@gitkraken/core-gitlens 0.6.0 → 0.7.1

package/dist/plus/integrations/reads/resolveRepository.js

@@ -1,237 +1,244 @@
-import { createRemoteProviderMatcher } from '../../../git/remotes/matcher.js';
-import { parseGitRemoteUrl } from '../../../git/utils/remote.utils.js';
-import { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';
-import { AuthenticationError, RequestNotFoundError } from '../errors.js';
-import { isIssuesIntegration } from '../models/issuesIntegration.js';
-import { isAzureCloudDomain, isBitbucketCloudDomain, isGitHubDotCom, isGitLabDotCom } from '../providers/models.js';
-import { toProviderWarning } from '../results.js';
-import { hostFromDomain } from '../utils/domain.utils.js';
-import { getIntegrationIdForRemote, isGitCloudHostIntegrationId, isGitSelfManagedHostIntegrationId, remoteProviderTypeForConfig, remoteProviderTypeForIntegration, } from '../utils/integration.utils.js';
-import { noConnectionWarning } from './warnings.js';
+import { AuthenticationError, RequestNotFoundError } from "../../../git/errors.js";
+import { parseGitRemoteUrl } from "../../../git/utils/remote.utils.js";
+import { createRemoteProviderMatcher } from "../../../git/remotes/matcher.js";
+import { toProviderWarning } from "../results.js";
+import "../constants.js";
+import { decodePathSegment, getRemoteHostMatcher, hostFromDomain, isWebRemoteScheme } from "../utils/domain.utils.js";
+import { getIntegrationIdForRemote, getSelfManagedBaseUrl, isGitCloudHostIntegrationId, isGitSelfManagedHostIntegrationId, remoteProviderTypeForConfig, remoteProviderTypeForIntegration } from "../utils/integration.utils.js";
+import { isAzureCloudDomain, isBitbucketCloudDomain, isGitHubDotCom, isGitLabDotCom } from "../providers/models.js";
+import { noConnectionWarning } from "./warnings.js";
+import { isIssuesIntegration } from "../models/issuesIntegration.js";
+//#region ../plus/integrations/src/reads/resolveRepository.ts
 /**
- * Resolution of a remote URL to a provider repository identity — the facade's equivalent of `gk repo resolve`.
- *
- * Unlike every other read here, this one's input is REPOSITORY data, so most of the code below is about not
- * letting that data choose the credentials: an explicit cloud `providerId` must agree with the remote's canonical
- * host, and a self-managed host resolves only against a domain the user already authenticated. The
- * `host-mismatch` returns are those guards, not edge cases — resolving `owner/repo` against the wrong account
- * would hand back a confidently wrong identity and seed the domain-keyed instance cache from remote data.
- */
-export async function resolveRepository(ctx, options) {
-    const result = (status) => ({
-        resolution: { status: status },
-    });
-    const [scheme, parsedDomain, path] = parseGitRemoteUrl(options.remoteUrl);
-    const parsedHost = hostFromDomain(parsedDomain);
-    const explicitHost = hostFromDomain(options.host);
-    if (parsedHost != null && explicitHost != null && parsedHost !== explicitHost) {
-        return result('host-mismatch');
-    }
-    const matcherDomain = parsedDomain || options.host || '';
-    // An explicit cloud provider must agree with the remote's canonical cloud host. Without this guard the
-    // synthetic matcher below can reinterpret, for example, a gitlab.com URL as GitHub and then resolve a
-    // homonymous owner/repo through the wrong account. Match once without caller configs/synthetic entries;
-    // Azure's matcher also normalizes ssh.dev.azure.com and vs-ssh.visualstudio.com to their web host.
-    if (options.providerId != null && isGitCloudHostIntegrationId(options.providerId)) {
-        const nativeProvider = createRemoteProviderMatcher([])(options.remoteUrl, matcherDomain, path, scheme);
-        const nativeId = nativeProvider != null ? getIntegrationIdForRemote(nativeProvider) : undefined;
-        const nativeDomain = nativeProvider?.domain ?? matcherDomain;
-        const canonicalHost = options.providerId === GitCloudHostIntegrationId.GitHub
-            ? isGitHubDotCom(nativeDomain)
-            : options.providerId === GitCloudHostIntegrationId.GitLab
-                ? isGitLabDotCom(nativeDomain)
-                : options.providerId === GitCloudHostIntegrationId.Bitbucket
-                    ? isBitbucketCloudDomain(nativeDomain)
-                    : isAzureCloudDomain(nativeDomain);
-        if (nativeId !== options.providerId || !canonicalHost)
-            return result('host-mismatch');
-    }
-    const provider = createRemoteProviderMatcher(buildMatcherConfigs(ctx, options, parsedDomain))(options.remoteUrl, matcherDomain, path, scheme);
-    if (provider == null)
-        return result('invalid-remote-url');
-    let id = options.providerId ?? getIntegrationIdForRemote(provider);
-    // Custom Azure DevOps Server domains matched via getRemoteConfigs return undefined from
-    // getIntegrationIdForRemote because the provider is marked custom; map them to the server id so the
-    // project-scoped lookup uses that host's configured connection and API base URL.
-    if (id == null && provider.id === 'azure-devops' && provider.custom) {
-        id = GitSelfManagedHostIntegrationId.AzureDevOpsServer;
-    }
-    if (id == null)
-        return result('unsupported-provider');
-    const owner = provider.owner;
-    const name = provider.repoName;
-    if (owner == null || name == null)
-        return result('invalid-remote-url');
-    const providerRepo = provider.repoDesc;
-    // On a self-managed host, resolve only against a TRUSTED host: the pinned connection's configured
-    // domain, the explicit `domain`, or — when neither was supplied — a configured host matching the
-    // remote's. That last case keeps `remoteUrl` (repository-supplied) out of the trusted path: it selects
-    // among hosts the user already authenticated and can never introduce a new one. Resolving `owner/repo`
-    // against some other host's account would, if that host has the same owner/repo, return a confidently
-    // wrong identity — and would seed the domain-keyed integration cache (never evicted before dispose) with
-    // an entry derived from repository data.
-    const urlHost = hostFromDomain(provider.domain);
-    // Normalize BOTH sides before comparing: a stored connection domain is usually a full URL
-    // (`https://git.example.com`) while `urlHost` is already a bare host, so a raw compare would fail on
-    // scheme/trailing-slash alone and wrongly reject a correctly-configured connection.
-    let trustedHost = options.connectionId != null || options.domain != null
-        ? hostFromDomain(ctx.resolveDomainForRead(id, options.connectionId, options.domain))
-        : undefined;
-    if (isGitSelfManagedHostIntegrationId(id)) {
-        const configuredHosts = ctx.getConfigured(id).map(c => hostFromDomain(c.domain));
-        if (trustedHost == null && urlHost != null) {
-            trustedHost = configuredHosts.find(host => host === urlHost);
-        }
-        // A configured host that doesn't match the remote's is a genuine mismatch. With nothing configured
-        // there is no host to mismatch against — it's simply not connected, so fall through to the
-        // `unauthorized` path below (still WITHOUT resolving by the URL domain, so repo data can't seed the
-        // cache).
-        if (trustedHost == null && configuredHosts.length !== 0)
-            return result('host-mismatch');
-        if (trustedHost != null && urlHost != null && trustedHost !== urlHost)
-            return result('host-mismatch');
-    }
-    let integration;
-    try {
-        // Resolve the instance through the trusted target (as `getIntegrationForRead` does):
-        // `resolveReadSession` looks the session up against the instance's domain-scoped descriptor, so
-        // selecting the instance by the URL domain could miss the session and degrade to `no-connection`.
-        integration = isGitSelfManagedHostIntegrationId(id)
-            ? trustedHost != null
-                ? await ctx.getIntegrationForRead(id, options.connectionId, trustedHost)
-                : undefined
-            : await ctx.getIntegrationForDomain(id, provider.domain);
-    }
-    catch {
-        integration = undefined;
-    }
-    if (integration == null) {
-        // Attach a warning, as the thrown-AuthenticationError branch below does: a consumer driving auth
-        // recovery off `warning.kind` would otherwise get nothing for an unresolvable target.
-        return {
-            resolution: {
-                status: 'unauthorized',
-                warning: noConnectionWarning(id, provider.domain, options.connectionId),
-            },
-        };
-    }
-    // Issue trackers have no `getRepo` client; a git host without `getRepoFn` leaves `getRepoInfo`
-    // undefined. Either way this provider can't resolve repositories.
-    if (isIssuesIntegration(integration) || integration.getRepoInfo == null) {
-        return result('unsupported-provider');
-    }
-    // Azure repos are org + project scoped; the remote provider exposes project as `providerDesc.repoDomain`.
-    const project = provider.id === 'azure-devops' ? provider.providerDesc?.repoDomain : undefined;
-    const domain = provider.domain;
-    // Azure's lookup is project-scoped and returns `undefined` without one, which the connection-gap branch
-    // below would misreport as `unauthorized` (driving a pointless reconnect). A remote URL that carries no
-    // project simply can't address an Azure repo.
-    if (provider.id === 'azure-devops' && project == null)
-        return result('invalid-remote-url');
-    try {
-        const repo = await integration.getRepoInfo({
-            ...providerRepo,
-            owner: owner,
-            name: name,
-            project: project,
-            connectionId: options.connectionId,
-        });
-        if (repo == null) {
-            // `getRepoInfo` returns undefined only when no session could be resolved (not connected, or the
-            // requested connection is gone) — a real 404 throws below. So this is a connection gap. Attach a
-            // warning so a consumer driving auth recovery off `warning.kind` sees the same signal it gets from
-            // the thrown-AuthenticationError branch below; without it, the most common unauthorized case is
-            // silent.
-            return {
-                resolution: {
-                    status: 'unauthorized',
-                    warning: noConnectionWarning(id, domain, options.connectionId),
-                },
-            };
-        }
-        // Prefer the provider's canonical namespace/name (GitHub's REST/GraphQL lookup follows the 301
-        // rename redirect, so a stale old name resolves to the new canonical identity), falling back to the
-        // parsed remote when the response omits them. `renamed` is a case-insensitive compare of input vs
-        // canonical, mirroring gkcli's `EqualFold`, so hosts that merely echo the input casing (e.g.
-        // Bitbucket Server/Azure) don't get spuriously flagged.
-        const canonicalOwner = repo.namespace || owner;
-        const canonicalName = repo.name || name;
-        const renamed = canonicalOwner.toLowerCase() !== owner.toLowerCase() || canonicalName.toLowerCase() !== name.toLowerCase();
-        const identity = {
-            providerId: id,
-            domain: domain,
-            owner: canonicalOwner,
-            name: canonicalName,
-            project: project,
-            remoteUrl: options.remoteUrl,
-            renamed: renamed,
-        };
-        return { resolution: { status: 'resolved', identity: identity } };
-    }
-    catch (ex) {
-        // Order matters: 404 throws RequestNotFoundError (not `undefined`), so check not-found before auth
-        // and before the generic 5xx/unknown bucket — never classify a 401/403 as not-found.
-        let resolution;
-        if (ex instanceof RequestNotFoundError) {
-            resolution = { status: 'not-found' };
-        }
-        else if (ex instanceof AuthenticationError) {
-            resolution = { status: 'unauthorized', warning: toProviderWarning(id, domain, options.connectionId, ex) };
-        }
-        else {
-            resolution = { status: 'undetermined', warning: toProviderWarning(id, domain, options.connectionId, ex) };
-        }
-        return { resolution: resolution };
-    }
+* Resolution of a remote URL to a provider repository identity — the facade's equivalent of `gk repo resolve`.
+*
+* Unlike every other read here, this one's input is REPOSITORY data, so most of the code below is about not
+* letting that data choose the credentials: an explicit cloud `providerId` must agree with the remote's canonical
+* host, and a self-managed host resolves only against a domain the user already authenticated. The
+* `host-mismatch` returns are those guards, not edge cases — resolving `owner/repo` against the wrong account
+* would hand back a confidently wrong identity and seed the domain-keyed instance cache from remote data.
+*/
+async function resolveRepository(ctx, options) {
+	const result = (status) => ({ resolution: { status } });
+	const [scheme, parsedDomain, path] = parseGitRemoteUrl(options.remoteUrl);
+	const hostsMatch = getRemoteHostMatcher(scheme);
+	const parsedHost = hostFromDomain(parsedDomain);
+	const explicitHost = hostFromDomain(options.host);
+	if (parsedHost != null && explicitHost != null && !hostsMatch(parsedHost, explicitHost)) return result("host-mismatch");
+	const matcherDomain = parsedDomain || options.host || "";
+	if (options.providerId != null && isGitCloudHostIntegrationId(options.providerId)) {
+		const nativeProvider = createRemoteProviderMatcher([])(options.remoteUrl, matcherDomain, path, scheme);
+		const nativeId = nativeProvider != null ? getIntegrationIdForRemote(nativeProvider) : void 0;
+		const nativeDomain = nativeProvider?.domain ?? matcherDomain;
+		const canonicalHost = options.providerId === "github" ? isGitHubDotCom(nativeDomain) : options.providerId === "gitlab" ? isGitLabDotCom(nativeDomain) : options.providerId === "bitbucket" ? isBitbucketCloudDomain(nativeDomain) : isAzureCloudDomain(nativeDomain);
+		if (nativeId !== options.providerId || !canonicalHost) return result("host-mismatch");
+	}
+	let provider = createRemoteProviderMatcher(buildMatcherConfigs(ctx, options, parsedDomain))(options.remoteUrl, matcherDomain, path, scheme);
+	if (provider == null) return result("invalid-remote-url");
+	let id = options.providerId ?? getIntegrationIdForRemote(provider);
+	if (id == null && provider.id === "azure-devops" && provider.custom) id = "azure-devops-server";
+	if (id == null) return result("unsupported-provider");
+	const urlHost = hostFromDomain(provider.domain);
+	let trustedHost = options.connectionId != null || options.domain != null ? hostFromDomain(ctx.resolveDomainForRead(id, options.connectionId, options.domain)) : void 0;
+	let connectionId = options.connectionId;
+	let providerRepo;
+	if (isGitSelfManagedHostIntegrationId(id)) {
+		if (path.split("/").some((segment) => /^(?:\.|%2e){1,2}$/i.test(segment) || /%2f|%5c|\\/i.test(segment))) return result("invalid-remote-url");
+		const configured = ctx.getConfigured(id);
+		const configuredHosts = configured.map((c) => hostFromDomain(c.domain));
+		if (trustedHost == null && urlHost != null) {
+			const matchingHosts = new Set(configuredHosts.filter((host) => hostsMatch(host, urlHost)));
+			if (matchingHosts.size > 1) return result("host-mismatch");
+			trustedHost = matchingHosts.values().next().value;
+		}
+		if (trustedHost == null && configuredHosts.length !== 0) return result("host-mismatch");
+		if (trustedHost != null && urlHost != null && !hostsMatch(trustedHost, urlHost)) return result("host-mismatch");
+		const installation = matchInstallation(ctx, options, id, configured.filter((c) => hostFromDomain(c.domain) === trustedHost), {
+			scheme,
+			domain: parsedDomain,
+			path
+		});
+		if (typeof installation === "string") return result(installation);
+		if (installation != null) {
+			provider = installation.provider;
+			connectionId = installation.connectionId;
+			providerRepo = installation.repoDesc;
+		}
+	}
+	const owner = provider.owner;
+	const name = provider.repoName;
+	if (owner == null || name == null) return result("invalid-remote-url");
+	providerRepo ??= provider.repoDesc;
+	let integration;
+	try {
+		integration = isGitSelfManagedHostIntegrationId(id) ? trustedHost != null ? await ctx.getIntegrationForRead(id, connectionId, trustedHost) : void 0 : await ctx.getIntegrationForDomain(id, provider.domain);
+	} catch {
+		integration = void 0;
+	}
+	if (integration == null) return { resolution: {
+		status: "unauthorized",
+		warning: noConnectionWarning(id, provider.domain, connectionId)
+	} };
+	if (isIssuesIntegration(integration) || integration.getRepoInfo == null) return result("unsupported-provider");
+	const project = provider.id === "azure-devops" ? provider.providerDesc?.repoDomain : void 0;
+	const domain = trustedHost ?? provider.domain;
+	if (provider.id === "azure-devops" && project == null) return result("invalid-remote-url");
+	try {
+		const repo = await integration.getRepoInfo({
+			...providerRepo,
+			owner,
+			name,
+			project,
+			connectionId
+		});
+		if (repo == null) return { resolution: {
+			status: "unauthorized",
+			warning: noConnectionWarning(id, domain, connectionId)
+		} };
+		const canonicalOwner = repo.namespace || owner;
+		const canonicalName = repo.name || name;
+		const renamed = canonicalOwner.toLowerCase() !== owner.toLowerCase() || canonicalName.toLowerCase() !== name.toLowerCase();
+		return { resolution: {
+			status: "resolved",
+			identity: {
+				providerId: id,
+				domain,
+				owner: canonicalOwner,
+				name: canonicalName,
+				project,
+				remoteUrl: options.remoteUrl,
+				renamed
+			}
+		} };
+	} catch (ex) {
+		let resolution;
+		if (ex instanceof RequestNotFoundError) resolution = { status: "not-found" };
+		else if (ex instanceof AuthenticationError) resolution = {
+			status: "unauthorized",
+			warning: toProviderWarning(id, domain, connectionId, ex)
+		};
+		else resolution = {
+			status: "undetermined",
+			warning: toProviderWarning(id, domain, connectionId, ex)
+		};
+		return { resolution };
+	}
 }
 /**
- * The remote-matcher configs for this resolution: the user's own host remote configs (self-managed/custom
- * domains), plus a synthetic exact-domain entry for an explicit `providerId` + host so a custom domain still maps
- * to the right provider for path parsing.
- */
+* Narrows a web remote on a self-managed host to the configured installation it lives under: the pinned
+* connection's or, unpinned, the one whose installation path is the longest prefix of the remote's, so two
+* installations behind one host each resolve with their own credentials. The provider is re-matched against the
+* path relative to that installation, because the remote parsers expect the repository path to start at the
+* host root. An SSH remote carries no installation path, so it is left to the host-level checks.
+*/
+function matchInstallation(ctx, options, id, connections, remote) {
+	if (!isWebRemoteScheme(remote.scheme)) return void 0;
+	const installationPath = (connection) => {
+		const baseUrl = getSelfManagedBaseUrl(id, connection != null ? connection.baseUrl ?? connection.domain : options.domain);
+		return baseUrl != null ? new URL(baseUrl).pathname.replace(/\/+$/, "") : void 0;
+	};
+	const defaultConnection = connections.find((c) => c.primary) ?? connections[0];
+	const cloudConnections = connections.filter((c) => c.cloud);
+	const cloudDefault = cloudConnections.find((c) => c.primary) ?? cloudConnections[0];
+	const isDefaultReadable = defaultConnection?.cloud !== false || cloudDefault == null || installationPath(cloudDefault) === installationPath(defaultConnection);
+	const isReadable = (connection) => options.connectionId != null || (connection === defaultConnection ? isDefaultReadable : connection?.cloud === true && hostFromDomain(connection.id) !== connection.domain);
+	const candidates = options.connectionId != null ? connections.filter((c) => c.id === options.connectionId) : [defaultConnection, ...connections.filter((c) => c !== defaultConnection)];
+	if (!candidates.length) candidates.push(void 0);
+	const remotePath = `/${remote.path}`;
+	const remoteSegments = remote.path.split("/");
+	const relativeTo = (basePath) => {
+		if (id !== "azure-devops-server") return remotePath.startsWith(`${basePath}/`) ? remotePath.slice(basePath.length + 1) : void 0;
+		const baseSegments = basePath.split("/").filter(Boolean);
+		return remoteSegments.length > baseSegments.length && baseSegments.every((segment, i) => decodePathSegment(segment).toLowerCase() === decodePathSegment(remoteSegments[i]).toLowerCase()) ? remoteSegments.slice(baseSegments.length).join("/") : void 0;
+	};
+	let match;
+	let checked = false;
+	for (const connection of candidates) {
+		const basePath = installationPath(connection);
+		if (basePath == null) continue;
+		checked = true;
+		if (relativeTo(basePath) == null) continue;
+		if (match == null || basePath.length > match.basePath.length || basePath.length === match.basePath.length && !isReadable(match.connection) && isReadable(connection)) match = {
+			connection,
+			basePath
+		};
+	}
+	if (match == null) return checked ? "host-mismatch" : void 0;
+	if (!isReadable(match.connection)) return "host-mismatch";
+	const connectionId = options.connectionId ?? (match.connection !== defaultConnection ? match.connection?.id : void 0);
+	const matcher = createRemoteProviderMatcher(buildMatcherConfigs(ctx, {
+		...options,
+		providerId: id
+	}, remote.domain));
+	const rematch = (path) => matcher(options.remoteUrl, remote.domain, relativeTo(path) ?? "", remote.scheme);
+	let basePath = match.basePath;
+	let provider = rematch(basePath);
+	if (id !== "azure-devops-server") return provider != null ? {
+		provider,
+		connectionId,
+		repoDesc: provider.repoDesc
+	} : "invalid-remote-url";
+	if (basePath && provider?.providerDesc?.repoDomain == null) {
+		basePath = basePath.slice(0, basePath.lastIndexOf("/"));
+		provider = rematch(basePath);
+	}
+	if (provider == null) return "invalid-remote-url";
+	const repoDesc = provider.repoDesc;
+	const relative = typeof repoDesc.virtualDirectory === "string" ? repoDesc.virtualDirectory : void 0;
+	const virtualDirectory = [...basePath.split("/").filter(Boolean).map(decodePathSegment), ...relative?.split("/") ?? []].join("/") || void 0;
+	return {
+		provider,
+		connectionId,
+		repoDesc: {
+			...repoDesc,
+			virtualDirectory
+		}
+	};
+}
+/**
+* The remote-matcher configs for this resolution: the user's own host remote configs (self-managed/custom
+* domains), plus a synthetic exact-domain entry for an explicit `providerId` + host so a custom domain still maps
+* to the right provider for path parsing.
+*/
 function buildMatcherConfigs(ctx, options, parsedDomain) {
-    const configs = [];
-    for (const cfg of ctx.getRemoteConfigs()) {
-        const type = remoteProviderTypeForConfig(cfg.type);
-        if (type == null)
-            continue;
-        // Forward both domain- and regex-based custom remotes (carrying any protocol override), so a
-        // regex-configured host resolves instead of falling through to `unsupported`.
-        if (cfg.domain) {
-            configs.push({ type: type, domain: cfg.domain, protocol: cfg.protocol });
-        }
-        else if (cfg.regex) {
-            configs.push({ type: type, regex: cfg.regex, protocol: cfg.protocol });
-        }
-    }
-    if (options.providerId == null)
-        return configs;
-    const type = remoteProviderTypeForIntegration(options.providerId);
-    const domain = parsedDomain || options.host;
-    if (type == null || !domain)
-        return configs;
-    // The synthetic exact-domain entry is unshifted to the front, so it wins the match over the user's own
-    // config for the same host. Carry that config's protocol override across (matched by domain or regex,
-    // mirroring `ignoreSSLErrors`) so a self-managed host configured for a custom protocol — e.g. plain
-    // `http` — isn't silently downgraded to the provider default here.
-    const lowerDomain = domain.toLowerCase();
-    const protocol = configs.find(c => {
-        if (c.type !== type)
-            return false;
-        if (c.domain != null)
-            return c.domain.toLowerCase() === lowerDomain;
-        // Truthy (not just non-null): an empty regex would compile to a match-everything pattern.
-        if (c.regex) {
-            try {
-                return new RegExp(c.regex, 'i').test(lowerDomain);
-            }
-            catch {
-                return false;
-            }
-        }
-        return false;
-    })?.protocol;
-    configs.unshift({ type: type, domain: domain, protocol: protocol });
-    return configs;
+	const configs = [];
+	for (const cfg of ctx.getRemoteConfigs()) {
+		const type = remoteProviderTypeForConfig(cfg.type);
+		if (type == null) continue;
+		if (cfg.domain) configs.push({
+			type,
+			domain: cfg.domain,
+			protocol: cfg.protocol
+		});
+		else if (cfg.regex) configs.push({
+			type,
+			regex: cfg.regex,
+			protocol: cfg.protocol
+		});
+	}
+	if (options.providerId == null) return configs;
+	const type = remoteProviderTypeForIntegration(options.providerId);
+	const domain = parsedDomain || options.host;
+	if (type == null || !domain) return configs;
+	const lowerDomain = domain.toLowerCase();
+	const protocol = configs.find((c) => {
+		if (c.type !== type) return false;
+		if (c.domain != null) return c.domain.toLowerCase() === lowerDomain;
+		if (c.regex) try {
+			return new RegExp(c.regex, "i").test(lowerDomain);
+		} catch {
+			return false;
+		}
+		return false;
+	})?.protocol;
+	configs.unshift({
+		type,
+		domain,
+		protocol
+	});
+	return configs;
 }
+//#endregion
+export { resolveRepository };
+
 //# sourceMappingURL=resolveRepository.js.map

package/dist/plus/integrations/reads/resolveRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolveRepository.js","sourceRoot":"","sources":["../../../../src/plus/integrations/reads/resolveRepository.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAAE,yBAAyB,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAEpH,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACN,yBAAyB,EACzB,2BAA2B,EAC3B,iCAAiC,EACjC,2BAA2B,EAC3B,gCAAgC,GAChC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEpD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,GAAgC,EAChC,OAWC;IAED,MAAM,MAAM,GAAG,CAAC,MAAsC,EAA2B,EAAE,CAAC,CAAC;QACpF,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;KAC9B,CAAC,CAAC;IAEH,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,GAAG,iBAAiB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;IAChD,MAAM,YAAY,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,UAAU,IAAI,IAAI,IAAI,YAAY,IAAI,IAAI,IAAI,UAAU,KAAK,YAAY,EAAE,CAAC;QAC/E,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,aAAa,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;IAEzD,uGAAuG;IACvG,sGAAsG;IACtG,wGAAwG;IACxG,mGAAmG;IACnG,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI,IAAI,2BAA2B,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnF,MAAM,cAAc,GAAG,2BAA2B,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAG,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,yBAAyB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,MAAM,YAAY,GAAG,cAAc,EAAE,MAAM,IAAI,aAAa,CAAC;QAC7D,MAAM,aAAa,GAClB,OAAO,CAAC,UAAU,KAAK,yBAAyB,CAAC,MAAM;YACtD,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;YAC9B,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,yBAAyB,CAAC,MAAM;gBACxD,CAAC,CAAC,cAAc,CAAC,YAAY,CAAC;gBAC9B,CAAC,CAAC,OAAO,CAAC,UAAU,KAAK,yBAAyB,CAAC,SAAS;oBAC3D,CAAC,CAAC,sBAAsB,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACvC,IAAI,QAAQ,KAAK,OAAO,CAAC,UAAU,IAAI,CAAC,aAAa;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,QAAQ,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAC5F,OAAO,CAAC,SAAS,EACjB,aAAa,EACb,IAAI,EACJ,MAAM,CACN,CAAC;IACF,IAAI,QAAQ,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE1D,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IACnE,wFAAwF;IACxF,oGAAoG;IACpG,iFAAiF;IACjF,IAAI,EAAE,IAAI,IAAI,IAAI,QAAQ,CAAC,EAAE,KAAK,cAAc,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrE,EAAE,GAAG,+BAA+B,CAAC,iBAAiB,CAAC;IACxD,CAAC;IACD,IAAI,EAAE,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAEtD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC/B,IAAI,KAAK,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAEvE,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEvC,kGAAkG;IAClG,iGAAiG;IACjG,uGAAuG;IACvG,uGAAuG;IACvG,sGAAsG;IACtG,yGAAyG;IACzG,yCAAyC;IACzC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,0FAA0F;IAC1F,qGAAqG;IACrG,oFAAoF;IACpF,IAAI,WAAW,GACd,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI;QACrD,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpF,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,iCAAiC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,eAAe,GAAG,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QACjF,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;YAC5C,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAC9D,CAAC;QACD,mGAAmG;QACnG,2FAA2F;QAC3F,oGAAoG;QACpG,UAAU;QACV,IAAI,WAAW,IAAI,IAAI,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;QACxF,IAAI,WAAW,IAAI,IAAI,IAAI,OAAO,IAAI,IAAI,IAAI,WAAW,KAAK,OAAO;YAAE,OAAO,MAAM,CAAC,eAAe,CAAC,CAAC;IACvG,CAAC;IAED,IAAI,WAAW,CAAC;IAChB,IAAI,CAAC;QACJ,qFAAqF;QACrF,gGAAgG;QAChG,kGAAkG;QAClG,WAAW,GAAG,iCAAiC,CAAC,EAAE,CAAC;YAClD,CAAC,CAAC,WAAW,IAAI,IAAI;gBACpB,CAAC,CAAC,MAAM,GAAG,CAAC,qBAAqB,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,EAAE,WAAW,CAAC;gBACxE,CAAC,CAAC,SAAS;YACZ,CAAC,CAAC,MAAM,GAAG,CAAC,uBAAuB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACR,WAAW,GAAG,SAAS,CAAC;IACzB,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACzB,iGAAiG;QACjG,sFAAsF;QACtF,OAAO;YACN,UAAU,EAAE;gBACX,MAAM,EAAE,cAAc;gBACtB,OAAO,EAAE,mBAAmB,CAAC,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;aACvE;SACD,CAAC;IACH,CAAC;IACD,+FAA+F;IAC/F,kEAAkE;IAClE,IAAI,mBAAmB,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACvC,CAAC;IAED,0GAA0G;IAC1G,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,KAAK,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE/B,wGAAwG;IACxG,wGAAwG;IACxG,8CAA8C;IAC9C,IAAI,QAAQ,CAAC,EAAE,KAAK,cAAc,IAAI,OAAO,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAE3F,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,WAAW,CAAC;YAC1C,GAAG,YAAY;YACf,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,OAAO;YAChB,YAAY,EAAE,OAAO,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;YAClB,gGAAgG;YAChG,iGAAiG;YACjG,mGAAmG;YACnG,gGAAgG;YAChG,UAAU;YACV,OAAO;gBACN,UAAU,EAAE;oBACX,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC;iBAC9D;aACD,CAAC;QACH,CAAC;QAED,+FAA+F;QAC/F,oGAAoG;QACpG,kGAAkG;QAClG,6FAA6F;QAC7F,wDAAwD;QACxD,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;QAC/C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;QACxC,MAAM,OAAO,GACZ,cAAc,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,IAAI,aAAa,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;QAE5G,MAAM,QAAQ,GAAuB;YACpC,UAAU,EAAE,EAAE;YACd,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO;SAChB,CAAC;QACF,OAAO,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IACnE,CAAC;IAAC,OAAO,EAAE,EAAE,CAAC;QACb,mGAAmG;QACnG,qFAAqF;QACrF,IAAI,UAAgC,CAAC;QACrC,IAAI,EAAE,YAAY,oBAAoB,EAAE,CAAC;YACxC,UAAU,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACtC,CAAC;aAAM,IAAI,EAAE,YAAY,mBAAmB,EAAE,CAAC;YAC9C,UAAU,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3G,CAAC;aAAM,CAAC;YACP,UAAU,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC;QAC3G,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC;IACnC,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB,CAC3B,GAAgC,EAChC,OAAuD,EACvD,YAAoB;IAEpB,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,IAAI,IAAI,IAAI;YAAE,SAAS;QAE3B,6FAA6F;QAC7F,8EAA8E;QAC9E,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC1E,CAAC;aAAM,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,CAAC;IACF,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC;IAE/C,MAAM,IAAI,GAAG,gCAAgC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAC5C,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC;IAE5C,uGAAuG;IACvG,sGAAsG;IACtG,oGAAoG;IACpG,mEAAmE;IACnE,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QACjC,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC;QAEpE,0FAA0F;QAC1F,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACb,IAAI,CAAC;gBACJ,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,KAAK,CAAC;YACd,CAAC;QACF,CAAC;QAED,OAAO,KAAK,CAAC;IACd,CAAC,CAAC,EAAE,QAAQ,CAAC;IACb,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,OAAO,OAAO,CAAC;AAChB,CAAC"}
+{"version":3,"file":"resolveRepository.js","names":[],"sources":["../../../../../plus/integrations/src/reads/resolveRepository.ts"],"sourcesContent":["import type { RemoteProvider } from '@gitlens/git/models/remoteProvider.js';\nimport type { ResourceDescriptor } from '@gitlens/git/models/resourceDescriptor.js';\nimport type { RemoteProviderConfig } from '@gitlens/git/remotes/matcher.js';\nimport { createRemoteProviderMatcher } from '@gitlens/git/remotes/matcher.js';\nimport { parseGitRemoteUrl } from '@gitlens/git/utils/remote.utils.js';\nimport type { ConfiguredIntegrationDescriptor } from '../authentication/models.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { GitCloudHostIntegrationId, GitSelfManagedHostIntegrationId } from '../constants.js';\nimport { AuthenticationError, RequestNotFoundError } from '../errors.js';\nimport { isIssuesIntegration } from '../models/issuesIntegration.js';\nimport { isAzureCloudDomain, isBitbucketCloudDomain, isGitHubDotCom, isGitLabDotCom } from '../providers/models.js';\nimport type { RepositoryIdentity, RepositoryResolution, ResolveRepositoryResult } from '../results.js';\nimport { toProviderWarning } from '../results.js';\nimport { decodePathSegment, getRemoteHostMatcher, hostFromDomain, isWebRemoteScheme } from '../utils/domain.utils.js';\nimport {\n\tgetIntegrationIdForRemote,\n\tgetSelfManagedBaseUrl,\n\tisGitCloudHostIntegrationId,\n\tisGitSelfManagedHostIntegrationId,\n\tremoteProviderTypeForConfig,\n\tremoteProviderTypeForIntegration,\n} from '../utils/integration.utils.js';\nimport type { RepositoryResolutionContext } from './context.js';\nimport { noConnectionWarning } from './warnings.js';\n\ntype ResolveRepositoryOptions = {\n\tproviderId?: IntegrationIds;\n\tremoteUrl: string;\n\thost?: string;\n\tconnectionId?: string;\n\t/**\n\t * Explicit self-managed host domain used to select the integration instance. Used only when the requested\n\t * connection has no configured domain; it must come from the trusted authentication configuration, not\n\t * repository or remote data.\n\t */\n\tdomain?: string;\n};\n\n/**\n * Resolution of a remote URL to a provider repository identity — the facade's equivalent of `gk repo resolve`.\n *\n * Unlike every other read here, this one's input is REPOSITORY data, so most of the code below is about not\n * letting that data choose the credentials: an explicit cloud `providerId` must agree with the remote's canonical\n * host, and a self-managed host resolves only against a domain the user already authenticated. The\n * `host-mismatch` returns are those guards, not edge cases — resolving `owner/repo` against the wrong account\n * would hand back a confidently wrong identity and seed the domain-keyed instance cache from remote data.\n */\nexport async function resolveRepository(\n\tctx: RepositoryResolutionContext,\n\toptions: ResolveRepositoryOptions,\n): Promise<ResolveRepositoryResult> {\n\tconst result = (status: RepositoryResolution['status']): ResolveRepositoryResult => ({\n\t\tresolution: { status: status },\n\t});\n\n\tconst [scheme, parsedDomain, path] = parseGitRemoteUrl(options.remoteUrl);\n\t// An SSH remote's port belongs to its SSH daemon, not to the web authority a connection is keyed by.\n\tconst hostsMatch = getRemoteHostMatcher(scheme);\n\tconst parsedHost = hostFromDomain(parsedDomain);\n\tconst explicitHost = hostFromDomain(options.host);\n\tif (parsedHost != null && explicitHost != null && !hostsMatch(parsedHost, explicitHost)) {\n\t\treturn result('host-mismatch');\n\t}\n\n\tconst matcherDomain = parsedDomain || options.host || '';\n\n\t// An explicit cloud provider must agree with the remote's canonical cloud host. Without this guard the\n\t// synthetic matcher below can reinterpret, for example, a gitlab.com URL as GitHub and then resolve a\n\t// homonymous owner/repo through the wrong account. Match once without caller configs/synthetic entries;\n\t// Azure's matcher also normalizes ssh.dev.azure.com and vs-ssh.visualstudio.com to their web host.\n\tif (options.providerId != null && isGitCloudHostIntegrationId(options.providerId)) {\n\t\tconst nativeProvider = createRemoteProviderMatcher([])(options.remoteUrl, matcherDomain, path, scheme);\n\t\tconst nativeId = nativeProvider != null ? getIntegrationIdForRemote(nativeProvider) : undefined;\n\t\tconst nativeDomain = nativeProvider?.domain ?? matcherDomain;\n\t\tconst canonicalHost =\n\t\t\toptions.providerId === GitCloudHostIntegrationId.GitHub\n\t\t\t\t? isGitHubDotCom(nativeDomain)\n\t\t\t\t: options.providerId === GitCloudHostIntegrationId.GitLab\n\t\t\t\t\t? isGitLabDotCom(nativeDomain)\n\t\t\t\t\t: options.providerId === GitCloudHostIntegrationId.Bitbucket\n\t\t\t\t\t\t? isBitbucketCloudDomain(nativeDomain)\n\t\t\t\t\t\t: isAzureCloudDomain(nativeDomain);\n\t\tif (nativeId !== options.providerId || !canonicalHost) return result('host-mismatch');\n\t}\n\n\tlet provider = createRemoteProviderMatcher(buildMatcherConfigs(ctx, options, parsedDomain))(\n\t\toptions.remoteUrl,\n\t\tmatcherDomain,\n\t\tpath,\n\t\tscheme,\n\t);\n\tif (provider == null) return result('invalid-remote-url');\n\n\tlet id = options.providerId ?? getIntegrationIdForRemote(provider);\n\t// Custom Azure DevOps Server domains matched via getRemoteConfigs return undefined from\n\t// getIntegrationIdForRemote because the provider is marked custom; map them to the server id so the\n\t// project-scoped lookup uses that host's configured connection and API base URL.\n\tif (id == null && provider.id === 'azure-devops' && provider.custom) {\n\t\tid = GitSelfManagedHostIntegrationId.AzureDevOpsServer;\n\t}\n\tif (id == null) return result('unsupported-provider');\n\n\t// On a self-managed host, resolve only against a TRUSTED host: the pinned connection's configured\n\t// domain, the explicit `domain`, or — when neither was supplied — a configured host matching the\n\t// remote's. That last case keeps `remoteUrl` (repository-supplied) out of the trusted path: it selects\n\t// among hosts the user already authenticated and can never introduce a new one. Resolving `owner/repo`\n\t// against some other host's account would, if that host has the same owner/repo, return a confidently\n\t// wrong identity — and would seed the domain-keyed integration cache (never evicted before dispose) with\n\t// an entry derived from repository data.\n\tconst urlHost = hostFromDomain(provider.domain);\n\t// Normalize BOTH sides before comparing: a stored connection domain is usually a full URL\n\t// (`https://git.example.com`) while `urlHost` is already a bare host, so a raw compare would fail on\n\t// scheme/trailing-slash alone and wrongly reject a correctly-configured connection.\n\tlet trustedHost =\n\t\toptions.connectionId != null || options.domain != null\n\t\t\t? hostFromDomain(ctx.resolveDomainForRead(id, options.connectionId, options.domain))\n\t\t\t: undefined;\n\tlet connectionId = options.connectionId;\n\tlet providerRepo: ResourceDescriptor | undefined;\n\tif (isGitSelfManagedHostIntegrationId(id)) {\n\t\tif (path.split('/').some(segment => /^(?:\\.|%2e){1,2}$/i.test(segment) || /%2f|%5c|\\\\/i.test(segment))) {\n\t\t\treturn result('invalid-remote-url');\n\t\t}\n\n\t\tconst configured = ctx.getConfigured(id);\n\t\tconst configuredHosts = configured.map(c => hostFromDomain(c.domain));\n\t\tif (trustedHost == null && urlHost != null) {\n\t\t\tconst matchingHosts = new Set(configuredHosts.filter(host => hostsMatch(host, urlHost)));\n\t\t\tif (matchingHosts.size > 1) return result('host-mismatch');\n\n\t\t\ttrustedHost = matchingHosts.values().next().value;\n\t\t}\n\t\t// A configured host that doesn't match the remote's is a genuine mismatch. With nothing configured\n\t\t// there is no host to mismatch against — it's simply not connected, so fall through to the\n\t\t// `unauthorized` path below (still WITHOUT resolving by the URL domain, so repo data can't seed the\n\t\t// cache).\n\t\tif (trustedHost == null && configuredHosts.length !== 0) return result('host-mismatch');\n\t\tif (trustedHost != null && urlHost != null && !hostsMatch(trustedHost, urlHost)) {\n\t\t\treturn result('host-mismatch');\n\t\t}\n\n\t\tconst installation = matchInstallation(\n\t\t\tctx,\n\t\t\toptions,\n\t\t\tid,\n\t\t\tconfigured.filter(c => hostFromDomain(c.domain) === trustedHost),\n\t\t\t{ scheme: scheme, domain: parsedDomain, path: path },\n\t\t);\n\t\tif (typeof installation === 'string') return result(installation);\n\n\t\tif (installation != null) {\n\t\t\tprovider = installation.provider;\n\t\t\tconnectionId = installation.connectionId;\n\t\t\tproviderRepo = installation.repoDesc;\n\t\t}\n\t}\n\n\tconst owner = provider.owner;\n\tconst name = provider.repoName;\n\tif (owner == null || name == null) return result('invalid-remote-url');\n\n\tproviderRepo ??= provider.repoDesc;\n\n\tlet integration;\n\ttry {\n\t\t// Resolve the instance through the trusted target (as `getIntegrationForRead` does):\n\t\t// `resolveReadSession` looks the session up against the instance's domain-scoped descriptor, so\n\t\t// selecting the instance by the URL domain could miss the session and degrade to `no-connection`.\n\t\tintegration = isGitSelfManagedHostIntegrationId(id)\n\t\t\t? trustedHost != null\n\t\t\t\t? await ctx.getIntegrationForRead(id, connectionId, trustedHost)\n\t\t\t\t: undefined\n\t\t\t: await ctx.getIntegrationForDomain(id, provider.domain);\n\t} catch {\n\t\tintegration = undefined;\n\t}\n\tif (integration == null) {\n\t\t// Attach a warning, as the thrown-AuthenticationError branch below does: a consumer driving auth\n\t\t// recovery off `warning.kind` would otherwise get nothing for an unresolvable target.\n\t\treturn {\n\t\t\tresolution: {\n\t\t\t\tstatus: 'unauthorized',\n\t\t\t\twarning: noConnectionWarning(id, provider.domain, connectionId),\n\t\t\t},\n\t\t};\n\t}\n\t// Issue trackers have no `getRepo` client; a git host without `getRepoFn` leaves `getRepoInfo`\n\t// undefined. Either way this provider can't resolve repositories.\n\tif (isIssuesIntegration(integration) || integration.getRepoInfo == null) {\n\t\treturn result('unsupported-provider');\n\t}\n\n\t// Azure repos are org + project scoped; the remote provider exposes project as `providerDesc.repoDomain`.\n\tconst project = provider.id === 'azure-devops' ? provider.providerDesc?.repoDomain : undefined;\n\tconst domain = trustedHost ?? provider.domain;\n\n\t// Azure's lookup is project-scoped and returns `undefined` without one, which the connection-gap branch\n\t// below would misreport as `unauthorized` (driving a pointless reconnect). A remote URL that carries no\n\t// project simply can't address an Azure repo.\n\tif (provider.id === 'azure-devops' && project == null) return result('invalid-remote-url');\n\n\ttry {\n\t\tconst repo = await integration.getRepoInfo({\n\t\t\t...providerRepo,\n\t\t\towner: owner,\n\t\t\tname: name,\n\t\t\tproject: project,\n\t\t\tconnectionId: connectionId,\n\t\t});\n\t\tif (repo == null) {\n\t\t\t// `getRepoInfo` returns undefined only when no session could be resolved (not connected, or the\n\t\t\t// requested connection is gone) — a real 404 throws below. So this is a connection gap. Attach a\n\t\t\t// warning so a consumer driving auth recovery off `warning.kind` sees the same signal it gets from\n\t\t\t// the thrown-AuthenticationError branch below; without it, the most common unauthorized case is\n\t\t\t// silent.\n\t\t\treturn {\n\t\t\t\tresolution: {\n\t\t\t\t\tstatus: 'unauthorized',\n\t\t\t\t\twarning: noConnectionWarning(id, domain, connectionId),\n\t\t\t\t},\n\t\t\t};\n\t\t}\n\n\t\t// Prefer the provider's canonical namespace/name (GitHub's REST/GraphQL lookup follows the 301\n\t\t// rename redirect, so a stale old name resolves to the new canonical identity), falling back to the\n\t\t// parsed remote when the response omits them. `renamed` is a case-insensitive compare of input vs\n\t\t// canonical, mirroring gkcli's `EqualFold`, so hosts that merely echo the input casing (e.g.\n\t\t// Bitbucket Server/Azure) don't get spuriously flagged.\n\t\tconst canonicalOwner = repo.namespace || owner;\n\t\tconst canonicalName = repo.name || name;\n\t\tconst renamed =\n\t\t\tcanonicalOwner.toLowerCase() !== owner.toLowerCase() || canonicalName.toLowerCase() !== name.toLowerCase();\n\n\t\tconst identity: RepositoryIdentity = {\n\t\t\tproviderId: id,\n\t\t\tdomain: domain,\n\t\t\towner: canonicalOwner,\n\t\t\tname: canonicalName,\n\t\t\tproject: project,\n\t\t\tremoteUrl: options.remoteUrl,\n\t\t\trenamed: renamed,\n\t\t};\n\t\treturn { resolution: { status: 'resolved', identity: identity } };\n\t} catch (ex) {\n\t\t// Order matters: 404 throws RequestNotFoundError (not `undefined`), so check not-found before auth\n\t\t// and before the generic 5xx/unknown bucket — never classify a 401/403 as not-found.\n\t\tlet resolution: RepositoryResolution;\n\t\tif (ex instanceof RequestNotFoundError) {\n\t\t\tresolution = { status: 'not-found' };\n\t\t} else if (ex instanceof AuthenticationError) {\n\t\t\tresolution = { status: 'unauthorized', warning: toProviderWarning(id, domain, connectionId, ex) };\n\t\t} else {\n\t\t\tresolution = { status: 'undetermined', warning: toProviderWarning(id, domain, connectionId, ex) };\n\t\t}\n\t\treturn { resolution: resolution };\n\t}\n}\n\n/**\n * Narrows a web remote on a self-managed host to the configured installation it lives under: the pinned\n * connection's or, unpinned, the one whose installation path is the longest prefix of the remote's, so two\n * installations behind one host each resolve with their own credentials. The provider is re-matched against the\n * path relative to that installation, because the remote parsers expect the repository path to start at the\n * host root. An SSH remote carries no installation path, so it is left to the host-level checks.\n */\nfunction matchInstallation(\n\tctx: RepositoryResolutionContext,\n\toptions: ResolveRepositoryOptions,\n\tid: GitSelfManagedHostIntegrationId,\n\tconnections: ConfiguredIntegrationDescriptor[],\n\tremote: { scheme: string; domain: string; path: string },\n):\n\t| { provider: RemoteProvider; connectionId: string | undefined; repoDesc: ResourceDescriptor }\n\t| 'host-mismatch'\n\t| 'invalid-remote-url'\n\t| undefined {\n\tif (!isWebRemoteScheme(remote.scheme)) return undefined;\n\n\tconst installationPath = (connection: ConfiguredIntegrationDescriptor | undefined): string | undefined => {\n\t\tconst baseUrl = getSelfManagedBaseUrl(\n\t\t\tid,\n\t\t\tconnection != null ? (connection.baseUrl ?? connection.domain) : options.domain,\n\t\t);\n\t\treturn baseUrl != null ? new URL(baseUrl).pathname.replace(/\\/+$/, '') : undefined;\n\t};\n\n\t// The connection an unpinned read already targets comes first, so it wins a tie between installations.\n\tconst defaultConnection = connections.find(c => c.primary) ?? connections[0];\n\t// A cloud sync serves the host's cloud-scoped default instead, even over a local primary (see\n\t// `getStoredSession`), so an unpinned read reaches the default's installation only when both agree.\n\tconst cloudConnections = connections.filter(c => c.cloud);\n\tconst cloudDefault = cloudConnections.find(c => c.primary) ?? cloudConnections[0];\n\tconst isDefaultReadable =\n\t\tdefaultConnection?.cloud !== false ||\n\t\tcloudDefault == null ||\n\t\tinstallationPath(cloudDefault) === installationPath(defaultConnection);\n\t// Whether an unpinned read can reach this connection's session: the default one is read without an id, any\n\t// other only by a real cloud token id. Session lookup treats every connection id as one, and a local (PAT)\n\t// descriptor's or domain-derived legacy id is not (see `getConfiguredConnectionId`).\n\tconst isReadable = (connection: ConfiguredIntegrationDescriptor | undefined): boolean =>\n\t\toptions.connectionId != null ||\n\t\t(connection === defaultConnection\n\t\t\t? isDefaultReadable\n\t\t\t: connection?.cloud === true && hostFromDomain(connection.id) !== connection.domain);\n\n\tconst candidates: (ConfiguredIntegrationDescriptor | undefined)[] =\n\t\toptions.connectionId != null\n\t\t\t? connections.filter(c => c.id === options.connectionId)\n\t\t\t: [defaultConnection, ...connections.filter(c => c !== defaultConnection)];\n\t// With no configured candidate, the explicit (trusted) `domain` is the only installation address there is.\n\tif (!candidates.length) {\n\t\tcandidates.push(undefined);\n\t}\n\n\tconst remotePath = `/${remote.path}`;\n\tconst remoteSegments = remote.path.split('/');\n\t// The remote's path below an installation, or `undefined` when it isn't under it. Azure DevOps Server runs on\n\t// IIS, which serves its paths decoded and case-insensitively, so it compares segment by segment.\n\tconst relativeTo = (basePath: string): string | undefined => {\n\t\tif (id !== GitSelfManagedHostIntegrationId.AzureDevOpsServer) {\n\t\t\treturn remotePath.startsWith(`${basePath}/`) ? remotePath.slice(basePath.length + 1) : undefined;\n\t\t}\n\n\t\tconst baseSegments = basePath.split('/').filter(Boolean);\n\t\tconst isUnder =\n\t\t\tremoteSegments.length > baseSegments.length &&\n\t\t\tbaseSegments.every(\n\t\t\t\t(segment, i) =>\n\t\t\t\t\tdecodePathSegment(segment).toLowerCase() === decodePathSegment(remoteSegments[i]).toLowerCase(),\n\t\t\t);\n\t\treturn isUnder ? remoteSegments.slice(baseSegments.length).join('/') : undefined;\n\t};\n\tlet match: { connection: ConfiguredIntegrationDescriptor | undefined; basePath: string } | undefined;\n\tlet checked = false;\n\tfor (const connection of candidates) {\n\t\tconst basePath = installationPath(connection);\n\t\tif (basePath == null) continue;\n\n\t\tchecked = true;\n\t\tif (relativeTo(basePath) == null) continue;\n\n\t\t// The longest installation wins; on a tie, a readable connection replaces an unreadable one.\n\t\tconst isBetter =\n\t\t\tmatch == null ||\n\t\t\tbasePath.length > match.basePath.length ||\n\t\t\t(basePath.length === match.basePath.length && !isReadable(match.connection) && isReadable(connection));\n\t\tif (isBetter) {\n\t\t\tmatch = { connection: connection, basePath: basePath };\n\t\t}\n\t}\n\tif (match == null) return checked ? 'host-mismatch' : undefined;\n\t// Reading through the default connection instead would address its installation with a path relative to\n\t// another one, so an unreachable installation fails closed.\n\tif (!isReadable(match.connection)) return 'host-mismatch';\n\n\tconst connectionId =\n\t\toptions.connectionId ?? (match.connection !== defaultConnection ? match.connection?.id : undefined);\n\n\tconst matcher = createRemoteProviderMatcher(\n\t\tbuildMatcherConfigs(ctx, { ...options, providerId: id }, remote.domain),\n\t);\n\tconst rematch = (path: string) => matcher(options.remoteUrl, remote.domain, relativeTo(path) ?? '', remote.scheme);\n\tlet basePath = match.basePath;\n\tlet provider = rematch(basePath);\n\tif (id !== GitSelfManagedHostIntegrationId.AzureDevOpsServer) {\n\t\treturn provider != null\n\t\t\t? { provider: provider, connectionId: connectionId, repoDesc: provider.repoDesc }\n\t\t\t: 'invalid-remote-url';\n\t}\n\n\t// An Azure DevOps Server address may name the collection as well as the virtual directory; the parser expects\n\t// the collection in the path, so re-base on the address's parent when no project was found.\n\tif (basePath && provider?.providerDesc?.repoDomain == null) {\n\t\tbasePath = basePath.slice(0, basePath.lastIndexOf('/'));\n\t\tprovider = rematch(basePath);\n\t}\n\tif (provider == null) return 'invalid-remote-url';\n\n\t// Requests address the repository's virtual directory from the host root, not from the installation the\n\t// re-match made it relative to; the absolute form also tells a directory apart from a collection of that name.\n\tconst repoDesc = provider.repoDesc;\n\tconst relative = typeof repoDesc.virtualDirectory === 'string' ? repoDesc.virtualDirectory : undefined;\n\tconst virtualDirectory =\n\t\t[...basePath.split('/').filter(Boolean).map(decodePathSegment), ...(relative?.split('/') ?? [])].join('/') ||\n\t\tundefined;\n\treturn {\n\t\tprovider: provider,\n\t\tconnectionId: connectionId,\n\t\trepoDesc: { ...repoDesc, virtualDirectory: virtualDirectory },\n\t};\n}\n\n/**\n * The remote-matcher configs for this resolution: the user's own host remote configs (self-managed/custom\n * domains), plus a synthetic exact-domain entry for an explicit `providerId` + host so a custom domain still maps\n * to the right provider for path parsing.\n */\nfunction buildMatcherConfigs(\n\tctx: RepositoryResolutionContext,\n\toptions: { providerId?: IntegrationIds; host?: string },\n\tparsedDomain: string,\n): RemoteProviderConfig[] {\n\tconst configs: RemoteProviderConfig[] = [];\n\tfor (const cfg of ctx.getRemoteConfigs()) {\n\t\tconst type = remoteProviderTypeForConfig(cfg.type);\n\t\tif (type == null) continue;\n\n\t\t// Forward both domain- and regex-based custom remotes (carrying any protocol override), so a\n\t\t// regex-configured host resolves instead of falling through to `unsupported`.\n\t\tif (cfg.domain) {\n\t\t\tconfigs.push({ type: type, domain: cfg.domain, protocol: cfg.protocol });\n\t\t} else if (cfg.regex) {\n\t\t\tconfigs.push({ type: type, regex: cfg.regex, protocol: cfg.protocol });\n\t\t}\n\t}\n\tif (options.providerId == null) return configs;\n\n\tconst type = remoteProviderTypeForIntegration(options.providerId);\n\tconst domain = parsedDomain || options.host;\n\tif (type == null || !domain) return configs;\n\n\t// The synthetic exact-domain entry is unshifted to the front, so it wins the match over the user's own\n\t// config for the same host. Carry that config's protocol override across (matched by domain or regex,\n\t// mirroring `ignoreSSLErrors`) so a self-managed host configured for a custom protocol — e.g. plain\n\t// `http` — isn't silently downgraded to the provider default here.\n\tconst lowerDomain = domain.toLowerCase();\n\tconst protocol = configs.find(c => {\n\t\tif (c.type !== type) return false;\n\t\tif (c.domain != null) return c.domain.toLowerCase() === lowerDomain;\n\n\t\t// Truthy (not just non-null): an empty regex would compile to a match-everything pattern.\n\t\tif (c.regex) {\n\t\t\ttry {\n\t\t\t\treturn new RegExp(c.regex, 'i').test(lowerDomain);\n\t\t\t} catch {\n\t\t\t\treturn false;\n\t\t\t}\n\t\t}\n\n\t\treturn false;\n\t})?.protocol;\n\tconfigs.unshift({ type: type, domain: domain, protocol: protocol });\n\treturn configs;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA+CA,eAAsB,kBACrB,KACA,SACmC;CACnC,MAAM,UAAU,YAAqE,EACpF,YAAY,EAAU,OAAO,EAC9B;CAEA,MAAM,CAAC,QAAQ,cAAc,QAAQ,kBAAkB,QAAQ,SAAS;CAExE,MAAM,aAAa,qBAAqB,MAAM;CAC9C,MAAM,aAAa,eAAe,YAAY;CAC9C,MAAM,eAAe,eAAe,QAAQ,IAAI;CAChD,IAAI,cAAc,QAAQ,gBAAgB,QAAQ,CAAC,WAAW,YAAY,YAAY,GACrF,OAAO,OAAO,eAAe;CAG9B,MAAM,gBAAgB,gBAAgB,QAAQ,QAAQ;CAMtD,IAAI,QAAQ,cAAc,QAAQ,4BAA4B,QAAQ,UAAU,GAAG;EAClF,MAAM,iBAAiB,4BAA4B,CAAC,CAAC,CAAC,CAAC,QAAQ,WAAW,eAAe,MAAM,MAAM;EACrG,MAAM,WAAW,kBAAkB,OAAO,0BAA0B,cAAc,IAAI,KAAA;EACtF,MAAM,eAAe,gBAAgB,UAAU;EAC/C,MAAM,gBACL,QAAQ,eAAA,WACL,eAAe,YAAY,IAC3B,QAAQ,eAAA,WACP,eAAe,YAAY,IAC3B,QAAQ,eAAA,cACP,uBAAuB,YAAY,IACnC,mBAAmB,YAAY;EACrC,IAAI,aAAa,QAAQ,cAAc,CAAC,eAAe,OAAO,OAAO,eAAe;CACrF;CAEA,IAAI,WAAW,4BAA4B,oBAAoB,KAAK,SAAS,YAAY,CAAC,CAAC,CAC1F,QAAQ,WACR,eACA,MACA,MACD;CACA,IAAI,YAAY,MAAM,OAAO,OAAO,oBAAoB;CAExD,IAAI,KAAK,QAAQ,cAAc,0BAA0B,QAAQ;CAIjE,IAAI,MAAM,QAAQ,SAAS,OAAO,kBAAkB,SAAS,QAC5D,KAAA;CAED,IAAI,MAAM,MAAM,OAAO,OAAO,sBAAsB;CASpD,MAAM,UAAU,eAAe,SAAS,MAAM;CAI9C,IAAI,cACH,QAAQ,gBAAgB,QAAQ,QAAQ,UAAU,OAC/C,eAAe,IAAI,qBAAqB,IAAI,QAAQ,cAAc,QAAQ,MAAM,CAAC,IACjF,KAAA;CACJ,IAAI,eAAe,QAAQ;CAC3B,IAAI;CACJ,IAAI,kCAAkC,EAAE,GAAG;EAC1C,IAAI,KAAK,MAAM,GAAG,CAAC,CAAC,MAAK,YAAW,qBAAqB,KAAK,OAAO,KAAK,cAAc,KAAK,OAAO,CAAC,GACpG,OAAO,OAAO,oBAAoB;EAGnC,MAAM,aAAa,IAAI,cAAc,EAAE;EACvC,MAAM,kBAAkB,WAAW,KAAI,MAAK,eAAe,EAAE,MAAM,CAAC;EACpE,IAAI,eAAe,QAAQ,WAAW,MAAM;GAC3C,MAAM,gBAAgB,IAAI,IAAI,gBAAgB,QAAO,SAAQ,WAAW,MAAM,OAAO,CAAC,CAAC;GACvF,IAAI,cAAc,OAAO,GAAG,OAAO,OAAO,eAAe;GAEzD,cAAc,cAAc,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EAC7C;EAKA,IAAI,eAAe,QAAQ,gBAAgB,WAAW,GAAG,OAAO,OAAO,eAAe;EACtF,IAAI,eAAe,QAAQ,WAAW,QAAQ,CAAC,WAAW,aAAa,OAAO,GAC7E,OAAO,OAAO,eAAe;EAG9B,MAAM,eAAe,kBACpB,KACA,SACA,IACA,WAAW,QAAO,MAAK,eAAe,EAAE,MAAM,MAAM,WAAW,GAC/D;GAAU;GAAQ,QAAQ;GAAoB;EAAK,CACpD;EACA,IAAI,OAAO,iBAAiB,UAAU,OAAO,OAAO,YAAY;EAEhE,IAAI,gBAAgB,MAAM;GACzB,WAAW,aAAa;GACxB,eAAe,aAAa;GAC5B,eAAe,aAAa;EAC7B;CACD;CAEA,MAAM,QAAQ,SAAS;CACvB,MAAM,OAAO,SAAS;CACtB,IAAI,SAAS,QAAQ,QAAQ,MAAM,OAAO,OAAO,oBAAoB;CAErE,iBAAiB,SAAS;CAE1B,IAAI;CACJ,IAAI;EAIH,cAAc,kCAAkC,EAAE,IAC/C,eAAe,OACd,MAAM,IAAI,sBAAsB,IAAI,cAAc,WAAW,IAC7D,KAAA,IACD,MAAM,IAAI,wBAAwB,IAAI,SAAS,MAAM;CACzD,QAAQ;EACP,cAAc,KAAA;CACf;CACA,IAAI,eAAe,MAGlB,OAAO,EACN,YAAY;EACX,QAAQ;EACR,SAAS,oBAAoB,IAAI,SAAS,QAAQ,YAAY;CAC/D,EACD;CAID,IAAI,oBAAoB,WAAW,KAAK,YAAY,eAAe,MAClE,OAAO,OAAO,sBAAsB;CAIrC,MAAM,UAAU,SAAS,OAAO,iBAAiB,SAAS,cAAc,aAAa,KAAA;CACrF,MAAM,SAAS,eAAe,SAAS;CAKvC,IAAI,SAAS,OAAO,kBAAkB,WAAW,MAAM,OAAO,OAAO,oBAAoB;CAEzF,IAAI;EACH,MAAM,OAAO,MAAM,YAAY,YAAY;GAC1C,GAAG;GACI;GACD;GACG;GACK;EACf,CAAC;EACD,IAAI,QAAQ,MAMX,OAAO,EACN,YAAY;GACX,QAAQ;GACR,SAAS,oBAAoB,IAAI,QAAQ,YAAY;EACtD,EACD;EAQD,MAAM,iBAAiB,KAAK,aAAa;EACzC,MAAM,gBAAgB,KAAK,QAAQ;EACnC,MAAM,UACL,eAAe,YAAY,MAAM,MAAM,YAAY,KAAK,cAAc,YAAY,MAAM,KAAK,YAAY;EAW1G,OAAO,EAAE,YAAY;GAAE,QAAQ;GAAY,UAAU;IARpD,YAAY;IACJ;IACR,OAAO;IACP,MAAM;IACG;IACT,WAAW,QAAQ;IACV;GAEkD;EAAE,EAAE;CACjE,SAAS,IAAI;EAGZ,IAAI;EACJ,IAAI,cAAc,sBACjB,aAAa,EAAE,QAAQ,YAAY;OAC7B,IAAI,cAAc,qBACxB,aAAa;GAAE,QAAQ;GAAgB,SAAS,kBAAkB,IAAI,QAAQ,cAAc,EAAE;EAAE;OAEhG,aAAa;GAAE,QAAQ;GAAgB,SAAS,kBAAkB,IAAI,QAAQ,cAAc,EAAE;EAAE;EAEjG,OAAO,EAAc,WAAW;CACjC;AACD;;;;;;;;AASA,SAAS,kBACR,KACA,SACA,IACA,aACA,QAKY;CACZ,IAAI,CAAC,kBAAkB,OAAO,MAAM,GAAG,OAAO,KAAA;CAE9C,MAAM,oBAAoB,eAAgF;EACzG,MAAM,UAAU,sBACf,IACA,cAAc,OAAQ,WAAW,WAAW,WAAW,SAAU,QAAQ,MAC1E;EACA,OAAO,WAAW,OAAO,IAAI,IAAI,OAAO,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE,IAAI,KAAA;CAC1E;CAGA,MAAM,oBAAoB,YAAY,MAAK,MAAK,EAAE,OAAO,KAAK,YAAY;CAG1E,MAAM,mBAAmB,YAAY,QAAO,MAAK,EAAE,KAAK;CACxD,MAAM,eAAe,iBAAiB,MAAK,MAAK,EAAE,OAAO,KAAK,iBAAiB;CAC/E,MAAM,oBACL,mBAAmB,UAAU,SAC7B,gBAAgB,QAChB,iBAAiB,YAAY,MAAM,iBAAiB,iBAAiB;CAItE,MAAM,cAAc,eACnB,QAAQ,gBAAgB,SACvB,eAAe,oBACb,oBACA,YAAY,UAAU,QAAQ,eAAe,WAAW,EAAE,MAAM,WAAW;CAE/E,MAAM,aACL,QAAQ,gBAAgB,OACrB,YAAY,QAAO,MAAK,EAAE,OAAO,QAAQ,YAAY,IACrD,CAAC,mBAAmB,GAAG,YAAY,QAAO,MAAK,MAAM,iBAAiB,CAAC;CAE3E,IAAI,CAAC,WAAW,QACf,WAAW,KAAK,KAAA,CAAS;CAG1B,MAAM,aAAa,IAAI,OAAO;CAC9B,MAAM,iBAAiB,OAAO,KAAK,MAAM,GAAG;CAG5C,MAAM,cAAc,aAAyC;EAC5D,IAAI,OAAA,uBACH,OAAO,WAAW,WAAW,GAAG,SAAS,EAAE,IAAI,WAAW,MAAM,SAAS,SAAS,CAAC,IAAI,KAAA;EAGxF,MAAM,eAAe,SAAS,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAOvD,OALC,eAAe,SAAS,aAAa,UACrC,aAAa,OACX,SAAS,MACT,kBAAkB,OAAO,CAAC,CAAC,YAAY,MAAM,kBAAkB,eAAe,EAAE,CAAC,CAAC,YAAY,CAChG,IACgB,eAAe,MAAM,aAAa,MAAM,CAAC,CAAC,KAAK,GAAG,IAAI,KAAA;CACxE;CACA,IAAI;CACJ,IAAI,UAAU;CACd,KAAK,MAAM,cAAc,YAAY;EACpC,MAAM,WAAW,iBAAiB,UAAU;EAC5C,IAAI,YAAY,MAAM;EAEtB,UAAU;EACV,IAAI,WAAW,QAAQ,KAAK,MAAM;EAOlC,IAHC,SAAS,QACT,SAAS,SAAS,MAAM,SAAS,UAChC,SAAS,WAAW,MAAM,SAAS,UAAU,CAAC,WAAW,MAAM,UAAU,KAAK,WAAW,UAAU,GAEpG,QAAQ;GAAc;GAAsB;EAAS;CAEvD;CACA,IAAI,SAAS,MAAM,OAAO,UAAU,kBAAkB,KAAA;CAGtD,IAAI,CAAC,WAAW,MAAM,UAAU,GAAG,OAAO;CAE1C,MAAM,eACL,QAAQ,iBAAiB,MAAM,eAAe,oBAAoB,MAAM,YAAY,KAAK,KAAA;CAE1F,MAAM,UAAU,4BACf,oBAAoB,KAAK;EAAE,GAAG;EAAS,YAAY;CAAG,GAAG,OAAO,MAAM,CACvE;CACA,MAAM,WAAW,SAAiB,QAAQ,QAAQ,WAAW,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI,OAAO,MAAM;CACjH,IAAI,WAAW,MAAM;CACrB,IAAI,WAAW,QAAQ,QAAQ;CAC/B,IAAI,OAAA,uBACH,OAAO,YAAY,OAChB;EAAY;EAAwB;EAAc,UAAU,SAAS;CAAS,IAC9E;CAKJ,IAAI,YAAY,UAAU,cAAc,cAAc,MAAM;EAC3D,WAAW,SAAS,MAAM,GAAG,SAAS,YAAY,GAAG,CAAC;EACtD,WAAW,QAAQ,QAAQ;CAC5B;CACA,IAAI,YAAY,MAAM,OAAO;CAI7B,MAAM,WAAW,SAAS;CAC1B,MAAM,WAAW,OAAO,SAAS,qBAAqB,WAAW,SAAS,mBAAmB,KAAA;CAC7F,MAAM,mBACL,CAAC,GAAG,SAAS,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,iBAAiB,GAAG,GAAI,UAAU,MAAM,GAAG,KAAK,CAAC,CAAE,CAAC,CAAC,KAAK,GAAG,KACzG,KAAA;CACD,OAAO;EACI;EACI;EACd,UAAU;GAAE,GAAG;GAA4B;EAAiB;CAC7D;AACD;;;;;;AAOA,SAAS,oBACR,KACA,SACA,cACyB;CACzB,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,OAAO,IAAI,iBAAiB,GAAG;EACzC,MAAM,OAAO,4BAA4B,IAAI,IAAI;EACjD,IAAI,QAAQ,MAAM;EAIlB,IAAI,IAAI,QACP,QAAQ,KAAK;GAAQ;GAAM,QAAQ,IAAI;GAAQ,UAAU,IAAI;EAAS,CAAC;OACjE,IAAI,IAAI,OACd,QAAQ,KAAK;GAAQ;GAAM,OAAO,IAAI;GAAO,UAAU,IAAI;EAAS,CAAC;CAEvE;CACA,IAAI,QAAQ,cAAc,MAAM,OAAO;CAEvC,MAAM,OAAO,iCAAiC,QAAQ,UAAU;CAChE,MAAM,SAAS,gBAAgB,QAAQ;CACvC,IAAI,QAAQ,QAAQ,CAAC,QAAQ,OAAO;CAMpC,MAAM,cAAc,OAAO,YAAY;CACvC,MAAM,WAAW,QAAQ,MAAK,MAAK;EAClC,IAAI,EAAE,SAAS,MAAM,OAAO;EAC5B,IAAI,EAAE,UAAU,MAAM,OAAO,EAAE,OAAO,YAAY,MAAM;EAGxD,IAAI,EAAE,OACL,IAAI;GACH,OAAO,IAAI,OAAO,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,WAAW;EACjD,QAAQ;GACP,OAAO;EACR;EAGD,OAAO;CACR,CAAC,CAAC,EAAE;CACJ,QAAQ,QAAQ;EAAQ;EAAc;EAAkB;CAAS,CAAC;CAClE,OAAO;AACR"}