@mesh-tech/mesh-cli 0.1.1 → 0.12.1

package/dist/src/commands/vpn/index.js

@@ -0,0 +1,543 @@
+/**
+ * mesh vpn — Headscale VPN management commands
+ *
+ * Commands:
+ *   mesh vpn connect <context>   Connect to VPN via Tailscale + OIDC
+ *   mesh vpn disconnect          Disconnect from VPN
+ *   mesh vpn status              Show VPN control plane status
+ *   mesh vpn api-key             Create a Headscale API key
+ *   mesh vpn pre-auth-key        Create a pre-authentication key for a user
+ *   mesh vpn users               List registered VPN users
+ *
+ * All commands shell out to kubectl. The user must have kubeconfig
+ * configured for the target cluster (e.g., via `aws eks update-kubeconfig`).
+ */
+import { execFileSync } from "child_process";
+import * as net from "node:net";
+import { logInfo, logSuccess, logError, logWarn } from "../../utils/index.js";
+import { getContextConfig } from "../login.js";
+import { registerTunnelSubcommands } from "./tunnel.js";
+import { ensureDaemon, joinHeadscale, daemonState, stopDaemon, tailscaleAvailable, readDaemonMeta, findRunningDaemon, } from "../../utils/tailscale.js";
+// =============================================================================
+// Constants
+// =============================================================================
+/** Default namespace follows the convention: {tenant}-{env}-headscale */
+function defaultNamespace(tenant, env) {
+    return `${tenant}-${env}-headscale`;
+}
+const HEADSCALE_POD = "headscale-0";
+const HEADSCALE_CONTAINER = "headscale";
+// =============================================================================
+// Helpers
+// =============================================================================
+function resolveNamespace(options) {
+    return options.namespace ?? defaultNamespace(options.tenant, options.env);
+}
+/**
+ * Run a headscale CLI command inside the headscale pod.
+ * Returns stdout as a string. Throws on non-zero exit.
+ */
+function headscaleExec(namespace, args, opts) {
+    const cmd = ["headscale", ...args];
+    if (opts?.json) {
+        cmd.push("--output", "json");
+    }
+    const execOpts = {
+        encoding: "utf-8",
+        stdio: ["pipe", "pipe", "pipe"],
+    };
+    try {
+        const result = execFileSync("kubectl", [
+            "exec",
+            "-n", namespace,
+            HEADSCALE_POD,
+            "-c", HEADSCALE_CONTAINER,
+            "--",
+            ...cmd,
+        ], execOpts);
+        return result.trim();
+    }
+    catch (error) {
+        const execError = error;
+        const stderr = execError.stderr?.toString().trim() ?? "";
+        if (stderr) {
+            throw new Error(stderr);
+        }
+        throw error;
+    }
+}
+/**
+ * Derive the likely EKS cluster name from tenant/env convention.
+ */
+function clusterName(tenant, env) {
+    return `${tenant}-${env}-eks`;
+}
+/**
+ * Check that the headscale pod is running and reachable.
+ */
+function assertPodReady(namespace, options) {
+    try {
+        const output = execFileSync("kubectl", [
+            "get", "pod", HEADSCALE_POD,
+            "-n", namespace,
+            "-o", "jsonpath={.status.phase}",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+        if (output.trim() !== "Running") {
+            logError(`Headscale pod is not running (status: ${output.trim()})`);
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        const stderr = err.stderr?.toString() ?? "";
+        logError(`Cannot reach headscale pod in namespace ${namespace}`);
+        if (stderr.includes("expired") || stderr.includes("token")) {
+            logInfo("Your AWS credentials appear to be expired. Refresh them and retry.");
+        }
+        else {
+            const cluster = clusterName(options.tenant, options.env);
+            logInfo("Make sure your kubeconfig is configured for the target cluster:");
+            const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
+            logInfo(`  aws eks update-kubeconfig --name ${cluster} --region ${region}`);
+        }
+        process.exit(1);
+    }
+}
+// =============================================================================
+// Commands
+// =============================================================================
+async function vpnStatus(options) {
+    const ns = resolveNamespace(options);
+    logInfo(`Checking Headscale in namespace ${ns}...`);
+    assertPodReady(ns, options);
+    // Get pod details
+    const podJson = execFileSync("kubectl", [
+        "get", "pod", HEADSCALE_POD,
+        "-n", ns,
+        "-o", "json",
+    ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] });
+    const pod = JSON.parse(podJson);
+    const container = pod.status?.containerStatuses?.find((c) => c.name === HEADSCALE_CONTAINER);
+    const image = container?.image ?? "unknown";
+    const ready = container?.ready ?? false;
+    const restarts = container?.restartCount ?? 0;
+    // Get the HTTPRoute hostname
+    let endpoint = "unknown";
+    try {
+        endpoint = execFileSync("kubectl", [
+            "get", "httproute",
+            "-n", ns,
+            "-o", "jsonpath={.items[0].spec.hostnames[0]}",
+        ], { encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"] }).trim();
+        if (endpoint) {
+            endpoint = `https://${endpoint}`;
+        }
+    }
+    catch {
+        // HTTPRoute may not exist
+    }
+    // List users
+    let userCount = 0;
+    try {
+        const usersJson = headscaleExec(ns, ["users", "list"], { json: true });
+        const users = JSON.parse(usersJson);
+        userCount = Array.isArray(users) ? users.length : 0;
+    }
+    catch {
+        // Users may not be queryable yet
+    }
+    // List nodes
+    let nodeCount = 0;
+    try {
+        const nodesJson = headscaleExec(ns, ["nodes", "list"], { json: true });
+        const nodes = JSON.parse(nodesJson);
+        nodeCount = Array.isArray(nodes) ? nodes.length : 0;
+    }
+    catch {
+        // Nodes may not be queryable
+    }
+    console.log("");
+    console.log(`  Endpoint:   ${endpoint}`);
+    console.log(`  Image:      ${image}`);
+    console.log(`  Ready:      ${ready ? "yes" : "no"}`);
+    console.log(`  Restarts:   ${restarts}`);
+    console.log(`  Namespace:  ${ns}`);
+    console.log(`  Users:      ${userCount}`);
+    console.log(`  Nodes:      ${nodeCount}`);
+    console.log("");
+    if (ready) {
+        logSuccess("Headscale is healthy");
+    }
+    else {
+        logWarn("Headscale pod is not ready");
+    }
+}
+async function createApiKey(options) {
+    const ns = resolveNamespace(options);
+    logInfo(`Creating Headscale API key in namespace ${ns}...`);
+    assertPodReady(ns, options);
+    try {
+        const output = headscaleExec(ns, ["apikeys", "create"]);
+        console.log("");
+        logSuccess("API key created:");
+        console.log("");
+        console.log(`  ${output}`);
+        console.log("");
+        logWarn("Store this key securely — it cannot be retrieved again.");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logError(`Failed to create API key: ${message}`);
+        process.exit(1);
+    }
+}
+async function createPreAuthKey(options) {
+    const ns = resolveNamespace(options);
+    const { user, expiration, reusable, ephemeral } = options;
+    logInfo(`Creating pre-auth key for user "${user}" in namespace ${ns}...`);
+    assertPodReady(ns, options);
+    // Ensure the user exists
+    try {
+        headscaleExec(ns, ["users", "create", user]);
+        logInfo(`Created user "${user}"`);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        // "already exists" is fine
+        if (!message.includes("already exists")) {
+            logError(`Failed to create user: ${message}`);
+            process.exit(1);
+        }
+        logInfo(`User "${user}" already exists`);
+    }
+    const args = ["preauthkeys", "create", "--user", user];
+    if (expiration) {
+        args.push("--expiration", expiration);
+    }
+    if (reusable) {
+        args.push("--reusable");
+    }
+    if (ephemeral) {
+        args.push("--ephemeral");
+    }
+    try {
+        const output = headscaleExec(ns, args);
+        console.log("");
+        logSuccess("Pre-authentication key created:");
+        console.log("");
+        console.log(`  ${output}`);
+        console.log("");
+        logInfo("Use this key to register a node:");
+        logInfo(`  tailscale up --login-server <endpoint> --authkey ${output}`);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logError(`Failed to create pre-auth key: ${message}`);
+        process.exit(1);
+    }
+}
+async function listUsers(options) {
+    const ns = resolveNamespace(options);
+    logInfo(`Listing Headscale users in namespace ${ns}...`);
+    assertPodReady(ns, options);
+    try {
+        const output = headscaleExec(ns, ["users", "list"]);
+        console.log("");
+        console.log(output);
+        console.log("");
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        logError(`Failed to list users: ${message}`);
+        process.exit(1);
+    }
+}
+// =============================================================================
+// VPN Connect / Disconnect
+// =============================================================================
+/**
+ * Derive the VPN (Headscale) endpoint from a mesh login context.
+ *
+ * The login config stores an issuer URL like:
+ *   https://identity.dev.mesh-platform.trabian.com
+ * The VPN endpoint follows the same domain with "vpn" as the subdomain:
+ *   https://vpn.dev.mesh-platform.trabian.com
+ */
+function vpnEndpointFromContext(context) {
+    const config = getContextConfig(context);
+    if (!config) {
+        throw new Error(`No configuration found for "${context}".\n` +
+            `Run: mesh login ${context}  (or add the context to ~/.config/mesh/config.json)`);
+    }
+    const issuerUrl = new URL(config.issuer);
+    // Replace the first subdomain ("identity") with "vpn"
+    const hostParts = issuerUrl.hostname.split(".");
+    if (hostParts.length < 3) {
+        throw new Error(`Cannot derive VPN endpoint from issuer "${config.issuer}". ` +
+            `Expected a subdomain like identity.<env>.<domain>.`);
+    }
+    hostParts[0] = "vpn";
+    return `https://${hostParts.join(".")}`;
+}
+/** Split a platform context ("mesh.dev") into its tenant + env. Pure. */
+export function parseContextTenantEnv(context) {
+    const [tenant, env] = context.split(".");
+    return { tenant: tenant || "mesh", env: env || "dev" };
+}
+/** Ephemeral free TCP port on loopback for the userspace daemon's SOCKS proxy. */
+function findFreePort() {
+    return new Promise((resolve, reject) => {
+        const srv = net.createServer();
+        srv.on("error", reject);
+        srv.listen(0, "127.0.0.1", () => {
+            const addr = srv.address();
+            const port = typeof addr === "object" && addr ? addr.port : 0;
+            srv.close(() => resolve(port));
+        });
+    });
+}
+/**
+ * Check whether the `tailscale` CLI is installed and return its path,
+ * or null if not found.
+ */
+function findTailscale() {
+    try {
+        return execFileSync("which", ["tailscale"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        }).trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Return Tailscale's full status, or null if tailscale is not running. */
+function tailscaleStatus() {
+    try {
+        const json = execFileSync("tailscale", ["status", "--json"], {
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        return JSON.parse(json);
+    }
+    catch {
+        return null;
+    }
+}
+/** Return Tailscale's BackendState, or null if tailscale is not running. */
+export function tailscaleBackendState() {
+    return tailscaleStatus()?.BackendState ?? null;
+}
+/**
+ * Normalize a control server URL for comparison.
+ * Trims trailing slashes and lowercases the origin.
+ */
+function normalizeControlUrl(url) {
+    try {
+        const u = new URL(url);
+        return `${u.protocol}//${u.host}`.toLowerCase();
+    }
+    catch {
+        return url.replace(/\/+$/, "").toLowerCase();
+    }
+}
+async function vpnConnect(context, opts = {}) {
+    const endpoint = vpnEndpointFromContext(context);
+    if (opts.system) {
+        // Whole-machine VPN via the GUI Tailscale.app daemon. Opt-in only: it needs
+        // the GUI app installed/running and CANNOT run headless or under the safehouse
+        // sandbox (dyld can't load the app bundle's Sparkle.framework → abort trap).
+        await vpnConnectSystem(endpoint);
+        return;
+    }
+    await vpnConnectUserspace(context, endpoint);
+}
+/**
+ * Default path: bring up the per-tenant userspace `tailscaled` (brew formula, NOT
+ * the GUI app) and register this machine with the platform Headscale. This is the
+ * same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` already use, so
+ * it runs headless and under the sandbox. It exposes a local SOCKS5 proxy — the
+ * userspace analog of system-wide routing — instead of a system TUN; for
+ * auto-forwarded VPC services (Temporal, RDS, …) use `mesh vpn tunnel` / `mesh dev`.
+ */
+async function vpnConnectUserspace(context, loginServer) {
+    if (!tailscaleAvailable()) {
+        logError("Standalone tailscale/tailscaled not found.");
+        logInfo("Install it: brew install tailscale");
+        logInfo("(The GUI Tailscale.app is not used here — for whole-machine VPN see `mesh vpn connect --system`.)");
+        process.exit(1);
+    }
+    const { tenant } = parseContextTenantEnv(context);
+    const region = process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? "us-east-2";
+    if (daemonState(tenant).backendState === "Running") {
+        // Prefer daemon.json; recover the real bound port from argv if meta is missing
+        // (older build) so a "connected" session always shows how to reach it.
+        const port = readDaemonMeta(tenant)?.socksPort ?? findRunningDaemon(tenant)?.socksPort;
+        logSuccess(`Already connected to the platform VPN for '${tenant}' (userspace).`);
+        if (port)
+            logInfo(`  SOCKS5 proxy: 127.0.0.1:${port}  (route a tool via ALL_PROXY=socks5://127.0.0.1:${port})`);
+        return;
+    }
+    logInfo(`Connecting to the platform VPN for '${tenant}' (userspace tailscaled)…`);
+    const socksPort = readDaemonMeta(tenant)?.socksPort ?? (await findFreePort());
+    const realPort = await ensureDaemon(tenant, { region, socksPort });
+    // Interactive join — joinHeadscale relays the one-time registration URL for
+    // headless/SSH machines (no local browser to pop) and polls up to ~5 min.
+    await joinHeadscale(tenant, loginServer);
+    logSuccess(`VPN connected (userspace) for '${tenant}'.`);
+    logInfo(`  SOCKS5 proxy: 127.0.0.1:${realPort}  — route a tool via ALL_PROXY=socks5://127.0.0.1:${realPort}`);
+    logInfo("  For auto-forwarded VPC services (Temporal, RDS, …): mesh vpn tunnel up  (or mesh dev)");
+}
+/** Opt-in whole-machine VPN via the GUI Tailscale.app daemon (`mesh vpn connect --system`). */
+async function vpnConnectSystem(endpoint) {
+    if (!findTailscale()) {
+        logError("Tailscale CLI not found.");
+        logInfo("Install it: brew install tailscale  (or see https://tailscale.com/download)");
+        process.exit(1);
+    }
+    // If already connected to *this* endpoint, short-circuit. But if connected
+    // to a different control server, fall through and reconnect — otherwise the
+    // user would silently stay on the wrong tailnet.
+    const status = tailscaleStatus();
+    if (status?.BackendState === "Running") {
+        const current = status.ControlURL ? normalizeControlUrl(status.ControlURL) : null;
+        const target = normalizeControlUrl(endpoint);
+        if (current === target) {
+            logSuccess(`Already connected to VPN at ${endpoint}.`);
+            logInfo("Run: tailscale status  to see connected nodes.");
+            return;
+        }
+        if (current) {
+            logWarn(`Currently connected to ${current}. Reconnecting to ${target}...`);
+        }
+    }
+    logInfo(`Connecting to VPN at ${endpoint}...`);
+    logInfo("A browser window will open for Zitadel authentication.");
+    console.log("");
+    // tailscale up is interactive (opens browser), so we inherit stdio.
+    // On macOS, Tailscale.app owns the daemon — `tailscale up` talks to it.
+    // On Linux, tailscaled runs as root and `tailscale up` may need sudo.
+    //
+    // --reset: wipe prior prefs so this command is idempotent. Without it,
+    //   tailscale refuses to apply prefs if a previous session set non-default
+    //   flags that aren't re-specified here.
+    // --accept-routes: accept subnet routes advertised by the Headscale
+    //   SubnetRouter so clients can reach in-VPC services (EKS, RDS, internal LBs).
+    const upArgs = [
+        "up",
+        "--reset",
+        "--login-server", endpoint,
+        "--accept-routes",
+    ];
+    try {
+        execFileSync("tailscale", upArgs, { stdio: "inherit" });
+        console.log("");
+        logSuccess("VPN connected.");
+    }
+    catch (error) {
+        const code = error.status;
+        const isPermissionError = process.platform === "linux" && (code === 1 || code === 2);
+        console.log("");
+        logError(`tailscale up failed (exit ${code}).`);
+        if (isPermissionError) {
+            logInfo("On Linux, tailscaled runs as root — you may need sudo:");
+            logInfo(`  sudo tailscale ${upArgs.join(" ")}`);
+        }
+        process.exit(1);
+    }
+}
+async function vpnDisconnect(opts) {
+    if (opts.system) {
+        // Whole-machine GUI Tailscale down (opt-in, mirrors `connect --system`).
+        if (!findTailscale()) {
+            logError("Tailscale CLI not found.");
+            process.exit(1);
+        }
+        if (tailscaleBackendState() !== "Running") {
+            logInfo("System VPN is not connected.");
+            return;
+        }
+        logInfo("Disconnecting system VPN…");
+        try {
+            execFileSync("tailscale", ["down"], { stdio: "inherit" });
+            logSuccess("VPN disconnected.");
+        }
+        catch (error) {
+            const code = error.status;
+            logError(`tailscale down failed (exit ${code}). Try: sudo tailscale down`);
+            process.exit(1);
+        }
+        return;
+    }
+    // Default: stop the tenant's userspace daemon (leaves the Headscale node
+    // identity in the statedir so a later `connect` rejoins without re-login).
+    const { tenant } = opts;
+    if (daemonState(tenant).backendState === "Down") {
+        logInfo(`No userspace VPN daemon running for '${tenant}'.`);
+        return;
+    }
+    logInfo(`Disconnecting userspace VPN for '${tenant}'…`);
+    stopDaemon(tenant);
+    logSuccess(`VPN disconnected for '${tenant}'.`);
+}
+// =============================================================================
+// Registration
+// =============================================================================
+export function registerVpnCommands(program) {
+    const vpn = program
+        .command("vpn")
+        .description("Headscale VPN management")
+        .option("-t, --tenant <tenant>", "Platform tenant", "mesh")
+        .option("-e, --env <env>", "Platform environment", "dev")
+        .option("-n, --namespace <namespace>", "Override K8s namespace (default: {tenant}-{env}-headscale)");
+    vpn
+        .command("status")
+        .description("Show VPN control plane status")
+        .action(async () => {
+        const opts = vpn.opts();
+        await vpnStatus(opts);
+    });
+    vpn
+        .command("connect")
+        .description("Connect to the platform VPN (userspace tailscaled; opens browser for Zitadel auth)")
+        .argument("<context>", 'Platform context (e.g., "mesh.dev")')
+        .option("--system", "Use the whole-machine GUI Tailscale.app instead (system TUN; cannot run headless/sandboxed)")
+        .action(async (context, cmdOpts) => {
+        await vpnConnect(context, cmdOpts);
+    });
+    vpn
+        .command("disconnect")
+        .description("Disconnect from the platform VPN — stops the tenant's shared userspace daemon " +
+        "(also ends any active `mesh vpn tunnel` / `mesh dev` forwards for it); --system for GUI Tailscale")
+        .option("--system", "Disconnect the whole-machine GUI Tailscale instead of the userspace daemon")
+        .action(async (cmdOpts) => {
+        const { tenant } = vpn.opts();
+        await vpnDisconnect({ tenant, system: cmdOpts.system });
+    });
+    vpn
+        .command("api-key")
+        .description("Create a Headscale API key")
+        .action(async () => {
+        const opts = vpn.opts();
+        await createApiKey(opts);
+    });
+    vpn
+        .command("pre-auth-key")
+        .description("Create a pre-authentication key for node registration")
+        .requiredOption("-u, --user <user>", "User/namespace to create the key for (e.g., matt@trabian.com)")
+        .option("--expiration <duration>", "Key expiration (e.g., 24h, 7d)", "24h")
+        .option("--reusable", "Allow key to be used multiple times")
+        .option("--ephemeral", "Nodes registered with this key are ephemeral")
+        .action(async (cmdOpts) => {
+        const parentOpts = vpn.opts();
+        await createPreAuthKey({ ...parentOpts, ...cmdOpts });
+    });
+    vpn
+        .command("users")
+        .description("List registered VPN users")
+        .action(async () => {
+        const opts = vpn.opts();
+        await listUsers(opts);
+    });
+    registerTunnelSubcommands(vpn);
+}
+//# sourceMappingURL=index.js.map

package/dist/src/commands/vpn/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/vpn/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAE,YAAY,EAA4B,MAAM,eAAe,CAAC;AACvE,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EACL,YAAY,EACZ,aAAa,EACb,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAElC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,MAAc,EAAE,GAAW;IACnD,OAAO,GAAG,MAAM,IAAI,GAAG,YAAY,CAAC;AACtC,CAAC;AAED,MAAM,aAAa,GAAG,aAAa,CAAC;AACpC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAmBxC,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,gBAAgB,CAAC,OAAmB;IAC3C,OAAO,OAAO,CAAC,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAc,EACd,IAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,QAAQ,GAAwB;QACpC,QAAQ,EAAE,OAAyB;QACnC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;KAChC,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,SAAS,EACT;YACE,MAAM;YACN,IAAI,EAAE,SAAS;YACf,aAAa;YACb,IAAI,EAAE,mBAAmB;YACzB,IAAI;YACJ,GAAG,GAAG;SACP,EACD,QAAQ,CACT,CAAC;QACF,OAAQ,MAAiB,CAAC,IAAI,EAAE,CAAC;IACnC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,KAAsD,CAAC;QACzE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,MAAc,EAAE,GAAW;IAC9C,OAAO,GAAG,MAAM,IAAI,GAAG,MAAM,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,SAAiB,EAAE,OAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CACzB,SAAS,EACT;YACE,KAAK,EAAE,KAAK,EAAE,aAAa;YAC3B,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,0BAA0B;SACjC,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;QACF,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YAChC,QAAQ,CAAC,yCAAyC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAI,GAAoC,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC9E,QAAQ,CAAC,2CAA2C,SAAS,EAAE,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,CAAC,oEAAoE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACzD,OAAO,CAAC,iEAAiE,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;YACvF,OAAO,CAAC,sCAAsC,OAAO,aAAa,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,WAAW;AACX,gFAAgF;AAEhF,KAAK,UAAU,SAAS,CAAC,OAAmB;IAC1C,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAEpD,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE5B,kBAAkB;IAClB,MAAM,OAAO,GAAG,YAAY,CAC1B,SAAS,EACT;QACE,KAAK,EAAE,KAAK,EAAE,aAAa;QAC3B,IAAI,EAAE,EAAE;QACR,IAAI,EAAE,MAAM;KACb,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,IAAI,CACnD,CAAC,CAAmB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,mBAAmB,CACxD,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,EAAE,YAAY,IAAI,CAAC,CAAC;IAE9C,6BAA6B;IAC7B,IAAI,QAAQ,GAAG,SAAS,CAAC;IACzB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CACrB,SAAS,EACT;YACE,KAAK,EAAE,WAAW;YAClB,IAAI,EAAE,EAAE;YACR,IAAI,EAAE,wCAAwC;SAC/C,EACD,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACvD,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,GAAG,WAAW,QAAQ,EAAE,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;IAC5B,CAAC;IAED,aAAa;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IAED,aAAa;IACb,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,iBAAiB,QAAQ,EAAE,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,KAAK,EAAE,CAAC;QACV,UAAU,CAAC,sBAAsB,CAAC,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAAmB;IAC7C,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;IAE5D,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,UAAU,CAAC,kBAAkB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,yDAAyD,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,6BAA6B,OAAO,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAA0B;IACxD,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAE1D,OAAO,CAAC,mCAAmC,IAAI,kBAAkB,EAAE,KAAK,CAAC,CAAC;IAE1E,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE5B,yBAAyB;IACzB,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,iBAAiB,IAAI,GAAG,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,2BAA2B;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,UAAU,CAAC,iCAAiC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,kCAAkC,CAAC,CAAC;QAC5C,OAAO,CAAC,sDAAsD,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,kCAAkC,OAAO,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAmB;IAC1C,MAAM,EAAE,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;IAEzD,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,aAAa,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,QAAQ,CAAC,yBAAyB,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,OAAe;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,MAAM;YAC5C,mBAAmB,OAAO,sDAAsD,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzC,sDAAsD;IACtD,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,2CAA2C,MAAM,CAAC,MAAM,KAAK;YAC7D,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC;IACrB,OAAO,WAAW,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,qBAAqB,CAAC,OAAe;IACnD,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,KAAK,EAAE,CAAC;AACzD,CAAC;AAED,kFAAkF;AAClF,SAAS,YAAY;IACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAC/B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa;IACpB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AASD,2EAA2E;AAC3E,SAAS,eAAe;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;YAC3D,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoB,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,qBAAqB;IACnC,OAAO,eAAe,EAAE,EAAE,YAAY,IAAI,IAAI,CAAC;AACjD,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAe,EAAE,OAA6B,EAAE;IACxE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,4EAA4E;QAC5E,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACjC,OAAO;IACT,CAAC;IACD,MAAM,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,WAAmB;IACrE,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAC1B,QAAQ,CAAC,4CAA4C,CAAC,CAAC;QACvD,OAAO,CAAC,oCAAoC,CAAC,CAAC;QAC9C,OAAO,CAAC,mGAAmG,CAAC,CAAC;QAC7G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;IAEvF,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACnD,+EAA+E;QAC/E,uEAAuE;QACvE,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;QACvF,UAAU,CAAC,8CAA8C,MAAM,gBAAgB,CAAC,CAAC;QACjF,IAAI,IAAI;YAAE,OAAO,CAAC,6BAA6B,IAAI,oDAAoD,IAAI,GAAG,CAAC,CAAC;QAChH,OAAO;IACT,CAAC;IAED,OAAO,CAAC,uCAAuC,MAAM,2BAA2B,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,SAAS,IAAI,CAAC,MAAM,YAAY,EAAE,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACnE,4EAA4E;IAC5E,0EAA0E;IAC1E,MAAM,aAAa,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACzC,UAAU,CAAC,kCAAkC,MAAM,IAAI,CAAC,CAAC;IACzD,OAAO,CAAC,6BAA6B,QAAQ,qDAAqD,QAAQ,EAAE,CAAC,CAAC;IAC9G,OAAO,CAAC,yFAAyF,CAAC,CAAC;AACrG,CAAC;AAED,+FAA+F;AAC/F,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC9C,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QACrB,QAAQ,CAAC,0BAA0B,CAAC,CAAC;QACrC,OAAO,CAAC,6EAA6E,CAAC,CAAC;QACvF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,2EAA2E;IAC3E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,MAAM,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,MAAM,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC7C,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;YACvB,UAAU,CAAC,+BAA+B,QAAQ,GAAG,CAAC,CAAC;YACvD,OAAO,CAAC,gDAAgD,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,0BAA0B,OAAO,qBAAqB,MAAM,KAAK,CAAC,CAAC;QAC7E,CAAC;IACH,CAAC;IAED,OAAO,CAAC,wBAAwB,QAAQ,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,wDAAwD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,oEAAoE;IACpE,wEAAwE;IACxE,sEAAsE;IACtE,EAAE;IACF,uEAAuE;IACvE,2EAA2E;IAC3E,yCAAyC;IACzC,oEAAoE;IACpE,gFAAgF;IAChF,MAAM,MAAM,GAAG;QACb,IAAI;QACJ,SAAS;QACT,gBAAgB,EAAE,QAAQ;QAC1B,iBAAiB;KAClB,CAAC;IACF,IAAI,CAAC;QACH,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,UAAU,CAAC,gBAAgB,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,GAAI,KAA6B,CAAC,MAAM,CAAC;QACnD,MAAM,iBAAiB,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,CAAC,CAAC;QACrF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,QAAQ,CAAC,6BAA6B,IAAI,IAAI,CAAC,CAAC;QAChD,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,CAAC,wDAAwD,CAAC,CAAC;YAClE,OAAO,CAAC,oBAAoB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAA0C;IACrE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,yEAAyE;QACzE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,QAAQ,CAAC,0BAA0B,CAAC,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,qBAAqB,EAAE,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,CAAC,8BAA8B,CAAC,CAAC;YACxC,OAAO;QACT,CAAC;QACD,OAAO,CAAC,2BAA2B,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1D,UAAU,CAAC,mBAAmB,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,IAAI,GAAI,KAA6B,CAAC,MAAM,CAAC;YACnD,QAAQ,CAAC,+BAA+B,IAAI,6BAA6B,CAAC,CAAC;YAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO;IACT,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,YAAY,KAAK,MAAM,EAAE,CAAC;QAChD,OAAO,CAAC,wCAAwC,MAAM,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,OAAO,CAAC,oCAAoC,MAAM,IAAI,CAAC,CAAC;IACxD,UAAU,CAAC,MAAM,CAAC,CAAC;IACnB,UAAU,CAAC,yBAAyB,MAAM,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,0BAA0B,CAAC;SACvC,MAAM,CAAC,uBAAuB,EAAE,iBAAiB,EAAE,MAAM,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,sBAAsB,EAAE,KAAK,CAAC;SACxD,MAAM,CAAC,6BAA6B,EAAE,4DAA4D,CAAC,CAAC;IAEvG,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAgB,CAAC;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,oFAAoF,CAAC;SACjG,QAAQ,CAAC,WAAW,EAAE,qCAAqC,CAAC;SAC5D,MAAM,CACL,UAAU,EACV,6FAA6F,CAC9F;SACA,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,OAA6B,EAAE,EAAE;QAC/D,MAAM,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,gFAAgF;QAC9E,mGAAmG,CACtG;SACA,MAAM,CAAC,UAAU,EAAE,4EAA4E,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,OAA6B,EAAE,EAAE;QAC9C,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,EAAgB,CAAC;QAC5C,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAgB,CAAC;QACtC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,uDAAuD,CAAC;SACpE,cAAc,CAAC,mBAAmB,EAAE,+DAA+D,CAAC;SACpG,MAAM,CAAC,yBAAyB,EAAE,gCAAgC,EAAE,KAAK,CAAC;SAC1E,MAAM,CAAC,YAAY,EAAE,qCAAqC,CAAC;SAC3D,MAAM,CAAC,aAAa,EAAE,8CAA8C,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,OAAuF,EAAE,EAAE;QACxG,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAgB,CAAC;QAC5C,MAAM,gBAAgB,CAAC,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,2BAA2B,CAAC;SACxC,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAgB,CAAC;QACtC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEL,yBAAyB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/src/commands/vpn/tunnel.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `mesh vpn tunnel` — userspace-Tailscale tunnels to a tenant's VPC services.
+ *
+ * Stands up the tenant's `localhost:PORT` set (drop-in for the SSM tunnels)
+ * backed by a per-tenant userspace `tailscaled` + SOCKS5 forwarders. Detached
+ * and managed: `up` starts everything and returns; `down`/`status` manage it.
+ * (MESH-2040 / Slice 1 of MESH-2014; graduates the MESH-2036 spike.)
+ */
+import type { Command } from "commander";
+export declare function registerTunnelSubcommands(vpn: Command): void;
+//# sourceMappingURL=tunnel.d.ts.map

package/dist/src/commands/vpn/tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tunnel.d.ts","sourceRoot":"","sources":["../../../../src/commands/vpn/tunnel.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8LzC,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAkC5D"}