@gitkraken/core-gitlens 0.7.2 → 0.9.0

package/docs/kepler-git-write-api-parity.md

@@ -0,0 +1,365 @@
+# Kepler git write-API parity
+
+Decision record for the git WRITE-path gaps Kepler hit while routing every one of its git calls through
+`@gitkraken/core-gitlens` (gitkraken/kepler, branch `kepler/migrate-raw-git-spawns`). It is the sibling of
+[`kepler-read-api-parity.md`](./kepler-read-api-parity.md), which covers provider reads; this one covers the
+`git` sub-providers and the raw-command escape hatch.
+
+The shape of the problem: Kepler drives three libraries (`@gitkraken/sync-tools`, `conflict-tools`,
+`compose-tools`) that take a `{ exec }` git port plus optional typed ops, and know nothing of core; the host
+supplies a typed op only where a core call serves it exactly. Kepler also has its own worktree, branch and
+sync services. After the migration every command runs through core's executor, so it already shares the queue, environment, binary
+resolution and logging. What it could NOT do is use a typed sub-provider method for a set of commands core had
+no method for, or had one whose contract did not fit. Each such site stayed on `provider.git.run` with a
+comment naming the missing API. This document is the list of those APIs, what was added for each, and what was
+deliberately left alone.
+
+§1–§9 were the first round. §10–§19 are the second: the commands Kepler still ran raw once the first round
+shipped, each because a typed method lacked one option or one behavior.
+
+Verdict legend: **added** (a typed method now exists) · **extended** (an existing method gained the missing
+option) · **deferred** (left on the raw escape hatch on purpose, with the reason).
+
+## 1. Compare-and-swap ref updates — added
+
+`refs.updateReference` ran `git update-ref <ref> <sha>` and swallowed every failure (logged, resolved
+`undefined`), and there was no delete form. `@gitkraken/sync-tools` (0.4.0) publishes, applies and discards a
+sync result itself (`applyPublishedSync`, `discardPublishedSync`), and every ref move in that flow is a
+compare-and-swap: the real branch advances only if nothing else moved it since the library last read it. The
+library asks its host for that through a typed `updateRef(ref, sha, { previousSha, mustNotExist, remove })`
+op, and git's own `update-ref <ref> <new> <old>` is what makes it atomic. A writer that cannot refuse is a
+clobber, so without this a host could only serve the op through the raw escape hatch.
+
+- `updateReference(repoPath, ref, sha, options?: { expected?: string | 'absent' }, cancellation?)` now passes
+  the old value to git when `expected` is a sha, and the empty old value when it is `'absent'` (create only if
+  the ref does not exist yet). It THROWS a typed `ReferenceUpdateError` — reasons `conflict` (the ref moved,
+  or exists when it must not), `invalidRef`, `invalidObject`, `notFound` — instead of swallowing.
+- `deleteReference(repoPath, ref, options?: { expected?: string }, cancellation?)` runs
+  `update-ref -d --no-deref <ref> [<expected>]` with the same error — `--no-deref` so a symbolic ref is itself
+  deleted rather than the ref it points to — and refuses `HEAD` (`checkedOut`). `update-ref -d` has none of
+  `git branch -d`'s guards or cleanup, so for a local branch (`refs/heads/<name>`) `deleteReference` supplies
+  them: it refuses a branch checked out in any worktree (`checkedOut`, read from `git worktree list`, not the
+  cached list), and removes the `branch.<name>` config section and GitLens's per-branch metadata with the ref.
+  Only `git branch -d`'s merged check is left out, since a compare-and-swap caller has already decided.
+- Both fire the cache and repository hooks a branch, remote-tracking, tag or `HEAD` move fires; a ref in another
+  namespace (`refs/kepler/...`) announces nothing, since nothing core caches can observe it and an `unknown`
+  change would make a host refresh everything.
+
+The sync-tools op maps onto these one-to-one:
+
+| `updateRef` option | core call                                                        |
+| ------------------ | ---------------------------------------------------------------- |
+| `previousSha`      | `updateReference(repoPath, ref, sha, { expected: previousSha })` |
+| `mustNotExist`     | `updateReference(repoPath, ref, sha, { expected: 'absent' })`    |
+| `remove`           | `deleteReference(repoPath, ref, { expected: previousSha })`      |
+| none               | `updateReference(repoPath, ref, sha)`                            |
+
+`'absent'` against an existing ref rejects as `conflict` and leaves the ref where it was. Deleting a ref that
+is already gone rejects as `notFound` when `expected` is given (the caller named a value it expected to
+remove), and resolves when it is not.
+
+The library reads any rejection as the ref's answer, so the host must tell a cancellation apart from a
+refusal. A cancelled call rejects with core's `CancellationError` (`name === 'CancellationError'`), never a
+`ReferenceUpdateError`, and that includes a signal already aborted when the call is made; a host adapting to
+a library that expects `AbortError` maps it by name. A cancel that lands while git is running says nothing
+about whether the ref moved, so re-read it before acting on the outcome.
+
+**Breaking:** a caller that relied on a failed `updateReference` resolving silently now gets a rejection. No
+caller in this repository did.
+
+## 2. Who clears after a write, and telling core about a raw one — changed / added
+
+A typed mutator announces its write through `hooks.cache.onReset`, and core used to clear nothing itself on
+that path: each host's handler was expected to forward to `Cache.clearCaches`. Two things followed. A host
+with no handler kept serving pre-write reads after every typed write. And `clearCaches` only soft-invalidates
+a shared entry that is still in flight, so even a wired host could hand a caller that arrived after the write
+a read that started before it; GitLens also dropped the executor's pending commands on every reset, Kepler did
+not.
+
+A consumer that mutates through `provider.git.run` (a rebase driven by a library, a `clean`, a ref bookkeeping
+write) had nothing to call at all, and typed reads served the pre-mutation answer until a file watcher caught
+up, or forever with no watcher. Kepler classified verbs itself and called `clearCaches` after each one. The
+sharpest case: it fetches PR heads through a raw `fetch` (it needs a per-process credential environment the
+typed fetch cannot carry), and a typed `refs.validateReference` right after it served the pre-fetch tip for up
+to 60s. `clearCaches` fixed that read but fired none of the host's hooks, so nothing else in the host learned
+the refs moved.
+
+- The provider wraps `onReset` when it is constructed. On every reset it hard-evicts its own caches for those
+  types (`Cache.evictCaches`, so a later caller never joins pre-write work), drops the written repository's
+  pending commands (its registered worktrees' included, no other repository's), then calls the host's handler.
+  Clears driven by a file watcher reach `clearCaches` directly and keep sharing in-flight reads, which is what
+  stops a burst of file events from spawning duplicate reads. A host's handler now only has host-side state to
+  update; forwarding to `clearCaches` as well is redundant but harmless.
+- `provider.notifyChanged(repoPath, changes: RepositoryChange[], options?: { cache?: CachedGitTypes[] | 'all' })`
+  fires the same `cache.onReset` and `repository.onChanged` a typed write would, so a raw mutation gets the
+  same treatment, host listeners included. Without `cache` it resets what `changes` map to, the same caches a
+  file watcher's change of those kinds clears; an empty `changes`, or one naming `unknown`, resets everything,
+  and `cache: 'all'` always does. A consumer naming its own changes must name every kind the write can touch
+  (a `commit` that concludes a merge is `pausedOp` too), or those caches keep their pre-write answer.
+
+## 3. Worktree administration — added / extended
+
+- `worktrees.pruneWorktrees(repoPath, options?: { expire? })` — `git worktree prune`. Kepler prunes
+  after a directory it removed by hand, and before reusing a path git still lists. Like `deleteWorktree`, it
+  unregisters each worktree it removed from the cache.
+- `worktrees.lockWorktree(repoPath, path, options?: { reason? })` — `git worktree lock --reason`. The reason
+  is how Kepler marks a worktree as task-owned; only `unlockWorktree` existed.
+- `worktrees.createWorktree(repoPath, path, options?, runOptions?)` and
+  `deleteWorktree(repoPath, path, options?, runOptions?)` — gained run options. A large worktree's checkout or
+  removal legitimately outlasts the default per-command timeout, and a caller may need to cancel either. A
+  cancelled call rejects as `CancellationError`, not a worktree error. The thrown `WorktreeDeleteError` keeps git's
+  raw output reachable on `original`, which is what a platform-specific retry classifier needs.
+
+## 4. `git clean`, and the staging sub-provider's missing hooks — added / fixed
+
+- `staging.clean(repoPath, options?: { paths?, directories?, force?, ignored? })` — the only way to
+  discard untracked files; `ops.restore` cannot.
+- Every staging mutation (`stageFile(s)`, `stageDirectory`, `stageAll`, `unstage*`, `removeFile(s)`, `clean`)
+  now fires `onReset('status', 'diff', 'tracking')` and the index change, except when it targets a temporary
+  index, which is not the repository's. Before this, a consumer that staged a conflict resolution through the
+  typed API and then read `getConflictingFiles()` could be answered from the index as it stood before the
+  stage.
+
+## 5. Upstream and hooks config keys — added
+
+Kepler writes `branch.<name>.remote` / `branch.<name>.merge` (to set an upstream whose remote ref does not
+exist yet, which `--set-upstream-to` refuses) and reads `core.hooksPath`. All three are now documented members
+of `GitConfigKeys`, so `config.getConfig` / `setConfig` serve them with the usual cache. Writing either
+upstream key also resets the cached branch list, which reports the upstream.
+
+## 6. `git pull --ff-only` — extended
+
+`ops.pull` gained `fastForward: 'only'`, spelled as `ops.merge` spells it. Kepler advances a local base branch
+before forking a task worktree from it, and must not create a merge commit or start a rebase in a checkout it
+does not own. A refused fast-forward is a `PullError` with the new `noFastForward` reason (the name
+`FetchError` already uses); before this it fell through to `other`. A base branch checked out nowhere has no
+working tree to pull into, so it is advanced by fetching `<upstream>:<branch>`, which git refuses unless it
+fast-forwards; without the option that path only fetches. That fetch runs without `--update-head-ok`: "checked
+out nowhere" comes from the cached worktree list, so git's own refusal is what keeps a branch that is in fact
+checked out from moving. A branch with no upstream is `PullError` reason `noUpstream`, on this path and for a
+checked-out pull alike. `merge`'s `true` / `false` are not offered: a pull configured to rebase ignores `--ff`
+/ `--no-ff`.
+
+## 7. A commit from a tree with several parents and an author — added
+
+A compose or stack engine writes merge commits and replays commits with their original author, which the
+single-parent, identity-less `commits.createUnreachableCommitFromTree` could not.
+
+- `commits.createCommitFromTree(repoPath, tree, { parents, message, author?, committer?, sign?, source? })` runs
+  `commit-tree` with the message on stdin and the identity in the per-call environment, returning the sha.
+  With `sign` it reports a signing failure as `SigningError` and fires the signing hooks.
+- It is the only path that writes a commit object. `createUnreachableCommitFromTree` is removed, and the patch
+  sub-provider's commits (`createUnreachableCommitForPatch`, `createUnreachableCommitsFromPatches`,
+  `createEmptyInitialCommit`) go through it with unchanged results.
+
+## 8. `git init` — added
+
+`GitProvider.clone` existed; `init(path, options?: { defaultBranch?, bare? })` did not. Kepler creates a
+repository for a folder the user adds.
+
+## 9. Forced ref reads — added
+
+After a change core neither made nor was told about (another process moving a branch, a raw `fetch` the
+consumer has not reported yet), an ordinary read can answer from cache until its TTL runs out. `notifyChanged`
+is the fix when the consumer made the change; `force` is for a read that must be current regardless.
+
+- `refs.validateReference(repoPath, ref, { relativePath?, force? }, cancellation?)`,
+  `refs.getReference(repoPath, ref, { force? }, cancellation?)`,
+  `branches.getBranch(repoPath, name?, { force? }, cancellation?)` and
+  `revision.resolveRevision(repoPath, ref, pathOrUri?, { force? })`. A forced read drops its cache entry before
+  reading, so it neither returns the cached answer nor joins a read already in flight (a fresh entry gets a
+  fresh cancellation aggregate, whose id is part of the executor's dedup key), and it stores the fresh answer
+  for later unforced reads. `getStatus({ force })` and `getPausedOperationStatus({ force })` are the precedent.
+- `getBranch({ force })` evicts the whole branch cascade first: branch lists, ref tips, merge bases, commit
+  counts and resolved revisions, the set a branch move clears, since each can be derived from a ref that moved.
+  `getReference({ force })` forces its validation and branch lookup; tags are not forced.
+- `validateReference`'s `relativePath` moved into the options object, and `getBranch` / `getReference` take
+  options before `cancellation`, matching `getStatus`.
+
+## 10. An inherited git environment — fixed
+
+A host launched by git (a hook, a `rebase -x` step, an editor opened as `GIT_EDITOR`) inherits that
+repository's `GIT_DIR`, `GIT_WORK_TREE`, `GIT_INDEX_FILE` and friends, and git lets them override the working
+directory, so every command core ran targeted the launching repository. The base environment now drops
+`GIT_DIR`, `GIT_WORK_TREE`, `GIT_INDEX_FILE`, `GIT_COMMON_DIR`, `GIT_OBJECT_DIRECTORY`,
+`GIT_ALTERNATE_OBJECT_DIRECTORIES` and `GIT_NAMESPACE` from the inherited `process.env`, plus the state git
+hands a child about its own command: `GIT_CONFIG_PARAMETERS` (its `-c` options), `GIT_EXEC_PATH`, `GIT_PREFIX`
+and `GIT_REFLOG_ACTION`. None is worth keeping when set deliberately: a `GIT_DIR` would point every repository
+the host opens at one. `GIT_AUTHOR_*` / `GIT_COMMITTER_*` are different, since a deliberate identity (direnv,
+say) breaks nothing, so they are dropped only when git launched the host, which it always marks by exporting
+`GIT_EXEC_PATH`: an editor opened for `commit --amend` inherits that commit's author and date. `GIT_CONFIG_COUNT` /
+`GIT_CONFIG_KEY_<n>` / `GIT_CONFIG_VALUE_<n>` are kept: git never sets them itself, so inherited ones are the
+user's deliberate configuration. Only the inherited environment is scrubbed; a host's `env`, `getEnvironment()`
+and a per-call `env` can still set any of these, as temporary-index staging does with `GIT_INDEX_FILE`.
+
+## 11. Run options on stash and clean — extended
+
+`stash.applyStash`, `stash.saveStash` and `staging.clean` take the trailing `runOptions` (`env`,
+`cancellation`, `timeout`) every other long-running operation already did. No typed default changed: see the
+timeout decision below.
+
+## 12. A raw run that announces its own change — added
+
+`git.run({ notify })` calls the provider's `notifyChanged` once the run settles, succeeded or failed (a
+command that fails partway may still have moved something). An explicit `RepositoryChange[]` announces exactly
+that. `'infer'` classifies the argv: read-only and object-store-only commands announce nothing, a write
+announces its verb's changes for the repository it ran in (the `-C` target when given). Run under `-C`, a
+write also announces to the caller's own tree the kinds every worktree sharing that `.git` sees (`heads`,
+`tags`, `stash`, `remotes`, `worktrees`, `config`), since the target may be a worktree the cache never
+registered; its HEAD, index, paused operation and FETCH_HEAD are the target's alone. A write it can't
+classify resets both trees in full. Unset, nothing is classified and the run takes the same path as before.
+
+## 13. Fetch with explicit refspecs, and without FETCH_HEAD — extended
+
+- `ops.fetch(repoPath, { remote, refspecs, prune? })` passes the refspecs verbatim after the remote
+  (`+refs/heads/x:refs/remotes/o/x`, `upstream:local`). It never adds `-u`, so git keeps refusing to write
+  into a checked-out branch, which a caller fast-forwarding a branch checked out nowhere relies on. A refspec
+  whose destination is a local branch or tag also announces `heads` or `tags`. The type refuses `refspecs`
+  beside `branch`, `all` or `pull`.
+- `preserveFetchHead` passes `--no-write-fetch-head`, on every form of fetch. A checkout has one
+  `FETCH_HEAD`, and a user's own `git pull` reads it back right after its fetch, so a background fetch landing
+  in between breaks that pull. Git older than 2.29 has no such flag; there the option is ignored rather than
+  failing the fetch.
+
+## 14. Clone into an exact folder — extended
+
+`clone(url, parentPath, { folderName }, runOptions)`, on both core's `GitProvider` and GitLens's
+`GlGitProvider`. `folderName` is used as given, with no numbering past a taken name, so git's own refusal of a
+non-empty folder surfaces. Without it the folder is derived from the URL and numbered as before. `runOptions`
+carries the clone's credentials, cancellation and timeout.
+
+## 15. Status without untracked detail or branch state — extended
+
+`status.getStatus(repoPath, { untracked: 'no' | 'normal' | 'all', branch: false })`. `untracked` picks git's
+`-u` mode (default `all`, as before). `branch: false` skips `--branch`, whose ahead/behind against the upstream
+is the slow part on a large divergence; the result's `branch`, `sha`, `upstream` and `detached` are then unset
+and mean nothing. A narrower read gets its own dedup key, so a full-status caller never joins it and loses
+files. `GIT_OPTIONAL_LOCKS=0` was already set on every status read, so there is no lock option.
+
+## 16. A reflog read filtered by message — added
+
+`refs.getReflogEntries(repoPath, ref, { grep? })` returns `{ sha, message }` per entry, newest first, where
+`grep` is git's `--grep-reflog` pattern. It resolves `[]` when nothing matches or the ref has no reflog, and
+rejects when the read fails, so a caller can tell "no answer" from "never read". It runs `reflog show <ref> --`,
+not `reflog <ref>`: a branch named `delete`, `expire` or `exists` would otherwise run that subcommand, and one
+named like a tracked file would fail as ambiguous. Core's own base-branch inference moved onto it, which
+fixed both cases there.
+
+## 17. Commit counts that exclude other refs — extended
+
+`commits.getCommitCount(repoPath, rev, { excluding: { branches?, remotes?, tags?, refs?, except? } },
+cancellation?)` counts what `rev` has that other refs don't, such as what deleting a branch would orphan.
+`branches` / `remotes` / `tags` exclude a whole namespace, `refs` adds revisions verbatim, and `except` takes
+full ref names back out of an excluded namespace. Core rewrites each `except` entry to the short form and
+places it right before its own `--branches` / `--remotes` / `--tags`, because git matches `--exclude` against
+the short name and applies it only to the next pseudo-ref option. The spelling that reads naturally,
+`--exclude=refs/heads/x --branches`, excludes nothing. The GitHub provider returns `undefined` for an excluding
+count, which its API cannot answer. A count is cached until a branch, remote-tracking branch or tag changes,
+so a `refs` entry outside those namespaces (a tool's own `refs/<tool>/…`) can move without refreshing it;
+pass its SHA instead, which keys a new read.
+
+`commits.getLogShas` takes the same `excluding`, listing the SHAs instead of counting them; an omitted `rev` is
+anchored to `HEAD` (a bare `--not` lists nothing), and the GitHub provider returns no SHAs.
+
+**Breaking:** `getCommitCount` takes `options` before `cancellation`.
+
+## 18. The empty tree in the repository's object format — added / fixed
+
+The empty tree's id differs between SHA-1 and SHA-256 repositories, and core hardcoded the SHA-1 one as
+`rootSha`, so every diff against a root commit's missing parent failed in a SHA-256 repository.
+`revision.getEmptyTreeSha(repoPath)` computes it with `hash-object -t tree --stdin` (no `-w`; git knows the
+empty tree without storing it), once per repository and shared across its worktrees. Every `rootSha` use now
+goes through it, and `rootSha` is removed. GitHub repositories are always SHA-1.
+
+**Breaking:** `rootSha` is removed from `@gitlens/git/models/revision`.
+
+## 19. A link's clone of a large repository — fixed (GitLens)
+
+Not a Kepler gap, found alongside §14: GitLens's deep-link clone ran under `gitlens.advanced.git.timeout` and
+died partway through a large repository. It now runs uncapped, from a cancellable progress notification.
+
+## Overlaps with existing APIs, and how each was settled
+
+- **Refs containing a sha.** `branches.getBranchesWithCommits(repoPath, [sha], undefined, { all, mode })` and
+  `tags.getTagsWithCommit` already answer it, so `getRefTips` did not gain `--contains` / `--points-at`
+  filters. Kepler's one use (is a sha on any other local or remote branch) is `getBranchesWithCommits`.
+- **Config keys.** Added to the documented union rather than served by a separate untyped
+  `getConfigValue` / `setConfigValue`, which would have been a second way to read every key.
+- **Commit objects.** `createCommitFromTree` replaced `createUnreachableCommitFromTree` and the patch
+  sub-provider's own `commit-tree` calls, rather than sitting beside them.
+- **Deleting refs.** `deleteReference` stays beside `branches.deleteLocalBranch` and `tags.deleteTag` on
+  purpose. `deleteLocalBranch` keeps `git branch -d`'s merged check, which the delete flow's force-retry relies
+  on, and takes several names; `deleteTag` reports a `TagError` the UI renders. `deleteReference` is the
+  compare-and-swap form for any namespace, and shares the branch cleanup with `deleteLocalBranch`.
+- **Clearing caches.** `evictCaches` stays beside `clearCaches`: a write hard-evicts, a watcher clear keeps
+  sharing in-flight reads (see the decisions below).
+- **Reflog reads.** `getReflogEntries` stays beside `commits.getIncomingActivity`, which walks `HEAD`'s reflog
+  for merges and pulls, pages, and aggregates; a message grep on it would change its paging. Core's private
+  reflog greps were folded into `getReflogEntries` rather than kept.
+- **Dirty checks.** `getStatus({ untracked, branch: false })` stays beside `status.hasWorkingChanges`, which
+  answers yes/no with early exits; a caller counting files needs the list.
+- **Unpushed commits.** `getCommitCount({ excluding })` stays beside `hasUnpublishedCommits` /
+  `filterUnpublishedShas`, which are early-exit probes against remotes alone and count nothing.
+
+## Deferred, deliberately
+
+- **Index and object plumbing** (`read-tree`, `write-tree`, `update-index --index-info`, `mktree`,
+  `hash-object -w --stdin`, `cat-file -p`). The libraries drive these through `exec` with a scratch
+  `GIT_INDEX_FILE` and parse the results themselves; a typed surface would re-encode the same argv with more
+  room to drift. Revisit when a second consumer needs them.
+- **Generic `for-each-ref` with a caller-supplied format.** The `RefRecord` shape is private on purpose.
+- **A typed `worktree remove` for every consumer.** Kept the raw form where a consumer classifies platform
+  failures from stderr; §3's `original` makes the typed form usable for that too.
+
+## Bridging core into the tools libraries
+
+The libraries take their own port and know nothing of core, so a host serving one through core reshapes what
+core rejects with:
+
+- **Cancellation.** Core rejects with `CancellationError` (`name === 'CancellationError'`); a library that
+  expects `AbortError` gets it mapped by name.
+- **"Git answered no" versus a structural failure.** sync-tools tells them apart by whether `err.code` is a
+  number, and compose-tools reads `err.stderr`: the shape of Node's `execFile` error. Core's `GitError`
+  carries `stderr` but reports the exit as `exitCode`, which is a number or numeric string for a real exit and
+  an errno string (`'ENOENT'`) when git never started. A typed method's own error, such as
+  `ReferenceUpdateError`, keeps that `GitError` on `original`.
+
+## Decisions worth recording, because each closes off a plausible-looking alternative
+
+- `updateReference` throws rather than gaining an `errors: 'throw'` option. A ref writer whose failures are
+  invisible by default is the bug, not a mode.
+- `'absent'` rather than `expected: ''`. The empty old value is git's encoding of "must not exist"; a caller
+  spelling it as an empty string reads like a mistake, and an argv filter that drops empty strings would turn
+  a create into an unconditional overwrite.
+- New config keys join `GitConfigKeys` rather than widening it to `string` or adding an untyped read. The
+  union's value is that every listed key is documented; an escape hatch would keep the autocomplete and lose
+  the guarantee.
+- `deleteReference` gives a branch `git branch -d`'s guard and cleanup rather than refusing branches. A
+  compare-and-swap delete of a branch is legitimate (sync-tools' port contract exercises one), and refusing it
+  would push the caller back to a raw `update-ref -d` that orphans the same state.
+- A write hard-evicts while a watcher clear keeps sharing in-flight reads, rather than one policy for both. A
+  write is a known point after which an older read is wrong; a watcher tick has no such ordering, and sharing
+  the in-flight read is what keeps a burst of file events from multiplying git processes.
+- `notifyChanged` on the provider, and `git.run({ notify })` bound to it rather than a second invalidation
+  path. The executor has no cache and no hooks, so the provider binds itself to its `Git` and a `notify` run
+  calls the same `notifyChanged`. `'infer'` classifies the argv (read-only and object-store-only commands
+  announce nothing; a `-C` write also announces to the caller's tree what every worktree sees), for a
+  consumer whose raw runs are too varied to name the changes by hand.
+- Timeouts stay the caller's. No typed operation's default was lifted to "no timeout" for this round, even
+  for fetch or clone: GitLens passes its `gitlens.advanced.git.timeout` setting as core's default, and an
+  uncapped background fetch would hang with nothing to stop it. A caller that knows an operation is long
+  passes `timeout: 0` with a cancellation, as GitLens's deep-link clone now does.
+- `except` takes full ref names and core converts them, rather than exposing git's short-form `--exclude`. The
+  short form is what every caller gets wrong, silently.
+- Staging hooks skip the temporary-index case rather than firing unconditionally. A scratch index is not the
+  repository's; announcing an index change for it would invalidate status for nothing.
+
+**Kepler-side follow-up**, once a core release carries these: serve sync-tools' `updateRef` op through
+`updateReference` / `deleteReference` (mapping in §1), delete the review ref with `deleteReference`, drop the
+verb classifier in `core-git-port.ts` in favour of `git.run({ notify: 'infer' })`, and drop its interim
+environment scrub (§10). Then move the second round's raw sites onto their typed forms: credential fetches onto
+`fetch({ remote, refspecs, preserveFetchHead: true })` (§13), the clone onto `clone(..., { folderName }, { env,
+timeout: 0 })` (§14), the porcelain count onto `getStatus({ untracked: 'normal', branch: false, force: true })`
+(§15), the creation probe onto `getReflogEntries` (§16), the unpushed count onto `getCommitCount({ excluding })`
+(§17, which also fixes its always-zero `--exclude`), and the object-format probe onto `getEmptyTreeSha` (§18).
+Then retire the remaining `TODO(core-gitlens)` residuals.

package/docs/kepler-read-api-parity.md

@@ -182,34 +182,81 @@ which excludes unassigned issues. A provider that declares no filtered search ke
 See the note in `reads/broaden.ts` and
 [`integrations.md` §9](./integrations.md#9-per-provider-behavior-worth-designing-around).
 
-**Batch issue resolution (#5802).** `getIssuesBatch` resolves N `(owner, repo, number)` coordinates in one
-request, for the identity question a search cannot answer: "which issue does this branch name reference".
-It aliases the point read rather than a search, so there is no result ceiling and no ordering — and an
-absent slot is a PROVEN absence rather than "not found within a page budget", which is what lets a consumer
-CACHE a miss. A target whose chunk failed is not returned at all, so the two stay distinguishable; caching a
-failure as an absence is the bug that distinction prevents. GitHub/GHE only, matching `countIssues`.
-
-**Tracker issue resolution by key (#5810).** `getTrackerIssue` is the same identity read for an issue TRACKER,
-which `getIssuesBatch` cannot serve: its target is `(owner, repo, number)`, and a tracker issue is addressed by
-`(resourceId, ABC-123)` — no owner, no repo, and an identifier that is not a number. It answers in one request
-where the only published tracker surface (`listIssueTrackerIssuesPage`) needs a scoped page-walk that cannot
-prove absence without draining the whole scope. Same absence/failure contract as the batch read, and the same
-reason it matters: a tracker miss is the common outcome and was never cacheable.
-
-`resourceId` is required and trusted, so the read performs no resource discovery. Jira also requires
-`resourceUrl`, obtained alongside the resource ID, because the issue response's `self` is an API endpoint rather
-than a browser link; supplying both retains the one-request contract. Linear needs only the resource ID. Jira and
-Linear only; Trello refuses because its single-issue read can fall back to a capped board scan for a numeric
-identifier, where a "not found" result cannot be distinguished from a card beyond the cap.
-
-**Jira Data Center point reads (#5872).** The same read serves a self-hosted Jira instance once it carries the host:
-`getTrackerIssue` takes the `domain` its paged siblings already took, and `resourceId` is the host itself (the
-instance's single resource; one naming another host than the read resolves to is refused). It does NOT fall back to the primary connection the way the paged reads do — a
-self-managed tracker requires a `domain` or a `connectionId` with a configured host and is refused otherwise —
-because its proven absence is cacheable and two self-hosted instances routinely issue the same keys, so an answer
-from whichever host is primary would be cached under a key naming a different instance. The branch-association
-resolver (`getIssueFromGitConfigEntityIdentifier`) follows the same rule from the other side: its resolver receives
-the identifier's `domain`, and a Jira Data Center identifier without one is dropped rather than resolved.
+**Batch issue resolution (#5802, #5810).** `getIssuesBatch` resolves N issues by identity in one call, for the
+identity question a search cannot answer: "which issue does this branch name reference". It uses the point read
+rather than a search, so there is no result ceiling and no ordering — and an absent slot is a PROVEN absence
+rather than "not found within a page budget", which is what lets a consumer CACHE a miss. A target that failed —
+its whole request, or just that target, e.g. in an org enforcing SAML SSO the token isn't authorized for — is not
+returned at all, so the two stay distinguishable; caching a failure as an absence is the bug that distinction
+prevents.
+
+A target takes the form its provider addresses an issue by. GitHub/GHE take `(owner, repo, number)` coordinates,
+aliased up to 25 per request. A tracker issue is addressed by `(resourceId, ABC-123)` — no owner, no repo, and an
+identifier that is not a number — so Jira (Cloud and Data Center) and Linear take
+`{ key, resourceId, resourceUrl?, identifier }` targets, each answered by the single-issue read the tracker already
+implements. That replaces a scoped page-walk over `listIssueTrackerIssuesPage`, which cannot prove absence without
+draining the whole scope, where a miss is the common outcome. A key asked of several resources is one call with one
+target per resource. `resourceId` is trusted, so the read performs no resource discovery; Jira Cloud also requires
+`resourceUrl`, because the issue response's `self` is an API endpoint rather than a browser link. Trello refuses:
+its single-issue read can fall back to a capped board scan for a numeric identifier, where a "not found" cannot be
+told from a card beyond the cap. Bitbucket and Bitbucket DC, which have no issues, refuse too.
+
+GitLab and Azure DevOps take the same coordinates as GitHub, plus `project` on Azure DevOps, whose work items belong to
+the project rather than to a repository, so `repo` is ignored there. They cost one request per target and replace a
+scoped page-walk over `listIssuesPage`, which could not prove absence either. Neither host's existing single-issue
+read could, so each has a strict one. A GitLab miss costs a second request, because provider-apis reports a reply
+carrying only GraphQL errors the same way as a missing issue. An Azure DevOps miss is trusted only on Azure's own
+not-found body: `WorkItemUnauthorizedAccessException` (TF401232, "does not exist, or you do not have permissions to
+read it", so absent means not visible to this connection) or `ProjectDoesNotExistWithNameException`. An HTML 404, a
+410 or any other failure fails the target. Rows match the repository-scoped `listIssuesPage` rows, except that an
+Azure DevOps row has no `project`.
+
+A self-hosted Jira (Data Center, #5872) is served by the same tracker targets once the call carries the host:
+`getIssuesBatch` takes the `domain` its paged siblings take, and a target's `resourceId` is the host itself (the
+instance's single resource; a call with any target naming another host than the read resolves to is refused whole).
+It does NOT fall back to the primary connection the way the paged reads do — a self-managed tracker requires a
+`domain` or a `connectionId` with a configured host and the call is refused otherwise — because its proven absence
+is cacheable and two self-hosted instances routinely issue the same keys, so an answer from whichever host is
+primary would be cached under a key naming a different instance. The branch-association resolver
+(`getIssueFromGitConfigEntityIdentifier`) follows the same rule from the other side: its resolver receives the
+identifier's `domain`, and a Jira Data Center identifier without one is dropped rather than resolved.
+
+**Batch pull request resolution.** `getPullRequestsBatch` is the identity read for pull requests: N
+`(owner, repo, number)` coordinates, plus `project` on Azure DevOps, in any state. Before it the facade had only
+list, search, count and sweep reads for pull requests, so a consumer found one by scanning its repository's most
+recently updated pull requests per state and matching the URL — and an older merged pull request could be neither
+found nor proven gone. Same absence/failure contract as `getIssuesBatch`. It serves every git host, Bitbucket and
+Bitbucket DC included: GitHub/GHE alias up to 25 point reads into one document, while GitLab, Bitbucket, Bitbucket
+DC and Azure DevOps have no batch form and cost one request per target. A GitLab miss costs a second request, because
+provider-apis' GitLab read reports a reply that carries only GraphQL errors the same way as a missing merge
+request, so its `null` alone does not prove absence; an Azure DevOps miss is trusted only when Azure's own error
+body names the pull request, repository or project as not found, not on any other 404 or a 410. Rows take the
+list reads' conversion on every host but Bitbucket Cloud, which has no single pull request read in provider-apis
+and so answers from GitLens' own REST read instead, missing `commentsCount`, `isDraft` and the clone URLs. On
+GitLab, a miss the confirming read then contradicts fails the target rather than answering with the confirming
+read's own, differently-identified row. The read is uncached and does not go through
+`IntegrationCacheProvider.getPullRequest`, whose key carries no connection, so the consumer's cache is the only
+one holding the answer.
+
+**Pull requests by branch.** `getPullRequestsForBranches` answers "which pull requests have this branch as their
+head, in this repository" with no relationship to the user. Before it, Kepler correlated a local branch by matching
+the account-wide sweep, which holds only pull requests the user authored, is assigned or reviews — so a teammate's
+pull request from the user's branch never correlated — and a cold card paid for that whole sweep before showing
+anything. It matches on the head branch name in every state, so a merged pull request whose branch was deleted is
+still found, and on the head repository, the base one or the `headOwner` fork, so a same-named branch in another
+fork never correlates; a `headOwner` equal to the owner means the base repository, so Kepler can pass the owner of
+the remote the branch was pushed to. Up to 10 per branch; an empty list without `truncated` is a proven none a
+consumer can cache, and a failed target is dropped with `fetchFailed`. GitHub/GHE answer up to 25 branches per
+request, and every other host costs one request per branch. GitLab and Azure DevOps resolve each match (typically
+0–1 per branch) through `getPullRequestsBatch`'s own read, so a pull request's `url`, and so its identity, is the
+same whichever read found it. Bitbucket DC and Azure DevOps serve base-repository branches only and refuse a
+`headOwner` naming another owner.
+
+**Current account resolution.** `getCurrentAccount` answers who a git host connection is signed in as, on
+demand. Before it, Kepler learned the viewer's account only when its `IntegrationManagerCacheProvider`
+`getCurrentAccount` hook fired during some other read, so "is this pull request mine" could stay unanswered until
+something else resolved the account. The read goes through that same hook, so there is still one cache. `account`
+is never absent without a warning. Jira, Linear and Trello refuse: they have only a per-resource account.
 
 **Kepler-side follow-up:** `ProviderScopeFilter` carries a single `repo?: string` today and needs the criteria
 set; the `provider-data` adapter then routes "All visible" to `searchIssuesPage` + `countIssues`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gitkraken/core-gitlens",
   "description": "GitLens core — shared Git / AI / GitHub primitives for internal GitKraken consumption",
-  "version": "0.7.2",
+  "version": "0.9.0",
   "license": "SEE LICENSE IN LICENSE",
   "author": {
     "name": "GitKraken",

package/dist/plus/integrations/reads/trackerIssue.d.ts

@@ -1,33 +0,0 @@
-import { IssueShape } from "../../../git/models/issue.js";
-import { IntegrationIds } from "../constants.js";
-import { ProviderResult } from "../results.js";
-import { ProviderReadContext } from "./context.js";
-//#region ../plus/integrations/src/reads/trackerIssue.d.ts
-export interface TrackerIssueResult {
-  key: string;
-  /**
-   * The resolved issue, or `undefined` when it provably does not exist or is not visible to this connection.
-   * A failed read returns no item and sets `fetchFailed`.
-   */
-  issue?: IssueShape;
-}
-/**
- * `domain` selects the host of a self-managed tracker (Jira Data Center), as it does for
- * `listIssueTrackerIssuesPage`, and is ignored for the cloud trackers, which have a single canonical host.
- *
- * Unlike its siblings, this read never falls back to the primary connection for a self-managed tracker: it
- * requires a `domain` or a `connectionId` with a configured host and refuses otherwise. Two self-hosted
- * instances routinely issue the same project and issue keys, and this read's `issue: undefined` is a proven
- * absence a caller may cache — an answer from whichever host happens to be primary would be cached under a key
- * that names a different instance (#5872).
- */
-export declare function getTrackerIssue(ctx: ProviderReadContext, options: {
-  providerId: IntegrationIds;
-  resourceId: string;
-  resourceUrl?: string;
-  key: string;
-  connectionId?: string;
-  domain?: string;
-}): Promise<ProviderResult<TrackerIssueResult>>;
-//#endregion
-//# sourceMappingURL=trackerIssue.d.ts.map

package/dist/plus/integrations/reads/trackerIssue.js

@@ -1,60 +0,0 @@
-import "../constants.js";
-import { areDomainsOnSameHost, hostFromDomain } from "../utils/domain.utils.js";
-import { isIssuesHostIntegrationId, isIssuesSelfManagedHostIntegrationId } from "../utils/integration.utils.js";
-import { issueTrackerOnlySurfaceWarning, otherWarning } from "./warnings.js";
-import { runCaptured } from "./drains.js";
-import { isIssuesIntegration } from "../models/issuesIntegration.js";
-//#region ../plus/integrations/src/reads/trackerIssue.ts
-/**
-* `domain` selects the host of a self-managed tracker (Jira Data Center), as it does for
-* `listIssueTrackerIssuesPage`, and is ignored for the cloud trackers, which have a single canonical host.
-*
-* Unlike its siblings, this read never falls back to the primary connection for a self-managed tracker: it
-* requires a `domain` or a `connectionId` with a configured host and refuses otherwise. Two self-hosted
-* instances routinely issue the same project and issue keys, and this read's `issue: undefined` is a proven
-* absence a caller may cache — an answer from whichever host happens to be primary would be cached under a key
-* that names a different instance (#5872).
-*/
-async function getTrackerIssue(ctx, options) {
-	const refused = (warning) => ({
-		items: [],
-		warnings: [warning],
-		fetchFailed: true
-	});
-	const surface = "Issue resolution by key";
-	if (!isIssuesHostIntegrationId(options.providerId)) return refused(issueTrackerOnlySurfaceWarning(options.providerId, options.connectionId, surface));
-	if (options.resourceId.trim().length === 0) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} requires a resource id.`));
-	if (options.key.trim().length === 0) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} requires an issue key.`));
-	const resourceUrl = options.resourceUrl?.trim() || void 0;
-	if (options.providerId === "jira" && resourceUrl == null) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} requires the Jira resource URL so the result contains a browser link without resource discovery.`));
-	if (isIssuesSelfManagedHostIntegrationId(options.providerId) && (options.domain != null ? hostFromDomain(options.domain) == null : options.connectionId == null || !ctx.getConfigured(options.providerId).some((c) => c.id === options.connectionId && hostFromDomain(c.domain) != null))) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} requires a domain or a configured connection id for '${options.providerId}': every configured host can hold a different issue under the same key, so the read does not answer from the primary connection.`));
-	const integration = await ctx.getIntegrationForRead(options.providerId, options.connectionId, options.domain);
-	if (integration == null) {
-		const early = ctx.earlyReturnConnectionWarnings(options.providerId, options.connectionId, options.domain);
-		return {
-			items: [],
-			warnings: early.warnings,
-			fetchFailed: early.fetchFailed || void 0
-		};
-	}
-	if (!isIssuesIntegration(integration)) return refused(issueTrackerOnlySurfaceWarning(options.providerId, options.connectionId, surface));
-	if (!integration.supportsIssueLookupByResourceId) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} is not supported by '${options.providerId}'; its single-issue read cannot prove an absence, so a miss would not be safe to cache.`));
-	if (isIssuesSelfManagedHostIntegrationId(options.providerId) && !areDomainsOnSameHost(options.resourceId, integration.domain)) return refused(otherWarning(options.providerId, void 0, options.connectionId, `${surface} requires the resource id of '${options.providerId}' to name the host the read resolved to.`));
-	const domain = ctx.domainForRead(integration, options.providerId, options.connectionId, options.domain);
-	const issue = await runCaptured(options.providerId, domain, options.connectionId, () => integration.getIssueByResourceIdResult(options.resourceId, options.key, {
-		connectionId: options.connectionId,
-		resourceUrl
-	}), { warnOnMissingSession: true });
-	if (issue.warning != null) return refused(issue.warning);
-	return {
-		items: [{
-			key: options.key,
-			...issue.value != null ? { issue: issue.value } : {}
-		}],
-		warnings: []
-	};
-}
-//#endregion
-export { getTrackerIssue };
-
-//# sourceMappingURL=trackerIssue.js.map

package/dist/plus/integrations/reads/trackerIssue.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"trackerIssue.js","names":[],"sources":["../../../../../plus/integrations/src/reads/trackerIssue.ts"],"sourcesContent":["import type { IssueShape } from '@gitlens/git/models/issue.js';\nimport type { IntegrationIds } from '../constants.js';\nimport { IssuesCloudHostIntegrationId } from '../constants.js';\nimport { isIssuesIntegration } from '../models/issuesIntegration.js';\nimport type { ProviderResult, ProviderWarning } from '../results.js';\nimport { areDomainsOnSameHost, hostFromDomain } from '../utils/domain.utils.js';\nimport { isIssuesHostIntegrationId, isIssuesSelfManagedHostIntegrationId } from '../utils/integration.utils.js';\nimport type { ProviderReadContext } from './context.js';\nimport { runCaptured } from './drains.js';\nimport { issueTrackerOnlySurfaceWarning, otherWarning } from './warnings.js';\n\nexport interface TrackerIssueResult {\n\tkey: string;\n\t/**\n\t * The resolved issue, or `undefined` when it provably does not exist or is not visible to this connection.\n\t * A failed read returns no item and sets `fetchFailed`.\n\t */\n\tissue?: IssueShape;\n}\n\n/**\n * `domain` selects the host of a self-managed tracker (Jira Data Center), as it does for\n * `listIssueTrackerIssuesPage`, and is ignored for the cloud trackers, which have a single canonical host.\n *\n * Unlike its siblings, this read never falls back to the primary connection for a self-managed tracker: it\n * requires a `domain` or a `connectionId` with a configured host and refuses otherwise. Two self-hosted\n * instances routinely issue the same project and issue keys, and this read's `issue: undefined` is a proven\n * absence a caller may cache — an answer from whichever host happens to be primary would be cached under a key\n * that names a different instance (#5872).\n */\nexport async function getTrackerIssue(\n\tctx: ProviderReadContext,\n\toptions: {\n\t\tproviderId: IntegrationIds;\n\t\tresourceId: string;\n\t\tresourceUrl?: string;\n\t\tkey: string;\n\t\tconnectionId?: string;\n\t\tdomain?: string;\n\t},\n): Promise<ProviderResult<TrackerIssueResult>> {\n\tconst refused = (warning: ProviderWarning): ProviderResult<TrackerIssueResult> => ({\n\t\titems: [],\n\t\twarnings: [warning],\n\t\tfetchFailed: true,\n\t});\n\tconst surface = 'Issue resolution by key';\n\n\tif (!isIssuesHostIntegrationId(options.providerId)) {\n\t\treturn refused(issueTrackerOnlySurfaceWarning(options.providerId, options.connectionId, surface));\n\t}\n\n\tif (options.resourceId.trim().length === 0) {\n\t\treturn refused(\n\t\t\totherWarning(options.providerId, undefined, options.connectionId, `${surface} requires a resource id.`),\n\t\t);\n\t}\n\n\tif (options.key.trim().length === 0) {\n\t\treturn refused(\n\t\t\totherWarning(options.providerId, undefined, options.connectionId, `${surface} requires an issue key.`),\n\t\t);\n\t}\n\n\tconst resourceUrl = options.resourceUrl?.trim() || undefined;\n\tif (options.providerId === IssuesCloudHostIntegrationId.Jira && resourceUrl == null) {\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`${surface} requires the Jira resource URL so the result contains a browser link without resource discovery.`,\n\t\t\t),\n\t\t);\n\t}\n\n\t// A `domain` only selects a host when it parses to one, and a `connectionId` only when it names a configured\n\t// connection that has one; anything else would resolve the primary host instead, which is the fallback this\n\t// read refuses.\n\tif (\n\t\tisIssuesSelfManagedHostIntegrationId(options.providerId) &&\n\t\t(options.domain != null\n\t\t\t? hostFromDomain(options.domain) == null\n\t\t\t: options.connectionId == null ||\n\t\t\t\t!ctx\n\t\t\t\t\t.getConfigured(options.providerId)\n\t\t\t\t\t.some(c => c.id === options.connectionId && hostFromDomain(c.domain) != null))\n\t) {\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`${surface} requires a domain or a configured connection id for '${options.providerId}': every configured host can hold a different issue under the same key, so the read does not answer from the primary connection.`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst integration = await ctx.getIntegrationForRead(options.providerId, options.connectionId, options.domain);\n\tif (integration == null) {\n\t\t// A supplied connectionId or domain that no longer resolves is a broken target, not an empty account.\n\t\tconst early = ctx.earlyReturnConnectionWarnings(options.providerId, options.connectionId, options.domain);\n\t\treturn { items: [], warnings: early.warnings, fetchFailed: early.fetchFailed || undefined };\n\t}\n\tif (!isIssuesIntegration(integration)) {\n\t\treturn refused(issueTrackerOnlySurfaceWarning(options.providerId, options.connectionId, surface));\n\t}\n\tif (!integration.supportsIssueLookupByResourceId) {\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`${surface} is not supported by '${options.providerId}'; its single-issue read cannot prove an absence, so a miss would not be safe to cache.`,\n\t\t\t),\n\t\t);\n\t}\n\n\t// A self-managed tracker's single resource is its host, and the read is keyed (and cached) by `resourceId`\n\t// while it is addressed to the host `domain`/`connectionId` resolved. When they disagree, host B's answer —\n\t// including a cacheable absence — would be stored under host A's key.\n\tif (\n\t\tisIssuesSelfManagedHostIntegrationId(options.providerId) &&\n\t\t!areDomainsOnSameHost(options.resourceId, integration.domain)\n\t) {\n\t\treturn refused(\n\t\t\totherWarning(\n\t\t\t\toptions.providerId,\n\t\t\t\tundefined,\n\t\t\t\toptions.connectionId,\n\t\t\t\t`${surface} requires the resource id of '${options.providerId}' to name the host the read resolved to.`,\n\t\t\t),\n\t\t);\n\t}\n\n\tconst domain = ctx.domainForRead(integration, options.providerId, options.connectionId, options.domain);\n\tconst issue = await runCaptured(\n\t\toptions.providerId,\n\t\tdomain,\n\t\toptions.connectionId,\n\t\t() =>\n\t\t\tintegration.getIssueByResourceIdResult(options.resourceId, options.key, {\n\t\t\t\tconnectionId: options.connectionId,\n\t\t\t\tresourceUrl: resourceUrl,\n\t\t\t}),\n\t\t{ warnOnMissingSession: true },\n\t);\n\tif (issue.warning != null) {\n\t\treturn refused(issue.warning);\n\t}\n\n\treturn {\n\t\titems: [{ key: options.key, ...(issue.value != null ? { issue: issue.value } : {}) }],\n\t\twarnings: [],\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8BA,eAAsB,gBACrB,KACA,SAQ8C;CAC9C,MAAM,WAAW,aAAkE;EAClF,OAAO,CAAC;EACR,UAAU,CAAC,OAAO;EAClB,aAAa;CACd;CACA,MAAM,UAAU;CAEhB,IAAI,CAAC,0BAA0B,QAAQ,UAAU,GAChD,OAAO,QAAQ,+BAA+B,QAAQ,YAAY,QAAQ,cAAc,OAAO,CAAC;CAGjG,IAAI,QAAQ,WAAW,KAAK,CAAC,CAAC,WAAW,GACxC,OAAO,QACN,aAAa,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,GAAG,QAAQ,yBAAyB,CACvG;CAGD,IAAI,QAAQ,IAAI,KAAK,CAAC,CAAC,WAAW,GACjC,OAAO,QACN,aAAa,QAAQ,YAAY,KAAA,GAAW,QAAQ,cAAc,GAAG,QAAQ,wBAAwB,CACtG;CAGD,MAAM,cAAc,QAAQ,aAAa,KAAK,KAAK,KAAA;CACnD,IAAI,QAAQ,eAAA,UAAoD,eAAe,MAC9E,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,GAAG,QAAQ,kGACZ,CACD;CAMD,IACC,qCAAqC,QAAQ,UAAU,MACtD,QAAQ,UAAU,OAChB,eAAe,QAAQ,MAAM,KAAK,OAClC,QAAQ,gBAAgB,QACzB,CAAC,IACC,cAAc,QAAQ,UAAU,CAAC,CACjC,MAAK,MAAK,EAAE,OAAO,QAAQ,gBAAgB,eAAe,EAAE,MAAM,KAAK,IAAI,IAE/E,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,GAAG,QAAQ,wDAAwD,QAAQ,WAAW,iIACvF,CACD;CAGD,MAAM,cAAc,MAAM,IAAI,sBAAsB,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CAC5G,IAAI,eAAe,MAAM;EAExB,MAAM,QAAQ,IAAI,8BAA8B,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;EACxG,OAAO;GAAE,OAAO,CAAC;GAAG,UAAU,MAAM;GAAU,aAAa,MAAM,eAAe,KAAA;EAAU;CAC3F;CACA,IAAI,CAAC,oBAAoB,WAAW,GACnC,OAAO,QAAQ,+BAA+B,QAAQ,YAAY,QAAQ,cAAc,OAAO,CAAC;CAEjG,IAAI,CAAC,YAAY,iCAChB,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,GAAG,QAAQ,wBAAwB,QAAQ,WAAW,wFACvD,CACD;CAMD,IACC,qCAAqC,QAAQ,UAAU,KACvD,CAAC,qBAAqB,QAAQ,YAAY,YAAY,MAAM,GAE5D,OAAO,QACN,aACC,QAAQ,YACR,KAAA,GACA,QAAQ,cACR,GAAG,QAAQ,gCAAgC,QAAQ,WAAW,yCAC/D,CACD;CAGD,MAAM,SAAS,IAAI,cAAc,aAAa,QAAQ,YAAY,QAAQ,cAAc,QAAQ,MAAM;CACtG,MAAM,QAAQ,MAAM,YACnB,QAAQ,YACR,QACA,QAAQ,oBAEP,YAAY,2BAA2B,QAAQ,YAAY,QAAQ,KAAK;EACvE,cAAc,QAAQ;EACT;CACd,CAAC,GACF,EAAE,sBAAsB,KAAK,CAC9B;CACA,IAAI,MAAM,WAAW,MACpB,OAAO,QAAQ,MAAM,OAAO;CAG7B,OAAO;EACN,OAAO,CAAC;GAAE,KAAK,QAAQ;GAAK,GAAI,MAAM,SAAS,OAAO,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAAG,CAAC;EACpF,UAAU,CAAC;CACZ;AACD"}