@graphit/cli 0.2.331 → 0.2.348

package/dist/commands/kb-repo-token.js

@@ -0,0 +1,122 @@
+import { apiClient } from "../api/client.js";
+import { errorOutput, note, output } from "../output/format.js";
+// Project #289 Phase 8 (ARCH-10): the CI machine principal. An org admin mints a
+// token once (the server keeps only a hash, bound to the org and its bound
+// repository; the cleartext is printed on that one output and never again), the
+// pipeline holds it as a secret, and `kb repo verify|apply --token` presents it
+// instead of a login. `kb:verify` reaches verify and status; `kb:apply` reaches
+// verify, apply and status. The token is the pipeline's authority to CALL - the
+// change's humans still pass the approval check, so it never stands in for a
+// reviewer.
+const TOKENS_PATH = "/api/v1/cli/kb/repo/tokens";
+// The server's shape is `gkb.<v|a>.<org>.<token_id>.<secret>`; dots join the
+// segments because org ids and urlsafe secrets may both carry `_` and `-`.
+export const MACHINE_TOKEN_PREFIX = "gkb.";
+export const MACHINE_TOKEN_SCOPES = ["kb:verify", "kb:apply"];
+const METADATA_COLUMNS = [
+    "token_id",
+    "scope",
+    "repo",
+    "created_at",
+    "created_by_email",
+    "last_used_at",
+    "revoked_at",
+];
+// `--token` (interactive) or the GRAPHIT_TOKEN environment variable (CI) carries
+// the cleartext a mint printed. Anything else - a login session, a pasted token
+// id, an empty or unset CI secret - is refused here, before any request would
+// carry it to the server.
+export function assertMachineToken(token) {
+    if (typeof token !== "string" ||
+        !token.startsWith(MACHINE_TOKEN_PREFIX) ||
+        token.length === MACHINE_TOKEN_PREFIX.length) {
+        throw new Error(`--token or GRAPHIT_TOKEN must be a machine token minted by \`kb repo token mint\` (it starts with ${MACHINE_TOKEN_PREFIX}); ` +
+            "a login session, a token id or an empty value is not accepted");
+    }
+    return token;
+}
+export function assertMachineTokenScope(scope) {
+    if (!MACHINE_TOKEN_SCOPES.includes(scope)) {
+        throw new Error(`--scope must be ${MACHINE_TOKEN_SCOPES.join(" or ")}`);
+    }
+    return scope;
+}
+// The list route answers `{tokens: [...]}` or a bare array; either way only
+// metadata leaves here. A `token` member is dropped unread: the cleartext
+// exists on the mint output and nowhere else.
+export function tokenListRows(payload) {
+    const rows = Array.isArray(payload)
+        ? payload
+        : payload?.tokens;
+    if (!Array.isArray(rows))
+        return [];
+    const metadata = [];
+    for (const row of rows) {
+        if (!row || typeof row !== "object")
+            continue;
+        const entry = {};
+        for (const [key, value] of Object.entries(row)) {
+            if (key !== "token")
+                entry[key] = value;
+        }
+        metadata.push(entry);
+    }
+    return metadata;
+}
+// Intentionally not named `register*` (see kb-repo.ts): this attaches the
+// `token` group under `kb repo` and is called by attachKBRepoCommands.
+export function attachKBRepoTokenCommands(repo) {
+    const token = repo
+        .command("token")
+        .description("CI machine tokens (org admin): mint one display-once token per pipeline job, list their metadata, revoke");
+    token
+        .command("mint")
+        .description("Mint a display-once CI machine token (org admin); scope kb:verify or kb:apply")
+        .requiredOption("--scope <scope>", "kb:verify (the PR job: verify + status) or kb:apply (the merge job: verify, apply, status)")
+        .action(async function () {
+        try {
+            const scope = assertMachineTokenScope(this.opts().scope);
+            const minted = await apiClient.post(TOKENS_PATH, { scope });
+            note("  Shown once: store the token as a CI secret now. It cannot be displayed again; " +
+                "if it is lost, revoke it and mint another.");
+            output(this, {
+                token: minted.token,
+                token_id: minted.token_id,
+                scope: minted.scope,
+                repo: minted.repo ?? null,
+                created_at: minted.created_at ?? null,
+                display_once: true,
+            }, { keyValue: true });
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    token
+        .command("list")
+        .description("List CI machine tokens: metadata only, never the secret")
+        .action(async function () {
+        try {
+            const payload = await apiClient.get(TOKENS_PATH);
+            output(this, tokenListRows(payload), { columns: METADATA_COLUMNS });
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    token
+        .command("revoke <token-id>")
+        .description("Revoke a CI machine token (org admin)")
+        .action(async function (tokenId) {
+        try {
+            if (tokenId.startsWith(MACHINE_TOKEN_PREFIX)) {
+                throw new Error("revoke takes the token id from `kb repo token list`, never the token itself");
+            }
+            output(this, await apiClient.post(`${TOKENS_PATH}/${encodeURIComponent(tokenId)}/revoke`, {}));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+}
+//# sourceMappingURL=kb-repo-token.js.map

package/dist/commands/kb-repo-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-repo-token.js","sourceRoot":"","sources":["../../src/commands/kb-repo-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAEhE,iFAAiF;AACjF,2EAA2E;AAC3E,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,YAAY;AAEZ,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAEjD,6EAA6E;AAC7E,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,WAAW,EAAE,UAAU,CAAU,CAAC;AAkBvE,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,OAAO;IACP,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,cAAc;IACd,YAAY;CACb,CAAC;AAEF,iFAAiF;AACjF,gFAAgF;AAChF,8EAA8E;AAC9E,0BAA0B;AAC1B,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,UAAU,CAAC,oBAAoB,CAAC;QACvC,KAAK,CAAC,MAAM,KAAK,oBAAoB,CAAC,MAAM,EAC5C,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qGAAqG,oBAAoB,KAAK;YAC5H,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAA0B,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mBAAmB,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAA0B,CAAC;AACpC,CAAC;AAED,4EAA4E;AAC5E,0EAA0E;AAC1E,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QACjC,CAAC,CAAC,OAAO;QACT,CAAC,CAAE,OAAmD,EAAE,MAAM,CAAC;IACjE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QAC9C,MAAM,KAAK,GAA4B,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YAC1E,IAAI,GAAG,KAAK,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC1C,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,KAAwC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,uEAAuE;AACvE,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,MAAM,KAAK,GAAG,IAAI;SACf,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,0GAA0G,CAC3G,CAAC;IAEJ,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+EAA+E,CAAC;SAC5F,cAAc,CACb,iBAAiB,EACjB,4FAA4F,CAC7F;SACA,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAqB,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,IAAI,CACF,kFAAkF;gBAChF,4CAA4C,CAC/C,CAAC;YACF,MAAM,CACJ,IAAI,EACJ;gBACE,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;gBACrC,YAAY,EAAE,IAAI;aACnB,EACD,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,CAAU,WAAW,CAAC,CAAC;YAC1D,MAAM,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,KAAK,WAA0B,OAAe;QACpD,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YACD,MAAM,CACJ,IAAI,EACJ,MAAM,SAAS,CAAC,IAAI,CAClB,GAAG,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAC,SAAS,EACtD,EAAE,CACH,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/kb-repo.d.ts

@@ -0,0 +1,29 @@
+import { Command } from "commander";
+export declare const KB_REPO_EXIT_FAILED = 1;
+export declare const KB_REPO_EXIT_REFUSED = 2;
+export declare const KB_REPO_EXIT_TIMEOUT = 3;
+export declare const MACHINE_TOKEN_ENV = "GRAPHIT_TOKEN";
+export interface OperationStatus {
+    operation_id: string;
+    kind?: "verify" | "apply";
+    status: "preparing" | "queued" | "running" | "waiting_child" | "succeeded" | "refused" | "failed_retryable" | "failed";
+    stage: string;
+    plan_id?: string | null;
+    local_only?: boolean;
+    completed_components: number;
+    total_components: number;
+    report?: ({
+        verdict?: string;
+    } & Record<string, unknown>) | null;
+    error?: {
+        code?: string;
+        detail?: string;
+    } | null;
+}
+export declare function pollDelayMs(elapsedMs: number, intervalMs: number): number;
+export declare function resolveMachineToken(flag: unknown, env?: NodeJS.ProcessEnv): string | undefined;
+export declare function repoExitCode(status: OperationStatus): number;
+export declare function collectCheckout(checkout: string): Record<string, string>;
+export declare function checkoutIsDirty(checkout: string): boolean | undefined;
+export declare function writeExportedDatasources(out: string, files: Record<string, string>): string[];
+export declare function attachKBRepoCommands(kb: Command): void;

package/dist/commands/kb-repo.js

@@ -0,0 +1,407 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+import { apiClient, setMachineToken } from "../api/client.js";
+import { errorOutput, note, output } from "../output/format.js";
+import { assertMachineToken, attachKBRepoTokenCommands } from "./kb-repo-token.js";
+// The repository-owned Knowledge Base verbs. `kb repo verify` returns a plan
+// for a `.graphit/` tree at an exact commit; `kb repo apply` applies one. Both
+// poll a durable server operation; exit codes are stable so CI can gate on
+// them: 0 pass, 1 failed, 2 refused or a failing verdict, 3 stopped waiting.
+export const KB_REPO_EXIT_FAILED = 1;
+export const KB_REPO_EXIT_REFUSED = 2;
+export const KB_REPO_EXIT_TIMEOUT = 3;
+const DEFAULT_POLL_INTERVAL_MS = 1_000;
+const DEFAULT_TIMEOUT_MS = 30 * 60_000;
+// After the first minute an operation is doing real work (compile, apply children);
+// polling every second from then on only burns the caller's rate bucket and writes
+// the machine token's last_used_at at Firestore's per-document ceiling.
+const POLL_BACKOFF_AFTER_MS = 60_000;
+const SLOW_POLL_INTERVAL_MS = 5_000;
+// CI hands the machine token through the environment so it never enters argv
+// (process listings, shell traces, the CA-guard re-exec). `--token` stays for
+// interactive use.
+export const MACHINE_TOKEN_ENV = "GRAPHIT_TOKEN";
+const GRAPHIT_DIR = ".graphit";
+const MAX_FILE_BYTES = 8 * 1024 * 1024;
+function positiveMilliseconds(raw, fallback, flag) {
+    if (raw === undefined)
+        return fallback;
+    if (!/^[1-9]\d*$/.test(raw))
+        throw new Error(`${flag} must be a positive integer`);
+    return Number(raw);
+}
+// The delay before the next status read: the caller's interval for the first
+// minute, then at least five seconds. Exported for the test, pure on purpose.
+export function pollDelayMs(elapsedMs, intervalMs) {
+    return elapsedMs < POLL_BACKOFF_AFTER_MS ? intervalMs : Math.max(intervalMs, SLOW_POLL_INTERVAL_MS);
+}
+// The machine token for this process: `--token` when given (any value, so an
+// empty flag is refused rather than ignored), else the environment variable CI
+// sets, else nothing and the login stays the credential. An empty or unset CI
+// secret therefore fails typed here instead of silently falling back to a login
+// that does not exist on the runner.
+export function resolveMachineToken(flag, env = process.env) {
+    if (flag !== undefined)
+        return assertMachineToken(flag);
+    const fromEnv = env[MACHINE_TOKEN_ENV];
+    if (fromEnv !== undefined)
+        return assertMachineToken(fromEnv);
+    return undefined;
+}
+// A verify succeeds as an OPERATION even when its plan fails: the plan is the
+// result. The exit code reads the verdict, so a failing verdict cancels a
+// pipeline the same way a refusal does.
+export function repoExitCode(status) {
+    if (status.status === "succeeded") {
+        return status.report?.verdict === "fail" ? KB_REPO_EXIT_REFUSED : 0;
+    }
+    if (status.status === "refused")
+        return KB_REPO_EXIT_REFUSED;
+    return KB_REPO_EXIT_FAILED;
+}
+async function pollOperation(statusPath, options) {
+    const { intervalMs, timeoutMs } = options;
+    const started = Date.now();
+    let lastStage = "";
+    while (Date.now() - started < timeoutMs) {
+        let status;
+        try {
+            status = await apiClient.get(statusPath);
+        }
+        catch (error) {
+            // A deterministic refusal of the status read (concealed operation, no
+            // permission, switch off) will never turn into a result; surface it now
+            // instead of polling silently to the timeout. Network and 5xx keep polling.
+            const httpStatus = error.status;
+            if (typeof httpStatus === "number" && httpStatus >= 400 && httpStatus < 500 && httpStatus !== 429) {
+                throw error;
+            }
+            await new Promise((resolve) => setTimeout(resolve, pollDelayMs(Date.now() - started, intervalMs)));
+            continue;
+        }
+        if (status.stage !== lastStage) {
+            const progress = status.total_components
+                ? ` (${status.completed_components}/${status.total_components} components)`
+                : "";
+            note(`  ${status.stage}${progress}`);
+            lastStage = status.stage;
+        }
+        if (["succeeded", "refused", "failed"].includes(status.status))
+            return status;
+        await new Promise((resolve) => setTimeout(resolve, pollDelayMs(Date.now() - started, intervalMs)));
+    }
+    return null;
+}
+function walk(root, dir, into) {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const full = join(dir, entry.name);
+        if (entry.isSymbolicLink())
+            continue;
+        if (entry.isDirectory()) {
+            walk(root, full, into);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        if (statSync(full).size > MAX_FILE_BYTES) {
+            throw new Error(`${relative(root, full)} is over 8 MiB; the repository tree must stay text-sized`);
+        }
+        into[relative(root, full).split(sep).join("/")] = readFileSync(full, "utf-8");
+    }
+}
+function provenanceSourcePaths(files) {
+    const paths = new Set();
+    for (const [path, text] of Object.entries(files)) {
+        if (!path.startsWith(`${GRAPHIT_DIR}/provenance/`) || !path.endsWith(".json"))
+            continue;
+        let payload;
+        try {
+            payload = JSON.parse(text);
+        }
+        catch {
+            continue; // the server refuses a malformed shard with its typed code
+        }
+        for (const doc of Object.keys(payload.sources ?? {}))
+            paths.add(doc);
+    }
+    return [...paths].sort();
+}
+// Materialize a checkout the way the server materializes a commit archive:
+// `.graphit/**` plus exactly the source documents the provenance shards name.
+// Nothing else on disk leaves the machine.
+export function collectCheckout(checkout) {
+    const root = resolve(checkout);
+    const graphitDir = join(root, GRAPHIT_DIR);
+    if (!existsSync(graphitDir) || !statSync(graphitDir).isDirectory()) {
+        throw new Error(`No ${GRAPHIT_DIR}/ tree under ${root}. Set up the repository from Claude Code with the graphit skill first.`);
+    }
+    const files = {};
+    walk(root, graphitDir, files);
+    for (const doc of provenanceSourcePaths(files)) {
+        const full = resolve(root, doc);
+        if (!full.startsWith(root + sep) || !existsSync(full) || !statSync(full).isFile())
+            continue;
+        files[doc] = readFileSync(full, "utf-8");
+    }
+    return files;
+}
+function git(checkout, args) {
+    try {
+        return execFileSync("git", ["-C", checkout, ...args], {
+            encoding: "utf-8",
+            stdio: ["ignore", "pipe", "ignore"],
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+export function checkoutIsDirty(checkout) {
+    const status = git(checkout, ["status", "--porcelain", "--", GRAPHIT_DIR]);
+    return status === undefined ? undefined : status.length > 0;
+}
+// Write the server's `datasources/<name>.ds.yml` + `<name>.sql` pairs into one
+// directory. File names come from the server (the source's lower-cased name)
+// and are still refused here if they could leave `out` - defence in depth,
+// never the only check.
+export function writeExportedDatasources(out, files) {
+    const root = resolve(out);
+    mkdirSync(root, { recursive: true });
+    const written = [];
+    for (const [name, text] of Object.entries(files)) {
+        if (name.includes("/") || name.includes("\\") || name.startsWith(".") || name.includes("..")) {
+            throw new Error(`refusing to write ${name}: not a plain file name`);
+        }
+        if (!name.endsWith(".ds.yml") && !name.endsWith(".sql")) {
+            throw new Error(`refusing to write ${name}: not a definition file`);
+        }
+        writeFileSync(join(root, name), text, "utf-8");
+        written.push(name);
+    }
+    return written.sort();
+}
+async function runAndPoll(command, path, body, opts) {
+    const intervalMs = positiveMilliseconds(opts.pollIntervalMs, DEFAULT_POLL_INTERVAL_MS, "--poll-interval-ms");
+    const timeoutMs = positiveMilliseconds(opts.timeoutMs, DEFAULT_TIMEOUT_MS, "--timeout-ms");
+    const accepted = await apiClient.post(path, body, { timeoutMs: 120_000 });
+    note(`  queued ${accepted.operation_id}`);
+    const terminal = await pollOperation(accepted.status_path, { intervalMs, timeoutMs });
+    if (terminal === null) {
+        output(command, {
+            operation_id: accepted.operation_id,
+            status: "timed_out",
+            detail: "The operation is still running; poll the returned operation id",
+        });
+        process.exitCode = KB_REPO_EXIT_TIMEOUT;
+        return;
+    }
+    output(command, terminal.report ?? terminal);
+    process.exitCode = repoExitCode(terminal);
+}
+// Intentionally not named `register*`: the generated Commander walk invokes
+// every exported registrar as a top-level command. This attaches the `repo`
+// group under `kb` and is called by registerKBCommands.
+export function attachKBRepoCommands(kb) {
+    const repo = kb
+        .command("repo")
+        .description("Repository-owned Knowledge Base: verify a commit's .graphit/ tree into a plan, apply a plan");
+    repo
+        .command("verify")
+        .description("Compute the plan for a .graphit/ tree: identity + access, their semantic layer through provenance, " +
+        "validity + completeness, and the KB/DS/dashboard actions. Any refusal exits 2 (a CI check fails). " +
+        "--sha pulls the commit from the bound provider (CI); --path uploads a local checkout and yields a " +
+        "local-only plan that can never be applied")
+        .option("--sha <sha>", "Commit to verify; the server pulls its archive from the bound repository")
+        .option("--pr <id>", "Pull request the commit belongs to (with --sha)")
+        .option("--path <checkout>", "Local checkout to upload (CLI-only; the plan is local-only)")
+        .option("--allow-dirty", "Upload a checkout whose .graphit/ has uncommitted changes")
+        .option("--kind <kind>", "Plan kind: sync (default) or migration", "sync")
+        .option("--token <token>", "Machine token minted by `kb repo token mint` (CI); replaces the login")
+        .option("--poll-interval-ms <n>", "Status poll interval", String(DEFAULT_POLL_INTERVAL_MS))
+        .option("--timeout-ms <n>", "Maximum wait", String(DEFAULT_TIMEOUT_MS))
+        .action(async function () {
+        try {
+            const opts = this.opts();
+            if ((opts.sha && opts.path) || (!opts.sha && !opts.path)) {
+                throw new Error("Provide exactly one of --sha <sha> or --path <checkout>");
+            }
+            if (!["sync", "migration"].includes(opts.kind)) {
+                throw new Error("--kind must be sync or migration");
+            }
+            const machineToken = resolveMachineToken(opts.token);
+            if (machineToken !== undefined)
+                setMachineToken(machineToken);
+            if (opts.path) {
+                const dirty = checkoutIsDirty(opts.path);
+                if (dirty === true && !opts.allowDirty) {
+                    throw new Error(".graphit/ has uncommitted changes; commit them or pass --allow-dirty to upload the working tree");
+                }
+                const files = collectCheckout(opts.path);
+                const head = git(opts.path, ["rev-parse", "HEAD"]);
+                note("  local-only plan, not applyable: apply reads the bound provider, never an upload");
+                await runAndPoll(this, "/api/v1/cli/kb/repo/verify", {
+                    files,
+                    commit_sha: head && /^[0-9a-f]{7,64}$/.test(head) ? head : undefined,
+                    source_label: `local checkout${dirty ? " (dirty)" : ""}`,
+                    kind: opts.kind,
+                }, opts);
+                return;
+            }
+            await runAndPoll(this, "/api/v1/cli/kb/repo/verify", { commit_sha: opts.sha, pr_id: opts.pr, kind: opts.kind }, opts);
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("show")
+        .description("Show the repository binding: ownership mode, bound repository, branch, connection, last applied commit")
+        .action(async function () {
+        try {
+            output(this, await apiClient.get("/api/v1/cli/kb/repo"));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("mode <mode>")
+        .description("Set KB ownership (org admin): managed = direct writes; manual = the repository owns shared KB assets " +
+        "and Data Source definitions (changes via pull request). A non-empty managed KB refuses manual")
+        .action(async function (mode) {
+        try {
+            if (!["managed", "manual"].includes(mode)) {
+                throw new Error("mode must be managed or manual");
+            }
+            output(this, await apiClient.post("/api/v1/cli/kb/repo/mode", { mode }));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("bind")
+        .description("Bind the owning repository to a provider connection (org admin); the connection must name that repository")
+        .requiredOption("--connection <id>", "Git connection id (graphit connector list)")
+        .requiredOption("--repo <owner/name>", "Repository slug the connection names")
+        .option("--branch <name>", "Base branch verify and apply are bound to", "main")
+        .option("--approved-sha <sha>", "The only commit the migration apply accepts (founder-run migrations)")
+        .action(async function () {
+        try {
+            const opts = this.opts();
+            const body = {
+                connection_id: opts.connection,
+                repo: opts.repo,
+                base_branch: opts.branch,
+            };
+            if (opts.approvedSha)
+                body.approved_commit_sha = opts.approvedSha;
+            output(this, await apiClient.post("/api/v1/cli/kb/repo/bind", body));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("identities")
+        .description("List git identities (org admin): linked, unlinked, and accounts the last plans could not link")
+        .action(async function () {
+        try {
+            output(this, await apiClient.get("/api/v1/cli/kb/repo/identities"));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("link-identity <provider> <account> <member-email>")
+        .description("Link a provider account (login or account id) to the member with that email (org admin)")
+        .action(async function (provider, account, memberEmail) {
+        try {
+            if (!["github", "bitbucket"].includes(provider)) {
+                throw new Error("provider must be github or bitbucket");
+            }
+            output(this, await apiClient.post("/api/v1/cli/kb/repo/identities/link", {
+                provider,
+                account,
+                member_email: memberEmail,
+            }));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("unlink-identity <provider> <account>")
+        .description("Unlink a provider account from its member (org admin); leaves a tombstone the silent email match cannot cross")
+        .action(async function (provider, account) {
+        try {
+            if (!["github", "bitbucket"].includes(provider)) {
+                throw new Error("provider must be github or bitbucket");
+            }
+            output(this, await apiClient.post("/api/v1/cli/kb/repo/identities/unlink", {
+                provider,
+                account,
+            }));
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("export-datasources")
+        .description("Write the live Data Source definitions as datasources/<name>.ds.yml + <name>.sql (org admin): " +
+        "the mirror an org commits before entering manual mode; byte-identical when nothing differs")
+        .requiredOption("--out <dir>", "Directory to write into (the repository's .graphit/datasources)")
+        .action(async function () {
+        try {
+            const opts = this.opts();
+            const exported = await apiClient.get("/api/v1/cli/kb/repo/datasources");
+            const written = writeExportedDatasources(opts.out, exported.files ?? {});
+            output(this, {
+                out: resolve(opts.out),
+                definitions: exported.count ?? written.length / 2,
+                written,
+                skipped: exported.skipped ?? [],
+            });
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    repo
+        .command("apply")
+        .description("Apply a plan (org admin). --plan applies a saved plan id; --sha re-verifies the commit and applies " +
+        "the fresh plan in one call (the merge job). Refuses a stale plan, a changed tree, a failing verdict " +
+        "or a local-only plan; a concurrent apply on the same repository waits")
+        .option("--plan <id>", "Plan id returned by kb repo verify")
+        .option("--sha <sha>", "Commit to verify and apply; the server pulls its archive")
+        .option("--pr <id>", "Pull request the commit belongs to (with --sha)")
+        .option("--kind <kind>", "Plan kind: sync (default) or migration", "sync")
+        .option("--token <token>", "Machine token minted by `kb repo token mint` (CI); replaces the login")
+        .option("--poll-interval-ms <n>", "Status poll interval", String(DEFAULT_POLL_INTERVAL_MS))
+        .option("--timeout-ms <n>", "Maximum wait", String(DEFAULT_TIMEOUT_MS))
+        .action(async function () {
+        try {
+            const opts = this.opts();
+            if ((opts.plan && opts.sha) || (!opts.plan && !opts.sha)) {
+                throw new Error("Provide exactly one of --plan <id> or --sha <sha>");
+            }
+            if (!["sync", "migration"].includes(opts.kind)) {
+                throw new Error("--kind must be sync or migration");
+            }
+            const machineToken = resolveMachineToken(opts.token);
+            if (machineToken !== undefined)
+                setMachineToken(machineToken);
+            await runAndPoll(this, "/api/v1/cli/kb/repo/apply", opts.plan
+                ? { plan_id: opts.plan }
+                : { commit_sha: opts.sha, pr_id: opts.pr, kind: opts.kind }, opts);
+        }
+        catch (error) {
+            errorOutput(error);
+        }
+    });
+    attachKBRepoTokenCommands(repo);
+}
+//# sourceMappingURL=kb-repo.js.map

package/dist/commands/kb-repo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-repo.js","sourceRoot":"","sources":["../../src/commands/kb-repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAEnF,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAE7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AACrC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAEtC,MAAM,wBAAwB,GAAG,KAAK,CAAC;AACvC,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,oFAAoF;AACpF,mFAAmF;AACnF,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,6EAA6E;AAC7E,8EAA8E;AAC9E,mBAAmB;AACnB,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AACjD,MAAM,WAAW,GAAG,UAAU,CAAC;AAC/B,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AA6BvC,SAAS,oBAAoB,CAAC,GAAuB,EAAE,QAAgB,EAAE,IAAY;IACnF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,UAAkB;IAC/D,OAAO,SAAS,GAAG,qBAAqB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;AACtG,CAAC;AAED,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,qCAAqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,IAAa,EAAE,MAAyB,OAAO,CAAC,GAAG;IACrF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,wCAAwC;AACxC,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IAC7D,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,UAAkB,EAClB,OAAkD;IAElD,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC;QACxC,IAAI,MAAuB,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAkB,UAAU,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,sEAAsE;YACtE,wEAAwE;YACxE,4EAA4E;YAC5E,MAAM,UAAU,GAAI,KAA8B,CAAC,MAAM,CAAC;YAC1D,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG,IAAI,UAAU,KAAK,GAAG,EAAE,CAAC;gBAClG,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;YACnG,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB;gBACtC,CAAC,CAAC,KAAK,MAAM,CAAC,oBAAoB,IAAI,MAAM,CAAC,gBAAgB,cAAc;gBAC3E,CAAC,CAAC,EAAE,CAAC;YACP,IAAI,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,QAAQ,EAAE,CAAC,CAAC;YACrC,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,GAAW,EAAE,IAA4B;IACnE,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAS;QACrC,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;YACvB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,0DAA0D,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA6B;IAC1D,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,WAAW,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACxF,IAAI,OAA8C,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0C,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,2DAA2D;QACvE,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,8EAA8E;AAC9E,2CAA2C;AAC3C,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,MAAM,WAAW,gBAAgB,IAAI,wEAAwE,CAC9G,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAA2B,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE;YAAE,SAAS;QAC5F,KAAK,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,GAAG,CAAC,QAAgB,EAAE,IAAc;IAC3C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,EAAE;YACpD,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;SACpC,CAAC,CAAC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAC3E,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;AAC9D,CAAC;AAQD,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,wBAAwB;AACxB,MAAM,UAAU,wBAAwB,CAAC,GAAW,EAAE,KAA6B;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,yBAAyB,CAAC,CAAC;QACtE,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,IAAY,EACZ,IAA6B,EAC7B,IAAqD;IAErD,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,cAAc,EAAE,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IAC3F,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAoB,IAAI,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7F,IAAI,CAAC,YAAY,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACtF,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,CAAC,OAAO,EAAE;YACd,YAAY,EAAE,QAAQ,CAAC,YAAY;YACnC,MAAM,EAAE,WAAW;YACnB,MAAM,EAAE,gEAAgE;SACzE,CAAC,CAAC;QACH,OAAO,CAAC,QAAQ,GAAG,oBAAoB,CAAC;QACxC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC5C,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,wDAAwD;AACxD,MAAM,UAAU,oBAAoB,CAAC,EAAW;IAC9C,MAAM,IAAI,GAAG,EAAE;SACZ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6FAA6F,CAAC,CAAC;IAE9G,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,qGAAqG;QACnG,oGAAoG;QACpG,oGAAoG;QACpG,2CAA2C,CAC9C;SACA,MAAM,CAAC,aAAa,EAAE,0EAA0E,CAAC;SACjG,MAAM,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,6DAA6D,CAAC;SAC1F,MAAM,CAAC,eAAe,EAAE,2DAA2D,CAAC;SACpF,MAAM,CAAC,eAAe,EAAE,wCAAwC,EAAE,MAAM,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;SAC1F,MAAM,CAAC,kBAAkB,EAAE,cAAc,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;SACtE,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,YAAY,KAAK,SAAS;gBAAE,eAAe,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACvC,MAAM,IAAI,KAAK,CACb,iGAAiG,CAClG,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;gBACnD,IAAI,CAAC,mFAAmF,CAAC,CAAC;gBAC1F,MAAM,UAAU,CACd,IAAI,EACJ,4BAA4B,EAC5B;oBACE,KAAK;oBACL,UAAU,EAAE,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;oBACpE,YAAY,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;oBACxD,IAAI,EAAE,IAAI,CAAC,IAAI;iBAChB,EACD,IAAI,CACL,CAAC;gBACF,OAAO;YACT,CAAC;YACD,MAAM,UAAU,CACd,IAAI,EACJ,4BAA4B,EAC5B,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACzD,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,wGAAwG,CACzG;SACA,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAA0B,qBAAqB,CAAC,CAAC,CAAC;QACpF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CACV,uGAAuG;QACrG,+FAA+F,CAClG;SACA,MAAM,CAAC,KAAK,WAA0B,IAAY;QACjD,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,CAA0B,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,2GAA2G,CAC5G;SACA,cAAc,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;SACjF,cAAc,CAAC,qBAAqB,EAAE,sCAAsC,CAAC;SAC7E,MAAM,CAAC,iBAAiB,EAAE,2CAA2C,EAAE,MAAM,CAAC;SAC9E,MAAM,CAAC,sBAAsB,EAAE,sEAAsE,CAAC;SACtG,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,GAA4B;gBACpC,aAAa,EAAE,IAAI,CAAC,UAAU;gBAC9B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,MAAM;aACzB,CAAC;YACF,IAAI,IAAI,CAAC,WAAW;gBAAE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,WAAW,CAAC;YAClE,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,CAA0B,0BAA0B,EAAE,IAAI,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CACV,+FAA+F,CAChG;SACA,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAA0B,gCAAgC,CAAC,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,mDAAmD,CAAC;SAC5D,WAAW,CACV,yFAAyF,CAC1F;SACA,MAAM,CAAC,KAAK,WAA0B,QAAgB,EAAE,OAAe,EAAE,WAAmB;QAC3F,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CACJ,IAAI,EACJ,MAAM,SAAS,CAAC,IAAI,CAA0B,qCAAqC,EAAE;gBACnF,QAAQ;gBACR,OAAO;gBACP,YAAY,EAAE,WAAW;aAC1B,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,sCAAsC,CAAC;SAC/C,WAAW,CACV,+GAA+G,CAChH;SACA,MAAM,CAAC,KAAK,WAA0B,QAAgB,EAAE,OAAe;QACtE,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CACJ,IAAI,EACJ,MAAM,SAAS,CAAC,IAAI,CAA0B,uCAAuC,EAAE;gBACrF,QAAQ;gBACR,OAAO;aACR,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CACV,gGAAgG;QAC9F,4FAA4F,CAC/F;SACA,cAAc,CAAC,aAAa,EAAE,iEAAiE,CAAC;SAChG,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,CAAsB,iCAAiC,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YACzE,MAAM,CAAC,IAAI,EAAE;gBACX,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;gBACtB,WAAW,EAAE,QAAQ,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;gBACjD,OAAO;gBACP,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,qGAAqG;QACnG,sGAAsG;QACtG,uEAAuE,CAC1E;SACA,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,aAAa,EAAE,0DAA0D,CAAC;SACjF,MAAM,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACtE,MAAM,CAAC,eAAe,EAAE,wCAAwC,EAAE,MAAM,CAAC;SACzE,MAAM,CAAC,iBAAiB,EAAE,uEAAuE,CAAC;SAClG,MAAM,CAAC,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,CAAC,wBAAwB,CAAC,CAAC;SAC1F,MAAM,CAAC,kBAAkB,EAAE,cAAc,EAAE,MAAM,CAAC,kBAAkB,CAAC,CAAC;SACtE,MAAM,CAAC,KAAK;QACX,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrD,IAAI,YAAY,KAAK,SAAS;gBAAE,eAAe,CAAC,YAAY,CAAC,CAAC;YAC9D,MAAM,UAAU,CACd,IAAI,EACJ,2BAA2B,EAC3B,IAAI,CAAC,IAAI;gBACP,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;gBACxB,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAC7D,IAAI,CACL,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,yBAAyB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC"}