@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/commands/login.d.ts

@@ -1,31 +1,59 @@
 /**
- * mesh login — Authenticate with Zitadel via OIDC PKCE flow.
+ * mesh login — Authenticate with Zitadel via OIDC PKCE or Device Code flow.
  *
- * Opens browser to Zitadel, receives auth code via localhost callback,
- * exchanges for tokens, and caches at ~/.config/mesh/credentials.json.
+ * Opens browser to Zitadel (PKCE) or prints a code to enter in the browser
+ * (Device Code). Exchanges for tokens and caches at ~/.config/mesh/credentials.json.
  *
  * Config is read from ~/.config/mesh/config.json, keyed by context
- * (e.g., "mesh.dev"). Example:
+ * (e.g., "mesh.dev"). After deploying the platform, copy the CLI client ID
+ * from the Pulumi stack output into the config file.
  *
- *   {
- *     "mesh.dev": {
- *       "issuer": "https://identity.<env>.<your-platform-domain>",
- *       "clientId": "<cli-oidc-client-id>"
- *     }
- *   }
+ * In containers/SSH sessions, device code flow is used automatically.
  *
  * Usage:
  *   mesh login mesh.dev            — authenticate to mesh dev
- *   mesh login mesh.dev --status   — show current auth state
+ *   mesh login mesh.dev --device   — force device code flow
+ *   mesh login mesh.dev --status   — show current auth state (Zitadel session if
+ *                                    there is one, otherwise whatever the AWS
+ *                                    credential chain resolves — SSO or key pair)
  *   mesh logout mesh.dev           — clear cached credentials
  */
 import { Command } from "commander";
+import { type AwsIdentity } from "../utils/aws-auth.js";
 declare const CONFIG_DIR: string;
 declare const CONFIG_FILE: string;
 declare const CREDENTIALS_FILE: string;
 interface ContextConfig {
     issuer: string;
     clientId: string;
+    /**
+     * Default IAM role ARN to assume for this context when no `--role` flag
+     * and no `MESH_AWS_ROLE` env var are provided. Set automatically the first
+     * time `mesh login ... --export --role <arn>` runs against this context;
+     * subsequent `--role` values overwrite it.
+     */
+    defaultRole?: string;
+    /**
+     * Optional admin-tier IAM role for this context. When set,
+     * `selectRoleForCaller` upgrades to this ARN automatically when the
+     * caller's Zitadel JWT carries the admin role (default
+     * `mesh.platform:admin`; override via adminClaimRoles).
+     */
+    adminRole?: string;
+    /**
+     * Zitadel role names that map a caller to `adminRole`. Defaults to
+     * `["mesh.platform:admin"]` when omitted.
+     */
+    adminClaimRoles?: string[];
+    /** Headscale login server (published by the platform). */
+    vpn?: string;
+    /** Zero-touch pre-auth broker URL (published by the platform). */
+    vpnJoinBroker?: string;
+    /**
+     * Zitadel-gated registry-auth broker URL (published by the platform).
+     * With this set, `mesh registry login` needs no AWS credentials at all.
+     */
+    registryBroker?: string;
 }
 interface CachedCredentials {
     idToken: string;
@@ -35,13 +63,229 @@ interface CachedCredentials {
     email?: string;
     sub?: string;
 }
+type ConfigFile = Record<string, ContextConfig>;
 type CredentialsFile = Record<string, CachedCredentials>;
+export declare function writeContextConfig(context: string, config: ContextConfig): void;
 declare function getContextConfig(context: string): ContextConfig | null;
 declare function readAllCredentials(): CredentialsFile;
 declare function readCredentials(context: string): CachedCredentials | null;
+/**
+ * Write `data` to `path` atomically: write to a temp file in the SAME
+ * directory as `path` (so the subsequent rename is same-filesystem, hence
+ * atomic), then `fs.renameSync` it into place. This guarantees concurrent
+ * readers (e.g. other `credential_process` invocations racing a refresh)
+ * only ever observe a fully-written file — never a truncated one from an
+ * interleaved `fs.writeFileSync`.
+ *
+ * On any error, best-effort removes the temp file before rethrowing.
+ *
+ * Exported for unit testing.
+ */
+export declare function atomicWriteFileSync(path: string, data: string, mode: number): void;
 declare function decodeJwtPayload(token: string): Record<string, unknown>;
+/**
+ * Run device-code login, re-issuing a fresh code (up to `maxCodes`) if the user
+ * doesn't finish before a code expires. `attempt` performs ONE code's
+ * request+poll and resolves `"success"` or `"expired"`; it rejects only on a
+ * hard error (denied / network). Extracted + injectable so the reissue loop is
+ * unit-testable without real network calls.
+ */
+export declare function deviceLoginWithReissue(attempt: (codeNumber: number) => Promise<"success" | "expired">, maxCodes?: number): Promise<void>;
+/**
+ * Detect an environment where the PKCE browser-callback flow won't work — a
+ * container, a remote/SSH session, or any non-interactive shell (piped output,
+ * headless, agent/CI-run). In all of these the callback flow has no browser to
+ * open and no interactive terminal, so it can only hang until the 2-minute
+ * timeout. Device-code flow (print a URL + code to complete elsewhere) is the
+ * correct fallback, so callers use it whenever this returns true.
+ *
+ * Exported for tests.
+ */
+export declare function isRemoteEnvironment(): boolean;
+/**
+ * What `--status` reports when there is no usable Zitadel session.
+ *
+ * Zitadel is one way to reach a platform's AWS account, not the only one. A
+ * profile authenticated with SSO — or with a plain access-key/secret pair —
+ * is just as good, and everything downstream already accepts it: aws-auth's
+ * path 1 (ambient env creds) and path 3 (AssumeRole via the current session)
+ * never touch the OIDC cache. Reporting "not logged in" purely because that
+ * cache is empty sent people off to run a device flow they did not need, and
+ * failed the check for anyone deliberately using static credentials.
+ *
+ * So: fall through to the AWS credential chain and report what it finds.
+ */
+/** One `--status` output line plus which logger it goes through. */
+export interface StatusLine {
+    level: "success" | "info" | "warn";
+    text: string;
+}
+/**
+ * The account id embedded in an IAM role ARN
+ * (`arn:aws:iam::123456789012:role/...`), or undefined when there is no ARN
+ * to read one from.
+ */
+export declare function accountIdFromRoleArn(roleArn: string | undefined): string | undefined;
+/**
+ * Decide everything `--status` says (and its exit code) when there is no
+ * usable Zitadel session — pure so the wording and the exit decision are
+ * pinned by tests.
+ *
+ * The probe only proves "some AWS identity works on this machine"; it says
+ * nothing about whether that identity belongs to `context`. So the claim is
+ * scoped to the credentials — unless the context config carries a role ARN,
+ * whose account id makes the context check free: verify when we can, say so
+ * when we can't.
+ */
+export declare function renderAwsFallbackStatus(context: string, reason: string, identity: AwsIdentity | null, expectedAccountId?: string): {
+    lines: StatusLine[];
+    exitCode: 0 | 1;
+};
 export declare function registerLoginCommand(program: Command): void;
+/**
+ * Get a valid access token for the given context, refreshing if needed.
+ *
+ * Returns the id token (a JWT with `sub` claim) suitable for
+ * Authorization: Bearer headers. Returns null if no credentials are
+ * cached or refresh fails.
+ */
+/**
+ * True while a cached token is still valid, treating anything within `marginMs`
+ * of expiry as already stale. The margin lets pollers (e.g. the dev-user
+ * token-server) re-mint BEFORE expiry instead of handing out a token that dies
+ * before the caller's next poll.
+ */
+export declare function tokenStillValid(expiresAt: string, marginMs?: number, now?: number): boolean;
+declare function getValidToken(context: string, opts?: {
+    marginMs?: number;
+}): Promise<string | null>;
+/**
+ * Structured diagnosis of the deployer-credential path for a context/role,
+ * without mutating anything. The shared seam behind `mesh dev doctor`'s creds
+ * check and the launch preflight (MESH-2015), reusing the same
+ * `getValidToken` + `assumeRoleCredentials` path as `--credential-process`
+ * (MESH-1965).
+ */
+export type CredProbe = {
+    state: "ok";
+    ttlSeconds: number;
+    expiresAt: string;
+    email?: string;
+} | {
+    state: "no-session";
+} | {
+    state: "expired-session";
+} | {
+    state: "assume-denied";
+    detail: string;
+} | {
+    state: "stale-env-override";
+};
+/**
+ * Probe deployer creds for `context`/`roleArn`. Order matters:
+ *   1. No cached Zitadel session → `no-session`.
+ *   2. Cached session AND ambient `AWS_*` env keys present → `stale-env-override`
+ *      (the frozen triple would override the self-refreshing profile at
+ *      runtime — the exact `mesh dev` trap). Guarded on a cached session so
+ *      legitimate CI env-key credentials, which have no `mesh login` session,
+ *      are not misreported.
+ *   3. Session can't be refreshed → `expired-session`.
+ *   4. AssumeRoleWithWebIdentity fails → `assume-denied` (valid identity, wrong
+ *      IAM/role/policy).
+ *   5. Otherwise → `ok` with the STS TTL.
+ */
+export declare function probeCredentials(context: string, roleArn: string): Promise<CredProbe>;
+/**
+ * Render the `--static` output: raw temporary AWS credentials as shell
+ * `export` statements (the old frozen ~1h triple). Pure — no I/O. Includes a
+ * trailing newline. Exported for unit testing.
+ */
+export declare function renderExportStaticLines(args: {
+    accessKey: string;
+    secretKey: string;
+    sessionToken: string;
+    region: string;
+}): string;
+/**
+ * Render the default `--export` output: point the shell at a self-refreshing
+ * `credential_process` profile. The leading `unset` clears any stale STS
+ * triple already in the shell so it can't shadow the profile. Pure — no I/O.
+ * Includes a trailing newline. Exported for unit testing.
+ *
+ * Deliberately does NOT export `AWS_CONFIG_FILE`: the profile lives in the
+ * user's REAL AWS config file (managed marker section — see
+ * `upsertManagedAwsConfigSection`), so their other profiles (e.g.
+ * `AWS_PROFILE=mesh-dev` InfraAdmin) keep working in the same shell.
+ * Redirecting AWS_CONFIG_FILE to a mesh-private file used to clobber
+ * ~/.aws/config for every subsequent AWS command.
+ */
+export declare function renderExportProfileLines(args: {
+    profileName: string;
+    region: string;
+}): string;
+/**
+ * The AWS config file the managed profile section is written into: the
+ * user's `$AWS_CONFIG_FILE` when THEY have set one, else `~/.aws/config` —
+ * the same file `aws configure sso` manages. Exported for unit testing.
+ */
+export declare function resolveUserAwsConfigPath(env?: Record<string, string | undefined>): string;
+/**
+ * Where to write the managed AWS profile, with a safehouse fallback. Normally
+ * the user's real `~/.aws/config` (augmented in place, so their other tools see
+ * the profile — hence `redirected: false`, we don't touch their `AWS_CONFIG_FILE`).
+ * But when `~/.aws` is not writable (a sandbox without a `~/.aws` grant), fall
+ * back to a mesh-managed file under `~/.config/mesh` we CAN write, and set
+ * `redirected: true` so the caller also exports `AWS_CONFIG_FILE` (otherwise the
+ * AWS SDK, looking only at `~/.aws/config`, would never find the profile). An
+ * explicit `AWS_CONFIG_FILE` always wins and is never redirected.
+ */
+export declare function resolveAwsConfigTarget(env?: Record<string, string | undefined>): {
+    configPath: string;
+    redirected: boolean;
+};
+/**
+ * Resolve which IAM role ARN to use, honoring the same precedence in both
+ * `--export` and `--credential-process`: explicit `--role` wins, then
+ * `MESH_AWS_ROLE`, then the context's cached `defaultRole`. Pure aside from
+ * reading `process.env.MESH_AWS_ROLE` — returns an explanatory error instead
+ * of throwing so callers can route it to stderr and exit non-zero.
+ *
+ * Exported for unit testing.
+ */
+export declare function resolveRoleOrExplain(opts: {
+    role?: string;
+}, config: {
+    defaultRole?: string;
+}): {
+    role: string;
+} | {
+    error: string;
+};
+/**
+ * Ensure a valid login session for `context`, running the login flow (device
+ * code in remote/non-TTY, browser callback otherwise) if none is cached. Returns
+ * the cached credentials, or null if no config is available to log in with.
+ *
+ * For use by other commands (e.g. `secrets set`, the AWS-cred resolver) so they
+ * can trigger login on demand instead of just failing with guidance.
+ */
+export declare function ensureLogin(context: string, opts?: {
+    device?: boolean;
+    interactive?: boolean;
+}): Promise<CachedCredentials | null>;
 export { CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE };
 export type { ContextConfig, CachedCredentials, CredentialsFile };
-export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload };
+/** Every cached context config, keyed by context name. */
+export declare function readAllContextConfigs(): ConfigFile;
+/**
+ * The discovery chain on its own, without the browser flow that follows it.
+ *
+ * Exported so the clean-laptop bootstrap — SSM → pinned first-party alias →
+ * full-domain, and the anti-phishing refusal for an unknown short context — can
+ * be exercised end-to-end against the live well-known endpoint. The `login`
+ * command's own path is otherwise only reachable by completing an interactive
+ * sign-in, which is why this leg had no coverage above the unit tier.
+ */
+export declare function discoverConfigForContext(context: string): Promise<ContextConfig | null>;
+export { readCredentials, readAllCredentials, getContextConfig, decodeJwtPayload, getValidToken };
 //# sourceMappingURL=login.d.ts.map

package/dist/src/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,QAAA,MAAM,UAAU,QAGf,CAAC;AACF,QAAA,MAAM,WAAW,QAAuC,CAAC;AACzD,QAAA,MAAM,gBAAgB,QAA4C,CAAC;AAWnE,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAGD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAWzD,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAG/D;AAED,iBAAS,kBAAkB,IAAI,eAAe,CAO7C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAElE;AA4CD,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAwQD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2C3D;AAMD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOpC,OAAO,EAWL,KAAK,WAAW,EACjB,MAAM,sBAAsB,CAAC;AAQ9B,QAAA,MAAM,UAAU,QAGf,CAAC;AACF,QAAA,MAAM,WAAW,QAAuC,CAAC;AACzD,QAAA,MAAM,gBAAgB,QAA4C,CAAC;AAWnE,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,0DAA0D;IAC1D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,iBAAiB;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAChD,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;AAWzD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAK/E;AAED,iBAAS,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAG/D;AA8ID,iBAAS,kBAAkB,IAAI,eAAe,CAO7C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAElE;AAOD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAalF;AA0CD,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAIhE;AAuOD;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,EAC/D,QAAQ,GAAE,MAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAQf;AA8GD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAc7C;AAuBD;;;;;;;;;;;;GAYG;AACH,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,GAAG,SAAS,CAEpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,WAAW,GAAG,IAAI,EAC5B,iBAAiB,CAAC,EAAE,MAAM,GACzB;IAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAA;CAAE,CA+D1C;AA+FD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAoI3D;AAMD;;;;;;GAMG;AACH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,GAAG,SAAa,GAAG,OAAO,CAE1F;AAED,iBAAe,aAAa,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAC/B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA4BxB;AAMD;;;;;;GAMG;AACH,MAAM,MAAM,SAAS,GACjB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,KAAK,EAAE,YAAY,CAAA;CAAE,GACvB;IAAE,KAAK,EAAE,iBAAiB,CAAA;CAAE,GAC5B;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC1C;IAAE,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEpC;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,SAAS,CAAC,CA0BpB;AAeD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAOT;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAMT;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAER;AAcD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,OAAO,CAAA;CAAE,CAK7C;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,EACvB,MAAM,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAUtC;AA8BD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,MAAM,EACf,IAAI,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,OAAO,CAAA;CAAO,GACrD,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAsBnC;AAwOD,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC;AACrD,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,eAAe,EAAE,CAAC;AAClE,0DAA0D;AAC1D,wBAAgB,qBAAqB,IAAI,UAAU,CAElD;AAED;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAE7F;AAED,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC"}