@ddtcorex/dsh-maestro-review 0.10.0 → 0.11.0

package/lib/vendor/store.js

@@ -0,0 +1,500 @@
+// vendored from dsh-maestro-core store, sha256:ca062c527bb30c030c086751be275ee379071f33691568ff7d0eae4372012829
+import { homedir } from 'node:os';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { mkdir, open, readFile, rename, unlink, stat, rm, writeFile, link } from 'node:fs/promises';
+import { mkdirSync, readFileSync } from 'node:fs';
+import { watch } from 'node:fs';
+const EMPTY_DOC = { version: 1, domains: {} };
+const domainValidators = new Map();
+const changeCbs = new Set();
+let cached = null;
+async function fileSig(path) {
+    try {
+        const st = await stat(path);
+        return { mtimeMs: st.mtimeMs, ino: st.ino, size: st.size };
+    }
+    catch {
+        return null;
+    }
+}
+function sameSig(a, b) {
+    return a !== null && b !== null && a.mtimeMs === b.mtimeMs && a.ino === b.ino && a.size === b.size;
+}
+function resolveDshHome(explicit) {
+    return explicit ?? process.env.DSH_HOME ?? join(homedir(), '.dsh');
+}
+function storePath(opts) {
+    return join(resolveDshHome(opts?.dshHome), 'dsh-maestro-config', 'settings.json');
+}
+/** Register a validator for a domain you own. Writes to it are validated on every set(). */
+export function defineDomain(name, validator) {
+    domainValidators.set(name, validator);
+}
+// ---------------------------------------------------------------------------
+// change notification
+// ---------------------------------------------------------------------------
+/**
+ * Every plugin embeds its own copy of this module, so a listener has to hear
+ * writes made by another copy (or by another process), not only writes made
+ * through the copy that owns it. While at least one listener exists we watch
+ * the settings file and compare every domain against `snapshot`; a local write
+ * refreshes `snapshot` before it fires the callbacks, so it never fires twice.
+ *
+ * The watcher resolves DSH_HOME once, when it starts. A store pinned to an
+ * explicit `dshHome` therefore stays out of the watched home and neither fires
+ * nor receives notifications for writes that go somewhere else.
+ */
+const WATCH_DEBOUNCE_MS = 50;
+const POLL_MS = 2_000;
+const FILE_BASENAME = 'settings.json';
+let watcher = null;
+let pollTimer = null;
+let debounceTimer = null;
+let snapshot = {};
+let watchedHome = null;
+let checking = false;
+/** JSON text per domain, so a value change is a cheap string comparison. */
+function fingerprint(doc) {
+    const out = {};
+    for (const [domain, value] of Object.entries(doc.domains)) {
+        out[domain] = JSON.stringify(value) ?? 'undefined';
+    }
+    return out;
+}
+/**
+ * Seed the snapshot synchronously so a write racing `onChange` cannot slip
+ * between "listener registered" and "snapshot taken" and go unnoticed.
+ */
+function readSnapshotSync(home) {
+    try {
+        return fingerprint(parseDoc(readFileSync(storePath({ dshHome: home }), 'utf8')));
+    }
+    catch {
+        return {}; // no store on disk yet: every domain is new
+    }
+}
+/**
+ * Run every listener for one domain. Each callback gets its own try/catch: a
+ * throwing listener must neither reject the write that already committed nor
+ * hide the change from the listeners registered after it.
+ */
+function fire(domain) {
+    for (const cb of [...changeCbs]) {
+        try {
+            cb(domain);
+        }
+        catch (err) {
+            console.warn(`config-lib: onChange callback for '${domain}' threw: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
+async function checkExternal() {
+    if (changeCbs.size === 0 || watchedHome === null || checking)
+        return;
+    checking = true;
+    try {
+        // load() invalidates its own cache on an mtime change, so this sees other
+        // writers' values without an extra stat.
+        const next = fingerprint(await load({ dshHome: watchedHome }));
+        const changed = [];
+        for (const domain of new Set([...Object.keys(snapshot), ...Object.keys(next)])) {
+            // A domain that disappeared compares against undefined and counts as changed.
+            if (snapshot[domain] !== next[domain])
+                changed.push(domain);
+        }
+        snapshot = next;
+        for (const domain of changed)
+            fire(domain);
+    }
+    catch {
+        // A transient read failure must never break boot; the next tick retries.
+    }
+    finally {
+        checking = false;
+    }
+}
+function scheduleCheck() {
+    if (debounceTimer)
+        clearTimeout(debounceTimer);
+    debounceTimer = setTimeout(() => {
+        debounceTimer = null;
+        void checkExternal();
+    }, WATCH_DEBOUNCE_MS);
+    debounceTimer.unref();
+}
+function stopWatching() {
+    watcher?.close();
+    watcher = null;
+    if (pollTimer)
+        clearInterval(pollTimer);
+    pollTimer = null;
+    if (debounceTimer)
+        clearTimeout(debounceTimer);
+    debounceTimer = null;
+    snapshot = {};
+    watchedHome = null;
+}
+function startWatching() {
+    if (watcher || pollTimer)
+        return;
+    const home = resolveDshHome();
+    const path = storePath({ dshHome: home });
+    watchedHome = home;
+    snapshot = readSnapshotSync(home);
+    try {
+        // fs.watch is not recursive, so it only sees the file when its own
+        // directory exists; the store is the only writer of that path either way.
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        const w = watch(dirname(path), { persistent: false }, (_event, filename) => {
+            if (filename === null || filename === FILE_BASENAME)
+                scheduleCheck();
+        });
+        // An unhandled 'error' event (EMFILE, directory removed, ...) would crash
+        // the host. Drop the watcher and let the poll below carry on alone.
+        w.on('error', () => {
+            try {
+                w.close();
+            }
+            catch { /* already closed */ }
+            if (watcher === w)
+                watcher = null;
+        });
+        watcher = w;
+    }
+    catch {
+        watcher = null; // polling below still covers the change
+    }
+    pollTimer = setInterval(() => void checkExternal(), POLL_MS);
+    pollTimer.unref();
+}
+/** Fire callbacks registered through this instance after a successful set(). */
+export function onChange(cb) {
+    changeCbs.add(cb);
+    startWatching();
+    let disposed = false;
+    return () => {
+        if (disposed)
+            return;
+        disposed = true;
+        changeCbs.delete(cb);
+        if (changeCbs.size === 0)
+            stopWatching();
+    };
+}
+/** Test seam: drop the memoized document and listeners (schemas are kept). */
+export function resetForTests() {
+    cached = null;
+    changeCbs.clear();
+    stopWatching();
+}
+// ---------------------------------------------------------------------------
+// locking + io
+// ---------------------------------------------------------------------------
+/**
+ * Lock timing. A lock is only stolen once it is older than STALE_MS, which is
+ * deliberately longer than the time a waiter is willing to wait: a live writer
+ * that is merely slow must time its waiters out, never get robbed.
+ */
+const LOCK_TIMEOUT_MS = 5_000;
+const LOCK_STALE_MS = 30_000;
+/** Settings directory: created 0700, lock file 0600 (the settings file is 0600 too). Modes apply at creation only; existing paths are never chmod-ed. */
+const DIR_MODE = 0o700;
+const FILE_MODE = 0o600;
+/**
+ * Move a stale lock aside and delete it. rename() is atomic, so of several
+ * waiters only one moves the file. If the moved file turns out not to be the
+ * one we judged stale (a new owner took the path between our stat and the
+ * rename), it is put back with link(), which refuses to overwrite.
+ */
+async function stealStaleLock(lockPath, observedIno) {
+    const aside = `${lockPath}.stale-${randomBytes(4).toString('hex')}`;
+    try {
+        await rename(lockPath, aside);
+    }
+    catch {
+        return; // someone else removed or stole it first
+    }
+    try {
+        const moved = await stat(aside);
+        if (moved.ino !== observedIno)
+            await link(aside, lockPath).catch(() => { });
+    }
+    catch {
+        /* nothing to restore */
+    }
+    finally {
+        await rm(aside, { force: true }).catch(() => { });
+    }
+}
+async function withLock(path, fn) {
+    await mkdir(dirname(path), { recursive: true, mode: DIR_MODE }); // the store dir may not exist on first write
+    const lockPath = `${path}.lock`;
+    const token = `${process.pid}-${randomBytes(8).toString('hex')}`;
+    const deadline = Date.now() + LOCK_TIMEOUT_MS;
+    for (;;) {
+        try {
+            const handle = await open(lockPath, 'wx', FILE_MODE);
+            try {
+                await handle.writeFile(token);
+            }
+            finally {
+                await handle.close();
+            }
+            break;
+        }
+        catch (err) {
+            if (err?.code !== 'EEXIST')
+                throw err;
+            // Break stale locks left behind by a crashed writer.
+            try {
+                const st = await stat(lockPath);
+                if (Date.now() - st.mtimeMs > LOCK_STALE_MS) {
+                    await stealStaleLock(lockPath, st.ino);
+                    continue;
+                }
+            }
+            catch {
+                /* lock vanished between stat and now — just retry */
+            }
+            if (Date.now() > deadline)
+                throw new Error(`config-lib: lock timeout at ${lockPath}`);
+            await new Promise((r) => setTimeout(r, 20));
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        // Only release a lock that is still ours: if it was stolen and re-acquired
+        // meanwhile, deleting it would break the new owner's mutual exclusion.
+        try {
+            if ((await readFile(lockPath, 'utf8')) === token)
+                await unlink(lockPath);
+        }
+        catch {
+            /* already gone */
+        }
+    }
+}
+function parseDoc(raw) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null || typeof parsed.version !== 'number') {
+        throw new Error('config-lib: malformed settings document');
+    }
+    return { version: 1, domains: parsed.domains ?? {} };
+}
+async function readDoc(path) {
+    let raw;
+    try {
+        raw = await readFile(path, 'utf8');
+    }
+    catch (err) {
+        if (err?.code === 'ENOENT')
+            return { ...EMPTY_DOC, domains: {} };
+        throw err;
+    }
+    return parseDoc(raw);
+}
+function deepMerge(base, patch) {
+    if (base !== null && typeof base === 'object' && !Array.isArray(base) &&
+        patch !== null && typeof patch === 'object' && !Array.isArray(patch)) {
+        const out = { ...base };
+        for (const [k, v] of Object.entries(patch)) {
+            out[k] = k in out ? deepMerge(out[k], v) : v;
+        }
+        return out;
+    }
+    return patch;
+}
+async function writeDocLocked(path, doc) {
+    await mkdir(dirname(path), { recursive: true, mode: DIR_MODE });
+    const tmp = `${path}.tmp-${Math.random().toString(16).slice(2, 10)}`;
+    try {
+        await writeFile(tmp, JSON.stringify(doc, null, 2) + '\n', { mode: FILE_MODE });
+        await rename(tmp, path); // atomic on the same filesystem; rename carries the 600 mode
+    }
+    finally {
+        // After a successful rename the temp name is gone and this is a no-op; after
+        // a failed write or rename it removes the orphan instead of leaking one per try.
+        await rm(tmp, { force: true }).catch(() => { });
+    }
+}
+// ---------------------------------------------------------------------------
+// public API
+// ---------------------------------------------------------------------------
+export async function load(opts) {
+    const path = storePath(opts);
+    const homeKey = resolveDshHome(opts?.dshHome);
+    if (cached && cached.key === homeKey) {
+        // One stat per load: out-of-band edits (other processes) must surface
+        // without a restart.
+        const now = await fileSig(path);
+        if (now === null)
+            return cached.doc; // stat failed (vanished/locked) — serve stale, never break boot
+        if (sameSig(now, cached.sig))
+            return cached.doc;
+    }
+    const doc = await readDoc(path);
+    cached = { key: homeKey, doc, sig: await fileSig(path) };
+    return doc;
+}
+export async function get(domain, opts) {
+    const doc = await load(opts);
+    return doc.domains[domain];
+}
+export async function set(domain, patch, opts) {
+    const path = storePath(opts);
+    const key = resolveDshHome(opts?.dshHome);
+    let written;
+    await withLock(path, async () => {
+        const doc = await readDoc(path);
+        const validator = domainValidators.get(domain);
+        const merged = deepMerge(doc.domains[domain], patch);
+        if (validator) {
+            const res = validator.parse(merged);
+            if (!res.ok)
+                throw new Error(`config-lib: validation failed for '${domain}': ${res.error}`);
+        }
+        doc.domains[domain] = merged;
+        written = merged;
+        await writeDocLocked(path, doc);
+        cached = { key, doc, sig: await fileSig(path) };
+    });
+    // Refresh the watched copy first so the watcher sees no diff for this write.
+    if (watchedHome === key)
+        snapshot[domain] = JSON.stringify(written) ?? 'undefined';
+    fire(domain);
+}
+/**
+ * Delete one TOP-LEVEL key of a domain — the delete operation `set()` cannot
+ * express (a merge patch has no delete signal: `null` persists as null).
+ * Dotted paths are rejected to keep the semantics exactly one key. No-op
+ * (`false`, no write, no callbacks) when the domain is absent/not an object
+ * or the key is absent. Otherwise the resulting domain is validated like a
+ * `set()` before the atomic write; `true` means the key is gone.
+ */
+export async function unset(domain, key, opts) {
+    if (typeof key !== 'string' || key === '' || key.includes('.')) {
+        throw new Error(`config-lib: unset key must be a top-level name, got ${JSON.stringify(key)}`);
+    }
+    const path = storePath(opts);
+    const homeKey = resolveDshHome(opts?.dshHome);
+    let written;
+    const deleted = await withLock(path, async () => {
+        const doc = await readDoc(path);
+        const bucket = doc.domains[domain];
+        if (typeof bucket !== 'object' || bucket === null || Array.isArray(bucket))
+            return false;
+        if (!(key in bucket))
+            return false;
+        const next = { ...bucket };
+        delete next[key];
+        const validator = domainValidators.get(domain);
+        if (validator) {
+            const res = validator.parse(next);
+            if (!res.ok)
+                throw new Error(`config-lib: validation failed for '${domain}': ${res.error}`);
+        }
+        doc.domains[domain] = next;
+        written = next;
+        await writeDocLocked(path, doc);
+        cached = { key: homeKey, doc, sig: await fileSig(path) };
+        return true;
+    });
+    if (deleted) {
+        if (watchedHome === homeKey)
+            snapshot[domain] = JSON.stringify(written) ?? 'undefined';
+        fire(domain);
+    }
+    return deleted;
+}
+/** Names of domains registered via defineDomain (schema owners). */
+export function definedDomains() {
+    return [...domainValidators.keys()];
+}
+// ---------------------------------------------------------------------------
+// flat-key adapter map (live: remote/review/supervisor read through readFlat)
+// ---------------------------------------------------------------------------
+export const DOMAIN_KEY_MAP = {
+    gitlabBaseUrl: 'gitlab.baseUrl',
+    gitlabToken: 'gitlab.token',
+    botUsername: 'gitlab.botUsername',
+    webhookSecret: 'gitlab.webhookSecret',
+    webhookPort: 'gitlab.webhookPort',
+    projectMappings: 'gitlab.projectMappings',
+    autoRereviewOnPush: 'gitlab.autoRereviewOnPush',
+    autoReviewOnAssign: 'gitlab.autoReviewOnAssign',
+    reviewModel: 'review.model',
+    agentTimeoutMs: 'review.agentTimeoutMs',
+    reviewSessionRetentionDays: 'review.sessionRetentionDays',
+    tunnelHostname: 'tunnel.hostname',
+    tunnelCredentialsFile: 'tunnel.credentialsFile',
+    tunnelId: 'tunnel.id',
+    tunnelMode: 'tunnel.mode',
+    quickTarget: 'tunnel.quickTarget',
+    proxyPort: 'tunnel.proxyPort',
+    proxyHost: 'tunnel.proxyHost',
+    lanPinEnabled: 'tunnel.lanPinEnabled',
+    lanPort: 'tunnel.lanPort',
+    lanHost: 'tunnel.lanHost',
+    /** Login-cookie lifetime in hours for the remote PIN gate (0 = session cookie). */
+    pinSessionTtlHours: 'tunnel.pinSessionTtlHours',
+    telegramBotToken: 'notifier.telegram.botToken',
+    telegramChatId: 'notifier.telegram.chatId',
+    telegramReviewNotifications: 'notifier.policy.reviewNotifications',
+};
+/** Machine runtime state — never settings; owning adapters persist these in their own sidecar. */
+export const RUNTIME_KEYS = ['lastTunnelRunning'];
+function setIn(obj, dotted, value) {
+    const parts = dotted.split('.');
+    let cur = obj;
+    for (const part of parts.slice(0, -1)) {
+        if (typeof cur[part] !== 'object' || cur[part] === null)
+            cur[part] = {};
+        cur = cur[part];
+    }
+    cur[parts[parts.length - 1]] = value;
+}
+/** Route a flat legacy-keyed patch into per-domain writes; runtime keys are skipped. */
+export function splitLegacyPatch(patch) {
+    const byDomain = new Map();
+    for (const [key, value] of Object.entries(patch)) {
+        if (RUNTIME_KEYS.includes(key))
+            continue;
+        const dotted = DOMAIN_KEY_MAP[key];
+        if (!dotted)
+            continue;
+        const domain = dotted.split('.')[0];
+        const group = byDomain.get(domain) ?? {};
+        setIn(group, dotted.slice(domain.length + 1), value);
+        byDomain.set(domain, group);
+    }
+    return [...byDomain].map(([domain, patch]) => ({ domain, patch }));
+}
+/** Write a flat legacy-keyed patch through the domain store (multiple atomic set()s). */
+export async function writeLegacyPatch(patch, opts) {
+    for (const { domain, patch: group } of splitLegacyPatch(patch)) {
+        await set(domain, group, opts);
+    }
+}
+/** Inverse view: domains flattened back into legacy key names (undefined keys omitted). */
+export async function readFlat(opts) {
+    const doc = await load(opts);
+    const flat = {};
+    for (const [key, dotted] of Object.entries(DOMAIN_KEY_MAP)) {
+        let cur = doc.domains;
+        for (const part of dotted.split('.')) {
+            if (cur !== null && typeof cur === 'object')
+                cur = cur[part];
+            else {
+                cur = undefined;
+                break;
+            }
+        }
+        if (cur !== undefined)
+            flat[key] = cur;
+    }
+    return flat;
+}
+//# sourceMappingURL=store.js.map

package/lib/vendor/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/host/vendor/store.ts"],"names":[],"mappings":"AAAA,gHAAgH;AAChH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAA;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACnG,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACjD,OAAO,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAA;AAY/C,MAAM,SAAS,GAAgB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAE1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAA;AAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAA4B,CAAA;AAWrD,IAAI,MAAM,GAAkE,IAAI,CAAA;AAEhF,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,CAAiB,EAAE,CAAiB;IACnD,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAA;AACpG,CAAC;AAED,SAAS,cAAc,CAAC,QAAiB;IACvC,OAAO,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;AACpE,CAAC;AAED,SAAS,SAAS,CAAC,IAA2B;IAC5C,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,oBAAoB,EAAE,eAAe,CAAC,CAAA;AACnF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,SAA0B;IACnE,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACvC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAC5B,MAAM,OAAO,GAAG,KAAK,CAAA;AACrB,MAAM,aAAa,GAAG,eAAe,CAAA;AAErC,IAAI,OAAO,GAAqB,IAAI,CAAA;AACpC,IAAI,SAAS,GAA0B,IAAI,CAAA;AAC3C,IAAI,aAAa,GAA0B,IAAI,CAAA;AAC/C,IAAI,QAAQ,GAA2B,EAAE,CAAA;AACzC,IAAI,WAAW,GAAkB,IAAI,CAAA;AACrC,IAAI,QAAQ,GAAG,KAAK,CAAA;AAEpB,4EAA4E;AAC5E,SAAS,WAAW,CAAC,GAAgB;IACnC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,WAAW,CAAA;IACpD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA,CAAC,4CAA4C;IACxD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,IAAI,CAAC,MAAc;IAC1B,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,CAAA;QACZ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,sCAAsC,MAAM,YAAY,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC1H,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,IAAI,IAAI,QAAQ;QAAE,OAAM;IACpE,QAAQ,GAAG,IAAI,CAAA;IACf,IAAI,CAAC;QACH,0EAA0E;QAC1E,yCAAyC;QACzC,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,MAAM,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,8EAA8E;YAC9E,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7D,CAAC;QACD,QAAQ,GAAG,IAAI,CAAA;QACf,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,IAAI,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;YAAS,CAAC;QACT,QAAQ,GAAG,KAAK,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,aAAa;QAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IAC9C,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;QAC9B,aAAa,GAAG,IAAI,CAAA;QACpB,KAAK,aAAa,EAAE,CAAA;IACtB,CAAC,EAAE,iBAAiB,CAAC,CAAA;IACrB,aAAa,CAAC,KAAK,EAAE,CAAA;AACvB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,EAAE,KAAK,EAAE,CAAA;IAChB,OAAO,GAAG,IAAI,CAAA;IACd,IAAI,SAAS;QAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IACvC,SAAS,GAAG,IAAI,CAAA;IAChB,IAAI,aAAa;QAAE,YAAY,CAAC,aAAa,CAAC,CAAA;IAC9C,aAAa,GAAG,IAAI,CAAA;IACpB,QAAQ,GAAG,EAAE,CAAA;IACb,WAAW,GAAG,IAAI,CAAA;AACpB,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,OAAO,IAAI,SAAS;QAAE,OAAM;IAChC,MAAM,IAAI,GAAG,cAAc,EAAE,CAAA;IAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;IACzC,WAAW,GAAG,IAAI,CAAA;IAClB,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACjC,IAAI,CAAC;QACH,mEAAmE;QACnE,0EAA0E;QAC1E,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;YACzE,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,KAAK,aAAa;gBAAE,aAAa,EAAE,CAAA;QACtE,CAAC,CAAC,CAAA;QACF,0EAA0E;QAC1E,oEAAoE;QACpE,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBAAC,CAAC,CAAC,KAAK,EAAE,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAA;QACnC,CAAC,CAAC,CAAA;QACF,OAAO,GAAG,CAAC,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,IAAI,CAAA,CAAC,wCAAwC;IACzD,CAAC;IACD,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,aAAa,EAAE,EAAE,OAAO,CAAC,CAAA;IAC5D,SAAS,CAAC,KAAK,EAAE,CAAA;AACnB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,EAA4B;IACnD,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACjB,aAAa,EAAE,CAAA;IACf,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,OAAO,GAAG,EAAE;QACV,IAAI,QAAQ;YAAE,OAAM;QACpB,QAAQ,GAAG,IAAI,CAAA;QACf,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;QACpB,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC;YAAE,YAAY,EAAE,CAAA;IAC1C,CAAC,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa;IAC3B,MAAM,GAAG,IAAI,CAAA;IACb,SAAS,CAAC,KAAK,EAAE,CAAA;IACjB,YAAY,EAAE,CAAA;AAChB,CAAC;AAED,8EAA8E;AAC9E,eAAe;AACf,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,eAAe,GAAG,KAAK,CAAA;AAC7B,MAAM,aAAa,GAAG,MAAM,CAAA;AAE5B,yJAAyJ;AACzJ,MAAM,QAAQ,GAAG,KAAK,CAAA;AACtB,MAAM,SAAS,GAAG,KAAK,CAAA;AAEvB;;;;;GAKG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,WAAmB;IACjE,MAAM,KAAK,GAAG,GAAG,QAAQ,UAAU,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IACnE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAA;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAM,CAAC,yCAAyC;IAClD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,KAAK,CAAC,GAAG,KAAK,WAAW;YAAE,MAAM,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,wBAAwB;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAClD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY,EAAE,EAAoB;IAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA,CAAC,6CAA6C;IAC7G,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAA;IAC/B,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;IAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAA;IAC7C,SAAS,CAAC;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAA;YACpD,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YAC/B,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAA;YACtB,CAAC;YACD,MAAK;QACP,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAA;YACrC,qDAAqD;YACrD,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAA;gBAC/B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,GAAG,aAAa,EAAE,CAAC;oBAC5C,MAAM,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;oBACtC,SAAQ;gBACV,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qDAAqD;YACvD,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,EAAE,CAAC,CAAA;YACrF,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAA;IACnB,CAAC;YAAS,CAAC;QACT,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,KAAK;gBAAE,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAA;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAA;IACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAG,MAAM,CAAC,OAAmC,IAAI,EAAE,EAAE,CAAA;AACnF,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAY;IACjC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;QAChE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAc;IAC9C,IACE,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EACpE,CAAC;QACD,MAAM,GAAG,GAA4B,EAAE,GAAI,IAAgC,EAAE,CAAA;QAC7E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9C,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,GAAgB;IAC1D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAA;IACpE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAC9E,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA,CAAC,6DAA6D;IACvF,CAAC;YAAS,CAAC;QACT,6EAA6E;QAC7E,iFAAiF;QACjF,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAChD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAA2B;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC7C,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;QACrC,sEAAsE;QACtE,qBAAqB;QACrB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA,CAAC,gEAAgE;QACpG,IAAI,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC,GAAG,CAAA;IACjD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/B,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;IACxD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,MAAc,EAAE,IAA2B;IACnE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,GAAG,CACvB,MAAc,EACd,KAAa,EACb,IAA2B;IAE3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACzC,IAAI,OAAgB,CAAA;IACpB,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC9B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAA;QACpD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;YACnC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;QAC5B,OAAO,GAAG,MAAM,CAAA;QAChB,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;IACjD,CAAC,CAAC,CAAA;IACF,6EAA6E;IAC7E,IAAI,WAAW,KAAK,GAAG;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,WAAW,CAAA;IAClF,IAAI,CAAC,MAAM,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAc,EACd,GAAW,EACX,IAA2B;IAE3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,uDAAuD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC7C,IAAI,OAA4C,CAAA;IAChD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;QAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QACxF,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC;YAAE,OAAO,KAAK,CAAA;QAClC,MAAM,IAAI,GAAG,EAAE,GAAI,MAAkC,EAAE,CAAA;QACvD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAA;QAChB,MAAM,SAAS,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,CAAA;QAC7F,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC1B,OAAO,GAAG,IAAI,CAAA;QACd,MAAM,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,CAAA;QACxD,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,WAAW,KAAK,OAAO;YAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,WAAW,CAAA;QACtF,IAAI,CAAC,MAAM,CAAC,CAAA;IACd,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc;IAC5B,OAAO,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAA;AACrC,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,aAAa,EAAE,gBAAgB;IAC/B,WAAW,EAAE,cAAc;IAC3B,WAAW,EAAE,oBAAoB;IACjC,aAAa,EAAE,sBAAsB;IACrC,WAAW,EAAE,oBAAoB;IACjC,eAAe,EAAE,wBAAwB;IACzC,kBAAkB,EAAE,2BAA2B;IAC/C,kBAAkB,EAAE,2BAA2B;IAC/C,WAAW,EAAE,cAAc;IAC3B,cAAc,EAAE,uBAAuB;IACvC,0BAA0B,EAAE,6BAA6B;IACzD,cAAc,EAAE,iBAAiB;IACjC,qBAAqB,EAAE,wBAAwB;IAC/C,QAAQ,EAAE,WAAW;IACrB,UAAU,EAAE,aAAa;IACzB,WAAW,EAAE,oBAAoB;IACjC,SAAS,EAAE,kBAAkB;IAC7B,SAAS,EAAE,kBAAkB;IAC7B,aAAa,EAAE,sBAAsB;IACrC,OAAO,EAAE,gBAAgB;IACzB,OAAO,EAAE,gBAAgB;IACzB,mFAAmF;IACnF,kBAAkB,EAAE,2BAA2B;IAC/C,gBAAgB,EAAE,4BAA4B;IAC9C,cAAc,EAAE,0BAA0B;IAC1C,2BAA2B,EAAE,qCAAqC;CACnE,CAAA;AAED,kGAAkG;AAClG,MAAM,CAAC,MAAM,YAAY,GAAsB,CAAC,mBAAmB,CAAC,CAAA;AAEpE,SAAS,KAAK,CAAC,GAA4B,EAAE,MAAc,EAAE,KAAc;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,GAAG,GAAG,GAAG,CAAA;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAA;QACvE,GAAG,GAAG,GAAG,CAAC,IAAI,CAA4B,CAAA;IAC5C,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAA;AACtC,CAAC;AAWD,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAA;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAQ;QACxC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,CAAC,MAAM;YAAE,SAAQ;QACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QACxC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACpD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAA8B,EAC9B,IAA2B;IAE3B,KAAK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAChC,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAA2B;IACxD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5B,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,IAAI,GAAG,GAAY,GAAG,CAAC,OAAO,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,GAAG,GAAI,GAA+B,CAAC,IAAI,CAAC,CAAA;iBACpF,CAAC;gBAAC,GAAG,GAAG,SAAS,CAAC;gBAAC,MAAK;YAAC,CAAC;QACjC,CAAC;QACD,IAAI,GAAG,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/lib/webhook-secret.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Webhook secret generation and the URL an operator pastes into GitLab.
+ *
+ * Parked at the meta root when the Maestro settings card lost its GitLab tab,
+ * and never ported: `review` kept the secret FIELD in its own settings section
+ * but had no way to produce a value for it, so the operator had to invent a
+ * 32-character base64url string by hand. A pasted secret with a `+`, a `/` or
+ * a `=` is a common outcome, and those characters are exactly what GitLab's
+ * token comparison and a URL path segment cannot carry.
+ */
+/** The merge-request webhook path this plugin serves. */
+export declare const GITLAB_WEBHOOK_PATH = "/hooks/gitlab-mr";
+/**
+ * Generate an opaque 256-bit secret suitable for GitLab's webhook token.
+ *
+ * Each byte contributes 6 bits (`byte & 0b00111111`), so the result is always
+ * 32 base64url characters with no padding and no character outside the
+ * alphabet — the two properties GitLab's comparison and a URL path segment
+ * both need. The randomness source is injectable so the mapping is testable
+ * without weakening the production path.
+ */
+export declare function generateWebhookSecret(randomValues?: (array: Uint8Array) => Uint8Array): string;
+/**
+ * GitLab's merge-request webhook endpoint for the configured public hostname.
+ *
+ * A user pasting the value back out of the settings field usually brings a
+ * scheme and a trailing slash with it, so both are stripped. An absent
+ * hostname names itself rather than producing a URL that looks real.
+ */
+export declare function gitlabWebhookUrl(hostname?: string): string;
+//# sourceMappingURL=webhook-secret.d.ts.map

package/lib/webhook-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-secret.d.ts","sourceRoot":"","sources":["../src/host/webhook-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,yDAAyD;AACzD,eAAO,MAAM,mBAAmB,qBAAqB,CAAA;AAErD;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CACnC,YAAY,GAAE,CAAC,KAAK,EAAE,UAAU,KAAK,UAAsE,GAC1G,MAAM,CAGR;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAG1D"}

package/lib/webhook-secret.js

@@ -0,0 +1,38 @@
+/**
+ * Webhook secret generation and the URL an operator pastes into GitLab.
+ *
+ * Parked at the meta root when the Maestro settings card lost its GitLab tab,
+ * and never ported: `review` kept the secret FIELD in its own settings section
+ * but had no way to produce a value for it, so the operator had to invent a
+ * 32-character base64url string by hand. A pasted secret with a `+`, a `/` or
+ * a `=` is a common outcome, and those characters are exactly what GitLab's
+ * token comparison and a URL path segment cannot carry.
+ */
+const BASE64URL_ALPHABET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+/** The merge-request webhook path this plugin serves. */
+export const GITLAB_WEBHOOK_PATH = '/hooks/gitlab-mr';
+/**
+ * Generate an opaque 256-bit secret suitable for GitLab's webhook token.
+ *
+ * Each byte contributes 6 bits (`byte & 0b00111111`), so the result is always
+ * 32 base64url characters with no padding and no character outside the
+ * alphabet — the two properties GitLab's comparison and a URL path segment
+ * both need. The randomness source is injectable so the mapping is testable
+ * without weakening the production path.
+ */
+export function generateWebhookSecret(randomValues = globalThis.crypto.getRandomValues.bind(globalThis.crypto)) {
+    const bytes = randomValues(new Uint8Array(32));
+    return Array.from(bytes, byte => BASE64URL_ALPHABET[byte & 0b00111111]).join('');
+}
+/**
+ * GitLab's merge-request webhook endpoint for the configured public hostname.
+ *
+ * A user pasting the value back out of the settings field usually brings a
+ * scheme and a trailing slash with it, so both are stripped. An absent
+ * hostname names itself rather than producing a URL that looks real.
+ */
+export function gitlabWebhookUrl(hostname) {
+    const authority = hostname?.trim().replace(/^https?:\/\//, '').replace(/\/+$/, '') || '<your-hostname>';
+    return `https://${authority}${GITLAB_WEBHOOK_PATH}`;
+}
+//# sourceMappingURL=webhook-secret.js.map

package/lib/webhook-secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhook-secret.js","sourceRoot":"","sources":["../src/host/webhook-secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,kBAAkB,GAAG,kEAAkE,CAAA;AAE7F,yDAAyD;AACzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CACnC,eAAkD,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;IAE3G,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AAClF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAiB;IAChD,MAAM,SAAS,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,iBAAiB,CAAA;IACvG,OAAO,WAAW,SAAS,GAAG,mBAAmB,EAAE,CAAA;AACrD,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ddtcorex/dsh-maestro-review",
   "private": false,
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Maestro Review — pluggable ReviewProvider (GitLab/GitHub) + orchestrator for automated MR review",
   "license": "MIT",
   "repository": {
@@ -17,7 +17,11 @@
   "exports": {
     ".": "./lib/index.js",
     "./lib/*": "./lib/*",
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./client": {
+      "types": "./lib/types/client/index.d.ts",
+      "default": "./lib/client.js"
+    }
   },
   "files": [
     "README.md",
@@ -35,7 +39,6 @@
     "@deepseek-ai/dsh-client-connection": "^0.1.0-rc.6 || >=0.1.1-rc.0 <0.3.0-0"
   },
   "dependencies": {
-    "@ddtcorex/dsh-maestro-config-lib": "^0.3.0",
     "@deepseek-ai/schemastery": "~3.18.4"
   },
   "devDependencies": {
@@ -50,7 +53,15 @@
     "@deepseek-ai/dsh-session-title": "0.2.0-rc.2",
     "@deepseek-ai/dsh-subagent": "0.2.0-rc.2",
     "@deepseek-ai/dsh-tools": "0.2.0-rc.2",
+    "@testing-library/jest-dom": "^7.0.1",
+    "@testing-library/react": "^16.3.3",
     "@types/node": "^22.0.0",
+    "@types/react": "~18.3.1",
+    "@types/react-dom": "~18.3.0",
+    "esbuild": "^0.25.12",
+    "jsdom": "^30.0.1",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
     "typescript": "^5.8.0",
     "vitest": "^3.2.4",
     "yaml": "^2.9.0"
@@ -62,12 +73,19 @@
         "./presets/maestro-reviewer.patch.yml",
         "./presets/maestro-auditor.patch.yml"
       ]
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-connection",
+        "@deepseek-ai/dsh-client-ui-slots"
+      ]
     }
   },
   "scripts": {
-    "build": "tsc",
-    "test": "vitest run",
-    "verify": "tsc --noEmit",
+    "build": "tsc -p tsconfig.json && tsc -p tsconfig.client.json && node scripts/build-client.mjs",
+    "test": "NODE_ENV=test vitest run",
+    "verify": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.client.json --noEmit",
     "docker:build": "docker build -f docker/Dockerfile -t ddtcorex/maestro-reviewer:0.10.0 -t ddtcorex/maestro-reviewer:latest ."
   }
 }