@mesh-tech/mesh-cli 0.14.0 → 0.15.0

package/dist/src/commands/local/seed-zitadel.js

@@ -24,21 +24,21 @@
  * Idempotent: search-before-create for project/app, "already exists" is
  * success for users, SSM params overwrite.
  */
-import * as fs from "fs";
-import * as os from "os";
-import * as path from "path";
-import { HUB_BASE_ROLES } from "@mesh-tech/api-registry";
-import { logInfo, logSuccess } from "../../utils/log.js";
-import { MeshCliError } from "../../utils/errors.js";
-import { writeContextConfig } from "../login.js";
-import { compose, hubPort, DEFAULT_HUB_PORT } from "./stack.js";
-import { LOCAL_TENANT, LOCAL_ENV } from "./seed.js";
-export const ZITADEL_ISSUER = "http://localhost:8080";
-export const LOGIN_CONTEXT = "local";
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { hubOperatorRoleKeys, hubRoleKeyTenant, restrictedRoleBase, } from '@mesh-tech/api-registry';
+import { logInfo, logSuccess, logWarn } from '../../utils/log.js';
+import { MeshCliError } from '../../utils/errors.js';
+import { writeContextConfig } from '../login.js';
+import { compose, hubPort, DEFAULT_HUB_PORT } from './stack.js';
+import { LOCAL_TENANT, LOCAL_ENV } from './seed.js';
+export const ZITADEL_ISSUER = 'http://localhost:8080';
+export const LOGIN_CONTEXT = 'local';
 /** The platform org — home of platform-layer creds, same name as the cloud
  * platform tenant. Set by ZITADEL_FIRSTINSTANCE_ORG_NAME in the compose;
  * app tenants (incl. the default `local`) get their own orgs on demand. */
-export const PLATFORM_ORG = "mesh";
+export const PLATFORM_ORG = 'mesh';
 /**
  * Approved-pattern naming inside the platform org: project per app
  * (lowercase), application per service/client inside it. The CLI is a
@@ -46,9 +46,9 @@ export const PLATFORM_ORG = "mesh";
  * (The cloud's legacy catch-all "Platform" project is being retired by the
  * pattern doc's spec items; local starts pattern-true.)
  */
-export const CLI_PROJECT_NAME = "mesh-cli";
-export const CLI_APP_NAME = "cli";
-export const CLI_REDIRECT_URI = "http://localhost:9876/callback";
+export const CLI_PROJECT_NAME = 'mesh-cli';
+export const CLI_APP_NAME = 'cli';
+export const CLI_REDIRECT_URI = 'http://localhost:9876/callback';
 /**
  * The Hub's own auth config (pattern-true: the Hub is a platform app →
  * project `hub` in the platform org, application per service). The `ui`
@@ -56,11 +56,14 @@ export const CLI_REDIRECT_URI = "http://localhost:9876/callback";
  * sidecar topology `mesh.apps.Service` deploys with `auth.provider: "mesh"`.
  * Roles ARE the Hub's vocabulary — imported from the module the deployed Hub's
  * infra declares them from, so a role that exists in the cloud is grantable
- * locally too (MESH-2504). Local seeds the base roles only; the tenant-keyed
- * restricted grants (`vendor:<tenant>`) are a deployed-estate concern.
+ * locally too (MESH-2504), including the tenant-keyed restricted keys
+ * (`vendor:<tenant>`, `auditor:<tenant>`) that carry the only scope the policy
+ * actually reads. The bare keys alone are not a usable local vocabulary: a bare
+ * restricted grant names no tenant, so `checkPolicy` matches it against nothing
+ * and it authorizes no tenant-scoped read.
  */
-export const HUB_PROJECT_NAME = "hub";
-export const HUB_APP_NAME = "ui";
+export const HUB_PROJECT_NAME = 'hub';
+export const HUB_APP_NAME = 'ui';
 /** Registered on the seeded Hub app; the default-port URI is always included
  * so a later port switch never strands the app config. Zitadel's devMode only
  * relaxes the https requirement — every redirect URI must still be registered
@@ -69,13 +72,25 @@ export const HUB_APP_NAME = "ui";
  * programmatic callers that set MESH_HUB_PORT after import see the override. */
 export const hubRedirectUri = () => `http://localhost:${hubPort()}/oauth2/callback`;
 export const HUB_DEFAULT_REDIRECT_URI = `http://localhost:${DEFAULT_HUB_PORT}/oauth2/callback`;
-export const HUB_ROLES = HUB_BASE_ROLES;
+export const HUB_ROLES = hubOperatorRoleKeys([LOCAL_TENANT]);
 export const ZITADEL_SSM_PARAM = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/platform/zitadel`;
 export const TEST_USERS_SSM_PREFIX = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/temporal/test-users`;
 /** Seeded human test users — plainly-labeled dev-grade credentials. */
 export const TEST_USERS = [
-    { name: "dev", email: "dev@local.mesh", firstName: "Dev", lastName: "User", password: "LocalDev1!" },
-    { name: "ops", email: "ops@local.mesh", firstName: "Ops", lastName: "User", password: "LocalDev1!" },
+    {
+        name: 'dev',
+        email: 'dev@local.mesh',
+        firstName: 'Dev',
+        lastName: 'User',
+        password: 'LocalDev1!',
+    },
+    {
+        name: 'ops',
+        email: 'ops@local.mesh',
+        firstName: 'Ops',
+        lastName: 'User',
+        password: 'LocalDev1!',
+    },
 ];
 /**
  * The CLI OIDC app payload — the same shape ZitadelPlatformIdentity creates in
@@ -86,11 +101,11 @@ export function buildCliAppPayload() {
     return {
         name: CLI_APP_NAME,
         redirectUris: [CLI_REDIRECT_URI],
-        responseTypes: ["OIDC_RESPONSE_TYPE_CODE"],
-        grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_DEVICE_CODE"],
-        appType: "OIDC_APP_TYPE_NATIVE",
-        authMethodType: "OIDC_AUTH_METHOD_TYPE_NONE",
-        accessTokenType: "OIDC_TOKEN_TYPE_JWT",
+        responseTypes: ['OIDC_RESPONSE_TYPE_CODE'],
+        grantTypes: ['OIDC_GRANT_TYPE_AUTHORIZATION_CODE', 'OIDC_GRANT_TYPE_DEVICE_CODE'],
+        appType: 'OIDC_APP_TYPE_NATIVE',
+        authMethodType: 'OIDC_AUTH_METHOD_TYPE_NONE',
+        accessTokenType: 'OIDC_TOKEN_TYPE_JWT',
         accessTokenRoleAssertion: true,
         idTokenRoleAssertion: true,
         idTokenUserinfoAssertion: true,
@@ -99,16 +114,16 @@ export function buildCliAppPayload() {
 }
 /** Read the seeder PAT the compose bootstrap wrote to the machinekey volume. */
 export function readSeederPat() {
-    const tmp = path.join(fs.mkdtempSync(path.join(os.tmpdir(), "mesh-zitadel-")), "pat.txt");
+    const tmp = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'mesh-zitadel-')), 'pat.txt');
     try {
-        compose(["cp", "zitadel:/machinekey/pat.txt", tmp]);
-        const pat = fs.readFileSync(tmp, "utf-8").trim();
+        compose(['cp', 'zitadel:/machinekey/pat.txt', tmp]);
+        const pat = fs.readFileSync(tmp, 'utf-8').trim();
         if (!pat)
-            throw new Error("empty PAT file");
+            throw new Error('empty PAT file');
         return pat;
     }
     catch {
-        throw new MeshCliError("Zitadel seeder PAT not found — the zitadel volume predates the bootstrap machine user (first-instance settings only apply on the first init).", { remediation: { command: "mesh stop --destroy && mesh start" } });
+        throw new MeshCliError('Zitadel seeder PAT not found — the zitadel volume predates the bootstrap machine user (first-instance settings only apply on the first init).', { remediation: { command: 'mesh stop --destroy && mesh start' } });
     }
     finally {
         fs.rmSync(path.dirname(tmp), { recursive: true, force: true });
@@ -120,8 +135,8 @@ export async function api(pat, method, apiPath, body, orgId) {
         method,
         headers: {
             Authorization: `Bearer ${pat}`,
-            "Content-Type": "application/json",
-            ...(orgId ? { "x-zitadel-orgid": orgId } : {}),
+            'Content-Type': 'application/json',
+            ...(orgId ? { 'x-zitadel-orgid': orgId } : {}),
         },
         body: body === undefined ? undefined : JSON.stringify(body),
         signal: AbortSignal.timeout(15_000),
@@ -136,44 +151,47 @@ export async function api(pat, method, apiPath, body, orgId) {
     }
     return data;
 }
-export const isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? "");
+export const isAlreadyExists = (err) => err?.status === 409 || err?.zitadelCode === 6 || /already exists/i.test(err?.message ?? '');
 /**
  * Shared search-before-create for Zitadel projects: return the existing
  * project's id, else create it. Every ensure*Project in the local seeding
  * and auth-provisioning goes through this.
  */
 export async function ensureZitadelProject(pat, name, opts = {}) {
-    const search = await api(pat, "POST", "/management/v1/projects/_search", { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, opts.orgId);
+    const search = await api(pat, 'POST', '/management/v1/projects/_search', { queries: [{ nameQuery: { name, method: 'TEXT_QUERY_METHOD_EQUALS' } }] }, opts.orgId);
     const existing = search?.result?.[0]?.id;
     if (existing) {
         if (opts.logExisting)
             logInfo(`Zitadel project '${name}' already exists`);
         return existing;
     }
-    const created = await api(pat, "POST", "/management/v1/projects", { name, projectRoleAssertion: true }, opts.orgId);
-    logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ""}`);
+    const created = await api(pat, 'POST', '/management/v1/projects', { name, projectRoleAssertion: true }, opts.orgId);
+    logSuccess(`Created Zitadel project '${name}'${opts.describe ? ` (${opts.describe})` : ''}`);
     return created.id;
 }
 /** Shared name-equals application search; returns the raw app or undefined. */
 export async function searchZitadelApp(pat, projectId, name, orgId) {
-    const search = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/_search`, { queries: [{ nameQuery: { name, method: "TEXT_QUERY_METHOD_EQUALS" } }] }, orgId);
+    const search = await api(pat, 'POST', `/management/v1/projects/${projectId}/apps/_search`, { queries: [{ nameQuery: { name, method: 'TEXT_QUERY_METHOD_EQUALS' } }] }, orgId);
     return search?.result?.[0];
 }
-const ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, { describe: "platform client feature", logExisting: true });
+const ensureCliProject = (pat) => ensureZitadelProject(pat, CLI_PROJECT_NAME, {
+    describe: 'platform client feature',
+    logExisting: true,
+});
 async function ensureCliApp(pat, projectId) {
     const existing = (await searchZitadelApp(pat, projectId, CLI_APP_NAME))?.oidcConfig?.clientId;
     if (existing) {
         logInfo(`Zitadel app '${CLI_APP_NAME}' already exists`);
         return existing;
     }
-    const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, buildCliAppPayload());
+    const created = await api(pat, 'POST', `/management/v1/projects/${projectId}/apps/oidc`, buildCliAppPayload());
     logSuccess(`Created Zitadel application '${CLI_APP_NAME}' (PKCE + device code)`);
     return created.clientId;
 }
 async function ensureTestUsers(pat) {
     for (const user of TEST_USERS) {
         try {
-            await api(pat, "POST", "/management/v1/users/human/_import", {
+            await api(pat, 'POST', '/management/v1/users/human/_import', {
                 userName: user.email,
                 profile: {
                     firstName: user.firstName,
@@ -199,13 +217,13 @@ async function ensureTestUsers(pat) {
 /** Where the Hub's oauth2-proxy credentials persist between runs (the local
  * analog of the K8s Secret the Service component creates for the sidecar). */
 export function hubAuthPath() {
-    const dir = path.join(os.homedir(), ".cache", "mesh", "mesh-local");
+    const dir = path.join(os.homedir(), '.cache', 'mesh', 'mesh-local');
     fs.mkdirSync(dir, { recursive: true });
-    return path.join(dir, "hub-auth.json");
+    return path.join(dir, 'hub-auth.json');
 }
 export function readHubAuth() {
     try {
-        const parsed = JSON.parse(fs.readFileSync(hubAuthPath(), "utf-8"));
+        const parsed = JSON.parse(fs.readFileSync(hubAuthPath(), 'utf-8'));
         if (parsed?.clientId && parsed?.clientSecret && parsed?.cookieSecret)
             return parsed;
         return null;
@@ -214,13 +232,24 @@ export function readHubAuth() {
         return null;
     }
 }
-const ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: "Hub platform app" });
+const ensureHubProject = (pat) => ensureZitadelProject(pat, HUB_PROJECT_NAME, { describe: 'Hub platform app' });
+/**
+ * What a role key is called in Zitadel's own UI and in the Hub's role picker.
+ *
+ * A tenant-keyed key reads as the base role plus the tenant it is scoped to, so
+ * that `vendor:local` is not offered to an administrator as an opaque string
+ * sitting next to a bare `vendor` that grants something entirely different.
+ */
+function hubRoleDisplayName(roleKey) {
+    const tenant = hubRoleKeyTenant(roleKey);
+    return tenant === null ? roleKey : `${restrictedRoleBase(roleKey) ?? roleKey} (${tenant})`;
+}
 async function ensureHubRoles(pat, projectId) {
     for (const role of HUB_ROLES) {
         try {
-            await api(pat, "POST", `/management/v1/projects/${projectId}/roles`, {
+            await api(pat, 'POST', `/management/v1/projects/${projectId}/roles`, {
                 roleKey: role,
-                displayName: role,
+                displayName: hubRoleDisplayName(role),
             });
             logSuccess(`Created Hub role '${role}'`);
         }
@@ -264,14 +293,17 @@ export async function reconcileHubRedirectUris(pat, projectId, app) {
     // additionalOrigins, clockSkew, backChannelLogoutUri — are NOT carried, so
     // anything set out-of-band in the Zitadel console is dropped here. Fine for
     // the local dev app; revisit before reusing against a shared instance.
-    await api(pat, "PUT", `/management/v1/projects/${projectId}/apps/${app.id}/oidc_config`, {
+    await api(pat, 'PUT', `/management/v1/projects/${projectId}/apps/${app.id}/oidc_config`, {
         redirectUris,
         postLogoutRedirectUris,
-        responseTypes: cfg.responseTypes ?? ["OIDC_RESPONSE_TYPE_CODE"],
-        grantTypes: cfg.grantTypes ?? ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
-        appType: "OIDC_APP_TYPE_WEB",
-        authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
-        accessTokenType: cfg.accessTokenType ?? "OIDC_TOKEN_TYPE_JWT",
+        responseTypes: cfg.responseTypes ?? ['OIDC_RESPONSE_TYPE_CODE'],
+        grantTypes: cfg.grantTypes ?? [
+            'OIDC_GRANT_TYPE_AUTHORIZATION_CODE',
+            'OIDC_GRANT_TYPE_REFRESH_TOKEN',
+        ],
+        appType: 'OIDC_APP_TYPE_WEB',
+        authMethodType: 'OIDC_AUTH_METHOD_TYPE_BASIC',
+        accessTokenType: cfg.accessTokenType ?? 'OIDC_TOKEN_TYPE_JWT',
         accessTokenRoleAssertion: cfg.accessTokenRoleAssertion ?? true,
         idTokenRoleAssertion: cfg.idTokenRoleAssertion ?? true,
         idTokenUserinfoAssertion: cfg.idTokenUserinfoAssertion ?? true,
@@ -290,11 +322,11 @@ async function ensureHubApp(pat, projectId) {
         const persisted = readHubAuth();
         if (persisted && persisted.clientId === clientId)
             return { clientId };
-        const regenerated = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`, {});
+        const regenerated = await api(pat, 'POST', `/management/v1/projects/${projectId}/apps/${existing.id}/oidc_config/_generate_client_secret`, {});
         logSuccess(`Regenerated Hub UI client secret (local copy was missing)`);
         return { clientId, clientSecret: regenerated.clientSecret };
     }
-    const created = await api(pat, "POST", `/management/v1/projects/${projectId}/apps/oidc`, {
+    const created = await api(pat, 'POST', `/management/v1/projects/${projectId}/apps/oidc`, {
         name: HUB_APP_NAME,
         redirectUris: [...new Set([hubRedirectUri(), HUB_DEFAULT_REDIRECT_URI])],
         postLogoutRedirectUris: [
@@ -307,11 +339,11 @@ async function ensureHubApp(pat, projectId) {
                 `http://localhost:${DEFAULT_HUB_PORT}/`,
             ]),
         ],
-        responseTypes: ["OIDC_RESPONSE_TYPE_CODE"],
-        grantTypes: ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE", "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
-        appType: "OIDC_APP_TYPE_WEB",
-        authMethodType: "OIDC_AUTH_METHOD_TYPE_BASIC",
-        accessTokenType: "OIDC_TOKEN_TYPE_JWT",
+        responseTypes: ['OIDC_RESPONSE_TYPE_CODE'],
+        grantTypes: ['OIDC_GRANT_TYPE_AUTHORIZATION_CODE', 'OIDC_GRANT_TYPE_REFRESH_TOKEN'],
+        appType: 'OIDC_APP_TYPE_WEB',
+        authMethodType: 'OIDC_AUTH_METHOD_TYPE_BASIC',
+        accessTokenType: 'OIDC_TOKEN_TYPE_JWT',
         accessTokenRoleAssertion: true,
         idTokenRoleAssertion: true,
         idTokenUserinfoAssertion: true,
@@ -324,23 +356,23 @@ async function ensureHubApp(pat, projectId) {
  * ops@local.mesh gets `developer` — proves per-user role claims. */
 async function ensureHubGrants(pat, projectId) {
     const grants = [
-        { email: "admin@local.mesh", roles: ["ops"] },
-        { email: "dev@local.mesh", roles: ["ops"] },
-        { email: "ops@local.mesh", roles: ["developer"] },
+        { email: 'admin@local.mesh', roles: ['ops'] },
+        { email: 'dev@local.mesh', roles: ['ops'] },
+        { email: 'ops@local.mesh', roles: ['developer'] },
     ];
     for (const grant of grants) {
-        const search = await api(pat, "POST", "/management/v1/users/_search", {
-            queries: [{ userNameQuery: { userName: grant.email, method: "TEXT_QUERY_METHOD_EQUALS" } }],
+        const search = await api(pat, 'POST', '/management/v1/users/_search', {
+            queries: [{ userNameQuery: { userName: grant.email, method: 'TEXT_QUERY_METHOD_EQUALS' } }],
         });
         const userId = search?.result?.[0]?.id;
         if (!userId)
             continue;
         try {
-            await api(pat, "POST", `/management/v1/users/${userId}/grants`, {
+            await api(pat, 'POST', `/management/v1/users/${userId}/grants`, {
                 projectId,
                 roleKeys: grant.roles,
             });
-            logSuccess(`Granted Hub role(s) ${grant.roles.join(", ")} → ${grant.email}`);
+            logSuccess(`Granted Hub role(s) ${grant.roles.join(', ')} → ${grant.email}`);
         }
         catch (err) {
             if (!isAlreadyExists(err))
@@ -362,40 +394,186 @@ export async function seedHubAuth(pat) {
         : undefined;
     const config = {
         clientId: app.clientId,
-        clientSecret: app.clientSecret ?? persisted?.clientSecret ?? "",
-        cookieSecret: persistedCookie ?? (await import("crypto")).randomBytes(16).toString("hex"),
+        projectId,
+        clientSecret: app.clientSecret ?? persisted?.clientSecret ?? '',
+        cookieSecret: persistedCookie ?? (await import('crypto')).randomBytes(16).toString('hex'),
     };
     fs.writeFileSync(hubAuthPath(), JSON.stringify(config, null, 2), { mode: 0o600 });
     return config;
 }
+/**
+ * Publish the Hub's OWN authz pointer — the local stand-in for what the platform
+ * Pulumi program publishes (Hub RBAC design §7.1).
+ *
+ * The Hub administers every app's identity through
+ * `identity/apps/{app}/users`, which resolves the app's Zitadel project and org
+ * from its published pointer. Without a pointer of its own the Hub is the one
+ * app it cannot administer: its Users page has no project to create people in
+ * and no role vocabulary to grant, which is why that page could only ever be a
+ * mock. Locally there is no Pulumi run to publish it, so seeding does.
+ *
+ * Read-modify-write: the compiled-schema keys (`opsHubMetadataRef`, `mode`) are
+ * published by the Hub itself and must survive this.
+ */
+async function publishHubAuthzPointer(projectId, orgId, awsConfig) {
+    const { SSMClient, GetParameterCommand, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const ssm = new SSMClient(awsConfig);
+    const name = `/mesh-platform/${LOCAL_TENANT}/${LOCAL_ENV}/apps/hub/stacks/local/authz`;
+    let current = {};
+    try {
+        const existing = await ssm.send(new GetParameterCommand({ Name: name }));
+        current = JSON.parse(existing.Parameter?.Value ?? "{}");
+    }
+    catch {
+        // First run — nothing published yet.
+    }
+    const value = {
+        spicedb: { instanceRefs: [] },
+        ...current,
+        zitadel: { projectId, orgId, issuer: ZITADEL_ISSUER },
+    };
+    await ssm.send(new PutParameterCommand({
+        Name: name,
+        Type: "String",
+        Overwrite: true,
+        Value: JSON.stringify(value),
+        Description: "Hub authz pointer (local analog of the platform Pulumi program)",
+    }));
+    logSuccess(`Hub authz pointer published → project ${projectId} in org ${orgId}`);
+}
 /** Registry parity: what SSM discovery and `mesh dev test-user` read in the cloud. */
 async function writeRegistryParams(cliClientId, awsConfig) {
-    const { SSMClient, PutParameterCommand } = await import("@aws-sdk/client-ssm");
+    const { SSMClient, PutParameterCommand } = await import('@aws-sdk/client-ssm');
     const ssm = new SSMClient(awsConfig);
     await ssm.send(new PutParameterCommand({
         Name: ZITADEL_SSM_PARAM,
-        Type: "String",
+        Type: 'String',
         Overwrite: true,
         Value: JSON.stringify({ endpoint: ZITADEL_ISSUER, cliClientId }),
-        Description: "Zitadel platform export (seeded by mesh start)",
+        Description: 'Zitadel platform export (seeded by mesh start)',
     }));
     for (const user of TEST_USERS) {
         await ssm.send(new PutParameterCommand({
             Name: `${TEST_USERS_SSM_PREFIX}/${user.name}`,
-            Type: "String",
+            Type: 'String',
             Overwrite: true,
             Value: JSON.stringify({ email: user.email, password: user.password, roles: [] }),
             Description: `Local test user '${user.name}' (dev-grade, seeded by mesh start)`,
         }));
     }
 }
+/** Secrets Manager id the Hub reads its Zitadel admin key from (opsHubSecretName). */
+export const OPS_HUB_SECRET_ID = 'mesh/local/dev/zitadel/ops-hub';
+/**
+ * Give the local Hub an ADMIN plane.
+ *
+ * The Hub verifies tokens with `ZITADEL_ISSUER`, but every WRITE — creating a
+ * user, minting an API key — goes through a machine key it loads from Secrets
+ * Manager. Without that key the local Hub silently offers no create affordance
+ * and nothing reaches the IdP, which reads as "the feature is broken" rather
+ * than "the credential was never provisioned".
+ *
+ * The key is a Zitadel machine key (private_key_jwt): `{ keyId, key, userId }`.
+ * Idempotent — an existing user is reused, and a fresh key is minted only when
+ * the secret is absent, because Zitadel returns the private half exactly once.
+ */
+async function ensureOpsHubAdmin(pat, awsConfig) {
+    const { SecretsManagerClient, GetSecretValueCommand, CreateSecretCommand, PutSecretValueCommand, } = await import('@aws-sdk/client-secrets-manager');
+    const sm = new SecretsManagerClient(awsConfig);
+    const existing = await sm
+        .send(new GetSecretValueCommand({ SecretId: OPS_HUB_SECRET_ID }))
+        .catch(() => null);
+    if (existing?.SecretString) {
+        logSuccess('Hub admin key already provisioned (Zitadel writes enabled)');
+        return;
+    }
+    const userName = 'hub-opshub';
+    const found = await api(pat, 'POST', '/management/v1/users/_search', {
+        queries: [{ userNameQuery: { userName, method: 'TEXT_QUERY_METHOD_EQUALS' } }],
+    });
+    let userId = found?.result?.[0]?.id;
+    if (!userId) {
+        const created = await api(pat, 'POST', '/management/v1/users/machine', {
+            userName,
+            name: 'Hub Ops Hub admin',
+            description: 'Local Hub Zitadel admin plane (seeded by mesh start)',
+        });
+        userId = created?.userId;
+    }
+    if (!userId)
+        throw new MeshCliError("could not create the Hub's Zitadel admin user");
+    // IAM_OWNER because the Hub administers every org on the instance — each app
+    // tenant gets its own org, and a key is minted in the app's org, not the Hub's.
+    await api(pat, 'POST', '/admin/v1/members', { userId, roles: ['IAM_OWNER'] }).catch(() => undefined);
+    const key = await api(pat, 'POST', `/management/v1/users/${userId}/keys`, {
+        type: 'KEY_TYPE_JSON',
+    });
+    if (!key?.keyDetails)
+        throw new MeshCliError('Zitadel did not return a machine key for the Hub admin user');
+    const raw = JSON.parse(Buffer.from(key.keyDetails, 'base64').toString('utf8'));
+    const secretString = JSON.stringify({ keyId: raw.keyId, key: raw.key, userId: raw.userId });
+    await sm
+        .send(new CreateSecretCommand({ Name: OPS_HUB_SECRET_ID, SecretString: secretString }))
+        .catch(async () => {
+        await sm.send(new PutSecretValueCommand({ SecretId: OPS_HUB_SECRET_ID, SecretString: secretString }));
+    });
+    logSuccess(`Hub admin key provisioned → ${OPS_HUB_SECRET_ID} (Zitadel writes enabled)`);
+}
+/** Where the local stack's mail goes — the `mailpit` service in docker-compose. */
+const LOCAL_SMTP = {
+    host: 'mailpit:1025',
+    from: 'no-reply@local.mesh',
+    fromName: 'Mesh (local)',
+};
+/**
+ * Point the instance's mail at the local mailbox, on every start.
+ *
+ * The compose file sets the same thing via `ZITADEL_DEFAULTINSTANCE_SMTP…`,
+ * but those apply at FIRST INIT only — so every stack that existed before the
+ * mailbox was added would keep no SMTP config at all, and activation and
+ * password-reset mail would go on silently going nowhere. Reconciling here
+ * covers those without asking anyone to `mesh stop --destroy`.
+ *
+ * Idempotent: reads the configured providers first and only writes when the
+ * host differs. Best-effort — a stack whose mail is misconfigured is worth a
+ * warning, not a failed `mesh start`.
+ */
+async function ensureLocalSmtp(pat) {
+    try {
+        const existing = await api(pat, 'POST', '/admin/v1/smtp/_search', {}).catch(() => null);
+        const configs = existing?.result ?? [];
+        const match = configs.find((c) => c.host === LOCAL_SMTP.host);
+        if (!match) {
+            const created = await api(pat, 'POST', '/admin/v1/smtp', {
+                senderAddress: LOCAL_SMTP.from,
+                senderName: LOCAL_SMTP.fromName,
+                tls: false,
+                host: LOCAL_SMTP.host,
+                user: '',
+                password: '',
+            });
+            // A provider that exists but is not active still sends nothing.
+            if (created?.id)
+                await api(pat, 'POST', `/admin/v1/smtp/${created.id}/_activate`, {});
+            logSuccess(`Local mailbox wired to Zitadel → ${LOCAL_SMTP.host} (view at http://localhost:8025)`);
+            return;
+        }
+        if (match.state !== 'SMTP_CONFIG_ACTIVE' && match.id) {
+            await api(pat, 'POST', `/admin/v1/smtp/${match.id}/_activate`, {});
+        }
+    }
+    catch (err) {
+        logWarn(`Could not wire the local mailbox to Zitadel (${err.message}). ` +
+            'Activation and password-reset mail will not be delivered locally.');
+    }
+}
 export async function seedZitadel(awsConfig) {
     const pat = readSeederPat();
-    const org = await api(pat, "POST", "/admin/v1/orgs/_search", {
-        queries: [{ nameQuery: { name: PLATFORM_ORG, method: "TEXT_QUERY_METHOD_EQUALS" } }],
+    const org = await api(pat, 'POST', '/admin/v1/orgs/_search', {
+        queries: [{ nameQuery: { name: PLATFORM_ORG, method: 'TEXT_QUERY_METHOD_EQUALS' } }],
     });
     if (!org?.result?.[0]) {
-        throw new MeshCliError(`Platform org '${PLATFORM_ORG}' not found — the zitadel volume predates the org naming.`, { remediation: { command: "mesh stop --destroy && mesh start" } });
+        throw new MeshCliError(`Platform org '${PLATFORM_ORG}' not found — the zitadel volume predates the org naming.`, { remediation: { command: 'mesh stop --destroy && mesh start' } });
     }
     logSuccess(`Platform org '${PLATFORM_ORG}' ready (platform tenant root — holds platform-service auth config)`);
     // Zitadel v4 defaults new instances to the login-v2 UI — a separate
@@ -403,17 +581,20 @@ export async function seedZitadel(awsConfig) {
     // authorize flow has a page to land on (idempotent; compose sets the
     // same default at first-instance time).
     try {
-        await api(pat, "PUT", "/v2/features/instance", { loginV2: { required: false } });
+        await api(pat, 'PUT', '/v2/features/instance', { loginV2: { required: false } });
     }
     catch {
         // pre-v4 instance or endpoint drift — v1 login is already the default
     }
+    await ensureLocalSmtp(pat);
     const projectId = await ensureCliProject(pat);
     const cliClientId = await ensureCliApp(pat, projectId);
     await ensureTestUsers(pat);
     // Hub auth AFTER test users exist (role grants target them).
     const hubAuth = await seedHubAuth(pat);
+    await publishHubAuthzPointer(hubAuth.projectId, org.result[0].id, awsConfig);
     await writeRegistryParams(cliClientId, awsConfig);
+    await ensureOpsHubAdmin(pat, awsConfig);
     writeContextConfig(LOGIN_CONTEXT, { issuer: ZITADEL_ISSUER, clientId: cliClientId });
     logSuccess(`Login context '${LOGIN_CONTEXT}' configured → try: mesh login ${LOGIN_CONTEXT}`);
     return { projectId, cliClientId, hubAuth };

package/dist/src/commands/local/seed-zitadel.js.map

@@ -1 +1 @@
-{"version":3,"file":"seed-zitadel.js","sourceRoot":"","sources":["../../../../src/commands/local/seed-zitadel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AACjE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC;;;;;gFAKgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,oBAAoB,OAAO,EAAE,kBAAkB,CAAC;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,gBAAgB,kBAAkB,CAAC;AAC/F,MAAM,CAAC,MAAM,SAAS,GAAG,cAAc,CAAC;AACxC,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,YAAY,IAAI,SAAS,mBAAmB,CAAC;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,YAAY,IAAI,SAAS,sBAAsB,CAAC;AAUvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;IACpG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE;CACrG,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,aAAa,EAAE,CAAC,yBAAyB,CAAC;QAC1C,UAAU,EAAE,CAAC,oCAAoC,EAAE,6BAA6B,CAAC;QACjF,OAAO,EAAE,sBAAsB;QAC/B,cAAc,EAAE,4BAA4B;QAC5C,eAAe,EAAE,qBAAqB;QACtC,wBAAwB,EAAE,IAAI;QAC9B,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,+IAA+I,EAC/I,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,GAAW,EACX,MAAc,EACd,OAAe,EACf,IAAc,EACd,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE;QACrD,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAQ,IAAI,KAAK,CAAC,WAAW,MAAM,IAAI,OAAO,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QACrG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAQ,EAAE,EAAE,CAC1C,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,IAAY,EACZ,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,iCAAiC,EACjC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAC1E,IAAI,CAAC,KAAK,CACX,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,oBAAoB,IAAI,kBAAkB,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,GAAG,EACH,MAAM,EACN,yBAAyB,EACzB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EACpC,IAAI,CAAC,KAAK,CACX,CAAC;IACF,UAAU,CAAC,4BAA4B,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,SAAiB,EACjB,IAAY,EACZ,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,eAAe,EACnD,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAC1E,KAAK,CACN,CAAC;IACF,OAAO,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAmB,EAAE,CACxD,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1G,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,gBAAgB,YAAY,kBAAkB,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,SAAS,YAAY,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC/G,UAAU,CAAC,gCAAgC,YAAY,wBAAwB,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,oCAAoC,EAAE;gBAC3D,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,OAAO,EAAE;oBACP,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE;iBAClD;gBACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;gBACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,sBAAsB,EAAE,KAAK;aAC9B,CAAC,CAAC;YACH,UAAU,CAAC,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,aAAa,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAUD;8EAC8E;AAC9E,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,EAAE,YAAY;YAAE,OAAO,MAAM,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAmB,EAAE,CACxD,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEhF,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,SAAiB;IAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,SAAS,QAAQ,EAAE;gBACnE,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;aAClB,CAAC,CAAC;YACH,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAmBD;;;;;yBAKyB;AACzB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,SAAiB,EACjB,GAAe;IAEf,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;KACtF,CAAC;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,sBAAsB,GAAG;QAC7B,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;YACrC,oBAAoB,OAAO,EAAE,EAAE;YAC/B,oBAAoB,OAAO,EAAE,GAAG;YAChC,oBAAoB,gBAAgB,EAAE;YACtC,oBAAoB,gBAAgB,GAAG;SACxC,CAAC;KACH,CAAC;IACF,IACE,YAAY,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM;QACvD,sBAAsB,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM,EAC3E,CAAC;QACD,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,iEAAiE;IACjE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,2BAA2B,SAAS,SAAS,GAAG,CAAC,EAAE,cAAc,EAAE;QACvF,YAAY;QACZ,sBAAsB;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC,yBAAyB,CAAC;QAC/D,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,oCAAoC,EAAE,+BAA+B,CAAC;QACrG,OAAO,EAAE,mBAAmB;QAC5B,cAAc,EAAE,6BAA6B;QAC7C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,qBAAqB;QAC7D,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,IAAI,IAAI;QAC9D,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,IAAI,IAAI;QAC9D,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;KAC7B,CAAC,CAAC;IACH,UAAU,CAAC,gDAAgD,OAAO,EAAE,kCAAkC,CAAC,CAAC;AAC1G,CAAC;AAED;;yDAEyD;AACzD,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,MAAM,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,SAAS,QAAQ,CAAC,EAAE,sCAAsC,EAC9F,EAAE,CACH,CAAC;QACF,UAAU,CAAC,2DAA2D,CAAC,CAAC;QACxE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,SAAS,YAAY,EAAE;QACvF,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACxE,sBAAsB,EAAE;YACtB,yEAAyE;YACzE,uDAAuD;YACvD,GAAG,IAAI,GAAG,CAAC;gBACT,oBAAoB,OAAO,EAAE,EAAE;gBAC/B,oBAAoB,OAAO,EAAE,GAAG;gBAChC,oBAAoB,gBAAgB,EAAE;gBACtC,oBAAoB,gBAAgB,GAAG;aACxC,CAAC;SACH;QACD,aAAa,EAAE,CAAC,yBAAyB,CAAC;QAC1C,UAAU,EAAE,CAAC,oCAAoC,EAAE,+BAA+B,CAAC;QACnF,OAAO,EAAE,mBAAmB;QAC5B,cAAc,EAAE,6BAA6B;QAC7C,eAAe,EAAE,qBAAqB;QACtC,wBAAwB,EAAE,IAAI;QAC9B,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,UAAU,CAAC,gCAAgC,YAAY,kCAAkC,CAAC,CAAC;IAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC5E,CAAC;AAED;oEACoE;AACpE,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,SAAiB;IAC3D,MAAM,MAAM,GAA8C;QACxD,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;QAC3C,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;KAClD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,8BAA8B,EAAE;YACpE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,MAAM,SAAS,EAAE;gBAC9D,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,uBAAuB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,eAAe,GACnB,SAAS,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC;QAC7E,CAAC,CAAC,SAAS,CAAC,YAAY;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,EAAE;QAC/D,YAAY,EACV,eAAe,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC9E,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,SAAiB;IACvE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;QAChE,WAAW,EAAE,gDAAgD;KAC9D,CAAC,CACH,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,GAAG,qBAAqB,IAAI,IAAI,CAAC,IAAI,EAAE;YAC7C,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAChF,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,qCAAqC;SAChF,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB;IACjD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAC3D,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,YAAY,2DAA2D,EACxF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,UAAU,CAAC,iBAAiB,YAAY,qEAAqE,CAAC,CAAC;IAC/G,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,6DAA6D;IAC7D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAClD,kBAAkB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACrF,UAAU,CAAC,kBAAkB,aAAa,kCAAkC,aAAa,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"seed-zitadel.js","sourceRoot":"","sources":["../../../../src/commands/local/seed-zitadel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEpD,MAAM,CAAC,MAAM,cAAc,GAAG,uBAAuB,CAAC;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC;AACrC;;2EAE2E;AAC3E,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,UAAU,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,gCAAgC,CAAC;AACjE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AACtC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC;;;;;gFAKgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,GAAW,EAAE,CAAC,oBAAoB,OAAO,EAAE,kBAAkB,CAAC;AAC5F,MAAM,CAAC,MAAM,wBAAwB,GAAG,oBAAoB,gBAAgB,kBAAkB,CAAC;AAC/F,MAAM,CAAC,MAAM,SAAS,GAAG,mBAAmB,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;AAC7D,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,YAAY,IAAI,SAAS,mBAAmB,CAAC;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,YAAY,IAAI,SAAS,sBAAsB,CAAC;AAUvG,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAoB;IACzC;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,YAAY;KACvB;IACD;QACE,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,gBAAgB;QACvB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,YAAY;KACvB;CACF,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,CAAC,gBAAgB,CAAC;QAChC,aAAa,EAAE,CAAC,yBAAyB,CAAC;QAC1C,UAAU,EAAE,CAAC,oCAAoC,EAAE,6BAA6B,CAAC;QACjF,OAAO,EAAE,sBAAsB;QAC/B,cAAc,EAAE,4BAA4B;QAC5C,eAAe,EAAE,qBAAqB;QACtC,wBAAwB,EAAE,IAAI;QAC9B,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,EAAE,6BAA6B,EAAE,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CACpB,+IAA+I,EAC/I,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,GAAW,EACX,MAAc,EACd,OAAe,EACf,IAAc,EACd,KAAc;IAEd,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,cAAc,GAAG,OAAO,EAAE,EAAE;QACrD,MAAM;QACN,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C;QACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAQ,IAAI,KAAK,CACxB,WAAW,MAAM,IAAI,OAAO,MAAM,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CACzE,CAAC;QACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACxB,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,IAAI,CAAC;QAC7B,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAQ,EAAE,EAAE,CAC1C,GAAG,EAAE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;AAE9F;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAW,EACX,IAAY,EACZ,OAAqE,EAAE;IAEvE,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,iCAAiC,EACjC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAC1E,IAAI,CAAC,KAAK,CACX,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACzC,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,oBAAoB,IAAI,kBAAkB,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,GAAG,EACH,MAAM,EACN,yBAAyB,EACzB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EACpC,IAAI,CAAC,KAAK,CACX,CAAC;IACF,UAAU,CAAC,4BAA4B,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7F,OAAO,OAAO,CAAC,EAAE,CAAC;AACpB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAW,EACX,SAAiB,EACjB,IAAY,EACZ,KAAc;IAEd,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,eAAe,EACnD,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC,EAAE,EAC1E,KAAK,CACN,CAAC;IACF,OAAO,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAmB,EAAE,CACxD,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE;IAC1C,QAAQ,EAAE,yBAAyB;IACnC,WAAW,EAAE,IAAI;CAClB,CAAC,CAAC;AAEL,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,SAAiB;IACxD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC;IAC9F,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,CAAC,gBAAgB,YAAY,kBAAkB,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,YAAY,EAChD,kBAAkB,EAAE,CACrB,CAAC;IACF,UAAU,CAAC,gCAAgC,YAAY,wBAAwB,CAAC,CAAC;IACjF,OAAO,OAAO,CAAC,QAAQ,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,oCAAoC,EAAE;gBAC3D,QAAQ,EAAE,IAAI,CAAC,KAAK;gBACpB,OAAO,EAAE;oBACP,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,EAAE;iBAClD;gBACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;gBACnD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,sBAAsB,EAAE,KAAK;aAC9B,CAAC,CAAC;YACH,UAAU,CAAC,qBAAqB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,aAAa,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAYD;8EAC8E;AAC9E,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;IACpE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACnE,IAAI,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,YAAY,IAAI,MAAM,EAAE,YAAY;YAAE,OAAO,MAAM,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,GAAW,EAAmB,EAAE,CACxD,oBAAoB,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;AAEhF;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,MAAM,GAAG,CAAC;AAC7F,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,SAAiB;IAC1D,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,SAAS,QAAQ,EAAE;gBACnE,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,kBAAkB,CAAC,IAAI,CAAC;aACtC,CAAC,CAAC;YACH,UAAU,CAAC,qBAAqB,IAAI,GAAG,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAmBD;;;;;yBAKyB;AACzB,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,SAAiB,EACjB,GAAe;IAEf,MAAM,GAAG,GAAG,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG;QACnB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC;KACtF,CAAC;IACF,2EAA2E;IAC3E,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,sBAAsB,GAAG;QAC7B,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC;YACrC,oBAAoB,OAAO,EAAE,EAAE;YAC/B,oBAAoB,OAAO,EAAE,GAAG;YAChC,oBAAoB,gBAAgB,EAAE;YACtC,oBAAoB,gBAAgB,GAAG;SACxC,CAAC;KACH,CAAC;IACF,IACE,YAAY,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,MAAM;QACvD,sBAAsB,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,MAAM,EAC3E,CAAC;QACD,OAAO;IACT,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,iEAAiE;IACjE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,2BAA2B,SAAS,SAAS,GAAG,CAAC,EAAE,cAAc,EAAE;QACvF,YAAY;QACZ,sBAAsB;QACtB,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,CAAC,yBAAyB,CAAC;QAC/D,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI;YAC5B,oCAAoC;YACpC,+BAA+B;SAChC;QACD,OAAO,EAAE,mBAAmB;QAC5B,cAAc,EAAE,6BAA6B;QAC7C,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,qBAAqB;QAC7D,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,IAAI,IAAI;QAC9D,oBAAoB,EAAE,GAAG,CAAC,oBAAoB,IAAI,IAAI;QACtD,wBAAwB,EAAE,GAAG,CAAC,wBAAwB,IAAI,IAAI;QAC9D,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;KAC7B,CAAC,CAAC;IACH,UAAU,CACR,gDAAgD,OAAO,EAAE,kCAAkC,CAC5F,CAAC;AACJ,CAAC;AAED;;yDAEyD;AACzD,KAAK,UAAU,YAAY,CACzB,GAAW,EACX,SAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,wBAAwB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC;QAChD,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtE,MAAM,WAAW,GAAG,MAAM,GAAG,CAC3B,GAAG,EACH,MAAM,EACN,2BAA2B,SAAS,SAAS,QAAQ,CAAC,EAAE,sCAAsC,EAC9F,EAAE,CACH,CAAC;QACF,UAAU,CAAC,2DAA2D,CAAC,CAAC;QACxE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,CAAC,YAAY,EAAE,CAAC;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,2BAA2B,SAAS,YAAY,EAAE;QACvF,IAAI,EAAE,YAAY;QAClB,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACxE,sBAAsB,EAAE;YACtB,yEAAyE;YACzE,uDAAuD;YACvD,GAAG,IAAI,GAAG,CAAC;gBACT,oBAAoB,OAAO,EAAE,EAAE;gBAC/B,oBAAoB,OAAO,EAAE,GAAG;gBAChC,oBAAoB,gBAAgB,EAAE;gBACtC,oBAAoB,gBAAgB,GAAG;aACxC,CAAC;SACH;QACD,aAAa,EAAE,CAAC,yBAAyB,CAAC;QAC1C,UAAU,EAAE,CAAC,oCAAoC,EAAE,+BAA+B,CAAC;QACnF,OAAO,EAAE,mBAAmB;QAC5B,cAAc,EAAE,6BAA6B;QAC7C,eAAe,EAAE,qBAAqB;QACtC,wBAAwB,EAAE,IAAI;QAC9B,oBAAoB,EAAE,IAAI;QAC1B,wBAAwB,EAAE,IAAI;QAC9B,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IACH,UAAU,CAAC,gCAAgC,YAAY,kCAAkC,CAAC,CAAC;IAC3F,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;AAC5E,CAAC;AAED;oEACoE;AACpE,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,SAAiB;IAC3D,MAAM,MAAM,GAA8C;QACxD,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,KAAK,CAAC,EAAE;QAC3C,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;KAClD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,8BAA8B,EAAE;YACpE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;SAC5F,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,MAAM,SAAS,EAAE;gBAC9D,SAAS;gBACT,QAAQ,EAAE,KAAK,CAAC,KAAK;aACtB,CAAC,CAAC;YACH,UAAU,CAAC,uBAAuB,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;QACvC,CAAC;IACH,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IAEtC,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;IAChC,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,eAAe,GACnB,SAAS,EAAE,YAAY,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,MAAM,CAAC;QAC7E,CAAC,CAAC,SAAS,CAAC,YAAY;QACxB,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,MAAM,GAAkB;QAC5B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS;QACT,YAAY,EAAE,GAAG,CAAC,YAAY,IAAI,SAAS,EAAE,YAAY,IAAI,EAAE;QAC/D,YAAY,EAAE,eAAe,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;KAC1F,CAAC;IACF,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,KAAK,UAAU,sBAAsB,CACnC,SAAiB,EACjB,KAAa,EACb,SAAiB;IAEjB,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpG,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,kBAAkB,YAAY,IAAI,SAAS,8BAA8B,CAAC;IAEvF,IAAI,OAAO,GAA4B,EAAE,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,IAAI,IAAI,CAA4B,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;IACvC,CAAC;IAED,MAAM,KAAK,GAAG;QACZ,OAAO,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE;QAC7B,GAAG,OAAO;QACV,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE;KACtD,CAAC;IACF,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;QAC5B,WAAW,EAAE,iEAAiE;KAC/E,CAAC,CACH,CAAC;IACF,UAAU,CAAC,yCAAyC,SAAS,WAAW,KAAK,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,mBAAmB,CAAC,WAAmB,EAAE,SAAiB;IACvE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;QACtB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;QAChE,WAAW,EAAE,gDAAgD;KAC9D,CAAC,CACH,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,mBAAmB,CAAC;YACtB,IAAI,EAAE,GAAG,qBAAqB,IAAI,IAAI,CAAC,IAAI,EAAE;YAC7C,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;YAChF,WAAW,EAAE,oBAAoB,IAAI,CAAC,IAAI,qCAAqC;SAChF,CAAC,CACH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,iBAAiB,GAAG,gCAAgC,CAAC;AAElE;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,SAAiB;IAC7D,MAAM,EACJ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,qBAAqB,GACtB,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;IACpD,MAAM,EAAE,GAAG,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,MAAM,EAAE;SACtB,IAAI,CAAC,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;SAChE,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACrB,IAAI,QAAQ,EAAE,YAAY,EAAE,CAAC;QAC3B,UAAU,CAAC,4DAA4D,CAAC,CAAC;QACzE,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,8BAA8B,EAAE;QACnE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;KAC/E,CAAC,CAAC;IACH,IAAI,MAAM,GAAuB,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,8BAA8B,EAAE;YACrE,QAAQ;YACR,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,sDAAsD;SACpE,CAAC,CAAC;QACH,MAAM,GAAG,OAAO,EAAE,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,+CAA+C,CAAC,CAAC;IAErF,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,CACjF,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IAEF,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,MAAM,OAAO,EAAE;QACxE,IAAI,EAAE,eAAe;KACtB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,UAAU;QAClB,MAAM,IAAI,YAAY,CAAC,6DAA6D,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAI5E,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5F,MAAM,EAAE;SACL,IAAI,CAAC,IAAI,mBAAmB,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CAAC;SACtF,KAAK,CAAC,KAAK,IAAI,EAAE;QAChB,MAAM,EAAE,CAAC,IAAI,CACX,IAAI,qBAAqB,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC,CACvF,CAAC;IACJ,CAAC,CAAC,CAAC;IACL,UAAU,CAAC,+BAA+B,iBAAiB,2BAA2B,CAAC,CAAC;AAC1F,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,GAAG;IACjB,IAAI,EAAE,cAAc;IACpB,IAAI,EAAE,qBAAqB;IAC3B,QAAQ,EAAE,cAAc;CAChB,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,eAAe,CAAC,GAAW;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,OAAO,GACX,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,gBAAgB,EAAE;gBACvD,aAAa,EAAE,UAAU,CAAC,IAAI;gBAC9B,UAAU,EAAE,UAAU,CAAC,QAAQ;gBAC/B,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,IAAI,EAAE,EAAE;gBACR,QAAQ,EAAE,EAAE;aACb,CAAC,CAAC;YACH,gEAAgE;YAChE,IAAI,OAAO,EAAE,EAAE;gBAAE,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,OAAO,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;YACtF,UAAU,CAAC,oCAAoC,UAAU,CAAC,IAAI,kCAAkC,CAAC,CAAC;YAClG,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,KAAK,KAAK,oBAAoB,IAAI,KAAK,CAAC,EAAE,EAAE,CAAC;YACrD,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,kBAAkB,KAAK,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,gDAAiD,GAAa,CAAC,OAAO,KAAK;YACzE,mEAAmE,CACtE,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,SAAiB;IACjD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,wBAAwB,EAAE;QAC3D,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,0BAA0B,EAAE,EAAE,CAAC;KACrF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,YAAY,CACpB,iBAAiB,YAAY,2DAA2D,EACxF,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,UAAU,CACR,iBAAiB,YAAY,qEAAqE,CACnG,CAAC;IACF,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,wCAAwC;IACxC,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IAC3B,6DAA6D;IAC7D,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,sBAAsB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,iBAAiB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACxC,kBAAkB,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;IACrF,UAAU,CAAC,kBAAkB,aAAa,kCAAkC,aAAa,EAAE,CAAC,CAAC;IAC7F,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;AAC7C,CAAC"}