@idea1/cli 1.10.4 → 1.11.1

package/dist/services/platform-auth.js

@@ -0,0 +1,476 @@
+import { createHash, randomBytes } from 'crypto';
+import { createServer } from 'http';
+import { setTimeout as delay } from 'timers/promises';
+import { AsyncEntry } from '@napi-rs/keyring';
+import { logger } from '../lib/logger.js';
+import { isUnattended } from '../lib/prompt.js';
+import { openUrl } from './os-launcher.js';
+/**
+ * The CLI's OAuth client of the Idea1 platform: it holds the credential every platform call is
+ * authorized with, and signs the user in and out.
+ *
+ * The CLI is a public client (no secret) that registers itself dynamically with the platform's
+ * authorization server, discovered at `{apiBase}/.well-known/oauth-authorization-server`. Signing in
+ * is the authorization code flow with PKCE: the browser opens the platform's consent page, where the
+ * user picks the team the grant is bound to, and the platform redirects back to a loopback server
+ * the CLI runs on a random port of 127.0.0.1 (the registered `http://127.0.0.1/callback` matches on
+ * any port). The resulting team-bound access token is short-lived; the refresh token renews it.
+ *
+ * The credential lives in the operating system's credential store (macOS Keychain, Windows
+ * Credential Manager, Secret Service on Linux) under the service `idea1-cli` and the API base URL as
+ * the account, as the JSON of a `StoredCredential`; a credential longer than one entry holds
+ * continues in further entries. Parallel CLI processes share it: the platform does not rotate
+ * refresh tokens, so concurrent refreshes all stay valid and the last write wins.
+ *
+ * `IDEA1_TOKEN`, when set, is the bearer token of every call instead (a team API client's token in
+ * CI, or a test's): nothing is read from or written to the credential store, and nothing is
+ * refreshed. `IDEA1_API_BASE_URL` points the CLI at another platform than https://api.idea1.ai.
+ */
+export const API_BASE_URL_ENV = 'IDEA1_API_BASE_URL';
+export const TOKEN_ENV = 'IDEA1_TOKEN';
+const DEFAULT_API_BASE_URL = 'https://api.idea1.ai';
+const CREDENTIAL_STORE_SERVICE = 'idea1-cli';
+/**
+ * The most UTF-16 code units one credential store entry holds: Windows Credential Manager caps an
+ * entry at 2560 bytes. The platform's access and refresh tokens are JWTs that together exceed it,
+ * so a credential is kept as a run of entries, each a piece of its JSON behind a header of at most
+ * CREDENTIAL_PIECE_HEADER_LENGTH code units (the write's id and the run's length).
+ */
+const CREDENTIAL_STORE_ENTRY_LENGTH = 1280;
+const CREDENTIAL_PIECE_HEADER_LENGTH = 12;
+const CREDENTIAL_PIECE_TEXT_LENGTH = CREDENTIAL_STORE_ENTRY_LENGTH - CREDENTIAL_PIECE_HEADER_LENGTH;
+const CREDENTIAL_PIECE_PATTERN = /^([0-9a-f]{8}):(\d+):(.*)$/s;
+/** How many times, and how far apart, a run whose entries are not all of one write is read. */
+const STORED_CREDENTIAL_READ_ATTEMPTS = 4;
+const STORED_CREDENTIAL_READ_RETRY_MS = 100;
+const CLIENT_NAME = 'Idea1 CLI';
+const CLIENT_SCOPE = 'team:read projects:read projects:write';
+/** The redirect URI the client registers; the loopback server listens on a random port of it. */
+const REGISTERED_REDIRECT_URI = 'http://127.0.0.1/callback';
+const SIGN_IN_TIMEOUT_MS = 5 * 60 * 1000;
+/** An access token this close to its expiry is renewed before it is used. */
+const EXPIRY_MARGIN_MS = 60 * 1000;
+/**
+ * An OAuth error response (RFC 6749 §5.2), from an endpoint or from the authorization redirect.
+ */
+class OAuthError extends Error {
+    code;
+    constructor(code, description) {
+        super(description === null ? `idea1.ai sign-in failed: ${code}` : `idea1.ai sign-in failed: ${code} (${description})`);
+        this.code = code;
+    }
+}
+/**
+ * The base URL of the platform's API, without a trailing slash.
+ */
+export function apiBaseUrl() {
+    const configured = process.env[API_BASE_URL_ENV]?.trim();
+    return (configured ? configured : DEFAULT_API_BASE_URL).replace(/\/+$/, '');
+}
+function tokenFromEnvironment() {
+    const token = process.env[TOKEN_ENV]?.trim();
+    return token ? token : null;
+}
+/**
+ * `fetch` with the platform credential as the bearer token. Signs the user in first when there is
+ * no usable credential (an unattended run fails instead, asking for `idea1 login`), renews an
+ * expired access token, and on a 401 renews it and retries the request once. With `IDEA1_TOKEN`
+ * set, that token is sent as it is and a 401 is the caller's response.
+ */
+export async function authorizedFetch(url, init) {
+    const environmentToken = tokenFromEnvironment();
+    if (environmentToken !== null) {
+        return fetch(url, withBearer(init, environmentToken));
+    }
+    const credential = await serialized(() => usableCredential(null));
+    const response = await fetch(url, withBearer(init, credential.accessToken));
+    if (response.status !== 401) {
+        return response;
+    }
+    const renewed = await serialized(() => usableCredential(credential.accessToken));
+    return fetch(url, withBearer(init, renewed.accessToken));
+}
+/**
+ * Sign in through the browser, replacing any stored credential for the platform.
+ */
+export async function login() {
+    if (tokenFromEnvironment() !== null) {
+        throw new Error(`${TOKEN_ENV} is set, and every platform call uses it: unset it to sign in with \`idea1 login\`.`);
+    }
+    await serialized(async () => {
+        await signIn((await readStoredCredential())?.clientId ?? null);
+    });
+}
+/**
+ * Revoke the stored credential's refresh token and remove the credential from the credential
+ * store. Returns false when there was no credential to remove.
+ */
+export async function logout() {
+    return serialized(async () => {
+        const stored = await readStoredCredential();
+        if (stored === null) {
+            return false;
+        }
+        try {
+            await revoke(stored);
+        }
+        finally {
+            await deleteStoredCredential();
+        }
+        return true;
+    });
+}
+/**
+ * Credential reads, renewals and sign-ins run one at a time in a process, so parallel platform
+ * calls renew or sign in once.
+ */
+let credentialQueue = Promise.resolve();
+function serialized(work) {
+    const result = credentialQueue.then(work);
+    credentialQueue = result.catch(() => undefined);
+    return result;
+}
+/**
+ * A credential whose access token is current, other than `rejectedAccessToken` (the one a 401 was
+ * answered with, unless another call or process has renewed it since). A credential the platform
+ * no longer honours is removed, and the user signs in again.
+ */
+async function usableCredential(rejectedAccessToken) {
+    const stored = await readStoredCredential();
+    if (stored === null) {
+        return signInWhenAttended(null);
+    }
+    const expired = Date.parse(stored.accessTokenExpiresAt) - EXPIRY_MARGIN_MS <= Date.now();
+    if (!expired && stored.accessToken !== rejectedAccessToken) {
+        return stored;
+    }
+    try {
+        return await refresh(stored);
+    }
+    catch (error) {
+        if (error instanceof OAuthError && (error.code === 'invalid_grant' || error.code === 'invalid_client')) {
+            await deleteStoredCredential();
+            return signInWhenAttended(error.code === 'invalid_grant' ? stored.clientId : null);
+        }
+        throw error;
+    }
+}
+async function signInWhenAttended(clientId) {
+    if (isUnattended()) {
+        throw new Error(`Not signed in to idea1.ai (${apiBaseUrl()}). Run \`idea1 login\` to sign in.`);
+    }
+    logger.step(`Signing in to idea1.ai (${apiBaseUrl()})...`);
+    return signIn(clientId);
+}
+/**
+ * Sign in through the browser with the given registered client, or a newly registered one, and
+ * store the credential: the authorization code flow with PKCE (S256) and `state`, redirected to a
+ * loopback server on a random port.
+ *
+ * The platform answers an authorization request it refuses outright, such as one for a client it
+ * no longer knows, with an error page instead of a redirect to the loopback server. So before the
+ * browser opens, the request for a stored client is sent once without following its redirect: a
+ * client the platform no longer knows is registered again, and any other refusal ends the sign-in.
+ */
+async function signIn(storedClientId) {
+    const metadata = await discoverAuthorizationServer();
+    const codeVerifier = base64Url(randomBytes(32));
+    const codeChallenge = base64Url(createHash('sha256').update(codeVerifier).digest());
+    const state = base64Url(randomBytes(16));
+    const callback = await listenForAuthorizationCallback(state);
+    try {
+        const authorizationUrlFor = (clientId) => {
+            const url = new URL(metadata.authorization_endpoint);
+            url.search = new URLSearchParams({
+                response_type: 'code',
+                client_id: clientId,
+                redirect_uri: callback.redirectUri,
+                scope: CLIENT_SCOPE,
+                state,
+                code_challenge: codeChallenge,
+                code_challenge_method: 'S256'
+            }).toString();
+            return url.toString();
+        };
+        let clientId = storedClientId ?? await registerClient(metadata);
+        if (storedClientId !== null) {
+            const refusal = await authorizationRefusal(authorizationUrlFor(storedClientId));
+            if (refusal?.code === 'invalid_client') {
+                clientId = await registerClient(metadata);
+            }
+            else if (refusal !== null) {
+                throw refusal;
+            }
+        }
+        const [code] = await Promise.all([callback.code, openInBrowser(authorizationUrlFor(clientId))]);
+        const tokens = await postTokenRequest(metadata, {
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: callback.redirectUri,
+            client_id: clientId,
+            code_verifier: codeVerifier
+        });
+        if (tokens.refresh_token === null) {
+            throw new Error('idea1.ai issued no refresh token for the sign-in.');
+        }
+        return storeTokens(clientId, tokens, tokens.refresh_token);
+    }
+    finally {
+        callback.close();
+    }
+}
+/**
+ * The OAuth error the authorize endpoint answers a request with instead of redirecting it; null
+ * when it redirects. The endpoint validates the request and redirects to the consent page with no
+ * side effect, so the request is safe to send ahead of the browser.
+ */
+async function authorizationRefusal(authorizationUrl) {
+    const response = await fetch(authorizationUrl, { redirect: 'manual', headers: { Accept: 'application/json' } });
+    const text = await response.text();
+    const error = response.status >= 400 && response.status < 500 ? parseOAuthError(text) : null;
+    return error === null ? null : new OAuthError(error.error, error.error_description ?? null);
+}
+async function openInBrowser(url) {
+    logger.dim(`Sign in to idea1.ai in your browser. If it does not open, open this URL:\n${url}`);
+    try {
+        await openUrl(url);
+    }
+    catch (error) {
+        logger.warning(`Could not open the browser: ${error.message}`);
+    }
+}
+/**
+ * A loopback HTTP server on a random port of 127.0.0.1 that receives the authorization redirect:
+ * `code` settles with the authorization code, the platform's error, or a timeout.
+ */
+async function listenForAuthorizationCallback(state) {
+    const server = createServer();
+    let timeout;
+    const code = new Promise((resolve, reject) => {
+        timeout = setTimeout(() => reject(new Error(`Sign-in did not finish in the browser within ${SIGN_IN_TIMEOUT_MS / 60_000} minutes.`)), SIGN_IN_TIMEOUT_MS);
+        server.on('request', (request, response) => {
+            const url = new URL(request.url ?? '/', 'http://127.0.0.1');
+            // Anything other than the redirect of this sign-in (a favicon, a stale tab) is not an answer.
+            if (url.pathname !== '/callback' || url.searchParams.get('state') !== state) {
+                response.writeHead(404).end();
+                return;
+            }
+            const error = url.searchParams.get('error');
+            const authorizationCode = url.searchParams.get('code');
+            if (error !== null || !authorizationCode) {
+                writeCallbackPage(response, 'Sign-in did not complete. Return to the terminal for details; you can close this tab.');
+                reject(new OAuthError(error ?? 'invalid_request', url.searchParams.get('error_description')));
+                return;
+            }
+            writeCallbackPage(response, 'Signed in to idea1.ai. You can close this tab and return to the terminal.');
+            resolve(authorizationCode);
+        });
+    });
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', () => resolve());
+    });
+    const { port } = server.address();
+    const redirectUri = new URL(REGISTERED_REDIRECT_URI);
+    redirectUri.port = String(port);
+    return {
+        redirectUri: redirectUri.toString(),
+        code,
+        close: () => {
+            clearTimeout(timeout);
+            server.close();
+            server.closeAllConnections();
+        }
+    };
+}
+function writeCallbackPage(response, message) {
+    response.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8', Connection: 'close' });
+    response.end('<!doctype html><html><head><meta charset="utf-8"><title>Idea1 CLI</title></head>' +
+        `<body style="font-family: system-ui, sans-serif; margin: 4rem; text-align: center"><p>${message}</p></body></html>`);
+}
+let authorizationServerMetadata = null;
+function discoverAuthorizationServer() {
+    authorizationServerMetadata ??= readJson(fetch(`${apiBaseUrl()}/.well-known/oauth-authorization-server`, { headers: { Accept: 'application/json' } })).catch(error => {
+        authorizationServerMetadata = null;
+        throw error;
+    });
+    return authorizationServerMetadata;
+}
+async function registerClient(metadata) {
+    const registration = await readJson(fetch(metadata.registration_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_name: CLIENT_NAME,
+            redirect_uris: [REGISTERED_REDIRECT_URI],
+            grant_types: ['authorization_code', 'refresh_token'],
+            response_types: ['code'],
+            token_endpoint_auth_method: 'none',
+            scope: CLIENT_SCOPE
+        })
+    }));
+    return registration.client_id;
+}
+/**
+ * Renew the access token. The platform does not rotate refresh tokens, so the stored one is kept
+ * unless the response carries another.
+ */
+async function refresh(stored) {
+    const tokens = await postTokenRequest(await discoverAuthorizationServer(), {
+        grant_type: 'refresh_token',
+        refresh_token: stored.refreshToken,
+        client_id: stored.clientId
+    });
+    return storeTokens(stored.clientId, tokens, tokens.refresh_token ?? stored.refreshToken);
+}
+async function revoke(stored) {
+    const metadata = await discoverAuthorizationServer();
+    await readSuccessBody(fetch(metadata.revocation_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ token: stored.refreshToken, token_type_hint: 'refresh_token', client_id: stored.clientId }).toString()
+    }));
+}
+function postTokenRequest(metadata, parameters) {
+    return readJson(fetch(metadata.token_endpoint, {
+        method: 'POST',
+        headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams(parameters).toString()
+    }));
+}
+/**
+ * The JSON body of an OAuth endpoint's success response.
+ */
+async function readJson(pending) {
+    return JSON.parse(await readSuccessBody(pending));
+}
+/**
+ * The body of an OAuth endpoint's success response; an error response throws OAuthError with the
+ * endpoint's `error` code, or an Error naming the HTTP status when it has none.
+ */
+async function readSuccessBody(pending) {
+    const response = await pending;
+    const text = await response.text();
+    if (response.ok) {
+        return text;
+    }
+    const error = parseOAuthError(text);
+    if (error !== null) {
+        throw new OAuthError(error.error, error.error_description ?? null);
+    }
+    throw new Error(`idea1.ai refused ${response.url} (${response.status} ${response.statusText})${text.trim() ? `: ${text.trim().slice(0, 500)}` : ''}`);
+}
+function parseOAuthError(text) {
+    try {
+        const body = JSON.parse(text);
+        return typeof body.error === 'string' ? { error: body.error, error_description: body.error_description } : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function storeTokens(clientId, tokens, refreshToken) {
+    const credential = {
+        clientId,
+        refreshToken,
+        accessToken: tokens.access_token,
+        accessTokenExpiresAt: new Date(Date.now() + tokens.expires_in * 1000).toISOString()
+    };
+    await writeStoredCredential(credential);
+    return credential;
+}
+/**
+ * The credential's run of entries: its JSON in pieces, the first under the API base URL as the
+ * account and the rest under the URL suffixed `#2`, `#3`, and so on. Entries are written one at a
+ * time, so a run read mid-write, or left by a write that was cut short, mixes entries of different
+ * writes: it is read again a few times, and if it stays mixed there is no credential and the user
+ * signs in again. An entry of plain JSON is a whole credential on its own, and a stored text that
+ * is not JSON is no credential, since its parse error would quote the store's content.
+ */
+async function readStoredCredential() {
+    for (let attempt = 1; attempt <= STORED_CREDENTIAL_READ_ATTEMPTS; attempt++) {
+        const first = await credentialStoreEntry(1).getPassword();
+        if (first === null) {
+            return null;
+        }
+        if (first.startsWith('{')) {
+            return parseStoredCredential(first);
+        }
+        const json = await readStoredCredentialRun(first);
+        if (json !== null) {
+            return parseStoredCredential(json);
+        }
+        await delay(STORED_CREDENTIAL_READ_RETRY_MS);
+    }
+    return null;
+}
+/** The JSON of the run that `first` starts, or null when its entries are not all of one write. */
+async function readStoredCredentialRun(first) {
+    const firstPiece = parseCredentialPiece(first);
+    if (firstPiece === null) {
+        return null;
+    }
+    const texts = [firstPiece.text];
+    for (let index = 2; index <= firstPiece.count; index++) {
+        const entry = await credentialStoreEntry(index).getPassword();
+        const piece = entry === null ? null : parseCredentialPiece(entry);
+        if (piece === null || piece.writeId !== firstPiece.writeId || piece.count !== firstPiece.count) {
+            return null;
+        }
+        texts.push(piece.text);
+    }
+    return texts.join('');
+}
+function parseStoredCredential(json) {
+    try {
+        return JSON.parse(json);
+    }
+    catch (error) {
+        if (error instanceof SyntaxError) {
+            return null;
+        }
+        throw error;
+    }
+}
+function parseCredentialPiece(entry) {
+    const match = CREDENTIAL_PIECE_PATTERN.exec(entry);
+    return match === null ? null : { writeId: match[1], count: Number(match[2]), text: match[3] };
+}
+async function writeStoredCredential(credential) {
+    const json = JSON.stringify(credential);
+    const texts = [];
+    for (let start = 0; start < json.length;) {
+        let end = Math.min(start + CREDENTIAL_PIECE_TEXT_LENGTH, json.length);
+        // A surrogate pair stays in one piece: the store cannot hold half of one.
+        if (end < json.length && json.charCodeAt(end - 1) >= 0xd800 && json.charCodeAt(end - 1) <= 0xdbff) {
+            end--;
+        }
+        texts.push(json.slice(start, end));
+        start = end;
+    }
+    const writeId = randomBytes(4).toString('hex');
+    for (const [offset, text] of texts.entries()) {
+        await credentialStoreEntry(offset + 1).setPassword(`${writeId}:${texts.length}:${text}`);
+    }
+    await deleteStoredCredentialFrom(texts.length + 1);
+}
+async function deleteStoredCredential() {
+    await deleteStoredCredentialFrom(1);
+}
+/** Removes the entries of the run from `index` on, such as those a shorter credential leaves behind. */
+async function deleteStoredCredentialFrom(index) {
+    while (await credentialStoreEntry(index).deletePassword()) {
+        index++;
+    }
+}
+function credentialStoreEntry(index) {
+    const account = index === 1 ? apiBaseUrl() : `${apiBaseUrl()}#${index}`;
+    return new AsyncEntry(CREDENTIAL_STORE_SERVICE, account);
+}
+function withBearer(init, token) {
+    return { ...init, headers: { ...init.headers, Authorization: `Bearer ${token}` } };
+}
+function base64Url(bytes) {
+    return bytes.toString('base64url');
+}
+//# sourceMappingURL=platform-auth.js.map

package/dist/services/platform-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-auth.js","sourceRoot":"","sources":["../../src/services/platform-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,YAAY,EAAuB,MAAM,MAAM,CAAC;AAEzD,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AACrD,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AAEvC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AACpD,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAC7C;;;;;GAKG;AACH,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAC3C,MAAM,8BAA8B,GAAG,EAAE,CAAC;AAC1C,MAAM,4BAA4B,GAAG,6BAA6B,GAAG,8BAA8B,CAAC;AACpG,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,+FAA+F;AAC/F,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAC5C,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,YAAY,GAAG,wCAAwC,CAAC;AAC9D,iGAAiG;AACjG,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACzC,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAuCnC;;GAEG;AACH,MAAM,UAAW,SAAQ,KAAK;IACP;IAArB,YAAqB,IAAY,EAAE,WAA0B;QAC3D,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC,CAAC,4BAA4B,IAAI,KAAK,WAAW,GAAG,CAAC,CAAC;QADpG,SAAI,GAAJ,IAAI,CAAQ;IAEjC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,CAAC;IACzD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,oBAAoB;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;IAC7C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAiB;IAClE,MAAM,gBAAgB,GAAG,oBAAoB,EAAE,CAAC;IAChD,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IACjF,OAAO,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK;IACzB,IAAI,oBAAoB,EAAE,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,qFAAqF,CAAC,CAAC;IACrH,CAAC;IAED,MAAM,UAAU,CAAC,KAAK,IAAI,EAAE;QAC1B,MAAM,MAAM,CAAC,CAAC,MAAM,oBAAoB,EAAE,CAAC,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,OAAO,UAAU,CAAC,KAAK,IAAI,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;QAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;gBAAS,CAAC;YACT,MAAM,sBAAsB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,IAAI,eAAe,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;AAE1D,SAAS,UAAU,CAAI,IAAsB;IAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,mBAAkC;IAChE,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC5C,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,gBAAgB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACzF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,WAAW,KAAK,mBAAmB,EAAE,CAAC;QAC3D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAAE,CAAC;YACvG,MAAM,sBAAsB,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,QAAuB;IACvD,IAAI,YAAY,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,EAAE,oCAAoC,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,2BAA2B,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,MAAM,CAAC,cAA6B;IACjD,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAChD,MAAM,aAAa,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,8BAA8B,CAAC,KAAK,CAAC,CAAC;IAE7D,IAAI,CAAC;QACH,MAAM,mBAAmB,GAAG,CAAC,QAAgB,EAAU,EAAE;YACvD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YACrD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;gBAC/B,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,QAAQ,CAAC,WAAW;gBAClC,KAAK,EAAE,YAAY;gBACnB,KAAK;gBACL,cAAc,EAAE,aAAa;gBAC7B,qBAAqB,EAAE,MAAM;aAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC,CAAC;QAEF,IAAI,QAAQ,GAAG,cAAc,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,mBAAmB,CAAC,cAAc,CAAC,CAAC,CAAC;YAChF,IAAI,OAAO,EAAE,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACvC,QAAQ,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5C,CAAC;iBAAM,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBAC5B,MAAM,OAAO,CAAC;YAChB,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QAEhG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE;YAC9C,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,QAAQ,CAAC,WAAW;YAClC,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;SAC5B,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7D,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,gBAAwB;IAC1D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;IAChH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7F,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW;IACtC,MAAM,CAAC,GAAG,CAAC,6EAA6E,GAAG,EAAE,CAAC,CAAC;IAC/F,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,CAAC,+BAAgC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,8BAA8B,CAAC,KAAa;IACzD,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,IAAI,OAAmC,CAAC;IAExC,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,OAAO,GAAG,UAAU,CAClB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,gDAAgD,kBAAkB,GAAG,MAAM,WAAW,CAAC,CAAC,EAC/G,kBAAkB,CACnB,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YAC5D,8FAA8F;YAC9F,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,EAAE,CAAC;gBAC5E,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;gBAC9B,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,iBAAiB,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACvD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACzC,iBAAiB,CAAC,QAAQ,EAAE,uFAAuF,CAAC,CAAC;gBACrH,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,IAAI,iBAAiB,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC;gBAC9F,OAAO;YACT,CAAC;YAED,iBAAiB,CAAC,QAAQ,EAAE,2EAA2E,CAAC,CAAC;YACzG,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,EAAiB,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrD,WAAW,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAEhC,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;QACnC,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACV,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAwB,EAAE,OAAe;IAClE,QAAQ,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7F,QAAQ,CAAC,GAAG,CACV,kFAAkF;QAClF,yFAAyF,OAAO,oBAAoB,CACrH,CAAC;AACJ,CAAC;AAED,IAAI,2BAA2B,GAAgD,IAAI,CAAC;AAEpF,SAAS,2BAA2B;IAClC,2BAA2B,KAAK,QAAQ,CACtC,KAAK,CAAC,GAAG,UAAU,EAAE,yCAAyC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAC7G,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACd,2BAA2B,GAAG,IAAI,CAAC;QACnC,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,QAAqC;IACjE,MAAM,YAAY,GAAG,MAAM,QAAQ,CAA6B,KAAK,CAAC,QAAQ,CAAC,qBAAqB,EAAE;QACpG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,WAAW;YACxB,aAAa,EAAE,CAAC,uBAAuB,CAAC;YACxC,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,cAAc,EAAE,CAAC,MAAM,CAAC;YACxB,0BAA0B,EAAE,MAAM;YAClC,KAAK,EAAE,YAAY;SACpB,CAAC;KACH,CAAC,CAAC,CAAC;IACJ,OAAO,YAAY,CAAC,SAAS,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,OAAO,CAAC,MAAwB;IAC7C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,MAAM,2BAA2B,EAAE,EAAE;QACzE,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,MAAM,CAAC,YAAY;QAClC,SAAS,EAAE,MAAM,CAAC,QAAQ;KAC3B,CAAC,CAAC;IACH,OAAO,WAAW,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC;AAC3F,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,MAAwB;IAC5C,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;IACrD,MAAM,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,EAAE;QACxD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;KACnI,CAAC,CAAC,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAqC,EAAE,UAAkC;IACjG,OAAO,QAAQ,CAAgB,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE;QAC5D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,QAAQ,CAAI,OAA0B;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAM,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAAC,OAA0B;IACvD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;IAC/B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,oBAAoB,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2D,CAAC;QACxF,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAqB,EAAE,YAAoB;IACtF,MAAM,UAAU,GAAqB;QACnC,QAAQ;QACR,YAAY;QACZ,WAAW,EAAE,MAAM,CAAC,YAAY;QAChC,oBAAoB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;KACpF,CAAC;IACF,MAAM,qBAAqB,CAAC,UAAU,CAAC,CAAC;IACxC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,oBAAoB;IACjC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,+BAA+B,EAAE,OAAO,EAAE,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kGAAkG;AAClG,KAAK,UAAU,uBAAuB,CAAC,KAAa;IAClD,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAClE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,UAAU,CAAC,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC,KAAK,EAAE,CAAC;YAC/F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,qBAAqB,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAqB,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,UAA4B;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,GAAI,CAAC;QAC1C,IAAI,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,4BAA4B,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtE,0EAA0E;QAC1E,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC;YAClG,GAAG,EAAE,CAAC;QACR,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACnC,KAAK,GAAG,GAAG,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,MAAM,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,OAAO,IAAI,KAAK,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,0BAA0B,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,KAAK,UAAU,sBAAsB;IACnC,MAAM,0BAA0B,CAAC,CAAC,CAAC,CAAC;AACtC,CAAC;AAED,wGAAwG;AACxG,KAAK,UAAU,0BAA0B,CAAC,KAAa;IACrD,OAAO,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1D,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACzC,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,IAAI,KAAK,EAAE,CAAC;IACxE,OAAO,IAAI,UAAU,CAAC,wBAAwB,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,UAAU,CAAC,IAAiB,EAAE,KAAa;IAClD,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAiC,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAAC;AAC/G,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC"}

package/dist/services/platform.d.ts

@@ -1,37 +1,89 @@
-import type { DevWorkflowType } from '../workflow/data/workflow-context.js';
+import type { DevWorkflowType, WorkflowContext } from '../workflow/data/workflow-context.js';
 import type { ProjectItemSummary } from '../workflow/data/project-item.js';
 import type { TeamMember } from '../workflow/data/team-member.js';
 import type { ClaudeRunOptions } from './claude.js';
 /**
  * The CLI's access to the Idea1 cloud platform (app.idea1.ai / api.idea1.ai): reading a project
  * item's summary (by item or by branch), recording the item's workflow context, setting its workflow
- * status (with the teammate it is assigned to), creating items, listing the team's Projects and
- * members, deriving a branch name from an item. Callers use `platform.someFunction()` and know
- * nothing about the transport.
+ * status (with the teammate it is assigned to), transitioning an item on the platform and approving
+ * a branch's pull request (the stage-1 merges the platform performs), approving a release and
+ * committing its version bump (the stage-2 work the platform performs), creating items, listing the team's Projects and
+ * members, deriving a branch name from an item, and reading who is signed in. Callers use
+ * `platform.someFunction()` and know nothing about the transport.
  *
- * Today the transport is Claude Code driving the Idea1 MCP tools. That is an implementation detail
- * of this module - it may be replaced by authenticated calls to the platform's HTTP API without
- * touching any caller. Because these are simple tool calls rather than implementation sessions,
- * every Claude run here uses PLATFORM_CALL_RUN_OPTIONS. The prompts are the templates in
- * `src/prompts/platform-prompts.ts`; this module owns the output schemas their answers are read with.
+ * The transport is the platform's REST API, authorized with the user's OAuth credential or
+ * `IDEA1_TOKEN` (see `platform-auth.ts`), on the team that credential is bound to. Responses are the
+ * platform's `ApiDataResponse` envelope; a refused request surfaces as an Error carrying the
+ * platform's status and message. Claude is used only to name branches, on PLATFORM_CALL_RUN_OPTIONS.
  */
 /**
- * Model and effort for every platform call: a small, fast model at medium effort is all a
- * single MCP tool call needs, and pinning it keeps these calls consistent and cheap.
+ * Model and effort for the Claude run that names a branch: a small, fast model at medium effort is
+ * all a one-line answer from a description needs, and pinning it keeps the run consistent and cheap.
  */
 export declare const PLATFORM_CALL_RUN_OPTIONS: Required<ClaudeRunOptions>;
+/**
+ * Who the platform credential signs in as: the user's email address and the team its calls work on.
+ */
+export interface SignedInUser {
+    emailAddress: string;
+    teamName: string;
+}
 /**
  * Record workflow context updates on an idea1.ai project item directly, with no side effects on the
  * platform: the CLI has already run the transition's work locally. The item must be under workflow
  * management (have a workflow context); the workflow engine is the only caller, as the persist step
  * of a transition. `assignedToEmail` names the team member the item is assigned to along with the
- * status; null leaves the assignment as it is.
- *
- * TODO: Direct workflow-context updates move from the update_item MCP tool to an authenticated
- * platform API call; the CLI will authenticate a user and call the API for direct integrations
- * like this, and MCP tools will be only operations that agents should run.
+ * status; null leaves the assignment as it is. Returns false, with a warning, when the platform did
+ * not record it.
  */
 export declare function setWorkflowStatus(itemUrl: string, status: string, pullRequestUrl: string | null, assignedToEmail: string | null): Promise<boolean>;
+/**
+ * The platform's `WorkflowTransitionResponse`: the item's workflow context after the transition, and
+ * what was done.
+ */
+export interface WorkflowTransitionResult {
+    workflowContext: WorkflowContext;
+    message: string;
+}
+/**
+ * Move a project item into `targetStatus` on the platform, which runs the side effects of every
+ * state it enters and records each one: entering Approved and Merged merges the item's pull request
+ * as the Idea1 GitHub App, once the signed-in user's approval is recorded on it. `expectedStatus` is
+ * the status the item has as far as the CLI knows; the platform refuses the transition when the item
+ * has moved since, so it never runs twice.
+ */
+export declare function transitionWorkflow(itemUrl: string, expectedStatus: string, targetStatus: string): Promise<WorkflowTransitionResult>;
+/**
+ * Approve the open pull request of a branch no project item carries: the platform records the
+ * signed-in user's approval on it and merges it as the Idea1 GitHub App. Returns what was done.
+ */
+export declare function approvePullRequest(repositoryFullName: string, branchName: string): Promise<string>;
+/**
+ * Approve the open release PR from a release branch (the base, hotfix or content release branch):
+ * the platform checks the signed-in user is its assignee and holds the release role, brings its
+ * change list up to date, records the approval on it and merges it as the Idea1 GitHub App. Returns
+ * what was done.
+ */
+export declare function approveRelease(repositoryFullName: string, branchName: string): Promise<string>;
+/** A version file of a version bump with its whole new content. */
+export interface VersionFileContent {
+    path: string;
+    content: string;
+}
+/**
+ * The platform's `ReleaseVersionBumpResponse`.
+ */
+interface ReleaseVersionBumpResponse {
+    commitSha: string;
+    subject: string;
+}
+/**
+ * Have the platform commit a release's version bump onto its release branch as the Idea1 GitHub
+ * App, for a releaser who cannot push to the branch: the new content of each version file, made
+ * against the branch at `expectedHeadSha`. The platform accepts only version edits of the declared
+ * packages' version files. Returns the commit.
+ */
+export declare function commitVersionBump(repositoryFullName: string, branchName: string, expectedHeadSha: string, files: readonly VersionFileContent[]): Promise<ReleaseVersionBumpResponse>;
 /**
  * The summary of the project item a branch implements: null for a branch outside workflow
  * management. The repository is always named; nothing defaults it.
@@ -67,7 +119,7 @@ export interface UpsertProjectItemWorkflowContextInput {
  */
 export declare function upsertProjectItemWorkflowContext(input: UpsertProjectItemWorkflowContextInput): Promise<ProjectItemSummary>;
 /**
- * Generate a branch name from a project item description
+ * Generate a branch name from a project item's description.
  */
 export declare function generateBranchName(itemUrl: string): Promise<string>;
 /**
@@ -86,9 +138,14 @@ export declare function listTeamMembers(): Promise<TeamMember[]>;
  */
 export declare function resolveTeammate(identity: string): Promise<TeamMember>;
 /**
- * Create a new idea1 project item with the given title in the named Project.
+ * Create a new idea1 project item with the given title in the named live Project.
  * The item is created with description `# <title>`.
  * Returns the created item's URL.
  */
 export declare function createProjectItem(title: string, projectName: string): Promise<string>;
+/**
+ * The user the platform credential signs in as, and the team its calls work on.
+ */
+export declare function getSignedInUser(): Promise<SignedInUser>;
+export {};
 //# sourceMappingURL=platform.d.ts.map

package/dist/services/platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/services/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAC5E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAelE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAEpD;;;;;;;;;;;;GAYG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAyC,CAAC;AAgB3G;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBxJ;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAclJ;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkBxF;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAkBhI;AAwED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAezE;AAED;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAUtD;AAoBD;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvD;AAkBD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ3E;AA4BD;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe3F"}
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../src/services/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,sCAAsC,CAAC;AAC7F,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAKlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGpD;;;;;;;;;;;;;GAaG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,gBAAgB,CAAyC,CAAC;AA4D3G;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAqID;;;;;;;GAOG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI,EAAE,eAAe,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAaxJ;AAED;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,eAAe,EAAE,eAAe,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;CACjB;AAKD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAgBzI;AAYD;;;GAGG;AACH,wBAAsB,kBAAkB,CAAC,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMxG;AAaD;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAMpG;AAED,mEAAmE;AACnE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,UAAU,0BAA0B;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,kBAAkB,EAAE,MAAM,EAC1B,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,EACvB,KAAK,EAAE,SAAS,kBAAkB,EAAE,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAWrC;AAED;;;GAGG;AACH,wBAAsB,8BAA8B,CAAC,KAAK,EAAE;IAAE,kBAAkB,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CASlJ;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAIxF;AAED;;GAEG;AACH,MAAM,WAAW,qCAAqC;IACpD,cAAc,EAAE,MAAM,CAAC;IACvB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,eAAe,CAAC;IACjC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CAAC,KAAK,EAAE,qCAAqC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAehI;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAWzE;AAUD;;GAEG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAItD;AAID;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAQvD;AAcD;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ3E;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY3F;AAED;;GAEG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAG7D"}