@zincapp/znvault-cli 4.7.1 → 4.9.0

package/dist/commands/mysql/index.js

@@ -0,0 +1,207 @@
+// src/commands/mysql/index.ts
+import * as output from '../../lib/output.js';
+import { resolveTarget } from './resolve.js';
+import { runBrokered } from './broker.js';
+import { assertMysqlOnPath, runMysql } from './run.js';
+import { addAlias, listAliases, removeAlias } from './alias.js';
+/**
+ * Collect helper for Commander repeatable options (--file <path> ... --file <path>).
+ * Each invocation appends the new value to the accumulator array.
+ */
+function collect(value, previous) {
+    return [...previous, value];
+}
+/**
+ * Parse and validate the `--ttl <seconds>` option (M-2).
+ *
+ * `parseInt('abc', 10)` is `NaN`, and `NaN ?? 600` stays `NaN` — which would be
+ * sent to the server as the requested TTL and produce a confusing bad request.
+ * Validate locally and fail fast with a clear message BEFORE any lease is
+ * generated.
+ *
+ * @param raw The raw `--ttl` option value, or undefined when not provided.
+ * @returns The parsed positive integer, or undefined when `--ttl` is absent
+ *          (so the server/role default applies).
+ * @throws If `--ttl` is provided but is not a positive integer.
+ */
+export function parseTtlSeconds(raw) {
+    if (raw === undefined)
+        return undefined;
+    const ttl = Number(raw);
+    if (!Number.isInteger(ttl) || ttl <= 0) {
+        throw new Error(`Invalid --ttl '${raw}': must be a positive integer number of seconds.`);
+    }
+    return ttl;
+}
+/**
+ * Register the `mysql` command group and all subcommands on `program`.
+ */
+export function registerMysqlCommands(program) {
+    const mysql = program
+        .command('mysql')
+        // enablePositionalOptions() lets the variadic [mysqlArgs...] coexist cleanly
+        // with named options — keeps '--' separator forwarding well-defined.
+        .enablePositionalOptions()
+        .description('Connect to MySQL databases via short-lived dynamic-secret credentials')
+        .addHelpText('after', `
+Examples:
+  # Interactive shell (connect mode)
+  znvault mysql connect my-connection
+
+  # Execute SQL from a file
+  znvault mysql exec my-connection --file schema.sql
+
+  # Execute inline SQL
+  znvault mysql exec my-connection --sql "SELECT 1"
+
+  # Pipe SQL from stdin
+  echo "SELECT version()" | znvault mysql exec my-connection
+
+  # Use an alias (see: znvault mysql alias add)
+  znvault mysql connect staging-rw
+
+  # Save an alias for quick access
+  znvault mysql alias add staging-rw --connection staging-mysql --role app-rw
+
+  # Pass extra mysql flags after --
+  znvault mysql connect my-connection -- --table
+`);
+    // ── exec ─────────────────────────────────────────────────────────────────────
+    //
+    // Using `exec <target> [mysqlArgs...]` (variadic) instead of passThroughOptions()
+    // so that named options (--role, --sql, etc.) can appear AFTER the positional
+    // <target> argument without being misread as excess positional args.
+    //
+    // With passThroughOptions(), Commander stops option-parsing at the first
+    // non-option token (the target), so `exec staging-mysql --role app-rw` was
+    // rejected as "too many arguments" — the target consumed the stop-point and
+    // --role/--sql were treated as excess positional args.
+    //
+    // The variadic approach: Commander continues parsing named options across the
+    // whole argv, and any unrecognised tokens (or tokens after `--`) land in the
+    // mysqlArgs array instead of causing an error.  The `--` separator itself is
+    // NOT included in mysqlArgs — Commander strips it automatically.
+    mysql
+        .command('exec <target> [mysqlArgs...]')
+        .description('Execute SQL against a MySQL database via a short-lived credential')
+        .option('--role <name>', 'Dynamic-secrets role name or ID')
+        .option('--file <path>', 'SQL file to execute (repeatable; concatenated in order)', collect, [])
+        .option('--sql <sql>', 'Inline SQL to execute')
+        .option('--ttl <seconds>', `Requested lease TTL in seconds (default: 600; capped by role maxTtl)`)
+        .option('--database <db>', 'Database/schema to select (overrides the credential default)')
+        .action(async (target, mysqlArgs, opts) => {
+        // mysqlArgs contains any extra tokens (e.g. post-`--` flags like --batch).
+        // Commander excludes the `--` separator itself from this array.
+        const passthrough = mysqlArgs;
+        try {
+            // Fail fast: check mysql binary before generating any lease.
+            assertMysqlOnPath();
+            // Validate --ttl locally before generating any lease (M-2).
+            const ttlSeconds = parseTtlSeconds(opts.ttl);
+            const { roleId } = await resolveTarget(target, opts.role);
+            const code = await runBrokered({
+                roleId,
+                ttlSeconds,
+                run: ({ credential, fd, fdPath }) => runMysql({
+                    fd,
+                    fdPath,
+                    database: opts.database ?? credential.database,
+                    mode: 'exec',
+                    files: opts.file,
+                    sql: opts.sql,
+                    passthrough,
+                }),
+            });
+            process.exit(code);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── connect ───────────────────────────────────────────────────────────────────
+    // Same variadic idiom as exec — see exec comment above.
+    mysql
+        .command('connect <target> [mysqlArgs...]')
+        .description('Open an interactive MySQL shell via a short-lived credential')
+        .option('--role <name>', 'Dynamic-secrets role name or ID')
+        .option('--ttl <seconds>', `Requested lease TTL in seconds (default: 600; capped by role maxTtl)`)
+        .option('--database <db>', 'Database/schema to select (overrides the credential default)')
+        .action(async (target, mysqlArgs, opts) => {
+        const passthrough = mysqlArgs;
+        try {
+            // Fail fast: check mysql binary before generating any lease.
+            assertMysqlOnPath();
+            // Validate --ttl locally before generating any lease (M-2).
+            const ttlSeconds = parseTtlSeconds(opts.ttl);
+            const { roleId } = await resolveTarget(target, opts.role);
+            const code = await runBrokered({
+                roleId,
+                ttlSeconds,
+                run: ({ credential, fd, fdPath }) => runMysql({
+                    fd,
+                    fdPath,
+                    database: opts.database ?? credential.database,
+                    mode: 'connect',
+                    passthrough,
+                }),
+            });
+            process.exit(code);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // ── alias ─────────────────────────────────────────────────────────────────────
+    const alias = mysql
+        .command('alias')
+        .description('Manage MySQL connection aliases for quick access');
+    alias
+        .command('add <name>')
+        .description('Add or overwrite a MySQL connection alias')
+        .requiredOption('--connection <connection>', 'Connection name or ID to bind')
+        .requiredOption('--role <role>', 'Role name or ID to bind')
+        .action((name, opts) => {
+        try {
+            addAlias(name, opts.connection, opts.role);
+            output.success(`Alias '${name}' saved → ${opts.connection} / ${opts.role}`);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    alias
+        .command('list')
+        .alias('ls')
+        .description('List all MySQL aliases in the active profile')
+        .action(() => {
+        try {
+            const aliases = listAliases();
+            if (aliases.length === 0) {
+                output.info('No aliases defined. Use: znvault mysql alias add <name> --connection <c> --role <r>');
+                return;
+            }
+            output.table(['Name', 'Connection', 'Role'], aliases.map(({ name, connection, role }) => [name, connection, role]));
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    alias
+        .command('rm <name>')
+        .description('Remove a MySQL alias from the active profile')
+        .action((name) => {
+        try {
+            removeAlias(name);
+            output.success(`Alias '${name}' removed`);
+        }
+        catch (err) {
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/mysql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/mysql/index.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAiB9B,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGhE;;;GAGG;AACH,SAAS,OAAO,CAAC,KAAa,EAAE,QAAkB;IAChD,OAAO,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAuB;IACrD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,kBAAkB,GAAG,kDAAkD,CACxE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,OAAO,CAAC;QACjB,6EAA6E;QAC7E,qEAAqE;SACpE,uBAAuB,EAAE;SACzB,WAAW,CAAC,uEAAuE,CAAC;SACpF,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBzB,CAAC,CAAC;IAED,gFAAgF;IAChF,EAAE;IACF,kFAAkF;IAClF,8EAA8E;IAC9E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,EAAE;IACF,8EAA8E;IAC9E,6EAA6E;IAC7E,6EAA6E;IAC7E,iEAAiE;IACjE,KAAK;SACF,OAAO,CAAC,8BAA8B,CAAC;SACvC,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC1D,MAAM,CAAC,eAAe,EAAE,yDAAyD,EAAE,OAAO,EAAE,EAAE,CAAC;SAC/F,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC;SAC9C,MAAM,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;SACjG,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,SAAmB,EAAE,IAAyB,EAAE,EAAE;QAC/E,2EAA2E;QAC3E,gEAAgE;QAChE,MAAM,WAAW,GAAa,SAAS,CAAC;QAExC,IAAI,CAAC;YACH,6DAA6D;YAC7D,iBAAiB,EAAE,CAAC;YAEpB,4DAA4D;YAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC7B,MAAM;gBACN,UAAU;gBACV,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,QAAQ,CAAC;oBACP,EAAE;oBACF,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;oBAC9C,IAAI,EAAE,MAAM;oBACZ,KAAK,EAAE,IAAI,CAAC,IAAI;oBAChB,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,WAAW;iBACZ,CAAC;aACL,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iFAAiF;IACjF,wDAAwD;IACxD,KAAK;SACF,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,eAAe,EAAE,iCAAiC,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,sEAAsE,CAAC;SACjG,MAAM,CAAC,iBAAiB,EAAE,8DAA8D,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,SAAmB,EAAE,IAAsB,EAAE,EAAE;QAC5E,MAAM,WAAW,GAAa,SAAS,CAAC;QAExC,IAAI,CAAC;YACH,6DAA6D;YAC7D,iBAAiB,EAAE,CAAC;YAEpB,4DAA4D;YAC5D,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE7C,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC;gBAC7B,MAAM;gBACN,UAAU;gBACV,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,QAAQ,CAAC;oBACP,EAAE;oBACF,MAAM;oBACN,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ;oBAC9C,IAAI,EAAE,SAAS;oBACf,WAAW;iBACZ,CAAC;aACL,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iFAAiF;IACjF,MAAM,KAAK,GAAG,KAAK;SAChB,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEnE,KAAK;SACF,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,2CAA2C,CAAC;SACxD,cAAc,CAAC,2BAA2B,EAAE,+BAA+B,CAAC;SAC5E,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,CAAC,IAAY,EAAE,IAA0C,EAAE,EAAE;QACnE,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3C,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,aAAa,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,GAAG,EAAE;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;gBACnG,OAAO;YACT,CAAC;YACD,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,EAC9B,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,CACtE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,WAAW,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,WAAW,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/mysql/mycnf.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The result of createMyCnf.
+ *
+ * - `fd`:     the open file descriptor backing the (now unlinked) my.cnf. The
+ *             child mysql inherits this fd at the SAME number and re-opens it
+ *             via `fdPath`.
+ * - `fdPath`: `/dev/fd/<fd>` — pass this verbatim as the value of
+ *             `--defaults-extra-file`. Works on macOS (/dev/fd) and Linux
+ *             (/dev/fd → /proc/self/fd).
+ * - `cleanup`: idempotent, best-effort. Closes `fd` (releasing the inode so its
+ *             bytes are reclaimed) and rmdir's the now-empty mem-fs dir.
+ */
+export interface MyCnfHandle {
+    /** Open fd backing the unlinked cnf inode. Child inherits it at this number. */
+    fd: number;
+    /** `/dev/fd/<fd>` — the value to pass to --defaults-extra-file. */
+    fdPath: string;
+    /** Idempotent best-effort teardown: closeSync(fd) + rmdir(dir). */
+    cleanup: () => void;
+}
+/**
+ * Create the temp my.cnf, unlink its directory entry immediately, and return an
+ * open fd plus an idempotent cleanup().
+ *
+ * The body is fully synchronous (all fs operations are *Sync), but the function
+ * returns a Promise to preserve the broker's `await createMyCnf(...)` contract
+ * (and so it can become genuinely async later without touching callers).
+ * Declared non-`async` + returning Promise.resolve avoids the require-await
+ * lint warning while keeping the Promise return type (M-5).
+ *
+ * @throws If the exclusive create fails (e.g. EEXIST on a suffix collision,
+ *         which is astronomically unlikely with 8 random bytes, or ENOSPC).
+ */
+export declare function createMyCnf(opts: {
+    user: string;
+    password: string;
+    host: string;
+    port: number;
+}): Promise<MyCnfHandle>;
+//# sourceMappingURL=mycnf.d.ts.map

package/dist/commands/mysql/mycnf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mycnf.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/mycnf.ts"],"names":[],"mappings":"AA2CA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,mEAAmE;IACnE,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;CAC5D,GAAG,OAAO,CAAC,WAAW,CAAC,CA8DvB"}

package/dist/commands/mysql/mycnf.js

@@ -0,0 +1,136 @@
+// src/commands/mysql/mycnf.ts
+//
+// Writes the short-lived 0600 my.cnf that carries the leased MySQL credentials
+// (spec B2) and hands it to the child mysql as an OPEN FILE DESCRIPTOR rather
+// than a path on disk.
+//
+// F1 (no plaintext directory entry survives the run) is achieved by the
+// open → write → unlink-immediately pattern:
+//   1. openSync(path, 'wx+', 0600)   → exclusive create, returns fd.
+//   2. writeSync(fd, body)           → credentials written through the fd.
+//   3. unlinkSync(path)              → directory entry removed AT ONCE. The
+//      inode (and its plaintext bytes) stays alive ONLY because the open fd
+//      still references it; there is NO name in the filesystem from this point
+//      on, so a `kill -9` or crash leaves nothing on disk to recover.
+//   4. runMysql passes `/dev/fd/<fd>` as --defaults-extra-file and inherits the
+//      fd into the child at the SAME number, so mysql re-opens the still-alive
+//      inode through /dev/fd. (On macOS /dev/fd/N re-opens the inode — which is
+//      why the fd MUST be readable; see the 'wx+' note below. On Linux /dev/fd
+//      is /proc/self/fd and resolves the same inode.)
+//   5. cleanup() closes the fd → last reference gone → kernel reclaims the
+//      inode + its bytes. cleanup() is idempotent and best-effort.
+//
+// This replaces the old "spawn-then-unlink" approach, which raced: spawn()
+// returns when the child is forked but BEFORE it has exec'd mysql and read the
+// defaults file, so the unlink could win the race and mysql would die with
+// "Failed to open required defaults file". Keeping the inode alive via an open
+// fd removes the race entirely — the name is already gone before spawn, and the
+// fd guarantees the bytes survive until cleanup().
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { randomBytes } from 'node:crypto';
+function memBackedTmpBase() {
+    // Prefer a memory-backed fs so the plaintext never hits spinning disk (spec F1).
+    try {
+        fs.accessSync('/dev/shm', fs.constants.W_OK);
+        return '/dev/shm';
+    }
+    catch {
+        return os.tmpdir();
+    }
+}
+/**
+ * Create the temp my.cnf, unlink its directory entry immediately, and return an
+ * open fd plus an idempotent cleanup().
+ *
+ * The body is fully synchronous (all fs operations are *Sync), but the function
+ * returns a Promise to preserve the broker's `await createMyCnf(...)` contract
+ * (and so it can become genuinely async later without touching callers).
+ * Declared non-`async` + returning Promise.resolve avoids the require-await
+ * lint warning while keeping the Promise return type (M-5).
+ *
+ * @throws If the exclusive create fails (e.g. EEXIST on a suffix collision,
+ *         which is astronomically unlikely with 8 random bytes, or ENOSPC).
+ */
+export function createMyCnf(opts) {
+    const suffix = randomBytes(8).toString('hex');
+    const dir = path.join(memBackedTmpBase(), `znvault-my-${suffix}`);
+    // 0700 dir on a memory-backed fs (spec F1). Created before the file so the
+    // file's parent is owner-only even for the brief moment the name exists.
+    fs.mkdirSync(dir, { mode: 0o700 });
+    const file = path.join(dir, 'my.cnf');
+    const body = `[client]\nuser=${opts.user}\npassword=${opts.password}\nhost=${opts.host}\nport=${opts.port}\n`;
+    // 'wx+' = O_RDWR | O_CREAT | O_EXCL, mode 0600.
+    //   - O_EXCL  : fail if the file somehow already exists (no clobber / no
+    //               following an attacker-planted symlink).
+    //   - O_RDWR  : the fd MUST be READABLE. On macOS, `/dev/fd/N` RE-OPENS the
+    //               underlying inode (it is not a plain dup of the open file
+    //               description), so a write-only ('wx') fd would make mysql fail
+    //               with EBADF/permission when it tries to read /dev/fd/N. O_RDWR
+    //               keeps the inode re-openable for read by the child. Verified
+    //               against real mysql 9.4 on macOS.
+    let fd;
+    try {
+        fd = fs.openSync(file, 'wx+', 0o600);
+    }
+    catch (err) {
+        // mkdir succeeded but open failed — drop the empty dir so we don't leak it.
+        try {
+            fs.rmdirSync(dir);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    let closed = false;
+    try {
+        // CRITICAL: write at an EXPLICIT position 0 (the 5-arg overload) so the fd's
+        // current file OFFSET stays at 0. On macOS, `/dev/fd/N` does NOT give the
+        // child a fresh offset-0 description — it shares the original fd's offset.
+        // A plain `writeSync(fd, body)` advances the offset to EOF, so mysql reading
+        // /dev/fd/N would start at EOF and parse an EMPTY defaults file (verified:
+        // `mysql --print-defaults` shows zero args). Positioned writes do not move
+        // the file pointer, so the offset remains 0 and mysql reads the whole body.
+        const bodyBuf = Buffer.from(body, 'utf8');
+        fs.writeSync(fd, bodyBuf, 0, bodyBuf.length, 0);
+        // F1: remove the directory entry IMMEDIATELY. The inode stays alive purely
+        // because `fd` is still open; there is no name on disk from here on.
+        fs.unlinkSync(file);
+    }
+    catch (err) {
+        // Writing or unlinking failed — don't leak the fd or the dir.
+        try {
+            fs.closeSync(fd);
+            closed = true;
+        }
+        catch { /* ignore */ }
+        try {
+            fs.unlinkSync(file);
+        }
+        catch { /* ignore */ }
+        try {
+            fs.rmdirSync(dir);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    const cleanup = () => {
+        // Closing the last fd referencing the (already unlinked) inode releases it,
+        // so the kernel reclaims the plaintext bytes. Idempotent via `closed`.
+        if (!closed) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch { /* ignore */ }
+            closed = true;
+        }
+        // The file name is already gone; the dir should be empty. rmdir is
+        // best-effort (it may already be gone if cleanup ran twice).
+        try {
+            fs.rmdirSync(dir);
+        }
+        catch { /* ignore */ }
+    };
+    return Promise.resolve({ fd, fdPath: `/dev/fd/${fd.toString()}`, cleanup });
+}
+//# sourceMappingURL=mycnf.js.map

package/dist/commands/mysql/mycnf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mycnf.js","sourceRoot":"","sources":["../../../src/commands/mysql/mycnf.ts"],"names":[],"mappings":"AAAA,8BAA8B;AAC9B,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,uBAAuB;AACvB,EAAE;AACF,wEAAwE;AACxE,6CAA6C;AAC7C,qEAAqE;AACrE,2EAA2E;AAC3E,4EAA4E;AAC5E,4EAA4E;AAC5E,+EAA+E;AAC/E,sEAAsE;AACtE,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,sDAAsD;AACtD,2EAA2E;AAC3E,mEAAmE;AACnE,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,2EAA2E;AAC3E,+EAA+E;AAC/E,gFAAgF;AAChF,mDAAmD;AACnD,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,SAAS,gBAAgB;IACvB,iFAAiF;IACjF,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,UAAU,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAuBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAE3B;IACC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,cAAc,MAAM,EAAE,CAAC,CAAC;IAClE,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,kBAAkB,IAAI,CAAC,IAAI,cAAc,IAAI,CAAC,QAAQ,UAAU,IAAI,CAAC,IAAI,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC;IAE9G,gDAAgD;IAChD,yEAAyE;IACzE,wDAAwD;IACxD,4EAA4E;IAC5E,yEAAyE;IACzE,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,iDAAiD;IACjD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4EAA4E;QAC5E,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,CAAC;QACH,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,2EAA2E;QAC3E,2EAA2E;QAC3E,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAChD,2EAA2E;QAC3E,qEAAqE;QACrE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,8DAA8D;QAC9D,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,MAAM,GAAG,IAAI,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QAC/D,IAAI,CAAC;YAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACnD,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,GAAS,EAAE;QACzB,4EAA4E;QAC5E,uEAAuE;QACvE,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QACD,mEAAmE;QACnE,6DAA6D;QAC7D,IAAI,CAAC;YAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IACnD,CAAC,CAAC;IAEF,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/commands/mysql/resolve.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Resolve `target` (a connection name/id OR an alias) plus an optional role
+ * name/id into concrete IDs.
+ *
+ * Resolution rules:
+ *   1. If `target` matches a saved alias, expand to { connection, role }.
+ *      Validate both still exist; if not, throw a "dangling alias" error (F13).
+ *   2. Otherwise treat `target` as a connection name/id and fetch it.
+ *   3. Resolve the role:
+ *      - If a role name/id is given, find it in the connection's role list.
+ *      - If no role given and the connection has exactly one role, use it.
+ *      - Otherwise throw an error instructing the user to pass --role.
+ */
+export declare function resolveTarget(target: string, roleOpt?: string): Promise<{
+    connectionId: string;
+    roleId: string;
+}>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/commands/mysql/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/resolve.ts"],"names":[],"mappings":"AA8DA;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+DnD"}

package/dist/commands/mysql/resolve.js

@@ -0,0 +1,108 @@
+// src/commands/mysql/resolve.ts
+/**
+ * Resolve a target (connection name/id or alias) + optional role to concrete IDs.
+ *
+ * This is used by `znvault mysql exec/connect` to turn the user-supplied target
+ * and --role option into the { connectionId, roleId } pair needed by the broker.
+ */
+import { client } from '../../lib/client.js';
+import { getAlias } from './alias.js';
+/**
+ * Resolve a connection name or id to a concrete connection id.
+ *
+ * Strategy (avoids a guaranteed 404 round-trip on the common name case):
+ *   - If `target` looks like a connection id (starts with "dbc_"), try GET by id
+ *     first; if that 404s, fall back to listing and matching by name.
+ *   - Otherwise (target is a friendly name), list all connections and match by
+ *     name first; if not found, try GET by id as a last resort.
+ *   - If neither resolves, throw a clear "not found (by id or name)" error.
+ *
+ * Connection names are unique per tenant, so a name match is unambiguous.
+ * If somehow multiple entries share a name, the first match is used.
+ */
+async function resolveConnectionId(target) {
+    const looksLikeId = target.startsWith('dbc_');
+    if (looksLikeId) {
+        // Try direct GET by id first.
+        try {
+            const conn = await client.get(`/v1/dynamic-secrets/connections/${target}`);
+            return conn.id;
+        }
+        catch {
+            // Fall through to list-by-name.
+        }
+    }
+    // List all connections and match by name.
+    const connections = await client.get('/v1/dynamic-secrets/connections');
+    const byName = connections.find((c) => c.name === target);
+    if (byName !== undefined) {
+        return byName.id;
+    }
+    if (!looksLikeId) {
+        // Not found by name; try GET by id as a last resort.
+        try {
+            const conn = await client.get(`/v1/dynamic-secrets/connections/${target}`);
+            return conn.id;
+        }
+        catch {
+            // Fall through to error.
+        }
+    }
+    throw new Error(`Connection '${target}' not found (by id or name). ` +
+        `Run 'znvault dynamic-secrets connections list' to see available connections.`);
+}
+/**
+ * Resolve `target` (a connection name/id OR an alias) plus an optional role
+ * name/id into concrete IDs.
+ *
+ * Resolution rules:
+ *   1. If `target` matches a saved alias, expand to { connection, role }.
+ *      Validate both still exist; if not, throw a "dangling alias" error (F13).
+ *   2. Otherwise treat `target` as a connection name/id and fetch it.
+ *   3. Resolve the role:
+ *      - If a role name/id is given, find it in the connection's role list.
+ *      - If no role given and the connection has exactly one role, use it.
+ *      - Otherwise throw an error instructing the user to pass --role.
+ */
+export async function resolveTarget(target, roleOpt) {
+    const alias = getAlias(target);
+    if (alias !== undefined) {
+        // Alias path — validate that connection and role still exist.
+        const connectionTarget = alias.connection;
+        const roleTarget = alias.role;
+        let connectionId;
+        try {
+            connectionId = await resolveConnectionId(connectionTarget);
+        }
+        catch {
+            throw new Error(`Dangling alias '${target}': connection '${connectionTarget}' no longer exists`);
+        }
+        const roles = await client.get(`/v1/dynamic-secrets/connections/${connectionId}/roles`);
+        const role = roles.find((r) => r.name === roleTarget || r.id === roleTarget);
+        if (role === undefined) {
+            throw new Error(`Dangling alias '${target}': role '${roleTarget}' no longer exists on connection '${connectionTarget}'`);
+        }
+        return { connectionId, roleId: role.id };
+    }
+    // Direct connection path.
+    const connectionId = await resolveConnectionId(target);
+    const roles = await client.get(`/v1/dynamic-secrets/connections/${connectionId}/roles`);
+    if (roleOpt !== undefined) {
+        const role = roles.find((r) => r.name === roleOpt || r.id === roleOpt);
+        if (role === undefined) {
+            throw new Error(`Role '${roleOpt}' not found on connection '${target}'. ` +
+                `Available: ${roles.map((r) => r.name).join(', ') || '(none)'}`);
+        }
+        return { connectionId, roleId: role.id };
+    }
+    // No role given — require exactly one.
+    if (roles.length === 1) {
+        return { connectionId, roleId: roles[0].id };
+    }
+    if (roles.length === 0) {
+        throw new Error(`Connection '${target}' has no roles. Create one first, then pass --role <name>.`);
+    }
+    throw new Error(`Connection '${target}' has ${roles.length.toString()} roles. ` +
+        `Pass --role <name> to select one: ${roles.map((r) => r.name).join(', ')}`);
+}
+//# sourceMappingURL=resolve.js.map

package/dist/commands/mysql/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../../src/commands/mysql/resolve.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,mBAAmB,CAAC,MAAc;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAE9C,IAAI,WAAW,EAAE,CAAC;QAChB,8BAA8B;QAC9B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,mCAAmC,MAAM,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiB,iCAAiC,CAAC,CAAC;IACxF,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,qDAAqD;QACrD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAe,mCAAmC,MAAM,EAAE,CAAC,CAAC;YACzF,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,yBAAyB;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,+BAA+B;QAClD,8EAA8E,CACjF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAc,EACd,OAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,8DAA8D;QAC9D,MAAM,gBAAgB,GAAG,KAAK,CAAC,UAAU,CAAC;QAC1C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC;QAE9B,IAAI,YAAoB,CAAC;QACzB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,mBAAmB,CAAC,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,kBAAkB,gBAAgB,oBAAoB,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,mCAAmC,YAAY,QAAQ,CACxD,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QAC7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,YAAY,UAAU,qCAAqC,gBAAgB,GAAG,CACxG,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,0BAA0B;IAC1B,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAEvD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAC5B,mCAAmC,YAAY,QAAQ,CACxD,CAAC;IAEF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;QACvE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,SAAS,OAAO,8BAA8B,MAAM,KAAK;gBACvD,cAAc,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,QAAQ,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;IAC3C,CAAC;IAED,uCAAuC;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/C,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,4DAA4D,CAClF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,KAAK,CACb,eAAe,MAAM,SAAS,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU;QAC7D,qCAAqC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7E,CAAC;AACJ,CAAC"}