@clossys/launcher 0.3.1 → 0.5.0

package/dist/approval-sheet.d.ts

@@ -0,0 +1,21 @@
+import type { ApplyBundle, RepositoryChangeSet } from "./change-set-contract.js";
+/** Why a sheet was not rendered. The token is the whole message. */
+export type ApprovalSheetRefusal = "bundle-invalid" | "change-set-invalid" | "set-mismatch" | "value-unsafe";
+export declare class ApprovalSheetError extends Error {
+    readonly token: ApprovalSheetRefusal;
+    constructor(token: ApprovalSheetRefusal);
+}
+export interface ApprovalSheetInput {
+    readonly bundle: ApplyBundle;
+    /** The change set of every bundle repository that has one, in any order. */
+    readonly changeSets: readonly RepositoryChangeSet[];
+}
+/**
+ * Renders the approval sheet of `bundle`, LF-terminated. Throws an
+ * ApprovalSheetError, a fixed token that names no value, when the bundle or a
+ * set does not validate (the validators recompute each digest, so one that
+ * does not recompute is refused there), the sets are not exactly
+ * the bundle's, or any printed value fails its pattern.
+ */
+export declare function renderApprovalSheet(input: ApprovalSheetInput): string;
+//# sourceMappingURL=approval-sheet.d.ts.map

package/dist/approval-sheet.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-sheet.d.ts","sourceRoot":"","sources":["../src/approval-sheet.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAwC,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEvH,oEAAoE;AACpE,MAAM,MAAM,oBAAoB,GAAG,gBAAgB,GAAG,oBAAoB,GAAG,cAAc,GAAG,cAAc,CAAC;AAE7G,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,KAAK,EAAE,oBAAoB;gBAA3B,KAAK,EAAE,oBAAoB;CAIjD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,4EAA4E;IAC5E,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,EAAE,CAAC;CACrD;AAuED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAwDrE"}

package/dist/approval-sheet.js

@@ -0,0 +1,163 @@
+// The approval sheet (issue #1178, RFC section 12.7): what a client reads
+// before approving an apply bundle, rendered from ids and digests only. It is
+// a pure function of a bundle and the change sets the bundle names -- it reads
+// no file, runs no process and reads no clock -- so the same inputs always
+// give the same bytes.
+//
+// The sheet never carries brief or plan prose, the `texts` a set stores, a
+// package.json key's value, or any file's contents (V5). Every value it does
+// print is checked against a strict pattern first, and a value that fails one,
+// or holds one of the characters that could make a row read as something
+// else, refuses the whole sheet. A refusal is a fixed token and echoes
+// nothing: a bundle can come from a plan a hostile author wrote, and the
+// sheet is read by people and agents.
+//
+// The sheet asks for one approval: the line `Approve subjectDigest: <bundle
+// digest>`. It computes and records no approval; that is the plan's decision,
+// made in the hub.
+import { validateApplyBundle, validateRepositoryChangeSet } from "./change-set-contract.js";
+export class ApprovalSheetError extends Error {
+    token;
+    constructor(token) {
+        super(token);
+        this.token = token;
+        this.name = "ApprovalSheetError";
+    }
+}
+const REPOSITORY = /^[A-Za-z0-9._-]{1,100}(?:\/[A-Za-z0-9._-]{1,100})?$/u;
+const TOKEN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/u;
+const CHECK = /^V[1-9]$/u;
+const DIGEST = /^sha256:[0-9a-f]{64}$/u;
+const ITEM = /^[A-Za-z0-9._@/:~+-]{1,300}$/u;
+const PATH = /^[A-Za-z0-9._@/~+-]{1,300}$/u;
+const PACKAGE_NAME = /^(?:@[a-z0-9._~-]{1,100}\/)?[a-z0-9._~-]{1,100}$/u;
+const VERSION = /^[0-9A-Za-z.+-]{1,100}$/u;
+const DATE_TIME = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/u;
+const FORBIDDEN = /[<>`|\r\n]/u;
+function safe(value, pattern) {
+    if (typeof value !== "string" || FORBIDDEN.test(value) || !pattern.test(value))
+        throw new ApprovalSheetError("value-unsafe");
+    return value;
+}
+/** The first 12 hex digits of a digest, as RFC 12.7 names the Digest column. */
+function short(digest) {
+    return safe(digest, DIGEST).slice("sha256:".length, "sha256:".length + 12);
+}
+function isPackageAct(item) {
+    return item.act === "install" || item.act === "pin-starter";
+}
+function change(set, item) {
+    if (isPackageAct(item))
+        return `${safe(item.package.name, PACKAGE_NAME)}@${safe(item.package.version, VERSION)}`;
+    const count = set.files.filter((file) => file.item === item.id).length;
+    return `${count} ${count === 1 ? "path" : "paths"}`;
+}
+function yesNo(value) {
+    if (value === true)
+        return "yes";
+    if (value === false)
+        return "no";
+    throw new ApprovalSheetError("value-unsafe");
+}
+function row(cells) {
+    return `| ${cells.join(" | ")} |`;
+}
+function checkedBundle(input) {
+    const { bundle, changeSets } = input;
+    if (!validateApplyBundle(bundle).valid)
+        throw new ApprovalSheetError("bundle-invalid");
+    const sets = new Map();
+    for (const set of changeSets) {
+        if (!validateRepositoryChangeSet(set).valid)
+            throw new ApprovalSheetError("change-set-invalid");
+        if (set.bundle !== bundle.bundleDigest || set.planDigest !== bundle.plan.digest)
+            throw new ApprovalSheetError("set-mismatch");
+        if (sets.has(set.changeSetDigest))
+            throw new ApprovalSheetError("set-mismatch");
+        sets.set(set.changeSetDigest, set);
+    }
+    const held = bundle.repositories.flatMap((entry) => ("changeSet" in entry ? [{ id: entry.id, changeSetDigest: entry.changeSet }] : []));
+    // Exactly the sets the bundle names: none missing, none extra, each under its own repository.
+    if (held.length !== sets.size)
+        throw new ApprovalSheetError("set-mismatch");
+    for (const entry of held) {
+        const set = sets.get(entry.changeSetDigest);
+        if (set === undefined || set.repository.id !== entry.id)
+            throw new ApprovalSheetError("set-mismatch");
+    }
+    return { bundle, sets };
+}
+function repositoryRows(entry, sets) {
+    if (!("changeSet" in entry))
+        return [];
+    const set = sets.get(entry.changeSet);
+    const repository = safe(entry.id, REPOSITORY);
+    const digest = short(set.changeSetDigest);
+    return set.items.map((item) => row([repository, safe(item.act, TOKEN), safe(item.id, ITEM), change(set, item), digest]));
+}
+/**
+ * Renders the approval sheet of `bundle`, LF-terminated. Throws an
+ * ApprovalSheetError, a fixed token that names no value, when the bundle or a
+ * set does not validate (the validators recompute each digest, so one that
+ * does not recompute is refused there), the sets are not exactly
+ * the bundle's, or any printed value fails its pattern.
+ */
+export function renderApprovalSheet(input) {
+    const { bundle, sets } = checkedBundle(input);
+    const authorization = bundle.authorization === null
+        ? "none"
+        : `plan ${safe(bundle.authorization.planDigest, DIGEST)} expires ${safe(bundle.authorization.expiresAt, DATE_TIME)}`;
+    const lines = [
+        "Clossys apply plan: approval sheet",
+        `Mode: ${safe(bundle.mode, TOKEN)}`,
+        `Plan digest: ${safe(bundle.plan.digest, DIGEST)}`,
+        `Plan committed: ${yesNo(bundle.plan.committed)}`,
+        `Bundle digest: ${safe(bundle.bundleDigest, DIGEST)}`,
+        `Authorization: ${authorization}`,
+        `Approve subjectDigest: ${safe(bundle.bundleDigest, DIGEST)}`,
+        "",
+        row(["Repository", "Kind", "Item", "Change", "Digest"]),
+        row(["---", "---", "---", "---", "---"]),
+        ...bundle.repositories.flatMap((entry) => repositoryRows(entry, sets)),
+    ];
+    const deferred = [];
+    const adoptions = [];
+    const refused = [];
+    const skipped = [];
+    const unsatisfied = [];
+    for (const entry of bundle.repositories) {
+        const id = safe(entry.id, REPOSITORY);
+        if (!("changeSet" in entry)) {
+            skipped.push(`- ${id} ${safe(entry.verdict, TOKEN)} ${safe(entry.reason, TOKEN)}`);
+            continue;
+        }
+        const set = sets.get(entry.changeSet);
+        for (const proof of set.existingDeclarationAdoptions ?? []) {
+            // The schema already closes literal syntax; never print arbitrary caller prose.
+            adoptions.push(`- ${id} ${safe(proof.desired.planItem, ITEM)} ${safe(proof.placement, TOKEN)} ${safe(proof.beforeVersion, /^[~^]?[0-9A-Za-z.+-]{1,100}$/u)} (${safe(proof.beforeResolved.version, VERSION)}, ${safe(proof.beforeResolved.integrity, /^sha512-[A-Za-z0-9+/]{86}==$/u)}) -> ${safe(proof.desired.version, VERSION)} (${safe(proof.desired.integrity, /^sha512-[A-Za-z0-9+/]{86}==$/u)}); explicit adoption consent; observed base ${safe(proof.observedBaseCommit, /^[0-9a-f]{40}([0-9a-f]{24})?$/u)}; desired snapshot ${safe(proof.desiredSnapshotDigest, DIGEST)}`);
+        }
+        for (const item of set.deferred)
+            deferred.push(`- ${id} ${safe(item.planItem, ITEM)} ${safe(item.reason, TOKEN)}`);
+        for (const item of set.refused) {
+            const where = "path" in item ? safe(item.path, PATH) : `${safe(item.file, PATH)}#${safe(item.pointer, PATH)}`;
+            refused.push(`- ${id} ${where} ${safe(item.reason, TOKEN)}`);
+        }
+        for (const check of entry.checks) {
+            if (check.verdict === "satisfied")
+                continue;
+            unsatisfied.push(`- ${id} ${safe(check.check, CHECK)} ${safe(check.verdict, TOKEN)}${check.rule === undefined ? "" : ` ${safe(check.rule, TOKEN)}`}`);
+        }
+    }
+    for (const [title, entries] of [
+        ["Deferred", deferred],
+        ["Existing declaration adoption consent", adoptions],
+        ["Refused", refused],
+        ["Skipped", skipped],
+        ["Checks not satisfied", unsatisfied],
+    ]) {
+        if (entries.length > 0)
+            lines.push("", `${title}:`, ...entries);
+    }
+    return `${lines.join("\n")}\n`;
+}
+//# sourceMappingURL=approval-sheet.js.map

package/dist/approval-sheet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-sheet.js","sourceRoot":"","sources":["../src/approval-sheet.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,uBAAuB;AACvB,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,+EAA+E;AAC/E,yEAAyE;AACzE,uEAAuE;AACvE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,mBAAmB;AAEnB,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AAM5F,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAArB,YAAqB,KAA2B;QAC9C,KAAK,CAAC,KAAK,CAAC,CAAC;QADM,UAAK,GAAL,KAAK,CAAsB;QAE9C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAQD,MAAM,UAAU,GAAG,sDAAsD,CAAC;AAC1E,MAAM,KAAK,GAAG,6BAA6B,CAAC;AAC5C,MAAM,KAAK,GAAG,WAAW,CAAC;AAC1B,MAAM,MAAM,GAAG,wBAAwB,CAAC;AACxC,MAAM,IAAI,GAAG,+BAA+B,CAAC;AAC7C,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAC5C,MAAM,YAAY,GAAG,mDAAmD,CAAC;AACzE,MAAM,OAAO,GAAG,0BAA0B,CAAC;AAC3C,MAAM,SAAS,GAAG,4EAA4E,CAAC;AAC/F,MAAM,SAAS,GAAG,aAAa,CAAC;AAEhC,SAAS,IAAI,CAAC,KAAc,EAAE,OAAe;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC7H,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,SAAS,KAAK,CAAC,MAAc;IAC3B,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,IAAmB;IACvC,OAAO,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC;AAC9D,CAAC;AAED,SAAS,MAAM,CAAC,GAAwB,EAAE,IAAmB;IAC3D,IAAI,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACjH,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACvE,OAAO,GAAG,KAAK,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjC,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,GAAG,CAAC,KAAwB;IACnC,OAAO,KAAK,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;IACrC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,CAAC,gBAAgB,CAAC,CAAC;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,EAA+B,CAAC;IACpD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC,KAAK;YAAE,MAAM,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;QAChG,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,YAAY,IAAI,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAC9H,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxI,8FAA8F;IAC9F,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAC5E,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC5C,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,cAAc,CAAC,KAA4B,EAAE,IAA8C;IAClG,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3H,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,aAAa,GACjB,MAAM,CAAC,aAAa,KAAK,IAAI;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;IACzH,MAAM,KAAK,GAAa;QACtB,oCAAoC;QACpC,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;QACnC,gBAAgB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;QAClD,mBAAmB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;QACjD,kBAAkB,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE;QACrD,kBAAkB,aAAa,EAAE;QACjC,0BAA0B,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE;QAC7D,EAAE;QACF,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACxC,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;KACvE,CAAC;IAEF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;YACnF,SAAS;QACX,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,4BAA4B,IAAI,EAAE,EAAE,CAAC;YAC3D,gFAAgF;YAChF,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,EAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,aAAa,EAAC,+BAA+B,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EAAC,+BAA+B,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,EAAC,+BAA+B,CAAC,+CAA+C,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAC,gCAAgC,CAAC,sBAAsB,IAAI,CAAC,KAAK,CAAC,qBAAqB,EAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC/iB,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACnH,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW;gBAAE,SAAS;YAC5C,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACxJ,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI;QAC7B,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtB,CAAC,uCAAuC,EAAE,SAAS,CAAC;QACpD,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,SAAS,EAAE,OAAO,CAAC;QACpB,CAAC,sBAAsB,EAAE,WAAW,CAAC;KAC7B,EAAE,CAAC;QACX,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AACjC,CAAC"}

package/dist/body-command.d.ts

@@ -0,0 +1,42 @@
+import type { ReadinessRunner } from "./admission.js";
+import type { RepositoryChangeSet } from "./change-set-contract.js";
+/** What `body` reads: no member can carry a binding. */
+export interface BodyInput {
+    readonly clone: string;
+    readonly hub: string;
+    readonly set: RepositoryChangeSet;
+    readonly heldChangeSets: readonly RepositoryChangeSet[];
+    /** The number of the task-record issue in the target repository. */
+    readonly taskRecord: number;
+    /** The numbers of the pull requests of older change sets this one replaces. */
+    readonly supersedes?: readonly number[];
+    readonly now?: () => Date;
+    readonly runReadiness?: ReadinessRunner;
+}
+export type BodyOutcome = {
+    readonly exitCode: 0;
+    readonly body: string;
+} | {
+    readonly exitCode: 1 | 2;
+    readonly reason: string;
+};
+export declare class BodyUsageError extends Error {
+}
+export declare const BODY_USAGE = "launcher-apply-plan body --repo <id> --task-record <n> [--supersedes <n>]...";
+export interface BodyArgs {
+    readonly help: false;
+    readonly id: string;
+    readonly taskRecord: number;
+    readonly supersedes: readonly number[];
+}
+/**
+ * Reads `--repo`, `--task-record` and any number of `--supersedes`. A usage error carries no message: nothing the caller typed is
+ * ever echoed. A number is digits only, so a sign, an exponent, a space or a leading zero is a usage error; whether it is a
+ * positive number that is not the task record is the renderer's judgment (`supersedes-invalid`, `task-record-invalid`).
+ */
+export declare function parseBodyArgs(argv: readonly string[]): {
+    help: true;
+} | BodyArgs;
+/** Renders, binds and returns the body; never throws. */
+export declare function bodyRepository(input: BodyInput): Promise<BodyOutcome>;
+//# sourceMappingURL=body-command.d.ts.map

package/dist/body-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-command.d.ts","sourceRoot":"","sources":["../src/body-command.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,KAAK,EAAmB,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAOrF,wDAAwD;AACxD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACxD,oEAAoE;IACpE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,QAAQ,CAAC,YAAY,CAAC,EAAE,eAAe,CAAC;CACzC;AAED,MAAM,MAAM,WAAW,GACnB;IAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAE5C,eAAO,MAAM,UAAU,iFAAiF,CAAC;AAEzG,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAYD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAA;CAAE,GAAG,QAAQ,CAkBhF;AAkBD,yDAAyD;AACzD,wBAAsB,cAAc,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,CAkD3E"}

package/dist/body-command.js

@@ -0,0 +1,143 @@
+// `launcher-apply-plan body` (issue #1716, RFC apply-approved-plan section 6): the body of the pull request for one stored
+// change set, bound by what the hub decides now, with the hash of exactly the printed bytes recorded as the set's
+// `pullRequest.bodySha256`. An approval must bind exactly the body that is opened: any ambiguity refuses, and a refusal prints
+// nothing on standard output and one line of fixed tokens on standard error.
+//
+//   B1. The binding is what runPreconditions decides now, from the hub. It is never an option, an argument or a stored value; a
+//       refusal of the preconditions keeps its own token and its own exit code.
+//   B2. A stored planned bundle that lists this set holds a binding for it; that binding must be exactly B1's, else
+//       `binding-mismatch`. A bundle that is absent, not planned, or does not list the set records no binding to hold it to.
+//   B3. The body is renderPullRequest over the stored set (read again here, so what is rendered is what is stored), B1's binding,
+//       the task record and the superseded numbers: nothing else.
+//   B4. `bodySha256` is the SHA-256 of exactly the bytes printed, recorded after rendering by bindChangeSetBody, which replaces
+//       the one stored file atomically, refuses a symbolic link, and changes nothing else. Another recorded value is
+//       `body-bound`; the same value is a no-op.
+//   B5. `--supersedes` numbers are distinct positive safe integers other than the task record (the renderer refuses the rest as
+//       `supersedes-invalid`), and the set must have another stored set of its repository to replace, else `supersedes-unfounded`.
+//   B6. Every refusal is empty standard output and one standard error line naming a fixed token, never an argument, a path, an id
+//       or tool output.
+import { createHash } from "node:crypto";
+import { realpathSync } from "node:fs";
+import { BodyBoundError, bindChangeSetBody, readStoredApplyBundle, readStoredChangeSet } from "./apply-store.js";
+import { validateRepositoryChangeSet } from "./change-set-contract.js";
+import { changeSetDigest } from "./change-set-digest.js";
+import { runPreconditions } from "./materialize.js";
+import { renderPullRequest } from "./pull-request-body.js";
+import { safeReason } from "./status.js";
+export class BodyUsageError extends Error {
+}
+export const BODY_USAGE = "launcher-apply-plan body --repo <id> --task-record <n> [--supersedes <n>]...";
+const REPO_ID_SHAPE = /^[^/]+\/[^/]+$/u;
+const WHOLE_NUMBER = /^(?:0|[1-9][0-9]{0,15})$/u;
+function wholeNumber(text) {
+    if (text === undefined || !WHOLE_NUMBER.test(text))
+        throw new BodyUsageError();
+    const value = Number(text);
+    if (!Number.isSafeInteger(value))
+        throw new BodyUsageError();
+    return value;
+}
+/**
+ * Reads `--repo`, `--task-record` and any number of `--supersedes`. A usage error carries no message: nothing the caller typed is
+ * ever echoed. A number is digits only, so a sign, an exponent, a space or a leading zero is a usage error; whether it is a
+ * positive number that is not the task record is the renderer's judgment (`supersedes-invalid`, `task-record-invalid`).
+ */
+export function parseBodyArgs(argv) {
+    if (argv.length === 1 && (argv[0] === "--help" || argv[0] === "-h"))
+        return { help: true };
+    let id;
+    let taskRecord;
+    const supersedes = [];
+    for (let index = 0; index < argv.length; index += 2) {
+        const name = argv[index];
+        const value = argv[index + 1];
+        if (value === undefined)
+            throw new BodyUsageError();
+        if (name === "--repo" && id === undefined)
+            id = value;
+        else if (name === "--task-record" && taskRecord === undefined)
+            taskRecord = value;
+        else if (name === "--supersedes")
+            supersedes.push(wholeNumber(value));
+        else
+            throw new BodyUsageError();
+    }
+    if (id === undefined || taskRecord === undefined)
+        throw new BodyUsageError();
+    const name = id.slice(id.indexOf("/") + 1);
+    if (!REPO_ID_SHAPE.test(id) || name === "." || name === "..")
+        throw new BodyUsageError();
+    return { help: false, id, taskRecord: wholeNumber(taskRecord), supersedes };
+}
+const refuse = (reason) => ({ exitCode: 1, reason });
+const indeterminate = (reason) => ({ exitCode: 2, reason });
+const sameBinding = (left, right) => left.kind === right.kind &&
+    left.subjectDigest === right.subjectDigest &&
+    (left.kind !== "admitted" || (right.kind === "admitted" && left.setupChangeSet === right.setupChangeSet));
+/** Whether the hub holds a set of this repository, other than this one, that verifies under its own digest. */
+function hasAnotherSet(set, held) {
+    return held.some((other) => {
+        if (other.repository.id !== set.repository.id || other.changeSetDigest === set.changeSetDigest)
+            return false;
+        return validateRepositoryChangeSet(other).valid && changeSetDigest(other) === other.changeSetDigest;
+    });
+}
+/** Renders, binds and returns the body; never throws. */
+export async function bodyRepository(input) {
+    try {
+        const hub = realpathSync(input.hub);
+        let stored;
+        try {
+            stored = readStoredChangeSet(hub, input.set.changeSetDigest);
+        }
+        catch {
+            return indeterminate("store-unreadable");
+        }
+        if (stored === null || stored.repository.id !== input.set.repository.id)
+            return indeterminate("change-set-absent");
+        // B1
+        const pre = await runPreconditions(input.clone, input.hub, stored, input.heldChangeSets, { now: input.now, runReadiness: input.runReadiness });
+        if ("exitCode" in pre)
+            return pre.exitCode === 1 ? refuse(safeReason(pre.reason)) : indeterminate(safeReason(pre.reason));
+        // B2
+        let bundle;
+        try {
+            bundle = readStoredApplyBundle(hub, stored.bundle);
+        }
+        catch {
+            return indeterminate("bundle-unreadable");
+        }
+        if (bundle !== null && bundle.mode === "planned") {
+            for (const entry of bundle.repositories) {
+                if (!("changeSet" in entry) || entry.changeSet !== stored.changeSetDigest)
+                    continue;
+                const recorded = "binding" in entry ? entry.binding : undefined;
+                if (entry.id !== stored.repository.id || recorded === undefined || !sameBinding(recorded, pre.binding))
+                    return refuse("binding-mismatch");
+            }
+        }
+        // B5
+        const supersedes = input.supersedes ?? [];
+        if (supersedes.length > 0 && !hasAnotherSet(stored, input.heldChangeSets))
+            return refuse("supersedes-unfounded");
+        // B3
+        const rendered = renderPullRequest({ set: stored, binding: pre.binding, taskRecord: input.taskRecord, ...(supersedes.length === 0 ? {} : { supersedes }) });
+        if (rendered.state === "refused")
+            return refuse(safeReason(rendered.reason));
+        // B4: the hash of exactly the bytes that will be printed.
+        const hash = `sha256:${createHash("sha256").update(Buffer.from(rendered.body, "utf8")).digest("hex")}`;
+        if (hash !== rendered.bodySha256)
+            return refuse("render-failed");
+        try {
+            bindChangeSetBody(hub, stored.changeSetDigest, hash);
+        }
+        catch (cause) {
+            return cause instanceof BodyBoundError ? refuse("body-bound") : indeterminate("store-failed");
+        }
+        return { exitCode: 0, body: rendered.body };
+    }
+    catch {
+        return indeterminate("body-failed");
+    }
+}
+//# sourceMappingURL=body-command.js.map

package/dist/body-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"body-command.js","sourceRoot":"","sources":["../src/body-command.ts"],"names":[],"mappings":"AAAA,2HAA2H;AAC3H,kHAAkH;AAClH,+HAA+H;AAC/H,6EAA6E;AAC7E,EAAE;AACF,gIAAgI;AAChI,gFAAgF;AAChF,oHAAoH;AACpH,6HAA6H;AAC7H,kIAAkI;AAClI,kEAAkE;AAClE,gIAAgI;AAChI,qHAAqH;AACrH,iDAAiD;AACjD,gIAAgI;AAChI,mIAAmI;AACnI,kIAAkI;AAClI,wBAAwB;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEjH,OAAO,EAAE,2BAA2B,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBzC,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C,MAAM,CAAC,MAAM,UAAU,GAAG,8EAA8E,CAAC;AASzG,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,SAAS,WAAW,CAAC,IAAwB;IAC3C,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAC7D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC3F,IAAI,EAAsB,CAAC;IAC3B,IAAI,UAA8B,CAAC;IACnC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAC9B,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,IAAI,KAAK,QAAQ,IAAI,EAAE,KAAK,SAAS;YAAE,EAAE,GAAG,KAAK,CAAC;aACjD,IAAI,IAAI,KAAK,eAAe,IAAI,UAAU,KAAK,SAAS;YAAE,UAAU,GAAG,KAAK,CAAC;aAC7E,IAAI,IAAI,KAAK,cAAc;YAAE,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;;YACjE,MAAM,IAAI,cAAc,EAAE,CAAC;IAClC,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,cAAc,EAAE,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,WAAW,CAAC,UAAU,CAAC,EAAE,UAAU,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,CAAC,MAAc,EAAe,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;AAEjF,MAAM,WAAW,GAAG,CAAC,IAAqB,EAAE,KAAsB,EAAW,EAAE,CAC7E,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;IACxB,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;IAC1C,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;AAE5G,+GAA+G;AAC/G,SAAS,aAAa,CAAC,GAAwB,EAAE,IAAoC;IACnF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,KAAK,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,KAAK,CAAC,eAAe,KAAK,GAAG,CAAC,eAAe;YAAE,OAAO,KAAK,CAAC;QAC7G,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC,eAAe,CAAC;IACtG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAAgB;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAkC,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,kBAAkB,CAAC,CAAC;QAC3C,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;YAAE,OAAO,aAAa,CAAC,mBAAmB,CAAC,CAAC;QAEnH,KAAK;QACL,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/I,IAAI,UAAU,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1H,KAAK;QACL,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,aAAa,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxC,IAAI,CAAC,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,eAAe;oBAAE,SAAS;gBACpF,MAAM,QAAQ,GAAG,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;gBAChE,IAAI,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC;oBAAE,OAAO,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAC5I,CAAC;QACH,CAAC;QAED,KAAK;QACL,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1C,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,cAAc,CAAC;YAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAEjH,KAAK;QACL,MAAM,QAAQ,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5J,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAE7E,0DAA0D;QAC1D,MAAM,IAAI,GAAG,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvG,IAAI,IAAI,KAAK,QAAQ,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QACjE,IAAI,CAAC;YACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,KAAK,YAAY,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,aAAa,CAAC,CAAC;IACtC,CAAC;AACH,CAAC"}