@scalebun-release/cli 2.5.0

package/lib/commands/tls-pins.js

@@ -0,0 +1,209 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTlsCommands = registerTlsCommands;
+const tls = __importStar(require("tls"));
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+/**
+ * The SPKI pin: base64 of SHA-256 over the DER SubjectPublicKeyInfo.
+ *
+ * Over the PUBLIC KEY, not over the certificate. This is the whole reason
+ * pinning survives a certificate renewal at all — a renewed certificate for the
+ * same key has the same SPKI and the same pin. Hashing the certificate instead
+ * produces a string that looks identical in shape and matches nothing after the
+ * next renewal.
+ */
+/** A multi-valued RDN yields an array; join it rather than render '[object]'. */
+function flat(v) {
+    if (v === undefined)
+        return undefined;
+    return Array.isArray(v) ? v.join(', ') : v;
+}
+function spkiPin(cert) {
+    const der = cert.pubkey;
+    if (!der)
+        throw new Error('certificate exposed no public key');
+    return crypto.createHash('sha256').update(der).digest('base64');
+}
+function fetchChain(host, port, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const socket = tls.connect({ host, port, servername: host, rejectUnauthorized: false }, () => {
+            const chain = [];
+            const seen = new Set();
+            let cert = socket.getPeerCertificate(true);
+            let position = 0;
+            while (cert && Object.keys(cert).length > 0) {
+                const fp = cert.fingerprint256 ?? String(position);
+                if (seen.has(fp))
+                    break; // the root issues itself; stop rather than loop
+                seen.add(fp);
+                const validTo = new Date(cert.valid_to);
+                chain.push({
+                    position,
+                    // CN can be string | string[] on a multi-valued RDN.
+                    subject: flat(cert.subject?.CN) ?? JSON.stringify(cert.subject ?? {}),
+                    issuer: flat(cert.issuer?.CN) ?? JSON.stringify(cert.issuer ?? {}),
+                    isCa: position > 0,
+                    isSelfSigned: cert.fingerprint256 === cert.issuerCertificate?.fingerprint256,
+                    validTo: validTo.toISOString().slice(0, 10),
+                    daysRemaining: Math.round((validTo.getTime() - Date.now()) / 86400000),
+                    pin: spkiPin(cert),
+                });
+                if (!cert.issuerCertificate || cert.issuerCertificate === cert)
+                    break;
+                cert = cert.issuerCertificate;
+                position++;
+            }
+            socket.end();
+            resolve(chain);
+        });
+        socket.setTimeout(timeoutMs, () => {
+            socket.destroy();
+            reject(new Error(`timed out connecting to ${host}:${port}`));
+        });
+        socket.on('error', reject);
+    });
+}
+function registerTlsCommands(program) {
+    const tlsCmd = program
+        .command('tls')
+        .description('Certificate pinning: generate and verify pins');
+    tlsCmd
+        .command('pins')
+        .argument('<host>', 'hostname, e.g. api.example.com')
+        .option('--port <port>', 'TLS port', '443')
+        .option('--json', 'machine-readable output')
+        .description('Show the SPKI pins for a host, and which one to pin')
+        .action(async (host, opts) => {
+        const chain = await fetchChain(host, Number(opts.port), 10000);
+        if (opts.json) {
+            console.log(JSON.stringify({ host, chain }, null, 2));
+            return;
+        }
+        console.log(`\nCertificate chain for ${host}\n`);
+        for (const c of chain) {
+            const role = c.position === 0 ? 'leaf' : c.isSelfSigned ? 'root' : 'intermediate';
+            console.log(`  [${c.position}] ${role}`);
+            console.log(`      subject : ${c.subject}`);
+            console.log(`      issuer  : ${c.issuer}`);
+            console.log(`      expires : ${c.validTo} (${c.daysRemaining} days)`);
+            console.log(`      pin     : sha256/${c.pin}`);
+            console.log('');
+        }
+        const leaf = chain[0];
+        const intermediate = chain[1];
+        console.log('Which to pin\n');
+        if (leaf && leaf.daysRemaining < 120) {
+            console.log(`  The leaf expires in ${leaf.daysRemaining} days, which means it is on a short\n` +
+                '  renewal cycle. DO NOT PIN THE LEAF: the fleet would stop working on the\n' +
+                '  next renewal, and the OTA lane is itself pinned, so you could not ship a\n' +
+                '  fix over the air.\n');
+        }
+        if (intermediate) {
+            console.log('  Pin the INTERMEDIATE, and at least one more as backup:\n');
+            console.log(`    "${host}": [`);
+            console.log(`      "sha256/${intermediate.pin}",`);
+            console.log(`      "sha256/<BACKUP — see below>"`);
+            console.log('    ]\n');
+        }
+        console.log('  A BACKUP PIN IS NOT OPTIONAL. The SDK refuses to arm with fewer than two\n' +
+            '  pins for a host, on purpose: a single pin is a single point of failure with\n' +
+            '  no rotation path. The backup should be a key you control and can switch to —\n' +
+            "  typically your CA's other intermediate, or a spare key already issued.\n");
+    });
+    tlsCmd
+        .command('verify')
+        .argument('<config>', 'path to scalebun_tls_pins.json')
+        .option('--port <port>', 'TLS port', '443')
+        .description('Check a pin configuration against the live certificate chains')
+        .action(async (configPath, opts) => {
+        const raw = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+        const pinsByHost = raw.pins ?? {};
+        const hosts = Object.keys(pinsByHost);
+        if (hosts.length === 0) {
+            console.error('No hosts configured — this file pins nothing.');
+            process.exitCode = 1;
+            return;
+        }
+        let failed = false;
+        for (const host of hosts) {
+            const configured = (pinsByHost[host] ?? []).map((p) => p.replace(/^sha256\//, ''));
+            console.log(`\n${host}`);
+            if (configured.length < 2) {
+                console.log(`  ✗ ${configured.length} pin(s) configured. The SDK refuses to arm with fewer\n` +
+                    '    than two, so this host is currently NOT PINNED AT ALL — which is safe,\n' +
+                    '    but not what the file says it does.');
+                failed = true;
+                continue;
+            }
+            let chain;
+            try {
+                chain = await fetchChain(host, Number(opts.port), 10000);
+            }
+            catch (err) {
+                console.log(`  ✗ could not connect: ${err.message}`);
+                failed = true;
+                continue;
+            }
+            const live = new Set(chain.map((c) => c.pin));
+            const matched = configured.filter((p) => live.has(p));
+            if (matched.length === 0) {
+                console.log('  ✗ NO configured pin matches the live chain. Every connection would be\n' +
+                    '    rejected. Do not ship this.');
+                failed = true;
+                continue;
+            }
+            console.log(`  ✓ ${matched.length} of ${configured.length} pin(s) match the live chain`);
+            // A backup that matches the CURRENT chain is not a backup — it is a
+            // second copy of the thing you are already depending on.
+            if (matched.length === configured.length) {
+                console.log('  ! every configured pin matches the current chain. That is not a backup:\n' +
+                    '    if this chain is replaced, all of them fail together. At least one pin\n' +
+                    '    should be a key you can switch TO.');
+            }
+            const pinnedLeaf = chain[0] && configured.includes(chain[0].pin);
+            if (pinnedLeaf && chain[0].daysRemaining < 120) {
+                console.log(`  ! the LEAF is pinned and expires in ${chain[0].daysRemaining} days. On renewal\n` +
+                    '    the fleet stops working, and the OTA lane is pinned too, so no fix can\n' +
+                    '    be shipped over the air. Pin the intermediate instead.');
+            }
+        }
+        console.log('');
+        if (failed)
+            process.exitCode = 1;
+    });
+}
+//# sourceMappingURL=tls-pins.js.map

package/lib/commands/tls-pins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tls-pins.js","sourceRoot":"","sources":["../../src/commands/tls-pins.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2GA,kDAwIC;AA1ND,yCAA2B;AAC3B,+CAAiC;AACjC,uCAAyB;AAazB;;;;;;;;GAQG;AACH,iFAAiF;AACjF,SAAS,IAAI,CAAC,CAAgC;IAC5C,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,OAAO,CAAC,IAAiC;IAChD,MAAM,GAAG,GAAI,IAAY,CAAC,MAA4B,CAAC;IACvD,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB;IAC/D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CACxB,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAC3D,GAAG,EAAE;YACH,MAAM,KAAK,GAAiB,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;YAC/B,IAAI,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,QAAQ,GAAG,CAAC,CAAC;YAEjB,OAAO,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5C,MAAM,EAAE,GAAG,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC;gBACnD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;oBAAE,MAAM,CAAC,gDAAgD;gBACzE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAEb,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACxC,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ;oBACR,qDAAqD;oBACrD,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;oBACrE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;oBAClE,IAAI,EAAE,QAAQ,GAAG,CAAC;oBAClB,YAAY,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,iBAAiB,EAAE,cAAc;oBAC5E,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC3C,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,CAAC;oBACxE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC;iBACnB,CAAC,CAAC;gBAEH,IAAI,CAAC,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,KAAK,IAAI;oBAAE,MAAM;gBACtE,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC;gBAC9B,QAAQ,EAAE,CAAC;YACb,CAAC;YAED,MAAM,CAAC,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,GAAG,EAAE;YAChC,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAgB;IAClD,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEhE,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;SACpD,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC;SAC1C,MAAM,CAAC,QAAQ,EAAE,yBAAyB,CAAC;SAC3C,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAsC,EAAE,EAAE;QACrE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAM,CAAC,CAAC;QAEhE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,GACR,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;YACvE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,aAAa,QAAQ,CAAC,CAAC;YACtE,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAE9B,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CACT,yBAAyB,IAAI,CAAC,aAAa,uCAAuC;gBAChF,6EAA6E;gBAC7E,8EAA8E;gBAC9E,uBAAuB,CAC1B,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,iBAAiB,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;YACnD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CACT,8EAA8E;YAC5E,iFAAiF;YACjF,kFAAkF;YAClF,4EAA4E,CAC/E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,QAAQ,CAAC;SACjB,QAAQ,CAAC,UAAU,EAAE,gCAAgC,CAAC;SACtD,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,KAAK,CAAC;SAC1C,WAAW,CAAC,+DAA+D,CAAC;SAC5E,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,IAAsB,EAAE,EAAE;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,MAAM,UAAU,GAA6B,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,UAAU,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAEzB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,CAAC,GAAG,CACT,OAAO,UAAU,CAAC,MAAM,yDAAyD;oBAC/E,8EAA8E;oBAC9E,yCAAyC,CAC5C,CAAC;gBACF,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS;YACX,CAAC;YAED,IAAI,KAAmB,CAAC;YACxB,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAM,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CAAC,0BAA0B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrD,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAEtD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CACT,2EAA2E;oBACzE,iCAAiC,CACpC,CAAC;gBACF,MAAM,GAAG,IAAI,CAAC;gBACd,SAAS;YACX,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,OAAO,UAAU,CAAC,MAAM,8BAA8B,CAAC,CAAC;YAEzF,oEAAoE;YACpE,yDAAyD;YACzD,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CACT,6EAA6E;oBAC3E,8EAA8E;oBAC9E,wCAAwC,CAC3C,CAAC;YACJ,CAAC;YAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACjE,IAAI,UAAU,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,EAAE,CAAC;gBAC/C,OAAO,CAAC,GAAG,CACT,yCAAyC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,qBAAqB;oBAClF,8EAA8E;oBAC9E,4DAA4D,CAC/D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,MAAM;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/lib/index.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.d.ts.map

package/lib/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":""}

package/lib/index.js

@@ -0,0 +1,233 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const login_1 = require("./commands/login");
+const doctor_1 = require("./commands/doctor");
+const ota_publish_1 = require("./commands/ota-publish");
+const ota_bundle_1 = require("./commands/ota-bundle");
+const ota_sign_1 = require("./commands/ota-sign");
+const push_apns_1 = require("./commands/push-apns");
+const ota_channels_1 = require("./commands/ota-channels");
+const ota_delete_bundle_1 = require("./commands/ota-delete-bundle");
+const ota_keys_1 = require("./commands/ota-keys");
+const ota_rollout_1 = require("./commands/ota-rollout");
+const launch_1 = require("./commands/launch");
+const migrate_codepush_1 = require("./commands/migrate-codepush");
+const ci_init_1 = require("./commands/ci-init");
+const quickstart_1 = require("./commands/quickstart");
+const chalk_1 = __importDefault(require("chalk"));
+const ui_1 = require("./utils/ui");
+const banner_1 = require("./ui/banner");
+const graphics_1 = require("./ui/graphics");
+// Shared with quickstart's native-wiring step — one resolver, one behaviour.
+const sdkBin_1 = require("./utils/sdkBin");
+const link_1 = require("./commands/link");
+const shell_1 = require("./commands/shell");
+const ota_inspect_1 = require("./commands/ota-inspect");
+const ota_promote_1 = require("./commands/ota-promote");
+const tls_pins_1 = require("./commands/tls-pins");
+const context_1 = require("./utils/context");
+const guide_1 = require("./utils/guide");
+const output_1 = require("./utils/output");
+const program = new commander_1.Command();
+// Kept in one place so the block-art and sixel paths show the same tagline.
+const TAGLINE = 'Enterprise OTA Update & Telemetry Control Plane';
+// Read the version from package.json so it can never drift from the published
+// version. The compiled entry lives at lib/index.js, so ../package.json is the
+// CLI manifest. (Hardcoding it left `scalebun --version` reporting 0.1.0 long
+// after the package had moved on.)
+const { version } = require('../package.json');
+/**
+ * The no-arg splash: art (mark + wordmark) is gated by shouldShowArt(); the
+ * status line and command table are the command's actual output and always print.
+ *
+ * Sixel is opt-in this release (SCALEBUN_GRAPHICS=sixel); the default is block
+ * art. capabilities() probes stdin, so it runs ONLY when art will actually draw —
+ * never on a real command.
+ */
+async function printSplash() {
+    if ((0, banner_1.shouldShowArt)()) {
+        // Sixel is the DEFAULT: probe whenever art draws to a real terminal, and use
+        // the smooth logo wherever it's supported. `SCALEBUN_GRAPHICS=off` (handled
+        // inside capabilities()) forces block art. The stdout.isTTY guard keeps sixel
+        // out of pipes/redirects and skips the stdin probe when output isn't a TTY.
+        const caps = process.stdout.isTTY ? await (0, graphics_1.capabilities)() : null;
+        if (caps?.sixel) {
+            process.stdout.write((0, graphics_1.lockup)(caps, [...banner_1.WORDMARK], TAGLINE, { level: chalk_1.default.level }));
+        }
+        else {
+            process.stdout.write((0, banner_1.banner)({ version }));
+        }
+    }
+    (0, ui_1.renderStatus)();
+    // The command list is now stage-aware: stage 0 shows one command, stage 4
+    // shows the full grouped surface. See utils/guide.ts for why the stage is
+    // derived rather than stored.
+    const ctx = (0, context_1.getContext)();
+    (0, guide_1.renderContextLine)(ctx);
+    (0, guide_1.renderGuide)(ctx);
+}
+/**
+ * Should a bare `scalebun` hand over to the interactive session?
+ *
+ * The splash was a dead end: it printed a list of commands and exited, so the
+ * promise of "you don't have to type `scalebun` every time" was only reachable
+ * by typing `scalebun shell` — a mode you had to already know about, since the
+ * splash did not mention it below stage 4.
+ *
+ * Every guard below is a way this could hang something that cannot answer a
+ * prompt. A pipe (`scalebun | head`), a redirect, a CI runner, and machine mode
+ * all take the old path: print, exit, done. `SCALEBUN_NO_SHELL=1` is the escape
+ * hatch for a human who wants the splash and their prompt back.
+ */
+function shouldEnterShell() {
+    if (process.env.SCALEBUN_NO_SHELL === '1')
+        return false;
+    if (process.env.CI === 'true')
+        return false;
+    if ((0, output_1.isJson)())
+        return false;
+    if ((0, shell_1.inShell)())
+        return false;
+    return !!process.stdin.isTTY && !!process.stdout.isTTY;
+}
+/**
+ * What `scalebun` with no command does.
+ *
+ * On a terminal it IS the session — the menu draws its own frame (art, status,
+ * project, commands) and redraws it after every command, so printing a splash
+ * first would only be erased a frame later. Everywhere else it stays exactly
+ * what it was: print and exit.
+ */
+async function runBareInvocation() {
+    if (shouldEnterShell()) {
+        await (0, shell_1.runShell)(program);
+        return;
+    }
+    await printSplash();
+}
+/**
+ * Honour --json / --non-interactive before commander parses.
+ *
+ * Commander does not surface root options to subcommand handlers, so the flag
+ * is read from argv directly — the same argv-sniff precedent `--verbose`
+ * already uses in utils/ui.ts.
+ */
+function applyGlobalFlags(argv) {
+    if (argv.includes('--json'))
+        (0, output_1.setJsonMode)(true);
+}
+/**
+ * Commands that live in @scalebun/react-native's bin, not here.
+ *
+ * `init android` / `init ios` wire the host app's native files for OTA — they
+ * need the SDK package's codemods, so they ship with the SDK. But this CLI's
+ * own splash lists `scalebun init android` as step 3 of the getting-started
+ * flow, so when THIS binary wins the `scalebun` bin race it must forward the
+ * command rather than swallow it. (The SDK bin already forwards `ota …` the
+ * other way — this closes the loop so both binaries expose the same surface.)
+ */
+const SDK_BIN_COMMANDS = new Set(['init']);
+/**
+ * Handle argv that matched no registered command.
+ *
+ * This used to fall through to the root action, print the splash, and EXIT 0 —
+ * so `scalebun init android` (listed on our own splash) and any typo reported
+ * success while doing nothing. In CI that green exit is actively dangerous:
+ * a misspelled publish step passes the pipeline having published nothing.
+ */
+function handleUnmatchedCommand(argv) {
+    const cmd = argv[0];
+    if (SDK_BIN_COMMANDS.has(cmd)) {
+        const sdkBin = (0, sdkBin_1.resolveSdkBin)();
+        if (sdkBin) {
+            process.exit((0, sdkBin_1.runSdkBin)(sdkBin, argv));
+        }
+        console.error(`"scalebun ${cmd}" wires the native app and is provided by @scalebun/react-native.`);
+        console.error('It could not be resolved from here. Run this from your app root (the');
+        console.error('folder with node_modules/@scalebun/react-native), or install the SDK:');
+        console.error('  npm install @scalebun/react-native');
+        process.exit(1);
+    }
+    console.error(`error: unknown command '${cmd}'`);
+    console.error("Run `scalebun --help` for the list of commands.");
+    process.exit(1);
+}
+program
+    .name('scalebun')
+    .description('Scalebun CLI — OTA bundle publishing and management')
+    .version(version)
+    // Registered so a strict parser doesn't reject them; the splash reads argv
+    // directly (shouldShowArt / renderStatus), so these just keep commander happy.
+    .option('--no-banner', 'Hide the splash art (status + commands still print)')
+    .option('--verbose', 'Show extra detail (e.g. the API target in the status box)')
+    // Machine mode. Also honoured from SCALEBUN_JSON=1 so a CI job can set it
+    // once for the whole pipeline instead of on every invocation. Declared here
+    // so `--help` documents it; each command reads it via utils/output.
+    .option('--json', 'Machine-readable output; implies --non-interactive')
+    .option('--non-interactive', 'Never prompt — fail with the flag to pass instead')
+    // The variadic catch-all is what routes unmatched tokens into an explicit
+    // handler instead of commander's permissive default (which treated them as
+    // excess arguments to the root action and exited 0).
+    .argument('[command...]')
+    // ROOT ONLY (subcommands keep strict parsing): forwarded commands carry
+    // their own flags — `init android --check` — and without this the root
+    // parser rejects `--check` before the forwarder ever sees it.
+    .allowUnknownOption()
+    .action(async (extra) => {
+    if (!extra || extra.length === 0) {
+        await runBareInvocation();
+        return;
+    }
+    handleUnmatchedCommand(extra);
+});
+// `registerLoginCommand` was imported and never called, so `scalebun login`
+// did not exist — every other command depends on the credentials it writes,
+// and the documented first step of the CLI was unreachable.
+(0, login_1.registerLoginCommand)(program);
+(0, quickstart_1.registerQuickstartCommand)(program);
+(0, quickstart_1.registerAppsCommand)(program);
+(0, doctor_1.registerDoctorCommand)(program);
+(0, link_1.registerLinkCommands)(program);
+(0, shell_1.registerShellCommand)(program);
+const ota = program.command('ota').description('OTA update management');
+(0, ota_publish_1.registerOtaPublishCommand)(ota);
+(0, ota_bundle_1.registerOtaBundleCommand)(ota);
+(0, ota_sign_1.registerOtaSignCommand)(ota);
+(0, push_apns_1.registerPushCommand)(program);
+(0, ota_channels_1.registerOtaChannelsCommand)(ota);
+(0, ota_delete_bundle_1.registerOtaDeleteBundleCommand)(ota);
+(0, ota_keys_1.registerOtaKeysCommand)(ota);
+(0, ota_rollout_1.registerOtaRolloutCommands)(ota);
+(0, ota_inspect_1.registerOtaInspectCommands)(ota);
+(0, ota_promote_1.registerOtaPromoteCommand)(ota);
+(0, tls_pins_1.registerTlsCommands)(program);
+(0, launch_1.registerLaunchCommand)(program);
+/**
+ * `scalebun help [--all]` — the escape hatch from the staged splash.
+ *
+ * The splash shows only what is relevant to the current stage, which is right
+ * for a newcomer and wrong for anyone who already knows the tool. This always
+ * prints the full grouped surface, at any stage.
+ */
+program
+    .command('help')
+    .description('Show every command, grouped by task')
+    .option('--all', 'Print every command regardless of project stage')
+    .action(() => {
+    (0, guide_1.renderAllCommands)();
+});
+const migrate = program.command('migrate').description('Migration utilities from other platforms');
+(0, migrate_codepush_1.registerMigrateCodepushCommand)(migrate);
+(0, ci_init_1.registerCiInitCommand)(program);
+applyGlobalFlags(process.argv);
+if (process.argv.length <= 2) {
+    void runBareInvocation();
+}
+else {
+    program.parse(process.argv);
+}
+//# sourceMappingURL=index.js.map

package/lib/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;AAAA,yCAAoC;AACpC,4CAAwD;AACxD,8CAA0D;AAC1D,wDAAmE;AACnE,sDAAiE;AACjE,kDAA6D;AAC7D,oDAA2D;AAC3D,0DAAqE;AACrE,oEAA8E;AAC9E,kDAA6D;AAC7D,wDAAoE;AACpE,8CAA0D;AAC1D,kEAA6E;AAC7E,gDAA2D;AAC3D,sDAAuF;AACvF,kDAA0B;AAC1B,mCAA0C;AAC1C,wCAA8D;AAC9D,4CAAqD;AACrD,6EAA6E;AAC7E,2CAA0D;AAC1D,0CAAuD;AACvD,4CAA2E;AAC3E,wDAAoE;AACpE,wDAAmE;AACnE,kDAA0D;AAC1D,6CAA6C;AAC7C,yCAAkF;AAClF,2CAAqD;AAErD,MAAM,OAAO,GAAG,IAAI,mBAAO,EAAE,CAAC;AAE9B,4EAA4E;AAC5E,MAAM,OAAO,GAAG,iDAAiD,CAAC;AAElE,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,mCAAmC;AACnC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAC;AAEtE;;;;;;;GAOG;AACH,KAAK,UAAU,WAAW;IACxB,IAAI,IAAA,sBAAa,GAAE,EAAE,CAAC;QACpB,6EAA6E;QAC7E,4EAA4E;QAC5E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,IAAA,uBAAY,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,iBAAM,EAAC,IAAI,EAAE,CAAC,GAAG,iBAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,eAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAA,eAAM,EAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,IAAA,iBAAY,GAAE,CAAC;IACf,0EAA0E;IAC1E,0EAA0E;IAC1E,8BAA8B;IAC9B,MAAM,GAAG,GAAG,IAAA,oBAAU,GAAE,CAAC;IACzB,IAAA,yBAAiB,EAAC,GAAG,CAAC,CAAC;IACvB,IAAA,mBAAW,EAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACvB,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,IAAA,eAAM,GAAE;QAAE,OAAO,KAAK,CAAC;IAC3B,IAAI,IAAA,eAAO,GAAE;QAAE,OAAO,KAAK,CAAC;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;AACzD,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,gBAAgB,EAAE,EAAE,CAAC;QACvB,MAAM,IAAA,gBAAQ,EAAC,OAAO,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAc;IACtC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,IAAA,oBAAW,EAAC,IAAI,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AAE3C;;;;;;;GAOG;AACH,SAAS,sBAAsB,CAAC,IAAc;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IAErB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAA,sBAAa,GAAE,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,IAAA,kBAAS,EAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,aAAa,GAAG,mEAAmE,CAAC,CAAC;QACnG,OAAO,CAAC,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACtF,OAAO,CAAC,KAAK,CAAC,uEAAuE,CAAC,CAAC;QACvF,OAAO,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,GAAG,CAAC,CAAC;IACjD,OAAO,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO;KACJ,IAAI,CAAC,UAAU,CAAC;KAChB,WAAW,CAAC,qDAAqD,CAAC;KAClE,OAAO,CAAC,OAAO,CAAC;IACjB,2EAA2E;IAC3E,+EAA+E;KAC9E,MAAM,CAAC,aAAa,EAAE,qDAAqD,CAAC;KAC5E,MAAM,CAAC,WAAW,EAAE,2DAA2D,CAAC;IACjF,0EAA0E;IAC1E,4EAA4E;IAC5E,oEAAoE;KACnE,MAAM,CAAC,QAAQ,EAAE,oDAAoD,CAAC;KACtE,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;IACjF,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;KACpD,QAAQ,CAAC,cAAc,CAAC;IACzB,wEAAwE;IACxE,uEAAuE;IACvE,8DAA8D;KAC7D,kBAAkB,EAAE;KACpB,MAAM,CAAC,KAAK,EAAE,KAAe,EAAE,EAAE;IAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,iBAAiB,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IACD,sBAAsB,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC,CAAC,CAAC;AAEL,4EAA4E;AAC5E,4EAA4E;AAC5E,4DAA4D;AAC5D,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,sCAAyB,EAAC,OAAO,CAAC,CAAC;AACnC,IAAA,gCAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAC/B,IAAA,2BAAoB,EAAC,OAAO,CAAC,CAAC;AAC9B,IAAA,4BAAoB,EAAC,OAAO,CAAC,CAAC;AAE9B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;AACxE,IAAA,uCAAyB,EAAC,GAAG,CAAC,CAAC;AAC/B,IAAA,qCAAwB,EAAC,GAAG,CAAC,CAAC;AAC9B,IAAA,iCAAsB,EAAC,GAAG,CAAC,CAAC;AAC5B,IAAA,+BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,yCAA0B,EAAC,GAAG,CAAC,CAAC;AAChC,IAAA,kDAA8B,EAAC,GAAG,CAAC,CAAC;AACpC,IAAA,iCAAsB,EAAC,GAAG,CAAC,CAAC;AAC5B,IAAA,wCAA0B,EAAC,GAAG,CAAC,CAAC;AAChC,IAAA,wCAA0B,EAAC,GAAG,CAAC,CAAC;AAChC,IAAA,uCAAyB,EAAC,GAAG,CAAC,CAAC;AAC/B,IAAA,8BAAmB,EAAC,OAAO,CAAC,CAAC;AAC7B,IAAA,8BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B;;;;;;GAMG;AACH,OAAO;KACJ,OAAO,CAAC,MAAM,CAAC;KACf,WAAW,CAAC,qCAAqC,CAAC;KAClD,MAAM,CAAC,OAAO,EAAE,iDAAiD,CAAC;KAClE,MAAM,CAAC,GAAG,EAAE;IACX,IAAA,yBAAiB,GAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEL,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,0CAA0C,CAAC,CAAC;AACnG,IAAA,iDAA8B,EAAC,OAAO,CAAC,CAAC;AACxC,IAAA,+BAAqB,EAAC,OAAO,CAAC,CAAC;AAE/B,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAE/B,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;IAC7B,KAAK,iBAAiB,EAAE,CAAC;AAC3B,CAAC;KAAM,CAAC;IACN,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC"}

package/lib/ui/banner.d.ts

@@ -0,0 +1,23 @@
+import { MARK } from './mark';
+export { MARK };
+export declare const WORDMARK: readonly string[];
+/** Real TTY width wins; COLUMNS only covers the non-TTY case (pipes, tests). */
+export declare function termWidth(): number;
+export interface BannerOptions {
+    version?: string;
+    tagline?: string;
+    /** include the rabbit (default true) */
+    mark?: boolean;
+    /** terminal width override */
+    width?: number;
+    /** colour level override (0 none · 1 basic · 2 256 · 3 truecolor) */
+    level?: number;
+}
+export declare function banner(o?: BannerOptions): string;
+/**
+ * Gates the ART ONLY (mark + wordmark). The splash body — status line and
+ * command table — is the output of the no-arg command, not banner decoration,
+ * so it must NOT be gated by this. Keep the two concerns separate.
+ */
+export declare function shouldShowArt(argv?: string[]): boolean;
+//# sourceMappingURL=banner.d.ts.map

package/lib/ui/banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../../src/ui/banner.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,IAAI,EAAU,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,IAAI,EAAE,CAAC;AAGhB,eAAO,MAAM,QAAQ,EAAE,SAAS,MAAM,EAOrC,CAAC;AA8DF,gFAAgF;AAChF,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAID,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,MAAM,CAAC,CAAC,GAAE,aAAkB,GAAG,MAAM,CAwDpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAK7E"}