@mesh-tech/mesh-cli 0.13.0 → 0.15.0

package/dist/src/commands/secrets/set.js

@@ -19,6 +19,7 @@ import { SSMClient, GetParametersByPathCommand, } from "@aws-sdk/client-ssm";
 import { SecretsManagerClient, GetSecretValueCommand, PutSecretValueCommand, CreateSecretCommand, } from "@aws-sdk/client-secrets-manager";
 import input from "@inquirer/input";
 import password from "@inquirer/password";
+import { buildInstanceIndexValue, instanceIndexSecretId, isInstanceKey, parseInstanceIndex, } from "@mesh-tech/secrets";
 import { detectContext } from "../../utils/context.js";
 import { logInfo, logSuccess, logError } from "../../utils/log.js";
 import { resolveStackOption } from "../../utils/stack-flag.js";
@@ -34,7 +35,7 @@ import { resolveAwsCredentials } from "../../utils/aws-auth.js";
  * filename) — NOT `pulumi stack --show-name`, which would itself need creds to
  * read the backend (the chicken-and-egg this is meant to avoid).
  */
-async function ensureAwsCredentialsForStack(stack) {
+export async function ensureAwsCredentialsForStack(stack) {
     if (process.env.AWS_ACCESS_KEY_ID || process.env.AWS_SESSION_TOKEN)
         return;
     if (!stack)
@@ -83,7 +84,7 @@ function normalizeFields(raw) {
 // =============================================================================
 // SSM discovery
 // =============================================================================
-async function discoverExternalServices(ssmClient, tenant, platformEnv) {
+export async function discoverExternalServices(ssmClient, tenant, platformEnv) {
     const services = new Map();
     const basePath = `/mesh-platform/${tenant}/${platformEnv}`;
     let nextToken;
@@ -255,6 +256,13 @@ export async function setCommand(servicePath, opts) {
             `Specify an instance:\n  mesh secrets set external/${serviceName} --key=<${schema.keyedBy}>`);
         process.exit(1);
     }
+    // A reserved dot-name (`.index`, `.config`) or a path-bearing key would
+    // write credential JSON over the service's bookkeeping secrets.
+    if (opts.key && !isInstanceKey(opts.key)) {
+        logError(`Invalid instance key "${opts.key}": keys must not contain "/", start with ".", ` +
+            `or end with ".config" — those names are reserved for the index and config mirrors.`);
+        process.exit(1);
+    }
     // Read existing values (if any)
     let existing = {};
     try {
@@ -282,6 +290,9 @@ export async function setCommand(servicePath, opts) {
         const merged = deepMerge(existing, values);
         await writeSecret(smClient, secretId, merged, svc.meta);
         await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+        if (opts.key) {
+            await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+        }
         logSuccess(`Credentials written to ${secretId}`);
         return;
     }
@@ -299,6 +310,9 @@ export async function setCommand(servicePath, opts) {
     const merged = deepMerge(existing, values);
     await writeSecret(smClient, secretId, merged, svc.meta);
     await writeConfigMirror(smClient, secretId, schema, merged, svc.meta);
+    if (opts.key) {
+        await addKeyToInstanceIndex(smClient, secretPrefix, opts.key, serviceName);
+    }
     logSuccess(`Credentials written to ${secretId}`);
     // Show summary
     console.error("\nStored fields:");
@@ -308,7 +322,7 @@ export async function setCommand(servicePath, opts) {
 // =============================================================================
 // Helpers
 // =============================================================================
-function isResourceNotFound(err) {
+export function isResourceNotFound(err) {
     const e = err;
     return (e?.name === "ResourceNotFoundException" ||
         e?.__type === "ResourceNotFoundException" ||
@@ -380,6 +394,67 @@ function extractNonSecretFields(fields, values) {
     }
     return result;
 }
+/**
+ * Add an instance key to the service's instance index at
+ * `{secretPrefix}/.index` — the list `listInstances()` reads. Read-modify-
+ * write: a MISSING index is created from just this key (the deploy normally
+ * seeds an empty one), an already-listed key is a no-op. A MALFORMED index
+ * is deliberately left alone (warn only): rebuilding it from just this key
+ * would silently drop the rest of the fleet from the list, so the full
+ * repair belongs to `mesh secrets reindex`. The read-modify-write itself is
+ * unguarded — Secrets Manager has no conditional put — so two concurrent
+ * writers to the same service can drop a key; same repair.
+ *
+ * Non-fatal by design, like the `.config` mirror: the credential itself is
+ * already written, so failing the whole command here would report a write
+ * that succeeded as failed. The cost of skipping is an instance invisible to
+ * `listInstances()` until repaired — the warning names the repair.
+ */
+export async function addKeyToInstanceIndex(client, secretPrefix, key, serviceName) {
+    const indexId = instanceIndexSecretId(secretPrefix);
+    try {
+        let keys = [];
+        try {
+            const res = await client.send(new GetSecretValueCommand({ SecretId: indexId }));
+            keys = parseInstanceIndex(res.SecretString ?? "");
+        }
+        catch (err) {
+            if (!isResourceNotFound(err))
+                throw err;
+            // Pre-index deployment: the write below creates the index.
+        }
+        if (keys.includes(key))
+            return;
+        const secretString = buildInstanceIndexValue([...keys, key]);
+        try {
+            await client.send(new PutSecretValueCommand({ SecretId: indexId, SecretString: secretString }));
+        }
+        catch (err) {
+            if (!isResourceNotFound(err))
+                throw err;
+            await client.send(new CreateSecretCommand({
+                Name: indexId,
+                Description: `Instance-key index for ${serviceName} (read by listInstances(); maintained by mesh secrets set/reindex and the Hub)`,
+                SecretString: secretString,
+                Tags: [
+                    { Key: "mesh:type", Value: "external-service-index" },
+                    { Key: "mesh:service", Value: serviceName },
+                ],
+            }));
+            // The declaring stack also declares this secret; created here first,
+            // it is not in the stack's state, and the stack's next deploy fails on
+            // the name collision until the secret is imported or deleted.
+            logInfo(`Created ${indexId} OUT OF BAND — the declaring stack does not manage it. ` +
+                `Deploy the declaring stack (it creates the index) before writing keys, or ` +
+                `import this secret into the stack before its next deploy.`);
+        }
+    }
+    catch (err) {
+        logInfo(`Warning: failed to record instance "${key}" in ${indexId} — ` +
+            `listInstances() will not see it until you run: ` +
+            `mesh secrets reindex external/${serviceName} (${err})`);
+    }
+}
 async function writeConfigMirror(client, secretId, schema, merged, meta) {
     const configId = `${secretId}/.config`;
     const configValues = extractNonSecretFields(schema.fields, merged);

package/dist/src/commands/secrets/set.js.map

@@ -1 +1 @@
-{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,iBAAiB,CAAC;AACpC,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;GASG;AACH,KAAK,UAAU,4BAA4B,CAAC,KAAyB;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;AACH,CAAC;AAsCD,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;YAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;YAC9C,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAiD,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;QAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;QAC9C,MAAM,EAAG,GAAG,CAAC,MAAkB,IAAI,KAAK;QACxC,QAAQ,EAAG,GAAG,CAAC,QAAoB,IAAI,KAAK;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,GAA4C;IAE5C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,KAAK,UAAU,wBAAwB,CACrC,SAAoB,EACpB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE7F,MAAM,QAAQ,GAAG,kBAAkB,MAAM,IAAI,WAAW,EAAE,CAAC;IAC3D,IAAI,SAA6B,CAAC;IAElC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,0BAA0B,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE1C,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,qCAAqC,CACtC,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,4CAA4C,CAC7C,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAGjC,CAAC;gBACF,MAAM,MAAM,GAAqB;oBAC/B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;oBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAyB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IAEpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,MAAmC,EACnC,QAAiC,EACjC,MAA+B,EAC/B,IAAsB,EACtB,QAAgB,CAAC;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAE9C,8BAA8B;YAC9B,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5E,MAAM,WAAW,GAA4B,EAAE,CAAC;YAEhD,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAE9E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,aAAa;YACb,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;oBACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;gBACjC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,EAAE,CAAC;YAExD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;gBAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,GAAG;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjE,IAAI,KAAa,CAAC;YAElB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtD,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBAC1B,KAAK,GAAG,WAAY,CAAC;gBACvB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,KAAK,CAAC;oBAClB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,SAAS,cAAc,CACrB,MAAmC,EACnC,MAA+B,EAC/B,QAAgB,CAAC;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC7D,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAA+B,EAC/B,IAOC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,4BAA4B,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CACN,gEAAgE;YAC9D,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,mCAAmC,WAAW,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,CACN,IAAI,WAAW,iCAAiC,MAAM,CAAC,OAAO,KAAK;YACjE,qDAAqD,WAAW,WAAW,MAAM,CAAC,OAAO,GAAG,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,6EAA6E,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAEtE,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,eAAe;IACf,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,SAAS,kBAAkB,CAAC,GAAY;IACtC,MAAM,CAAC,GAAG,GAMT,CAAC;IAEF,OAAO,CACL,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,MAAM,KAAK,2BAA2B;QACzC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAChB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CACrB,MAAM,CAAC,GAAG,CAA4B,EACtC,KAAgC,CACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB,EAChB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,aAAa;gBACvE,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBAC/C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC1C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,MAAmC,EACnC,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAA4B,EAC5B,QAAgB,EAChB,MAAwB,EACxB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,QAAQ,UAAU,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,gBAAgB;oBAC1E,YAAY,EAAE,YAAY;oBAC1B,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;iBAC/D,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,8CAA8C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}
+{"version":3,"file":"set.js","sourceRoot":"","sources":["../../../../src/commands/secrets/set.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EACL,SAAS,EACT,0BAA0B,GAC3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,MAAM,iBAAiB,CAAC;AACpC,OAAO,QAAQ,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,aAAa,EACb,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAAyB;IAC1E,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC3E,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACrE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACjC,CAAC;AACH,CAAC;AAsCD,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAA4B;IAClD,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;YAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;YAC9C,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAiD,CAAC;SAC/E,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,OAAO;QACL,IAAI,EAAE,OAAO;QACb,IAAI,EAAG,GAAG,CAAC,IAAe,IAAI,EAAE;QAChC,WAAW,EAAG,GAAG,CAAC,WAAsB,IAAI,EAAE;QAC9C,MAAM,EAAG,GAAG,CAAC,MAAkB,IAAI,KAAK;QACxC,QAAQ,EAAG,GAAG,CAAC,QAAoB,IAAI,KAAK;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,GAA4C;IAE5C,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAoB,EACpB,MAAc,EACd,WAAmB;IAEnB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAoE,CAAC;IAE7F,MAAM,QAAQ,GAAG,kBAAkB,MAAM,IAAI,WAAW,EAAE,CAAC;IAC3D,IAAI,SAA6B,CAAC;IAElC,GAAG,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CACnC,IAAI,0BAA0B,CAAC;YAC7B,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,SAAS;SACrB,CAAC,CACH,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK;gBAAE,SAAS;YAE1C,2CAA2C;YAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,qCAAqC,CACtC,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAwB,CAAC;gBAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,kDAAkD;YAClD,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAChC,4CAA4C,CAC7C,CAAC;YACF,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnB,MAAM,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;gBACjC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAGjC,CAAC;gBACF,MAAM,MAAM,GAAqB;oBAC/B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;oBACnC,OAAO,EAAE,GAAG,CAAC,OAAO;iBACrB,CAAC;gBACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAC3C,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;gBAC3B,CAAC;qBAAM,CAAC;oBACN,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,EAAyB,EAAE,MAAM,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;QACH,CAAC;QAED,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC,QAAQ,SAAS,EAAE;IAEpB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF,gFAAgF;AAChF,kCAAkC;AAClC,gFAAgF;AAEhF;;;GAGG;AACH,KAAK,UAAU,YAAY,CACzB,MAAmC,EACnC,QAAiC,EACjC,MAA+B,EAC/B,IAAsB,EACtB,QAAgB,CAAC;IAEjB,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,iBAAiB;YACjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;YAE9C,8BAA8B;YAC9B,MAAM,aAAa,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC5E,MAAM,WAAW,GAA4B,EAAE,CAAC;YAEhD,MAAM,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YAE9E,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QACjC,CAAC;aAAM,CAAC;YACN,aAAa;YACb,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACvC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;oBACpD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;gBACjC,CAAC;gBACD,SAAS;YACX,CAAC;YAED,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAuB,CAAC;YAC7D,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,WAAW,KAAK,EAAE,CAAC;YAExD,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW;gBAC/B,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,GAAG;gBACxC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;YAEf,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,OAAO,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;YAEjE,IAAI,KAAa,CAAC;YAElB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,KAAK,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACtD,2CAA2C;gBAC3C,IAAI,CAAC,KAAK,IAAI,WAAW,EAAE,CAAC;oBAC1B,KAAK,GAAG,WAAY,CAAC;gBACvB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,MAAM,KAAK,CAAC;oBAClB,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;iBAC/C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,WAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,SAAS,cAAc,CACrB,MAAmC,EACnC,MAA+B,EAC/B,QAAgB,CAAC;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC7D,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,eAAe;AACf,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAA+B,EAC/B,IAOC;IAED,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAEpE,yEAAyE;IACzE,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,4BAA4B,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtD,iCAAiC;IACjC,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,SAAS,EACT,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,WAAW,CACpB,CAAC;IAEF,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACxB,QAAQ,CACN,gEAAgE;YAC9D,6EAA6E,CAChF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,sEAAsE;IACtE,IAAI,WAA+B,CAAC;IACpC,IAAI,WAAW,EAAE,CAAC;QAChB,WAAW,GAAG,WAAW,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,uDAAuD;IACvD,IAAI,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/C,IAAI,WAAW,EAAE,CAAC;YAChB,QAAQ,CAAC,qBAAqB,WAAW,cAAc,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAChD,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC3D,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,QAAQ,CAAC,mCAAmC,WAAW,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wBAAwB;IACxB,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,QAAQ,CACN,IAAI,WAAW,iCAAiC,MAAM,CAAC,OAAO,KAAK;YACjE,qDAAqD,WAAW,WAAW,MAAM,CAAC,OAAO,GAAG,CAC/F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,wEAAwE;IACxE,gEAAgE;IAChE,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,QAAQ,CACN,yBAAyB,IAAI,CAAC,GAAG,gDAAgD;YAC/E,oFAAoF,CACvF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gCAAgC;IAChC,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAClC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAClD,CAAC;QACF,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8DAA8D;IAChE,CAAC;IAED,iDAAiD;IACjD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,6EAA6E,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAC7E,CAAC;QACD,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IAED,mBAAmB;IACnB,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAClB,OAAO,CAAC,4BAA4B,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;IAC3E,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAC;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,MAAM,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEzE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAElB,kBAAkB;IAClB,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,MAAM,qBAAqB,CAAC,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAC7E,CAAC;IAED,UAAU,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;IAEjD,eAAe;IACf,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEhF,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,CAAC,GAAG,GAMT,CAAC;IAEF,OAAO,CACL,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,MAAM,KAAK,2BAA2B;QACzC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,EAAE,IAAI,KAAK,2BAA2B;QACvC,CAAC,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,CAAC,CACpF,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAChB,MAA+B,EAC/B,MAA+B;IAE/B,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IACE,KAAK,KAAK,IAAI;YACd,OAAO,KAAK,KAAK,QAAQ;YACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrB,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC/B,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI;YACpB,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAC3B,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CACrB,MAAM,CAAC,GAAG,CAA4B,EACtC,KAAgC,CACjC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAA4B,EAC5B,QAAgB,EAChB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE5C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;YACxB,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,YAAY;SAC3B,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,4CAA4C;YAC5C,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,aAAa;gBACvE,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE;oBAC/C,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE;iBAC1C;aACF,CAAC,CACH,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,sBAAsB,CAC7B,MAAmC,EACnC,MAA+B;IAE/B,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACnE,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;YACnE,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACzB,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAA4B,EAC5B,YAAoB,EACpB,GAAW,EACX,WAAmB;IAEnB,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,IAAI,GAAa,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAChF,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,2DAA2D;QAC7D,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO;QAC/B,MAAM,YAAY,GAAG,uBAAuB,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAC7E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACxC,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;gBACtB,IAAI,EAAE,OAAO;gBACb,WAAW,EAAE,0BAA0B,WAAW,gFAAgF;gBAClI,YAAY,EAAE,YAAY;gBAC1B,IAAI,EAAE;oBACJ,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,wBAAwB,EAAE;oBACrD,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,WAAW,EAAE;iBAC5C;aACF,CAAC,CACH,CAAC;YACF,qEAAqE;YACrE,uEAAuE;YACvE,8DAA8D;YAC9D,OAAO,CACL,WAAW,OAAO,yDAAyD;gBACzE,4EAA4E;gBAC5E,2DAA2D,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,uCAAuC,GAAG,QAAQ,OAAO,KAAK;YAC5D,iDAAiD;YACjD,iCAAiC,WAAW,KAAK,GAAG,GAAG,CAC1D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,MAA4B,EAC5B,QAAgB,EAChB,MAAwB,EACxB,MAA+B,EAC/B,IAAyB;IAEzB,MAAM,QAAQ,GAAG,GAAG,QAAQ,UAAU,CAAC;IACvC,MAAM,YAAY,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,qBAAqB,CAAC;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,YAAY;aAC3B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,CAAC,IAAI,CACf,IAAI,mBAAmB,CAAC;oBACtB,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,oCAAoC,IAAI,CAAC,IAAI,gBAAgB;oBAC1E,YAAY,EAAE,YAAY;oBAC1B,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;iBAC/D,CAAC,CACH,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,OAAO,CAAC,8CAA8C,QAAQ,KAAK,GAAG,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/fragments/base/index.ts.hbs

@@ -105,3 +105,12 @@ const worker = new mesh.apps.TemporalWorker("worker", {
 export const app = env.register({
   description: "{{titleCase name}}",
 });
+
+// Exported so the bindings above are used, and because a stack's URLs are the
+// first thing anyone wants after a deploy. `pulumi stack output` prints them.
+{{#if service}}
+export const apiUrl = api.url;
+{{/if}}
+{{#if temporal}}
+export const workerTaskQueue = worker.taskQueue;
+{{/if}}

package/fragments/base/package.json.hbs

@@ -5,7 +5,7 @@
   "type": "module",
   "main": "index.ts",
   "scripts": {
-    "typecheck": "tsc --noEmit"
+    "check-types": "tsc --noEmit"
   },
   "dependencies": {
     "@mesh-tech/app-kit": "{{#if workspaceDeps}}workspace:*{{else}}{{meshRange}}{{/if}}",

package/fragments/service/api/package.json.hbs

@@ -4,6 +4,10 @@
   "private": true,
   "type": "module",
   "scripts": {
+    "check-types": "{{#if database}}prisma generate --schema ../prisma/schema.prisma && {{/if}}tsc --noEmit",
+{{#if database}}
+    "db:generate": "prisma generate --schema ../prisma/schema.prisma",
+{{/if}}
     "dev": "tsx watch src/index.ts",
     "start": "node dist/index.js",
     "build": "esm-bundle src/index.ts --outfile dist/index.js"

package/fragments/service/api/src/index.ts.hbs

@@ -19,9 +19,6 @@ import { serve } from "@hono/node-server";
 {{#if temporal}}
 import { createTemporalClient } from "@mesh-tech/app-kit/temporal-client";
 {{/if}}
-{{#if database}}
-import { getDb } from "./db.js";
-{{/if}}
 
 const PORT = parseInt(process.env.PORT ?? "3000", 10);
 const app = new Hono();
@@ -54,5 +51,5 @@ app.post("/workflow", async (c) => {
 
 // Start server
 serve({ fetch: app.fetch, port: PORT, hostname: "0.0.0.0" }, (info) => {
-  console.log(`[API] {{titleCase name}} listening on port ${info.port}`);
+  console.info(`[API] {{titleCase name}} listening on port ${info.port}`);
 });

package/fragments/temporal/worker/package.json.hbs

@@ -4,6 +4,7 @@
   "private": true,
   "type": "module",
   "scripts": {
+    "check-types": "tsc --noEmit",
     "dev": "tsx watch src/worker.ts",
     "start": "node dist/worker.js",
     "build": "esm-bundle src/worker.ts --outfile dist/worker.js --workflows src/workflows.ts --external '@temporalio/*'"

package/fragments/temporal/worker/src/activities.ts.hbs

@@ -9,6 +9,10 @@
  * Generate a greeting message
  */
 export async function greet(name: string): Promise<string> {
-  console.log(`[Activity] Generating greeting for ${name}`);
+  // `console.log` is unstructured: the platform ships worker output to Loki, where
+  // a bare string cannot be filtered by service, activity, or correlation id.
+  // `console.info` is the lint-permitted level; a real activity should use
+  // `@mesh-tech/logger` so its fields are queryable.
+  console.info(`[Activity] Generating greeting for ${name}`);
   return `Hello, ${name}!`;
 }

package/fragments/temporal/worker/src/workflows.ts.hbs

@@ -8,7 +8,10 @@
  * - Use proxyActivities() to call activities
  */
 
-import { proxyActivities, sleep } from "@temporalio/workflow";
+// `sleep` is the deterministic timer to import here when a workflow needs to wait
+// (never `setTimeout`); it is left out until used, since an unused import is a
+// lint warning in every repo that scaffolds this.
+import { proxyActivities } from "@temporalio/workflow";
 import type * as activities from "./activities.js";
 
 const { greet } = proxyActivities<typeof activities>({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mesh-tech/mesh-cli",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "CLI for Mesh platform development utilities",
   "type": "module",
   "license": "UNLICENSED",
@@ -33,7 +33,7 @@
     "./package.json": "./package.json"
   },
   "devDependencies": {
-    "@mesh-tech/tsconfig": "1.47.1",
+    "@mesh-tech/tsconfig": "1.53.0",
     "@mesh-tech/workflow-viz": "0.2.1",
     "@tanstack/intent": "^0.3.6",
     "@types/node": "^20.0.0",
@@ -48,6 +48,7 @@
     "@inquirer/input": "^4.2.1",
     "@inquirer/password": "^4.0.17",
     "@inquirer/select": "^4.3.1",
+    "@mesh-tech/secrets": "0.1.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "handlebars": "^4.7.8",

package/skills/core/SKILL.md

@@ -93,7 +93,7 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh db` | `connect`, `credentials`(alias `creds`), `env`, `psql`, `exec <command...>` | Access tenant DBs through an SSM bastion tunnel. `env` prints `export`s for `eval`; `exec` runs a command with `DATABASE_URL` injected. | `-t/--tenant`, `-e/--env`, `-a/--app`, `--app-tenant`, `--app-stage`; `exec` also: `--secret <arn>`, `--ssl <require\|no-verify\|disable>`, `--port <n>` |
 | `mesh deploy ...` | passthrough | Runs `pulumi` with the stack's `mesh:deployerRole` assumed. Unknown opts/args pass through; defaults to `up` if no subcommand. | `-s/--stack <name>` (stripped before pulumi `up`); everything else → pulumi (`preview`, `up --yes`, `destroy`, `stack output …`) |
 | `mesh dev` | `logs <service>`, `restart <service>`, `list`, `test-user [name]` | Two modes. **Tethered** (deployed stack): reads the Pulumi stack dev output, opens tunnels, injects Secrets Manager secrets; needs VPN/AWS creds. **Local** (`--local`, auto when the app has no `Pulumi.yaml`): synthesizes services from the app layout (subdirs with a `dev` script) and wires them to the `mesh start` platform (Temporal `local-dev`, app DB, Zitadel, ministack via `AWS_ENDPOINT_URL`) — zero AWS/VPN/Pulumi. `--externals` (local mode; `--mock` is an alias) also realizes the app's declared external services (package.json → `mesh.externals`; legacy `mesh.mocks` still read). Each declaration runs in one of three MODES — `mock` (the service is emulated: `openapi` → a Prism mock server from a spec, or `src` → a mock process), `local` (a local version of the real service: a `compose` file + published `port`, e.g. a vendor-shaped DB — up `--wait` before the app's services; a realization another checkout already started is **adopted** instead of failing — declared port already served **by a container this compose file defines** → adopt as-is (a publisher the file doesn't define — a native install or unrelated container — is a hard **conflict**, never adopted, since credentials would seed against the wrong service); a stopped foreign container holding the compose `container_name` → `docker start` + adopt — so startup order across checkouts doesn't matter; adopted externals stay out of session state and `--kill` tears down only externals this session created, volumes kept), `remote` (connect to the ACTUAL service: inline vendor `credentials`, or the credentials the app's tenant environment is configured with via `remote.env`). A declaration may carry SEVERAL realizations; `mode` picks the default and `--externals name=mode` overrides it per run (`--externals plaid-db=remote,plaid`). Remote externals get a blackbox uptime probe against their real endpoint. Failing to realize a remote external is fatal only when you named it; a bare `--externals` warns and keeps going, so the local loop still works with no AWS identity. Every realization seeds its ExternalService credential secret (`{{url}}`/`{{host}}`/`{{port}}` from the stand-in's endpoint, `{{env:VAR}}` from the shell) so `resolveCredentials()` runs the deployed code path against the stand-in. Runners: tmux (default) or `--runner docker` (CI/headless — services run as a docker compose project with host networking; parity `--status`/`--kill`/`logs`/`restart`). | root: `--local`, `--externals [name[=mode],…]` (alias `--mock`), `--runner <tmux\|docker>`, `--app <path>`, `--stage`, `--headless`, `--kill`, `--status`, `--json`, `--session <name>`, `--profile <sso>`; `logs`: `--tail <n>`; `test-user`: `--tenant/--env/--region` |
-| `mesh start` / `mesh stop` / `mesh status` | — | Full-local Mesh platform via docker compose (project `mesh-local`, assets ship in the CLI package): Postgres, Temporal (+UI), Zitadel, SpiceDB, ministack (local AWS fabric: SSM/Secrets/S3 registry), memcached, OpenSearch, **and the hosted observability backends** (OTel collector + Loki + Tempo + Prometheus — the Hub's logs/traces/metrics views run unchanged). Seeds tenant `local`/env `dev` on first boot and reconciles every Zitadel-provisioned app tenant into the registry. **No AWS creds, VPN, or Pulumi state needed — Docker only.** The **Hub is included by default** — three overlay services, `hub-api` + `hub-ui` + `hub-auth` (an oauth2-proxy; it is what binds the front-door port and proxies to `hub-ui`, so front-door 401s/redirect loops are in ITS logs, not `hub-api`'s) — the front door at http://localhost:9000 — `MESH_HUB_PORT=<port>` publishes it elsewhere when 9000 is taken; export it for `mesh status` too (images build once from the published @mesh-tech/hub tarball; needs `mesh registry login` the first time; `--no-hub` opts out). Auth contract (MESH-2479): `--with-hub` refreshes to the latest published hub after preflighting the CodeArtifact token — with an expired/missing token it falls back to the already-built local images (warn + fixing command), or fails fast naming `mesh registry login --profile mesh-dev` when none exist; the default (no-flag) path with an expired/missing token starts hub-less and names the same fix. Non-TTY runs (CI, agents, piped output) get an `[HH:MM:SS]` prefix on every step line plus a heartbeat during long fetches/builds — `MESH_LOG_TIMESTAMPS=1/0` forces the prefix on/off (default: on when stderr is not a TTY). | `start`: `--no-seed`, `--no-hub`, `--with-hub`; `stop`: `--destroy` (drops volumes/seeds); `status`: `--json` |
+| `mesh start` / `mesh stop` / `mesh status` | — | Full-local Mesh platform via docker compose (project `mesh-local`, assets ship in the CLI package): Postgres, Temporal (+UI), Zitadel, SpiceDB, ministack (local AWS fabric: SSM/Secrets/S3 registry), memcached, OpenSearch, a **local mailbox** (Mailpit — SMTP :1025 wired into Zitadel, inbox at http://localhost:8025, so user-activation and password-reset mail is testable locally instead of vanishing), **and the hosted observability backends** (OTel collector + Loki + Tempo + Prometheus — the Hub's logs/traces/metrics views run unchanged). Seeds tenant `local`/env `dev` on first boot and reconciles every Zitadel-provisioned app tenant into the registry. **No AWS creds, VPN, or Pulumi state needed — Docker only.** The **Hub is included by default** — three overlay services, `hub-api` + `hub-ui` + `hub-auth` (an oauth2-proxy; it is what binds the front-door port and proxies to `hub-ui`, so front-door 401s/redirect loops are in ITS logs, not `hub-api`'s) — the front door at http://localhost:9000 — `MESH_HUB_PORT=<port>` publishes it elsewhere when 9000 is taken; export it for `mesh status` too (images build once from the published @mesh-tech/hub tarball; needs `mesh registry login` the first time; `--no-hub` opts out). Auth contract (MESH-2479): `--with-hub` refreshes to the latest published hub after preflighting the CodeArtifact token — with an expired/missing token it falls back to the already-built local images (warn + fixing command), or fails fast naming `mesh registry login --profile mesh-dev` when none exist; the default (no-flag) path with an expired/missing token starts hub-less and names the same fix. Non-TTY runs (CI, agents, piped output) get an `[HH:MM:SS]` prefix on every step line plus a heartbeat during long fetches/builds — `MESH_LOG_TIMESTAMPS=1/0` forces the prefix on/off (default: on when stderr is not a TTY). | `start`: `--no-seed`, `--no-hub`, `--with-hub`; `stop`: `--destroy` (drops volumes/seeds); `status`: `--json` |
 | `mesh hub` | `dev` | One-command local Hub over a running dev-local stack. Launches the CURRENT-CODE Hub (apps/hub api+ui from a mesh-platform checkout) pointed at an existing `mesh dev` session — auto-assembles `HUB_TENANT`/`HUB_SCOPE_ENV`/`HUB_SCOPE_TENANTS` (session platform context), `TEMPORAL_ADDRESS` (session tunnel), `AWS_*` (session scratch profile), `DEV_USER_*`+`DEV_USER_TOKEN_URL` (session dev identity; starts its own token-server if the session predates it, so tokens stay fresh past ~1h). Refuses to launch with an empty tenant scope (which the Hub renders as silently blank). Runs in tmux session `mesh-hub-dev`. | `dev`: `--session <name>`, `--tenants <csv>`, `--port` (or `MESH_HUB_DEV_PORT`, default 9000; the containerized `mesh start` Hub uses the separate `MESH_HUB_PORT`), `--api-port <3002>`, `--platform-dir <dir>` (or `MESH_PLATFORM_DIR`), `--print-env`, `--kill` |
 | `mesh create-app` | — | Scaffold a tenant app. Composable mode (primitives) or legacy template mode. Interactive when TTY + missing flags. Run at the root of an **empty** `{tenant}-mesh-apps` git clone (a `.git` with no `package.json`/`apps/`/`tenants/` and no enclosing pnpm workspace), it first generates the repo-level shape — `pnpm-workspace.yaml` over `apps/*`, private root `package.json`, scoped-registry `.npmrc`, base `tsconfig.json`, `.gitignore`, `README.md`, `apps/` — then scaffolds the app. Never overwrites an existing file. | `--tenant`, `--name`, `--primitives <csv>` (`service,database,temporal,bucket`), `--template <workflow\|api-auth\|api-role-gating\|external-service>`, `--test` (writes to `tests/tenants/`) |
 | `mesh init` | `app-tenant` | The repo doctor (A1–A3): read-only check pipeline — CLI auth, registry access, public npm not hijacked, platform reachable (Hub API), app-tenant registration, deployer role, repo shape, agent skills — each failure names the exact `mesh` fix. **Registry access** is a live probe of the CodeArtifact token, not a grep of `~/.npmrc`: an expired token `fail`s (it used to `pass`), an unreachable registry `warn`s (a network fault is not an auth fault). **Public npm not hijacked** fails when `~/.npmrc` carries an unscoped `registry=<codeartifact>` line, which makes CodeArtifact your default registry — one `mesh registry login` fixes both. Exit 0 iff all pass; re-run any time. `--fix` applies developer-scope fixes (registry token, skills sync); operator actions stay remediations — and `--profile <p>` is the SSO profile `--fix` logs into CodeArtifact with, echoed back in the `fix:` command each check prints so the advertised command is the one that runs. | `app-tenant`: `--tenant <name>`, `--context <ctx>` (default `local`), `--hub-url <url>`, `--fix`, `--profile <sso>`, `--json` |
@@ -102,7 +102,7 @@ Top-level commands (each `register*` is wired in `src/program.ts`, which `bin/me
 | `mesh stack` | `init`, `rm <name>` | `init` creates a personal dev stack `dev-{github-user}`, copying base-stack config, setting `mesh:deploy: false`, inheriting KMS secrets provider; `--worktree` appends the git-worktree token (`dev-{user}-{token}`) so concurrent worktrees deploy to **distinct** stacks (SSM paths, Temporal namespace, Nexus endpoint all derive from the stack name → one discriminator isolates all three; no-op on the primary checkout). `rm <name>` removes a personal stack (backend state + local config), credentialed. Both assume the deployer role — no raw `pulumi` / manual creds needed. | `init`: `--from <stack>`, `--name <stack>`, `--worktree`; `rm`: `--yes` |
 | `mesh tenant` | `add <name>`, `list` | Register/inspect app tenants on a platform stack. Run from the **platform layer** of a tenant platform repo (e.g. `mesh-sandbox/platform`). `add` inserts the tenant under `mesh:tenants` in `Pulumi.<stack>.yaml` via a comment-preserving YAML round-trip (untouched lines don't reformat), refuses a tenant that is already declared (an existing entry may carry fields a re-add would drop), derives the `{name}-{env}` subdomain from the stack name (echoed in the success line), and guards against running on the core layer or an app dir; it then prints the deploy + verify sequence — `mesh deploy up` is what makes the registration live. `list` prints what the stack config declares, so "is it registered?" is answerable without opening YAML (warns when the project doesn't look like a platform layer, so an empty result isn't mistaken for "no tenants"). | `add`: `--display-name <name>`, `--subdomain <sub>`, `--zitadel-org-id <id>`, `--stack <stack>`, `--json`; `list`: `--stack <stack>`, `--json` |
 | `mesh tunnel [group]` | `external <name>` | SSM port-forward to platform services. Groups: `dev` (temporal+db), `temporal`. **`external <name>`** tunnels to a *registered* `ExternalService`: host/port are read from its credential secret (`mesh/{app-tenant}/{app-stage}/external/{name}`) — the same values deployed apps resolve at runtime — so anything the bastion can reach is tunnelable with no per-service CLI entry and no bastion services-map change. `-t/-e` are **optional everywhere** — they fall back to the same Pulumi/SST context detection `mesh dev` uses, and `AWS_REGION`/`AWS_PROFILE` default from the nearest Pulumi config + the `{tenant}-{env}` profile convention (region falls back to the effective profile's own `region` — the `[default]` profile when none was resolved — before the platform default us-east-2). | root: `-t/--tenant`, `-e/--env`, `-l/--list`, `-s/--services <csv\|group>`, `--db-port`, `--temporal-ui-port`, `--temporal-frontend-port`; `external`: `-p/--port` (default: the remote port), `-k/--key <key>` (multi-instance `credentials.keyedBy` externals), `--app-tenant`/`--app-stage` (credential axis; default to `-t`/`-e`) |
-| `mesh secrets` | `exec <command...>`, `set [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`). | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stage`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stage`, `--region` |
+| `mesh secrets` | `exec <command...>`, `set [service]`, `reindex [service]`, `migrate-config` | Manage external-service creds in Secrets Manager. `exec` injects secrets as env; `set` reads field schema from SSM and prompts (or `--json`) — with `--key` it also records the instance in the service's instance index (`{prefix}/.index`, what `listInstances()` reads). `reindex` rebuilds that index from the per-key secrets actually in Secrets Manager (operator-credential `ListSecrets`) — the repair for an index that drifted (out-of-band secret create/delete, concurrent writers, malformed value) and the populate step when rolling the index out to an estate: **deploy the declaring stack first** (creates the managed, empty index), then `reindex`. | `set`: `--key <id>` (multi-instance), `--all`, `--json <str>`, `--stack`, `--region`; `reindex`: `--dry-run`, `--stack`, `--region`; `migrate-config`: `--force`, `--dry-run`, `--stack`, `--region` |
 | `mesh artifacts` | `get <ref>` | Download workflow artifact files from an AI-agent conversation. Ref `<conversationId>:<artifactId>` (artifactId defaults to `workflow-artifact`). | `-o/--output <dir>`, `--target <name>`, `--api-url <url>`, `--context <ctx>` (default `mesh.dev`) |
 | `mesh conversations` (alias `conv`) | `list`, `show <id>`, `artifacts <id>` | Read a deployed Mesh agent's conversations: list the caller's conversations, render a transcript, or list a conversation's artifacts. Resolves against the same `agent-targets` registry the MCP `agent_*` tools use. | all three: `--target <name>`, `--api-url <url>` (overrides `--target`), `--context <ctx>` (used with `--api-url`, default `mesh.dev`), `--json` (default when stdout isn't a TTY) |
 | `mesh vpn` | `connect <context>`, `disconnect`, `status`, `tunnel <up\|down\|status>`, `api-key`, `pre-auth-key`, `users` | Headscale VPN mgmt via Tailscale + kubectl. **`connect` now defaults to the userspace `tailscaled`** (brew formula, NOT the GUI Tailscale.app) — the same daemon `mesh dev --transport tailscale` / `mesh vpn tunnel` use, so it **runs headless / under the sandbox** and exposes a local SOCKS5 proxy (route a tool via `ALL_PROXY=socks5://127.0.0.1:<port>`). It relays a one-time browser-register URL for Zitadel auth. `--system` opts into the whole-machine GUI Tailscale.app (system TUN) — needs the app installed and **cannot run headless/sandboxed** (Sparkle.framework abort). For auto-forwarded VPC services (Temporal/RDS) prefer **`mesh vpn tunnel up`** or `mesh dev`. `tunnel status` reports runner **ownership** (`Runner: owned (verified)` vs `NOT OWNED (<reason>)` — a port answering a dial is not proof it's mesh's, MESH-2407); `--json` adds `owned` (bool) + `ownership` (reason string). Admin subcommands `exec` into the `headscale-0` pod. | root: `-t/--tenant` (default `mesh`), `-e/--env` (default `dev`), `-n/--namespace`; `connect`/`disconnect`: `--system`; `tunnel up`: `--context <ctx>`; `tunnel down`: `--stop` (stop daemon, keep login), `--logout`; `tunnel status`: `--json`; `pre-auth-key`: `-u/--user` (**required**), `--expiration <24h>`, `--reusable`, `--ephemeral` |
@@ -283,6 +283,8 @@ mesh db exec --secret <arn> -- node seed.js   # direct mode, skips SSM discovery
 mesh secrets set external/symitar                         # interactive (schema from SSM)
 mesh secrets set external/symitar --json '{"baseUrl":"…"}'
 mesh secrets set external/symitar --key 12345 --json '{…}'  # multi-instance (key = FI id)
+mesh secrets reindex external/symitar --dry-run           # show instance-index drift, write nothing
+mesh secrets reindex external/symitar                     # rebuild {prefix}/.index from real secrets
 mesh secrets exec -- node ./script.js                     # secrets injected as env
 ```
 

package/stack/docker-compose.hub.yml

@@ -48,6 +48,11 @@ services:
       # zitadel service — Zitadel routes by Host header, so the issuer host
       # must be `localhost` everywhere, exactly like the hosted public URL.
       ZITADEL_ISSUER: http://localhost:8080
+      # The Hub's ADMIN plane. Without this the Hub can verify a token but cannot
+      # write to Zitadel, so creating a user or minting an API key silently has
+      # nowhere to go — the console offers no affordance and nothing reaches the
+      # IdP. `mesh start` seeds the machine key this points at (seed-zitadel).
+      ZITADEL_OPSHUB_SECRET_NAME: mesh/local/dev/zitadel/ops-hub
       SPICEDB_ENDPOINT: spicedb:50051
       SPICEDB_HTTP_ENDPOINT: http://spicedb:8443
       SPICEDB_HTTP_SCHEME: http

package/stack/docker-compose.yml

@@ -197,6 +197,27 @@ services:
   # Zitadel Identity Server — v4 to match the cloud (approved tenant-auth
   # pattern spec item 7: v4's no-role-claims machine tokens make version
   # parity matter for auth testing).
+  # Local mailbox. Zitadel sends real mail for user activation and password
+  # resets, and without somewhere to send it those flows cannot be exercised at
+  # all locally — the Hub's "resend invitation" and "send password reset email"
+  # actions return 200 and the mail goes nowhere. Mailpit accepts everything on
+  # SMTP :1025 and shows it at :8025; nothing leaves the machine.
+  mailpit:
+    image: axllent/mailpit:v1.21
+    ports:
+      - '127.0.0.1:1025:1025'   # SMTP, for Zitadel
+      - '127.0.0.1:8025:8025'   # web UI, for a human
+    environment:
+      MP_SMTP_AUTH_ACCEPT_ANY: 'true'
+      MP_SMTP_AUTH_ALLOW_INSECURE: 'true'
+    healthcheck:
+      test: ['CMD', '/mailpit', 'readyz']
+      interval: 5s
+      timeout: 3s
+      retries: 20
+    networks:
+      - mesh_network
+
   zitadel:
     image: ghcr.io/zitadel/zitadel:v4.15.3
     depends_on:
@@ -204,6 +225,8 @@ services:
         condition: 'service_healthy'
       zitadel-machinekey-init:
         condition: 'service_completed_successfully'
+      mailpit:
+        condition: 'service_healthy'
     ports:
       - '127.0.0.1:8080:8080'
     environment:
@@ -248,6 +271,18 @@ services:
       ZITADEL_FIRSTINSTANCE_ORG_MACHINE_MACHINE_NAME: Local Seeder
       ZITADEL_FIRSTINSTANCE_ORG_MACHINE_PAT_EXPIRATIONDATE: '2099-01-01T00:00:00Z'
       ZITADEL_FIRSTINSTANCE_PATPATH: /machinekey/pat.txt
+      # SMTP for the default instance, pointed at the local mailbox above.
+      # DEFAULTINSTANCE settings apply at FIRST INIT only, same as the
+      # FIRSTINSTANCE block — a pre-existing zitadel volume keeps whatever it
+      # was initialised with, so `mesh start` also reconciles this over the
+      # admin API on every run (see seed-zitadel.ts). The env is here so a
+      # fresh `mesh start` has working mail before the seeder even runs.
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_HOST: 'mailpit:1025'
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_USER: ''
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_SMTP_PASSWORD: ''
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_TLS: false
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_FROM: 'no-reply@local.mesh'
+      ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_FROMNAME: 'Mesh (local)' 
     command: 'start-from-init --masterkey "MasterkeyNeedsToHave32Characters" --tlsMode disabled --init-projections=true'
     volumes:
       - zitadel_machinekey:/machinekey