAAE,kCAAkC,YAAY,IAAI,SAAS,yBAAyB;KAClG,CAAC,CACH,CAAC;IACF,MAAM,iBAAiB,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,UAAU,CAAC,sBAAsB,YAAY,UAAU,SAAS,OAAO,iBAAiB,EAAE,CAAC,CAAC;IAE5F,MAAM,EAAE,QAAQ,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,EAAE,GAAG,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC;QACrE,UAAU,CAAC,iCAAiC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,yBAAyB,IAAI,GAAG,EAAE,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnF,OAAO,CAAC,yBAAyB,gBAAgB,iBAAiB,CAAC,CAAC;QACtE,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,qBAAqB,EAAE,CAAC;IAE9B,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;AACpE,CAAC"}

package/dist/src/commands/local/stack.d.ts

@@ -0,0 +1,173 @@
+/**
+ * Helpers for the `mesh start/stop/status` full-local platform stack.
+ *
+ * The docker compose project (name `mesh-local`) ships inside the CLI package
+ * at `<package root>/stack/`, so the stack works in any repo with only Docker
+ * installed and is version-locked to the CLI.
+ */
+export declare const COMPOSE_PROJECT = "mesh-local";
+/**
+ * Host directory `mesh dev --local` writes service logs into
+ * ({namespace}/{service}.log). The stack's OTel collector tails it (filelog
+ * receiver) and ships to Loki with the hosted k8s_* label scheme, so the
+ * Hub's logs view works on local runs unchanged.
+ */
+export declare function localLogsDir(): string;
+/**
+ * Host directory holding blackbox probe targets (Prometheus file_sd JSON) —
+ * written by `mesh dev --externals` for external services, mounted into the
+ * stack's Prometheus. The local analog of the hosted Probe CRs.
+ */
+export declare function localProbesDir(): string;
+/** Endpoints the local stack exposes on the host. */
+export interface StackEndpoint {
+    service: string;
+    label: string;
+    url: string;
+    /** How `mesh status` probes it from the host */
+    probe: {
+        kind: "http";
+        url: string;
+    } | {
+        kind: "tcp";
+        port: number;
+    } | {
+        kind: "none";
+    };
+    /** Extra hint printed under the endpoint (credentials, tokens, …) */
+    hint?: string;
+}
+export declare const STACK_ENDPOINTS: StackEndpoint[];
+/** Default host port for the containerized local Hub. `mesh hub dev` derives
+ * its dev-server default from this too (hub/index.ts), so the two Hubs share
+ * one source for "9000" while keeping separate override variables
+ * (MESH_HUB_PORT here, MESH_HUB_DEV_PORT there). */
+export declare const DEFAULT_HUB_PORT = "9000";
+/**
+ * Host port the Hub is published on (docker-compose.hub.yml binds
+ * `${MESH_HUB_PORT:-9000}:4180`). Override with MESH_HUB_PORT to run the
+ * local Hub beside another process that owns 9000 — e.g. a hub-ui dev
+ * server running from a different checkout. Export it for BOTH `mesh start`
+ * and later `mesh status` calls: the compose file and these probes read the
+ * same variable (MESH-2256 tracks deriving it from the running stack so
+ * `mesh status` stops depending on shell hygiene). `mesh start` reconciles
+ * the seeded Zitadel Hub app's redirect URIs to include the chosen port —
+ * Zitadel requires every redirect URI to be registered even in devMode
+ * (devMode only allows http).
+ *
+ * Empty string falls back like compose's `${MESH_HUB_PORT:-9000}` does —
+ * `??` alone would diverge (probe `:`, publish 9000).
+ */
+export declare function hubPort(): string;
+/** Hub overlay endpoints — probed only when the hub containers exist.
+ * A function (not a module constant) so hubPort() is read at call time:
+ * the CLI's env is fixed before node starts, but tests and programmatic
+ * callers set MESH_HUB_PORT after import. */
+export declare function hubEndpoints(): StackEndpoint[];
+/**
+ * Locate the CLI package root (the directory whose package.json is
+ * @mesh-tech/mesh-cli). Works from both the compiled layout (dist/src/…)
+ * and the source layout (src/… under tsx).
+ */
+export declare function findPackageRoot(startDir?: string): string;
+export declare function stackDir(): string;
+/** The compose overlay that declares the Hub services. */
+export declare const HUB_OVERLAY_FILE = "docker-compose.hub.yml";
+/** Top-level service names a compose file declares. Pure — takes the file text. */
+export declare function parseComposeServiceNames(yamlText: string): string[];
+/**
+ * The services the Hub overlay — and only the overlay — declares.
+ *
+ * Read from `docker-compose.hub.yml` rather than hard-coded beside
+ * ONE_SHOT_SERVICES on purpose: a second name list rots the moment the
+ * overlay gains or renames a service. (It already declares three — hub-api,
+ * hub-ui, hub-auth — not the two the Hub is usually described by.)
+ */
+export declare function hubOverlayServices(): ReadonlySet<string>;
+/**
+ * The compose project is a MACHINE-WIDE singleton (`mesh-local`), but any
+ * checkout of the CLI can drive it — and `docker compose up` from a checkout
+ * whose stack config differs will recreate shared containers out from under
+ * whatever else is running against the stack (a second project's `mesh dev`
+ * session, a Hub built from another worktree, …).
+ *
+ * Returns the working dir of the checkout that last (re)created the running
+ * stack when it is NOT this one; undefined when the stack isn't running or
+ * is already owned here. Callers gate lifecycle commands on it.
+ */
+export declare function stackOwnedElsewhere(): string | undefined;
+/** Throw a remediated error if the docker daemon isn't reachable. */
+export declare function ensureDockerAvailable(): void;
+/** Run `docker compose` against the packaged stack. `hub` adds the Hub
+ * overlay file (safe for ps/logs/down: services simply may not exist);
+ * `env` adds process-env overrides (e.g. MESH_HUB_VERSION). */
+export declare function compose(args: string[], opts?: {
+    inherit?: boolean;
+    hub?: boolean;
+    env?: Record<string, string>;
+}): string;
+/**
+ * Pick the one line worth reading out of a failed compose run's output:
+ * the last error-looking line, else the last non-empty line (MESH-2479).
+ * Pure so the selection heuristic is unit-testable.
+ */
+export declare function summarizeComposeFailure(output: string): string;
+/** Where a lifecycle command's full compose output is written (per operation). */
+export declare function composeLogPath(op: string): string;
+/**
+ * `docker compose` for lifecycle commands (`up -d`): stream output like
+ * `compose({inherit: true})` does, but never bury the failure — on a non-zero
+ * exit throw a one-line summary instead of leaving ~200 lines of pull/create
+ * noise as the only signal (MESH-2479). In non-TTY runs the output is also
+ * teed to a log file (named in the error) and a heartbeat fills long quiet
+ * stretches; interactive terminals keep docker's own progress rendering.
+ */
+export declare function composeStreamed(args: string[], opts?: {
+    hub?: boolean;
+    env?: Record<string, string>;
+}): Promise<void>;
+export interface ServiceStatus {
+    name: string;
+    state: string;
+    health?: string;
+}
+/** Parse `docker compose ps --format json` (NDJSON, one object per line). */
+export declare function parseComposePs(output: string): ServiceStatus[];
+export declare function stackServices(): ServiceStatus[];
+/** Services expected to exit (one-shot jobs) — an `exited` state is fine. */
+export declare const ONE_SHOT_SERVICES: Set<string>;
+/**
+ * The services whose `exited` state is a real failure *right now*.
+ *
+ * `stackServices()` scans the whole `mesh-local` compose project, overlay
+ * included — but `mesh start` brings the base stack up first and the Hub
+ * overlay only afterwards. Before that point an `exited` hub container is a
+ * leftover from a previous run (a Docker restart, a laptop sleep), not a
+ * crash: the base `up -d` deliberately never started it. Counting it made
+ * `mesh start` abort before it ever tried to start the Hub, pointing at the
+ * wrong thing.
+ *
+ * Once the overlay HAS been started, an exited overlay service is a crash
+ * like any other — pass `overlayStarted: true` and the signal is preserved.
+ */
+export declare function crashedServices(services: ServiceStatus[], opts: {
+    overlayServices: ReadonlySet<string>;
+    overlayStarted: boolean;
+}): ServiceStatus[];
+/**
+ * Whether the Hub overlay is up in this run — i.e. at least one overlay
+ * container is actually `running`. `mesh status` has no other way to know
+ * (it never started anything), and "a container exists" is not it: a
+ * leftover `exited` one exists too.
+ */
+export declare function hubOverlayRunning(services: ServiceStatus[], overlayServices: ReadonlySet<string>): boolean;
+/**
+ * Whether the Hub API is serving. `some(s => s.name === "hub-api")` is not
+ * the same question — that is true of a leftover exited container, and
+ * probing Hub endpoints that were never meant to be up this run reports the
+ * stack unhealthy for a Hub nobody started.
+ */
+export declare function hubApiRunning(services: ServiceStatus[]): boolean;
+/** Probe a host endpoint (http 2xx-4xx counts as up; tcp connect counts as up). */
+export declare function probeEndpoint(endpoint: StackEndpoint): Promise<boolean>;
+//# sourceMappingURL=stack.d.ts.map

package/dist/src/commands/local/stack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack.d.ts","sourceRoot":"","sources":["../../../../src/commands/local/stack.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAIrC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAIvC;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACxF,qEAAqE;IACrE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,eAAO,MAAM,eAAe,EAAE,aAAa,EAuF1C,CAAC;AAEF;;;oDAGoD;AACpD,eAAO,MAAM,gBAAgB,SAAS,CAAC;AAEvC;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,OAAO,IAAI,MAAM,CAShC;AAED;;;6CAG6C;AAC7C,wBAAgB,YAAY,IAAI,aAAa,EAAE,CAgB9C;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAmBzD;AAED,wBAAgB,QAAQ,IAAI,MAAM,CAQjC;AAED,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,2BAA2B,CAAC;AAEzD,mFAAmF;AACnF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAGnE;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,CAAC,MAAM,CAAC,CAWxD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,GAAG,SAAS,CA4BxD;AAED,qEAAqE;AACrE,wBAAgB,qBAAqB,IAAI,IAAI,CAS5C;AAED;;+DAE+D;AAC/D,wBAAgB,OAAO,CACrB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GAC5E,MAAM,CAsBR;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAU9D;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE;IAAE,GAAG,CAAC,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAO,GACzD,OAAO,CAAC,IAAI,CAAC,CA0Ef;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,EAAE,CAiB9D;AAED,wBAAgB,aAAa,IAAI,aAAa,EAAE,CAG/C;AAED,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB,aAA0D,CAAC;AAEzF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,EAAE,EACzB,IAAI,EAAE;IAAE,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,GACtE,aAAa,EAAE,CAOjB;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,aAAa,EAAE,EACzB,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,GACnC,OAAO,CAET;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,OAAO,CAEhE;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAa7E"}