@mesh-tech/mesh-cli 0.35.2 → 0.37.0

package/dist/bin/mesh.chunk-A4DGMGHF.js

@@ -0,0 +1,303 @@
+import {
+  RESERVED_REGISTRY_CONTEXT,
+  clearContextConfig,
+  clearCredentials,
+  decodeJwtPayload,
+  discoverConfigFromWellKnown,
+  firstPartyDomainFor,
+  forceRefreshToken,
+  getContextConfig,
+  getValidToken,
+  projectRoleKeys,
+  readAllContextConfigs,
+  readAllCredentials,
+  readCredentials,
+  runLoginFlow,
+  tokenStillValid,
+  writeContextConfig
+} from "./mesh.chunk-R5VVTXG4.js";
+import {
+  logInfo
+} from "./mesh.chunk-WFFDF346.js";
+import {
+  MeshCliError
+} from "./mesh.chunk-IQOBTL42.js";
+
+// packages/mesh-cli/src/utils/registry-broker.ts
+var PUBLISHED_BROKER_TIMEOUT_MS = 15e3;
+function deriveRegistryBroker(context, getCfg = getContextConfig) {
+  const cfg = getCfg(context);
+  if (!cfg?.issuer) return null;
+  try {
+    const u = new URL(cfg.issuer);
+    const parts = u.hostname.split(".");
+    parts[0] = "registry-auth";
+    return `https://${parts.join(".")}`;
+  } catch {
+    return null;
+  }
+}
+async function classifyBrokerResponse(res) {
+  if (res.status === 401) return { ok: false, failure: { kind: "unauthenticated" } };
+  if (res.status === 403) {
+    const body2 = await res.json().catch(() => ({}));
+    return {
+      ok: false,
+      failure: {
+        kind: "not-authorized",
+        email: typeof body2.email === "string" ? body2.email : void 0,
+        requiredRoles: Array.isArray(body2.requiredRoles) ? body2.requiredRoles.filter((r) => typeof r === "string") : void 0,
+        requestUrl: typeof body2.requestUrl === "string" ? body2.requestUrl : void 0
+      }
+    };
+  }
+  if (res.status !== 200) {
+    return { ok: false, failure: { kind: "unavailable", detail: `broker returned ${res.status}` } };
+  }
+  let body;
+  try {
+    body = await res.json();
+  } catch (err) {
+    return {
+      ok: false,
+      failure: { kind: "unavailable", detail: `malformed broker response: ${err.message}` }
+    };
+  }
+  const { endpoint, authorizationToken, scope, expiresAt } = body;
+  if (typeof endpoint !== "string" || !endpoint || typeof authorizationToken !== "string" || !authorizationToken) {
+    return {
+      ok: false,
+      failure: { kind: "unavailable", detail: "broker response missing endpoint or authorizationToken" }
+    };
+  }
+  return {
+    ok: true,
+    grant: {
+      scope: typeof scope === "string" && scope ? scope : "@mesh-tech",
+      endpoint,
+      authorizationToken,
+      expiresAt: typeof expiresAt === "string" ? expiresAt : void 0
+    }
+  };
+}
+async function fetchRegistryGrant(context, brokerUrl, deps) {
+  const token = await deps.getValidToken(context);
+  if (!token) return { ok: false, failure: { kind: "no-session" } };
+  const doFetch = deps.fetchFn ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), deps.timeoutMs ?? PUBLISHED_BROKER_TIMEOUT_MS);
+  try {
+    const res = await doFetch(`${brokerUrl.replace(/\/+$/, "")}/token`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    return await classifyBrokerResponse(res);
+  } catch (err) {
+    return {
+      ok: false,
+      failure: { kind: "unavailable", detail: err.message }
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function realGrantDeps() {
+  return { getValidToken: (c) => getValidToken(c) };
+}
+
+// packages/mesh-cli/src/utils/registry-identity.ts
+var REGISTRY_ALIAS = "mesh.dev";
+var REGISTRY_DOMAIN = (() => {
+  const domain = firstPartyDomainFor(REGISTRY_ALIAS);
+  if (!domain) {
+    throw new Error(`FIRST_PARTY_CONTEXTS has no entry for the registry alias "${REGISTRY_ALIAS}"`);
+  }
+  return domain;
+})();
+var REGISTRY_CREDENTIAL_KEY = RESERVED_REGISTRY_CONTEXT;
+function isReservedRegistryContext(context) {
+  return context === REGISTRY_CREDENTIAL_KEY;
+}
+var RegistryIdentityError = class extends MeshCliError {
+  constructor(detail) {
+    super(
+      `Could not resolve the Mesh package registry (${detail}).
+  Discovery endpoint: https://cli.${REGISTRY_DOMAIN}/.well-known/mesh.json`,
+      { remediation: { command: "mesh registry login   # retry once you are online" } }
+    );
+    this.name = "RegistryIdentityError";
+  }
+};
+function toIdentity(cfg) {
+  if (!cfg?.issuer || !cfg.clientId) return null;
+  const registryBroker = cfg.registryBroker ?? deriveRegistryBroker(REGISTRY_CREDENTIAL_KEY, () => cfg);
+  if (!registryBroker) return null;
+  return {
+    issuer: cfg.issuer,
+    clientId: cfg.clientId,
+    registryBroker,
+    discoveredAt: cfg.discoveredAt ?? (/* @__PURE__ */ new Date(0)).toISOString()
+  };
+}
+async function resolveRegistryIdentity(opts = {}) {
+  if (!opts.refresh) {
+    const cached = toIdentity(getContextConfig(REGISTRY_CREDENTIAL_KEY));
+    if (cached) return cached;
+  }
+  const discovered = await discoverConfigFromWellKnown(REGISTRY_DOMAIN, REGISTRY_CREDENTIAL_KEY, {
+    quiet: true
+  });
+  if (!discovered) {
+    throw new RegistryIdentityError(
+      `discovery on ${REGISTRY_DOMAIN} failed \u2014 are you online?`
+    );
+  }
+  const stored = { ...discovered, discoveredAt: (/* @__PURE__ */ new Date()).toISOString() };
+  const identity = toIdentity(stored);
+  if (!identity) {
+    throw new RegistryIdentityError(`the discovery document names no registry broker`);
+  }
+  writeContextConfig(REGISTRY_CREDENTIAL_KEY, stored);
+  return identity;
+}
+function registrySessionCandidates(issuer, configs = readAllContextConfigs(), credentials = readAllCredentials()) {
+  const names = issuer ? [REGISTRY_CREDENTIAL_KEY, REGISTRY_ALIAS, REGISTRY_DOMAIN] : [REGISTRY_CREDENTIAL_KEY];
+  return names.filter((name) => {
+    if (!(name in credentials)) return false;
+    const cfg = configs[name];
+    if (!cfg?.issuer) return false;
+    return issuer ? cfg.issuer === issuer : true;
+  });
+}
+function readRegistrySession() {
+  const identity = toIdentity(getContextConfig(REGISTRY_CREDENTIAL_KEY));
+  for (const context of registrySessionCandidates(identity?.issuer ?? null)) {
+    const creds = readCredentials(context);
+    if (creds && tokenStillValid(creds.expiresAt)) {
+      return { context, email: creds.email ?? "unknown", expiresAt: creds.expiresAt };
+    }
+  }
+  return null;
+}
+async function ensureRegistrySession(opts) {
+  let identity;
+  try {
+    identity = await resolveRegistryIdentity();
+  } catch (err) {
+    return { ok: false, reason: "no-identity", detail: err.message };
+  }
+  for (const context of registrySessionCandidates(identity.issuer)) {
+    const token = await getValidToken(context);
+    if (!token) continue;
+    const creds2 = readCredentials(context);
+    if (creds2) return { ok: true, context, email: creds2.email ?? "unknown", expiresAt: creds2.expiresAt };
+  }
+  if (!opts.interactive) {
+    return {
+      ok: false,
+      reason: "no-tty",
+      detail: "no registry session is cached and this run cannot open a sign-in"
+    };
+  }
+  const stored = getContextConfig(REGISTRY_CREDENTIAL_KEY);
+  if (!stored) {
+    writeContextConfig(REGISTRY_CREDENTIAL_KEY, {
+      issuer: identity.issuer,
+      clientId: identity.clientId,
+      registryBroker: identity.registryBroker
+    });
+  }
+  logInfo(
+    opts.device ? "No registry session \u2014 sign in with the device code below\u2026" : "No registry session \u2014 opening your browser to sign in\u2026 (headless? use --device)"
+  );
+  try {
+    await runLoginFlow(REGISTRY_CREDENTIAL_KEY, identity, { device: opts.device });
+  } catch (err) {
+    return { ok: false, reason: "login-failed", detail: err.message };
+  }
+  const creds = readCredentials(REGISTRY_CREDENTIAL_KEY);
+  if (!creds) {
+    return { ok: false, reason: "login-failed", detail: "sign-in completed but no session was cached" };
+  }
+  return {
+    ok: true,
+    context: REGISTRY_CREDENTIAL_KEY,
+    email: creds.email ?? "unknown",
+    expiresAt: creds.expiresAt
+  };
+}
+function registryTokenRoles(idToken) {
+  if (!idToken) return [];
+  try {
+    return projectRoleKeys(decodeJwtPayload(idToken)).sort();
+  } catch {
+    return [];
+  }
+}
+function registryAccountState(idToken) {
+  if (!idToken) return {};
+  let claims = null;
+  try {
+    claims = decodeJwtPayload(idToken);
+  } catch {
+    return {};
+  }
+  if (!claims) return {};
+  const email = typeof claims.email === "string" ? claims.email : void 0;
+  const verified = claims.email_verified;
+  return { email, emailVerified: typeof verified === "boolean" ? verified : void 0 };
+}
+async function refreshRegistrySession(context) {
+  const before = registryTokenRoles(readCredentials(context)?.idToken);
+  const idToken = await forceRefreshToken(context);
+  if (!idToken) return { reminted: false, rolesChanged: false };
+  const after = registryTokenRoles(idToken);
+  const same = after.length === before.length && after.every((role, i) => role === before[i]);
+  return { reminted: true, rolesChanged: !same };
+}
+function clearRegistrySession() {
+  clearCredentials(REGISTRY_CREDENTIAL_KEY);
+  clearContextConfig(REGISTRY_CREDENTIAL_KEY);
+}
+function identityChanged(before, after) {
+  return before.issuer !== after.issuer || before.clientId !== after.clientId || before.registryBroker !== after.registryBroker;
+}
+function describeSessionExpiry(expiresAt, now = Date.now()) {
+  const ms = new Date(expiresAt).getTime() - now;
+  if (!(ms > 0)) return "expired";
+  const totalMinutes = Math.floor(ms / 6e4);
+  const h = Math.floor(totalMinutes / 60);
+  const m = totalMinutes % 60;
+  return h > 0 ? `${h}h ${m}m` : `${m}m`;
+}
+function logRegistryIdentity(identity) {
+  let host = identity.registryBroker;
+  try {
+    host = new URL(identity.registryBroker).host;
+  } catch {
+  }
+  logInfo(`Mesh package registry: mesh-platform (broker ${host})`);
+}
+
+export {
+  PUBLISHED_BROKER_TIMEOUT_MS,
+  fetchRegistryGrant,
+  realGrantDeps,
+  REGISTRY_ALIAS,
+  REGISTRY_DOMAIN,
+  REGISTRY_CREDENTIAL_KEY,
+  isReservedRegistryContext,
+  RegistryIdentityError,
+  resolveRegistryIdentity,
+  registrySessionCandidates,
+  readRegistrySession,
+  ensureRegistrySession,
+  registryTokenRoles,
+  registryAccountState,
+  refreshRegistrySession,
+  clearRegistrySession,
+  identityChanged,
+  describeSessionExpiry,
+  logRegistryIdentity
+};

package/dist/bin/mesh.chunk-A4DGMGHF.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/registry-broker.ts", "../../src/utils/registry-identity.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;AAoEO,IAAM,8BAA8B;AA4BpC,SAAS,qBACd,SACA,SAAmC,kBACpB;AACf,QAAM,MAAM,OAAO,OAAO;AAC1B,MAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,IAAI,MAAM;AAC5B,UAAM,QAAQ,EAAE,SAAS,MAAM,GAAG;AAClC,UAAM,CAAC,IAAI;AACX,WAAO,WAAW,MAAM,KAAK,GAAG,CAAC;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkBA,eAAsB,uBAAuB,KAGX;AAChC,MAAI,IAAI,WAAW,IAAK,QAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,kBAAkB,EAAE;AAEjF,MAAI,IAAI,WAAW,KAAK;AACtB,UAAMA,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC/C,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,QACP,MAAM;AAAA,QACN,OAAO,OAAOA,MAAK,UAAU,WAAWA,MAAK,QAAQ;AAAA,QACrD,eAAe,MAAM,QAAQA,MAAK,aAAa,IAC3CA,MAAK,cAAc,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ,IACnE;AAAA,QACJ,YAAY,OAAOA,MAAK,eAAe,WAAWA,MAAK,aAAa;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AAEA,MAAI,IAAI,WAAW,KAAK;AACtB,WAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,eAAe,QAAQ,mBAAmB,IAAI,MAAM,GAAG,EAAE;AAAA,EAChG;AAEA,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,MAAM,eAAe,QAAQ,8BAA+B,IAAc,OAAO,GAAG;AAAA,IACjG;AAAA,EACF;AAEA,QAAM,EAAE,UAAU,oBAAoB,OAAO,UAAU,IAAI;AAC3D,MAAI,OAAO,aAAa,YAAY,CAAC,YAAY,OAAO,uBAAuB,YAAY,CAAC,oBAAoB;AAC9G,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,MAAM,eAAe,QAAQ,yDAAyD;AAAA,IACnG;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,OAAO,OAAO,UAAU,YAAY,QAAQ,QAAQ;AAAA,MACpD;AAAA,MACA;AAAA,MACA,WAAW,OAAO,cAAc,WAAW,YAAY;AAAA,IACzD;AAAA,EACF;AACF;AAWA,eAAsB,mBACpB,SACA,WACA,MAC+B;AAC/B,QAAM,QAAQ,MAAM,KAAK,cAAc,OAAO;AAC9C,MAAI,CAAC,MAAO,QAAO,EAAE,IAAI,OAAO,SAAS,EAAE,MAAM,aAAa,EAAE;AAEhE,QAAM,UAAU,KAAK,WAAW;AAChC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,aAAa,2BAA2B;AAChG,MAAI;AACF,UAAM,MAAM,MAAM,QAAQ,GAAG,UAAU,QAAQ,QAAQ,EAAE,CAAC,UAAU;AAAA,MAClE,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC5C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,WAAO,MAAM,uBAAuB,GAAG;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,EAAE,MAAM,eAAe,QAAS,IAAc,QAAQ;AAAA,IACjE;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;AAGO,SAAS,gBAAgC;AAC9C,SAAO,EAAE,eAAe,CAAC,MAAM,cAAc,CAAC,EAAE;AAClD;;;ACtKO,IAAM,iBAAiB;AAGvB,IAAM,mBAA2B,MAAM;AAC5C,QAAM,SAAS,oBAAoB,cAAc;AACjD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,6DAA6D,cAAc,GAAG;AAAA,EAChG;AACA,SAAO;AACT,GAAG;AAOI,IAAM,0BAAkC;AAGxC,SAAS,0BAA0B,SAA0B;AAClE,SAAO,YAAY;AACrB;AAsBO,IAAM,wBAAN,cAAoC,aAAa;AAAA,EACtD,YAAY,QAAgB;AAC1B;AAAA,MACE,gDAAgD,MAAM;AAAA,oCACf,eAAe;AAAA,MACtD,EAAE,aAAa,EAAE,SAAS,oDAAoD,EAAE;AAAA,IAClF;AACA,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,WAAW,KAA6D;AAC/E,MAAI,CAAC,KAAK,UAAU,CAAC,IAAI,SAAU,QAAO;AAC1C,QAAM,iBACJ,IAAI,kBAAkB,qBAAqB,yBAAyB,MAAM,GAAG;AAC/E,MAAI,CAAC,eAAgB,QAAO;AAC5B,SAAO;AAAA,IACL,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd;AAAA,IACA,cAAc,IAAI,iBAAgB,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,EAC5D;AACF;AAeA,eAAsB,wBAAwB,OAA8B,CAAC,GAA8B;AACzG,MAAI,CAAC,KAAK,SAAS;AACjB,UAAM,SAAS,WAAW,iBAAiB,uBAAuB,CAAkC;AACpG,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,QAAM,aAAa,MAAM,4BAA4B,iBAAiB,yBAAyB;AAAA,IAC7F,OAAO;AAAA,EACT,CAAC;AACD,MAAI,CAAC,YAAY;AACf,UAAM,IAAI;AAAA,MACR,gBAAgB,eAAe;AAAA,IACjC;AAAA,EACF;AACA,QAAM,SAAiC,EAAE,GAAG,YAAY,eAAc,oBAAI,KAAK,GAAE,YAAY,EAAE;AAC/F,QAAM,WAAW,WAAW,MAAM;AAClC,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,sBAAsB,iDAAiD;AAAA,EACnF;AACA,qBAAmB,yBAAyB,MAAM;AAClD,SAAO;AACT;AAaO,SAAS,0BACd,QACA,UAA2D,sBAAsB,GACjF,cAAuC,mBAAmB,GAChD;AACV,QAAM,QAAQ,SAAS,CAAC,yBAAyB,gBAAgB,eAAe,IAAI,CAAC,uBAAuB;AAC5G,SAAO,MAAM,OAAO,CAAC,SAAS;AAC5B,QAAI,EAAE,QAAQ,aAAc,QAAO;AACnC,UAAM,MAAM,QAAQ,IAAI;AACxB,QAAI,CAAC,KAAK,OAAQ,QAAO;AACzB,WAAO,SAAS,IAAI,WAAW,SAAS;AAAA,EAC1C,CAAC;AACH;AAkBO,SAAS,sBAA8C;AAC5D,QAAM,WAAW,WAAW,iBAAiB,uBAAuB,CAAkC;AACtG,aAAW,WAAW,0BAA0B,UAAU,UAAU,IAAI,GAAG;AACzE,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,SAAS,gBAAgB,MAAM,SAAS,GAAG;AAC7C,aAAO,EAAE,SAAS,OAAO,MAAM,SAAS,WAAW,WAAW,MAAM,UAAU;AAAA,IAChF;AAAA,EACF;AACA,SAAO;AACT;AA4BA,eAAsB,sBAAsB,MAGT;AACjC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,wBAAwB;AAAA,EAC3C,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,eAAe,QAAS,IAAc,QAAQ;AAAA,EAC5E;AAEA,aAAW,WAAW,0BAA0B,SAAS,MAAM,GAAG;AAChE,UAAM,QAAQ,MAAM,cAAc,OAAO;AACzC,QAAI,CAAC,MAAO;AACZ,UAAMC,SAAQ,gBAAgB,OAAO;AACrC,QAAIA,OAAO,QAAO,EAAE,IAAI,MAAM,SAAS,OAAOA,OAAM,SAAS,WAAW,WAAWA,OAAM,UAAU;AAAA,EACrG;AAEA,MAAI,CAAC,KAAK,aAAa;AACrB,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAIA,QAAM,SAAS,iBAAiB,uBAAuB;AACvD,MAAI,CAAC,QAAQ;AACX,uBAAmB,yBAAyB;AAAA,MAC1C,QAAQ,SAAS;AAAA,MACjB,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,IAC3B,CAAC;AAAA,EACH;AAGA;AAAA,IACE,KAAK,SACD,wEACA;AAAA,EACN;AACA,MAAI;AACF,UAAM,aAAa,yBAAyB,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EAC/E,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAS,IAAc,QAAQ;AAAA,EAC7E;AACA,QAAM,QAAQ,gBAAgB,uBAAuB;AACrD,MAAI,CAAC,OAAO;AACV,WAAO,EAAE,IAAI,OAAO,QAAQ,gBAAgB,QAAQ,8CAA8C;AAAA,EACpG;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,OAAO,MAAM,SAAS;AAAA,IACtB,WAAW,MAAM;AAAA,EACnB;AACF;AAaO,SAAS,mBAAmB,SAA8C;AAC/E,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI;AACF,WAAO,gBAAgB,iBAAiB,OAAO,CAAC,EAAE,KAAK;AAAA,EACzD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AA4BO,SAAS,qBAAqB,SAA0D;AAC7F,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI,SAAyC;AAC7C,MAAI;AACF,aAAS,iBAAiB,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,QAAQ,OAAO,OAAO,UAAU,WAAW,OAAO,QAAQ;AAChE,QAAM,WAAW,OAAO;AACxB,SAAO,EAAE,OAAO,eAAe,OAAO,aAAa,YAAY,WAAW,OAAU;AACtF;AAyBA,eAAsB,uBAAuB,SAA0C;AACrF,QAAM,SAAS,mBAAmB,gBAAgB,OAAO,GAAG,OAAO;AACnE,QAAM,UAAU,MAAM,kBAAkB,OAAO;AAC/C,MAAI,CAAC,QAAS,QAAO,EAAE,UAAU,OAAO,cAAc,MAAM;AAC5D,QAAM,QAAQ,mBAAmB,OAAO;AACxC,QAAM,OAAO,MAAM,WAAW,OAAO,UAAU,MAAM,MAAM,CAAC,MAAM,MAAM,SAAS,OAAO,CAAC,CAAC;AAC1F,SAAO,EAAE,UAAU,MAAM,cAAc,CAAC,KAAK;AAC/C;AAWO,SAAS,uBAA6B;AAC3C,mBAAiB,uBAAuB;AACxC,qBAAmB,uBAAuB;AAC5C;AASO,SAAS,gBAAgB,QAA0B,OAAkC;AAC1F,SACE,OAAO,WAAW,MAAM,UACxB,OAAO,aAAa,MAAM,YAC1B,OAAO,mBAAmB,MAAM;AAEpC;AAMO,SAAS,sBAAsB,WAAmB,MAAM,KAAK,IAAI,GAAW;AACjF,QAAM,KAAK,IAAI,KAAK,SAAS,EAAE,QAAQ,IAAI;AAC3C,MAAI,EAAE,KAAK,GAAI,QAAO;AACtB,QAAM,eAAe,KAAK,MAAM,KAAK,GAAM;AAC3C,QAAM,IAAI,KAAK,MAAM,eAAe,EAAE;AACtC,QAAM,IAAI,eAAe;AACzB,SAAO,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;AACrC;AAGO,SAAS,oBAAoB,UAAkC;AACpE,MAAI,OAAO,SAAS;AACpB,MAAI;AACF,WAAO,IAAI,IAAI,SAAS,cAAc,EAAE;AAAA,EAC1C,QAAQ;AAAA,EAER;AACA,UAAQ,gDAAgD,IAAI,GAAG;AACjE;",
+  "names": ["body", "creds"]
+}

package/dist/bin/mesh.chunk-CQ2IC4OP.js

@@ -0,0 +1,217 @@
+import {
+  MeshCliError
+} from "./mesh.chunk-IQOBTL42.js";
+
+// packages/mesh-cli/src/commands/init/platform-setup.ts
+import * as fs from "fs";
+import * as path from "path";
+import { execFileSync } from "child_process";
+var PLATFORM_SETUP_DEFAULTS = {
+  env: "dev",
+  region: "us-east-2",
+  profile: "default"
+};
+var DOMAIN_REQUIRED_MESSAGE = "--domain is required: the core stack creates the public Route 53 zone <env>.<domain>, and a placeholder domain scaffolds a zone whose certificate can never validate, so ingress never serves HTTPS.";
+function defaultStateBucket(tenant) {
+  return `${tenant}-mesh-platform-pulumi-state`;
+}
+function defaultPlatformDir(tenant) {
+  return `${tenant}-mesh-platform`;
+}
+function validateEnv(value) {
+  return /^[a-z][a-z0-9-]*$/.test(value.trim()) ? true : "lowercase letters, digits and dashes, starting with a letter";
+}
+function validateRegion(value) {
+  return /^[a-z]{2}(-[a-z]+)+-\d$/.test(value.trim()) ? true : "an AWS region, e.g. us-east-2 or eu-west-1";
+}
+function validateDomain(value) {
+  const domain = value.trim().toLowerCase().replace(/\.$/, "");
+  if (!domain) return "a public domain you control, e.g. q2poc.pub";
+  if (!/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}$/.test(domain)) {
+    return "a public domain you control, e.g. q2poc.pub";
+  }
+  if (/(^|\.)(example\.(com|org|net)|invalid|localhost|test)$/.test(domain)) {
+    return `${domain} is a placeholder \u2014 its ACM certificate can never validate, because nobody can delegate that zone to you. Use a domain you control.`;
+  }
+  return true;
+}
+function validateStateBucket(value) {
+  const bucket = value.trim();
+  return /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket) && !bucket.includes("..") ? true : "3\u201363 characters: lowercase letters, digits, dots and dashes, starting and ending alphanumeric";
+}
+function resolveTargetDir(tenant, flags, cwd) {
+  const dir = path.resolve(cwd, flags.dir ?? defaultPlatformDir(tenant));
+  if (fs.existsSync(dir) && fs.readdirSync(dir).length > 0) {
+    throw new MeshCliError(`Target directory is not empty: ${dir}`, {
+      remediation: { command: `mesh init platform ${tenant} --dir <empty-dir>` }
+    });
+  }
+  return dir;
+}
+async function resolvePlatformSetup(tenant, flags, deps) {
+  const cwd = deps.cwd ?? process.cwd();
+  const dir = resolveTargetDir(tenant, flags, cwd);
+  const ask = deps.interactive && !flags.yes ? deps.prompts : void 0;
+  const env = flags.env ?? (ask ? await ask.input({ message: "Environment", default: PLATFORM_SETUP_DEFAULTS.env, validate: validateEnv }) : PLATFORM_SETUP_DEFAULTS.env);
+  if (validateEnv(env) !== true) throw new MeshCliError(`Invalid environment '${env}' \u2014 ${validateEnv(env)}.`);
+  const region = flags.region ?? (ask ? await ask.input({ message: "AWS region", default: PLATFORM_SETUP_DEFAULTS.region, validate: validateRegion }) : PLATFORM_SETUP_DEFAULTS.region);
+  if (validateRegion(region) !== true) throw new MeshCliError(`Invalid region '${region}' \u2014 ${validateRegion(region)}.`);
+  let domain = flags.domain;
+  if (domain === void 0) {
+    if (!ask) throw new MeshCliError(DOMAIN_REQUIRED_MESSAGE, { remediation: { command: `mesh init platform ${tenant} --domain <your-domain>` } });
+    domain = await ask.input({
+      message: `Public base domain (the core stack creates the Route 53 zone ${env}.<domain>; its NS records must be delegated from the parent before the deploy can finish)`,
+      validate: validateDomain
+    });
+  }
+  const domainCheck = validateDomain(domain);
+  if (domainCheck !== true) throw new MeshCliError(`Invalid --domain '${domain}' \u2014 ${domainCheck}`);
+  domain = domain.trim().toLowerCase().replace(/\.$/, "");
+  const profile = flags.profile ?? (ask ? await ask.input({ message: "AWS profile the stack config references", default: PLATFORM_SETUP_DEFAULTS.profile }) : PLATFORM_SETUP_DEFAULTS.profile);
+  const bucketDefault = defaultStateBucket(tenant);
+  const stateBucket = flags.stateBucket ?? (ask ? await ask.input({ message: "Pulumi state S3 bucket (holds this platform's state \u2014 created below if it does not exist)", default: bucketDefault, validate: validateStateBucket }) : bucketDefault);
+  const bucketCheck = validateStateBucket(stateBucket);
+  if (bucketCheck !== true) throw new MeshCliError(`Invalid --state-bucket '${stateBucket}' \u2014 ${bucketCheck}`);
+  let createStateBucket = flags.createStateBucket ?? false;
+  if (flags.createStateBucket === void 0 && ask) {
+    createStateBucket = await ask.confirm({
+      message: `Create s3://${stateBucket} in ${region} now (versioned), if it does not exist?`,
+      default: true
+    });
+  }
+  return {
+    tenant,
+    env,
+    region,
+    domain,
+    profile,
+    stateBucket: stateBucket.trim(),
+    dir,
+    createStateBucket
+  };
+}
+function stateBucketCreateCommand(setup) {
+  const location = setup.region === "us-east-1" ? "" : ` --create-bucket-configuration LocationConstraint=${setup.region}`;
+  return `aws s3api create-bucket --bucket ${setup.stateBucket} --region ${setup.region}${location} --profile ${setup.profile}`;
+}
+function awsJson(args, profile) {
+  return execFileSync("aws", [...args, "--profile", profile], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+}
+var realStateBucketDeps = {
+  headBucket(setup) {
+    try {
+      awsJson(["s3api", "head-bucket", "--bucket", setup.stateBucket, "--region", setup.region], setup.profile);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  createBucket(setup) {
+    const args = ["s3api", "create-bucket", "--bucket", setup.stateBucket, "--region", setup.region];
+    if (setup.region !== "us-east-1") args.push("--create-bucket-configuration", `LocationConstraint=${setup.region}`);
+    awsJson(args, setup.profile);
+  },
+  enableVersioning(setup) {
+    awsJson(
+      ["s3api", "put-bucket-versioning", "--bucket", setup.stateBucket, "--region", setup.region, "--versioning-configuration", "Status=Enabled"],
+      setup.profile
+    );
+  }
+};
+async function ensureStateBucket(setup, deps = realStateBucketDeps) {
+  if (!setup.createStateBucket) {
+    return { created: false, present: false, detail: "not requested" };
+  }
+  try {
+    if (deps.headBucket(setup)) {
+      return { created: false, present: true, detail: `s3://${setup.stateBucket} already exists` };
+    }
+  } catch {
+  }
+  try {
+    deps.createBucket(setup);
+  } catch (err) {
+    const why = errorDetail(err);
+    return { created: false, present: false, detail: `could not create s3://${setup.stateBucket} \u2014 ${why}` };
+  }
+  try {
+    deps.enableVersioning(setup);
+    return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region} (versioning on)` };
+  } catch (err) {
+    return { created: true, present: true, detail: `created s3://${setup.stateBucket} in ${setup.region}, but versioning could not be enabled \u2014 ${errorDetail(err)}` };
+  }
+}
+function errorDetail(err) {
+  const stderr = err && typeof err === "object" && "stderr" in err ? String(err.stderr ?? "") : "";
+  const text = stderr.trim() || (err instanceof Error ? err.message : String(err));
+  return text.split("\n").filter(Boolean).slice(-1)[0] ?? "unknown error";
+}
+function exportCredentialsCommand(profile) {
+  return `eval "$(aws configure export-credentials --profile ${profile} --format env)"   # mesh deploy reads AWS_ACCESS_KEY_ID; a platform stack carries no mesh:deployerRole`;
+}
+function renderPlatformNextSteps(setup, opts = {}) {
+  const dir = opts.relativeDir ?? setup.dir;
+  const steps = [];
+  if (!opts.bucket?.present) {
+    steps.push(`${stateBucketCreateCommand(setup)}   # the Pulumi state bucket, once`);
+  }
+  steps.push(
+    `cd ${dir}`,
+    "pnpm install",
+    `aws sso login --profile ${setup.profile}   # if this profile is SSO`,
+    exportCredentialsCommand(setup.profile),
+    `cd core && mesh deploy up        # the VPC, EKS, RDS and the public zone ${setup.env}.${setup.domain}`,
+    `# \u2192 then delegate the NS records of ${setup.env}.${setup.domain} from ${setup.domain} at your registrar; the deploy stops at the mesh-gateway Ingress until ACM issues the certificate, then continues`,
+    "cd ../platform && mesh deploy up  # Temporal, Zitadel, the Hub  (needs Docker \u2014 it builds service images)",
+    `mesh login ${setup.tenant}.${setup.env}      # your platform sign-in, once it is up`,
+    "",
+    "Then, in your apps repo, for the hello-world app:",
+    `  mesh init --tenant ${setup.tenant} --platform ${setup.env}`,
+    "  mesh create-app --name hello --primitives service",
+    "  mesh deploy up                   # from the app directory"
+  );
+  return steps;
+}
+async function scaffoldPlatformRepo(setup) {
+  if (fs.existsSync(setup.dir) && fs.readdirSync(setup.dir).length > 0) {
+    throw new MeshCliError(`Target directory is not empty: ${setup.dir}`, {
+      remediation: { command: `mesh init platform ${setup.tenant} --dir <empty-dir>` }
+    });
+  }
+  const { copyTemplate } = await import("./mesh.create-app-A5F45PWZ.js");
+  const { findPackageRoot } = await import("./mesh.stack-EFTFAOCV.js");
+  const { syncSkills } = await import("./mesh.skills-MNDSMBIE.js");
+  const templateDir = path.join(findPackageRoot(), "templates", "platform-repo");
+  fs.mkdirSync(setup.dir, { recursive: true });
+  copyTemplate(templateDir, setup.dir, {
+    tenant: setup.tenant,
+    env: setup.env,
+    region: setup.region,
+    domain: setup.domain,
+    profile: setup.profile,
+    stateBucket: setup.stateBucket
+  });
+  syncSkills(setup.dir);
+}
+
+export {
+  PLATFORM_SETUP_DEFAULTS,
+  DOMAIN_REQUIRED_MESSAGE,
+  defaultStateBucket,
+  defaultPlatformDir,
+  validateEnv,
+  validateRegion,
+  validateDomain,
+  validateStateBucket,
+  resolveTargetDir,
+  resolvePlatformSetup,
+  stateBucketCreateCommand,
+  realStateBucketDeps,
+  ensureStateBucket,
+  exportCredentialsCommand,
+  renderPlatformNextSteps,
+  scaffoldPlatformRepo
+};

package/dist/bin/mesh.chunk-CQ2IC4OP.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/commands/init/platform-setup.ts"],
+  "mappings": ";;;;;AA0BA,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,oBAAoB;AAqCtB,IAAM,0BAA0B;AAAA,EACrC,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,SAAS;AACX;AAGO,IAAM,0BACX;AASK,SAAS,mBAAmB,QAAwB;AACzD,SAAO,GAAG,MAAM;AAClB;AAQO,SAAS,mBAAmB,QAAwB;AACzD,SAAO,GAAG,MAAM;AAClB;AASO,SAAS,YAAY,OAA8B;AACxD,SAAO,oBAAoB,KAAK,MAAM,KAAK,CAAC,IACxC,OACA;AACN;AAUO,SAAS,eAAe,OAA8B;AAC3D,SAAO,0BAA0B,KAAK,MAAM,KAAK,CAAC,IAAI,OAAO;AAC/D;AAWO,SAAS,eAAe,OAA8B;AAC3D,QAAM,SAAS,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE;AAC3D,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,CAAC,kEAAkE,KAAK,MAAM,GAAG;AACnF,WAAO;AAAA,EACT;AACA,MAAI,yDAAyD,KAAK,MAAM,GAAG;AACzE,WAAO,GAAG,MAAM;AAAA,EAClB;AACA,SAAO;AACT;AAUO,SAAS,oBAAoB,OAA8B;AAChE,QAAM,SAAS,MAAM,KAAK;AAC1B,SAAO,qCAAqC,KAAK,MAAM,KAAK,CAAC,OAAO,SAAS,IAAI,IAC7E,OACA;AACN;AAaO,SAAS,iBAAiB,QAAgB,OAA2B,KAAqB;AAC/F,QAAM,MAAW,aAAQ,KAAK,MAAM,OAAO,mBAAmB,MAAM,CAAC;AACrE,MAAO,cAAW,GAAG,KAAQ,eAAY,GAAG,EAAE,SAAS,GAAG;AACxD,UAAM,IAAI,aAAa,kCAAkC,GAAG,IAAI;AAAA,MAC9D,aAAa,EAAE,SAAS,sBAAsB,MAAM,qBAAqB;AAAA,IAC3E,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAeA,eAAsB,qBACpB,QACA,OACA,MACwB;AACxB,QAAM,MAAM,KAAK,OAAO,QAAQ,IAAI;AAGpC,QAAM,MAAM,iBAAiB,QAAQ,OAAO,GAAG;AAC/C,QAAM,MAAM,KAAK,eAAe,CAAC,MAAM,MAAM,KAAK,UAAU;AAE5D,QAAM,MAAM,MAAM,QAAQ,MAAM,MAAM,IAAI,MAAM,EAAE,SAAS,eAAe,SAAS,wBAAwB,KAAK,UAAU,YAAY,CAAC,IAAI,wBAAwB;AACnK,MAAI,YAAY,GAAG,MAAM,KAAM,OAAM,IAAI,aAAa,wBAAwB,GAAG,YAAO,YAAY,GAAG,CAAC,GAAG;AAE3G,QAAM,SACJ,MAAM,WACL,MACG,MAAM,IAAI,MAAM,EAAE,SAAS,cAAc,SAAS,wBAAwB,QAAQ,UAAU,eAAe,CAAC,IAC5G,wBAAwB;AAC9B,MAAI,eAAe,MAAM,MAAM,KAAM,OAAM,IAAI,aAAa,mBAAmB,MAAM,YAAO,eAAe,MAAM,CAAC,GAAG;AAErH,MAAI,SAAS,MAAM;AACnB,MAAI,WAAW,QAAW;AACxB,QAAI,CAAC,IAAK,OAAM,IAAI,aAAa,yBAAyB,EAAE,aAAa,EAAE,SAAS,sBAAsB,MAAM,0BAA0B,EAAE,CAAC;AAC7I,aAAS,MAAM,IAAI,MAAM;AAAA,MACvB,SAAS,gEAAgE,GAAG;AAAA,MAC5E,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,QAAM,cAAc,eAAe,MAAM;AACzC,MAAI,gBAAgB,KAAM,OAAM,IAAI,aAAa,qBAAqB,MAAM,YAAO,WAAW,EAAE;AAChG,WAAS,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,OAAO,EAAE;AAEtD,QAAM,UACJ,MAAM,YACL,MACG,MAAM,IAAI,MAAM,EAAE,SAAS,2CAA2C,SAAS,wBAAwB,QAAQ,CAAC,IAChH,wBAAwB;AAE9B,QAAM,gBAAgB,mBAAmB,MAAM;AAC/C,QAAM,cACJ,MAAM,gBACL,MACG,MAAM,IAAI,MAAM,EAAE,SAAS,kGAA6F,SAAS,eAAe,UAAU,oBAAoB,CAAC,IAC/K;AACN,QAAM,cAAc,oBAAoB,WAAW;AACnD,MAAI,gBAAgB,KAAM,OAAM,IAAI,aAAa,2BAA2B,WAAW,YAAO,WAAW,EAAE;AAE3G,MAAI,oBAAoB,MAAM,qBAAqB;AACnD,MAAI,MAAM,sBAAsB,UAAa,KAAK;AAChD,wBAAoB,MAAM,IAAI,QAAQ;AAAA,MACpC,SAAS,eAAe,WAAW,OAAO,MAAM;AAAA,MAChD,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,YAAY,KAAK;AAAA,IAC9B;AAAA,IACA;AAAA,EACF;AACF;AAWO,SAAS,yBAAyB,OAA0E;AACjH,QAAM,WAAW,MAAM,WAAW,cAAc,KAAK,qDAAqD,MAAM,MAAM;AACtH,SAAO,oCAAoC,MAAM,WAAW,aAAa,MAAM,MAAM,GAAG,QAAQ,cAAc,MAAM,OAAO;AAC7H;AAkBA,SAAS,QAAQ,MAAgB,SAAyB;AACxD,SAAO,aAAa,OAAO,CAAC,GAAG,MAAM,aAAa,OAAO,GAAG;AAAA,IAC1D,UAAU;AAAA,IACV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,EAClC,CAAC;AACH;AAGO,IAAM,sBAAuC;AAAA,EAClD,WAAW,OAAO;AAChB,QAAI;AACF,cAAQ,CAAC,SAAS,eAAe,YAAY,MAAM,aAAa,YAAY,MAAM,MAAM,GAAG,MAAM,OAAO;AACxG,aAAO;AAAA,IACT,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EACA,aAAa,OAAO;AAClB,UAAM,OAAO,CAAC,SAAS,iBAAiB,YAAY,MAAM,aAAa,YAAY,MAAM,MAAM;AAE/F,QAAI,MAAM,WAAW,YAAa,MAAK,KAAK,iCAAiC,sBAAsB,MAAM,MAAM,EAAE;AACjH,YAAQ,MAAM,MAAM,OAAO;AAAA,EAC7B;AAAA,EACA,iBAAiB,OAAO;AACtB;AAAA,MACE,CAAC,SAAS,yBAAyB,YAAY,MAAM,aAAa,YAAY,MAAM,QAAQ,8BAA8B,gBAAgB;AAAA,MAC1I,MAAM;AAAA,IACR;AAAA,EACF;AACF;AAcA,eAAsB,kBAAkB,OAAsB,OAAwB,qBAAkD;AACtI,MAAI,CAAC,MAAM,mBAAmB;AAC5B,WAAO,EAAE,SAAS,OAAO,SAAS,OAAO,QAAQ,gBAAgB;AAAA,EACnE;AACA,MAAI;AACF,QAAI,KAAK,WAAW,KAAK,GAAG;AAC1B,aAAO,EAAE,SAAS,OAAO,SAAS,MAAM,QAAQ,QAAQ,MAAM,WAAW,kBAAkB;AAAA,IAC7F;AAAA,EACF,QAAQ;AAAA,EAER;AACA,MAAI;AACF,SAAK,aAAa,KAAK;AAAA,EACzB,SAAS,KAAK;AACZ,UAAM,MAAM,YAAY,GAAG;AAC3B,WAAO,EAAE,SAAS,OAAO,SAAS,OAAO,QAAQ,yBAAyB,MAAM,WAAW,WAAM,GAAG,GAAG;AAAA,EACzG;AACA,MAAI;AACF,SAAK,iBAAiB,KAAK;AAC3B,WAAO,EAAE,SAAS,MAAM,SAAS,MAAM,QAAQ,gBAAgB,MAAM,WAAW,OAAO,MAAM,MAAM,mBAAmB;AAAA,EACxH,SAAS,KAAK;AACZ,WAAO,EAAE,SAAS,MAAM,SAAS,MAAM,QAAQ,gBAAgB,MAAM,WAAW,OAAO,MAAM,MAAM,gDAA2C,YAAY,GAAG,CAAC,GAAG;AAAA,EACnK;AACF;AAGA,SAAS,YAAY,KAAsB;AACzC,QAAM,SAAS,OAAO,OAAO,QAAQ,YAAY,YAAY,MAAM,OAAQ,IAA6B,UAAU,EAAE,IAAI;AACxH,QAAM,OAAO,OAAO,KAAK,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9E,SAAO,KAAK,MAAM,IAAI,EAAE,OAAO,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK;AAC1D;AAeO,SAAS,yBAAyB,SAAyB;AAChE,SACE,sDAAsD,OAAO;AAGjE;AAaO,SAAS,wBAAwB,OAAsB,OAA8D,CAAC,GAAa;AACxI,QAAM,MAAM,KAAK,eAAe,MAAM;AACtC,QAAM,QAAkB,CAAC;AACzB,MAAI,CAAC,KAAK,QAAQ,SAAS;AACzB,UAAM,KAAK,GAAG,yBAAyB,KAAK,CAAC,oCAAoC;AAAA,EACnF;AACA,QAAM;AAAA,IACJ,MAAM,GAAG;AAAA,IACT;AAAA,IACA,2BAA2B,MAAM,OAAO;AAAA,IACxC,yBAAyB,MAAM,OAAO;AAAA,IACtC,4EAA4E,MAAM,GAAG,IAAI,MAAM,MAAM;AAAA,IACrG,4CAAuC,MAAM,GAAG,IAAI,MAAM,MAAM,SAAS,MAAM,MAAM;AAAA,IACrF;AAAA,IACA,cAAc,MAAM,MAAM,IAAI,MAAM,GAAG;AAAA,IACvC;AAAA,IACA;AAAA,IACA,wBAAwB,MAAM,MAAM,eAAe,MAAM,GAAG;AAAA,IAC5D;AAAA,IACA;AAAA,EACF;AACA,SAAO;AACT;AASA,eAAsB,qBAAqB,OAAqC;AAC9E,MAAO,cAAW,MAAM,GAAG,KAAQ,eAAY,MAAM,GAAG,EAAE,SAAS,GAAG;AACpE,UAAM,IAAI,aAAa,kCAAkC,MAAM,GAAG,IAAI;AAAA,MACpE,aAAa,EAAE,SAAS,sBAAsB,MAAM,MAAM,qBAAqB;AAAA,IACjF,CAAC;AAAA,EACH;AACA,QAAM,EAAE,aAAa,IAAI,MAAM,OAAO,+BAAkB;AACxD,QAAM,EAAE,gBAAgB,IAAI,MAAM,OAAO,0BAAmB;AAC5D,QAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2BAAc;AAClD,QAAM,cAAmB,UAAK,gBAAgB,GAAG,aAAa,eAAe;AAC7E,EAAG,aAAU,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAC3C,eAAa,aAAa,MAAM,KAAK;AAAA,IACnC,QAAQ,MAAM;AAAA,IACd,KAAK,MAAM;AAAA,IACX,QAAQ,MAAM;AAAA,IACd,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM;AAAA,IACf,aAAa,MAAM;AAAA,EACrB,CAAC;AACD,aAAW,MAAM,GAAG;AACtB;",
+  "names": []
+}