@kya-os/cli 1.8.3 → 2.0.2

package/dist/utils/dco/dispatch.d.ts

@@ -1,134 +0,0 @@
-/**
- * `dco dispatch` — ship a real, agent-signed PR in one command: branch,
- * signed commit, push, `gh pr create` with an `Agent DID:` line, then verify
- * the attribution the same way `dco verify` would.
- *
- * This is the command form of the quickstart runbook's Step 2 block
- * (docs/runbook-mcpi-dco-quickstart.md), including its cold-start
- * self-heal: a repo with no commits gets an initial commit, a repo with
- * no `origin` gets a private GitHub repo created for it.
- */
-export interface DcoDispatchResult {
-    ok: boolean;
-    /** Human-readable description of the step that failed, when !ok. */
-    failure?: string;
-    agent?: {
-        name: string;
-        slug: string;
-    };
-    did?: string;
-    /** PR title (and commit-subject source); echoed back for --json callers. */
-    title?: string;
-    branch?: string;
-    commitSha?: string;
-    signed?: boolean;
-    /** Set when the cold-start self-heal had to create a GitHub repo. */
-    createdRemote?: string;
-    prUrl?: string;
-    verified?: boolean;
-}
-export interface DcoDispatchOptions {
-    /**
-     * Dispatch as this existing agent instead of the checkout's `.mcpi/`
-     * identity: sign with `~/.mcpi/keys/<slug>` via per-invocation git config,
-     * so it works from any repo and ignores conflicting repo signing config.
-     */
-    agent?: string;
-    /**
-     * PR title (and the source for the commit subject). Defaults to the
-     * description's first line, truncated to MAX_TITLE_LENGTH.
-     */
-    title?: string;
-}
-/**
- * Resolve the PR title: the explicit `--title`, or the description's first
- * NON-EMPTY line when omitted (a description that opens with a blank line,
- * e.g. "\n\nActual title", must not yield an empty title). Either way it's
- * truncated to a safe length, since the title also seeds the commit subject
- * and a raw description can run long.
- */
-export declare function deriveDispatchTitle(description: string, explicitTitle?: string): string;
-/**
- * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
- * uppercase one, and lowercase passes everywhere. Truncated separately from
- * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
- * still yields a commit subject well inside commitlint's own length rule.
- */
-export declare function buildDispatchCommitSubject(title: string): string;
-/**
- * Whether `rawCommit` (the raw `git cat-file commit HEAD` output) carries a
- * `gpgsig` header — the reliable signed-commit check (`git log
- * --show-signature` needs `gpg.ssh.allowedSignersFile` locally and
- * misreports otherwise). Exported so `dispatch.ts` and `fix.ts` share the
- * exact same check rather than each re-deriving it: a raw commit object is
- * headers, then ONE blank line, then the free-text commit message, and a
- * naive `/^gpgsig /m.test(rawCommit)` over the WHOLE string false-positives
- * on an unsigned commit whose message body happens to contain a line
- * starting with "gpgsig " (an agent-composed `-m`/`--message` value is
- * exactly that kind of free text). Splitting off the header section before
- * testing closes that gap: git's object format guarantees no blank line
- * appears within the headers themselves, including a multi-line `gpgsig`
- * value's space-prefixed continuation lines, so the first `\n\n` reliably
- * marks the header/message boundary.
- */
-export declare function isCommitSigned(rawCommit: string): boolean;
-export interface ResolvedSigningIdentity {
-    agent: {
-        name: string;
-        slug: string;
-        url: string;
-    };
-    /** Slug-derived `did:web:knowthat.ai:agents:<slug>`; see the inline comment at its computation below. */
-    did: string;
-    signingConfig: string[];
-    /** Path to the converted OpenSSH signing key backing `signingConfig`, e.g. for `dco fix`'s attestation signing (`fix.ts`). */
-    keyPath: string;
-}
-export type ResolveSigningIdentityResult = {
-    ok: true;
-    identity: ResolvedSigningIdentity;
-} | {
-    ok: false;
-    failure: string;
-    /** Populated only once agent/DID resolution got far enough to know them (a DID-preflight failure). */
-    agent?: {
-        name: string;
-        slug: string;
-    };
-    did?: string;
-};
-/**
- * Resolve the agent identity, slug-derived DID, and per-invocation git
- * signing config for a dispatch-style operation: either an explicit
- * `--agent <slug>` (signs with `~/.mcpi/keys/<slug>`, works from any repo
- * and ignores conflicting repo signing config) or the checkout's own
- * `.mcpi/` identity. Fails closed, in order, BEFORE any git or GitHub side
- * effects: invalid/missing slug, missing signing key, then DID preflight
- * (`resolveDidPreflight`) so an unclaimed agent never reaches a git or `gh`
- * call.
- *
- * `runDcoDispatch` below and `runDcoFix` (`fix.ts`) both call this instead
- * of re-deriving the same agent/DID/signing-key logic: a second
- * implementation that drifted from this one could sign a commit with a
- * different key than the one an `Agent DID:`/attestation line claims.
- */
-export declare function resolveSigningIdentity(cwd: string, agentSlug: string | undefined): Promise<ResolveSigningIdentityResult>;
-export interface ColdStartResult {
-    /** Set when no `origin` remote existed and one was created. */
-    createdRemote?: string;
-}
-/**
- * The cold-start self-heal `runDcoDispatch` performs on `cwd` before its own
- * demo commit: `git init` if `cwd` isn't a work tree yet, a signed initial
- * commit if there's no `HEAD` yet, and a fresh private GitHub repo if there's
- * no `origin` remote yet. Factored out so `kya-os agent task`
- * (`utils/agent/task.ts`) reuses the exact same self-heal instead of a
- * second copy that could drift on ordering or on which commit ends up
- * signed — see this feature's design doc ("create or reuse a scratch repo
- * the way `runDcoDispatch` cold-start does"). `agent task` runs this
- * against a throwaway temp directory it creates itself, not the caller's own
- * cwd, unlike `runDcoDispatch`'s in-place self-heal.
- */
-export declare function ensureColdStartRepo(cwd: string, signingConfig: string[]): Promise<ColdStartResult>;
-export declare function runDcoDispatch(cwd: string, description: string, options?: DcoDispatchOptions): Promise<DcoDispatchResult>;
-//# sourceMappingURL=dispatch.d.ts.map

package/dist/utils/dco/dispatch.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/utils/dco/dispatch.ts"],"names":[],"mappings":"AAiBA;;;;;;;;;GASG;AACH,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AA8BD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CASR;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAmBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAGzD;AAmCD,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,yGAAyG;IACzG,GAAG,EAAE,MAAM,CAAC;IACZ,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,8HAA8H;IAC9H,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,4BAA4B,GACpC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,uBAAuB,CAAA;CAAE,GAC/C;IACE,EAAE,EAAE,KAAK,CAAC;IACV,OAAO,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEN;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B,OAAO,CAAC,4BAA4B,CAAC,CA8EvC;AAED,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CA+CxG;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,kBAAuB,GAC/B,OAAO,CAAC,iBAAiB,CAAC,CA8I5B"}

package/dist/utils/dco/dispatch.js

@@ -1,399 +0,0 @@
-import { execFile } from "child_process";
-import { existsSync, lstatSync, readFileSync, rmSync } from "fs";
-import { basename, join } from "path";
-import { promisify } from "util";
-import { writeFileAtomicSafe } from "../cli-kit/index.js";
-import { getPullRequestBody } from "./github.js";
-import { signingKeyPath } from "./paths.js";
-import { resolveAgentIdentity } from "./resolve-agent.js";
-import { RESOLVE_TIMEOUT_MS, didWebToHttpsUrl, hasAgentDidClaim, verifyPrAttribution, } from "./verify.js";
-const execFileAsync = promisify(execFile);
-async function run(cmd, args, cwd) {
-    const { stdout } = await execFileAsync(cmd, args, {
-        cwd,
-        encoding: "utf8",
-        maxBuffer: 10 * 1024 * 1024,
-    });
-    return stdout.trim();
-}
-async function gitSucceeds(args, cwd) {
-    try {
-        await run("git", args, cwd);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function errorMessage(error) {
-    if (error && typeof error === "object" && "stderr" in error) {
-        const stderr = String(error.stderr ?? "").trim();
-        if (stderr) {
-            return stderr;
-        }
-    }
-    return error instanceof Error ? error.message : String(error);
-}
-// commitlint's default subject-max-length is 100; ~72 for the PR title
-// mirrors GitHub's own soft wrap, and ~60 after the "docs: " prefix keeps the
-// full commit subject comfortably inside that even in stricter repos.
-const MAX_TITLE_LENGTH = 72;
-const MAX_COMMIT_SUBJECT_LENGTH = 60;
-function truncate(value, maxLength) {
-    return value.length > maxLength ? value.slice(0, maxLength).trimEnd() : value;
-}
-/**
- * Resolve the PR title: the explicit `--title`, or the description's first
- * NON-EMPTY line when omitted (a description that opens with a blank line,
- * e.g. "\n\nActual title", must not yield an empty title). Either way it's
- * truncated to a safe length, since the title also seeds the commit subject
- * and a raw description can run long.
- */
-export function deriveDispatchTitle(description, explicitTitle) {
-    if (explicitTitle && explicitTitle.trim().length > 0) {
-        return truncate(explicitTitle.trim(), MAX_TITLE_LENGTH);
-    }
-    const firstNonEmptyLine = description
-        .split(/\r?\n/)
-        .map((line) => line.trim())
-        .find((line) => line.length > 0);
-    return truncate(firstNonEmptyLine ?? "", MAX_TITLE_LENGTH);
-}
-/**
- * Lowercase subject on purpose: commitlint `subject-case` hooks reject an
- * uppercase one, and lowercase passes everywhere. Truncated separately from
- * the title (after the "docs: " prefix) so a title near MAX_TITLE_LENGTH
- * still yields a commit subject well inside commitlint's own length rule.
- */
-export function buildDispatchCommitSubject(title) {
-    return `docs: ${truncate(title.toLowerCase(), MAX_COMMIT_SUBJECT_LENGTH)}`;
-}
-/**
- * Extra `git -c` config prepended to the commit so it signs with the exact
- * key belonging to the agent this run is attributing the PR to, regardless
- * of what the repo's ambient config says (and so agent-slug mode works from
- * any repo, with no `.mcpi/` state there at all).
- */
-function buildSigningConfig(keyPath) {
-    return [
-        "-c",
-        "gpg.format=ssh",
-        "-c",
-        "commit.gpgsign=true",
-        "-c",
-        `user.signingkey=${keyPath}`,
-    ];
-}
-/**
- * Whether `rawCommit` (the raw `git cat-file commit HEAD` output) carries a
- * `gpgsig` header — the reliable signed-commit check (`git log
- * --show-signature` needs `gpg.ssh.allowedSignersFile` locally and
- * misreports otherwise). Exported so `dispatch.ts` and `fix.ts` share the
- * exact same check rather than each re-deriving it: a raw commit object is
- * headers, then ONE blank line, then the free-text commit message, and a
- * naive `/^gpgsig /m.test(rawCommit)` over the WHOLE string false-positives
- * on an unsigned commit whose message body happens to contain a line
- * starting with "gpgsig " (an agent-composed `-m`/`--message` value is
- * exactly that kind of free text). Splitting off the header section before
- * testing closes that gap: git's object format guarantees no blank line
- * appears within the headers themselves, including a multi-line `gpgsig`
- * value's space-prefixed continuation lines, so the first `\n\n` reliably
- * marks the header/message boundary.
- */
-export function isCommitSigned(rawCommit) {
-    const headers = rawCommit.split("\n\n")[0] ?? "";
-    return /^gpgsig /m.test(headers);
-}
-/** Fail fast when the DID isn't claimed/resolvable, BEFORE any git or GitHub
- * side effects: an unclaimed agent otherwise only surfaces as a verification
- * failure after a junk repo, branch, and PR already exist. */
-async function resolveDidPreflight(did) {
-    const documentUrl = didWebToHttpsUrl(did);
-    if (!documentUrl) {
-        return `could not derive a document URL from ${did}`;
-    }
-    try {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), RESOLVE_TIMEOUT_MS);
-        let response;
-        try {
-            response = await fetch(documentUrl, {
-                signal: controller.signal,
-                redirect: "manual",
-            });
-        }
-        finally {
-            clearTimeout(timer);
-        }
-        if (!response.ok) {
-            return `HTTP ${response.status} from ${documentUrl}`;
-        }
-        const doc = (await response.json());
-        if (doc?.id !== did) {
-            return `${documentUrl} describes ${String(doc?.id)}, not ${did}`;
-        }
-        return null;
-    }
-    catch (error) {
-        return `${documentUrl} unreachable: ${errorMessage(error)}`;
-    }
-}
-/**
- * Resolve the agent identity, slug-derived DID, and per-invocation git
- * signing config for a dispatch-style operation: either an explicit
- * `--agent <slug>` (signs with `~/.mcpi/keys/<slug>`, works from any repo
- * and ignores conflicting repo signing config) or the checkout's own
- * `.mcpi/` identity. Fails closed, in order, BEFORE any git or GitHub side
- * effects: invalid/missing slug, missing signing key, then DID preflight
- * (`resolveDidPreflight`) so an unclaimed agent never reaches a git or `gh`
- * call.
- *
- * `runDcoDispatch` below and `runDcoFix` (`fix.ts`) both call this instead
- * of re-deriving the same agent/DID/signing-key logic: a second
- * implementation that drifted from this one could sign a commit with a
- * different key than the one an `Agent DID:`/attestation line claims.
- */
-export async function resolveSigningIdentity(cwd, agentSlug) {
-    let agent;
-    let signingConfig;
-    let keyPath;
-    if (agentSlug) {
-        try {
-            keyPath = signingKeyPath(agentSlug);
-        }
-        catch (error) {
-            return { ok: false, failure: errorMessage(error) };
-        }
-        if (!existsSync(keyPath)) {
-            return {
-                ok: false,
-                failure: `No signing key for agent "${agentSlug}" at ${keyPath}. Run \`dco setup ${agentSlug}\` once, or check the slug.`,
-            };
-        }
-        agent = {
-            name: agentSlug,
-            slug: agentSlug,
-            url: `https://knowthat.ai/agents/${agentSlug}`,
-        };
-        signingConfig = buildSigningConfig(keyPath);
-    }
-    else {
-        const resolved = await resolveAgentIdentity(cwd);
-        if (!resolved) {
-            return {
-                ok: false,
-                failure: 
-                // Command-agnostic on purpose: `dco fix` takes the slug via
-                // `--agent <slug>`, `dco dispatch` takes it as a leading
-                // positional (`dco dispatch <slug> <description>`) with no
-                // --agent option at all, and this failure is shared by both.
-                "No agent identity configured in this checkout. Run `kya-os register` + `dco setup` here, or specify an existing claimed agent's slug (see this command's --help for the syntax).",
-            };
-        }
-        agent = { name: resolved.name, slug: resolved.slug, url: resolved.url };
-        // Sign with the SAME agent's key the PR/commit is attributed to, exactly
-        // like agent-slug mode, instead of silently relying on whatever ambient
-        // repo git config happens to be configured: without this, a checkout
-        // signed by a different key (or unsigned) than the one named in the
-        // Agent DID line would produce a commit whose signature and attribution
-        // disagree.
-        try {
-            keyPath = signingKeyPath(resolved.slug);
-        }
-        catch (error) {
-            return { ok: false, failure: errorMessage(error) };
-        }
-        if (!existsSync(keyPath)) {
-            return {
-                ok: false,
-                failure: `No signing key for agent "${resolved.slug}" at ${keyPath}. Run \`dco setup\` in this checkout, then try again.`,
-            };
-        }
-        signingConfig = buildSigningConfig(keyPath);
-    }
-    // Built from the slug instead of trusting identity.json's `did`, which can
-    // still hold the unresolvable pre-claim placeholder (known bug; see the
-    // quickstart runbook). The slug is what registration actually persisted.
-    const did = `did:web:knowthat.ai:agents:${agent.slug}`;
-    const unresolvable = await resolveDidPreflight(did);
-    if (unresolvable) {
-        return {
-            ok: false,
-            failure: `Agent DID ${did} does not resolve (${unresolvable}). ` +
-                // Same command-agnostic wording as the "no agent identity" failure
-                // above — see its comment.
-                "Only a claimed registry agent can sign a verifiable PR. Specify the slug of a claimed agent instead (see this command's --help for the syntax), or claim this one first.",
-            agent: { name: agent.name, slug: agent.slug },
-            did,
-        };
-    }
-    return { ok: true, identity: { agent, did, signingConfig, keyPath } };
-}
-/**
- * The cold-start self-heal `runDcoDispatch` performs on `cwd` before its own
- * demo commit: `git init` if `cwd` isn't a work tree yet, a signed initial
- * commit if there's no `HEAD` yet, and a fresh private GitHub repo if there's
- * no `origin` remote yet. Factored out so `kya-os agent task`
- * (`utils/agent/task.ts`) reuses the exact same self-heal instead of a
- * second copy that could drift on ordering or on which commit ends up
- * signed — see this feature's design doc ("create or reuse a scratch repo
- * the way `runDcoDispatch` cold-start does"). `agent task` runs this
- * against a throwaway temp directory it creates itself, not the caller's own
- * cwd, unlike `runDcoDispatch`'s in-place self-heal.
- */
-export async function ensureColdStartRepo(cwd, signingConfig) {
-    const result = {};
-    if (!(await gitSucceeds(["rev-parse", "--is-inside-work-tree"], cwd))) {
-        await run("git", ["init", "-q"], cwd);
-    }
-    if (!(await gitSucceeds(["rev-parse", "HEAD"], cwd))) {
-        // Symlink-safe: a planted `.gitkeep` symlink in an untrusted cwd must
-        // not make this follow it and clobber an arbitrary file.
-        writeFileAtomicSafe(join(cwd, ".gitkeep"), "# demo repo\n");
-        await run("git", ["add", ".gitkeep"], cwd);
-        // Signed like the demo commit below: without this, agent-slug mode's
-        // cold-start init commit would fall back to ambient repo signing
-        // config (or none at all), landing an unsigned or wrong-key commit
-        // before the attributed one even exists. `-- .gitkeep` restricts the
-        // commit to that one file so nothing else already in the index rides
-        // along, and hooks are disabled so a stale prepare-commit-msg hook
-        // can't stamp this boilerplate commit with the wrong agent.
-        await run("git", [
-            "-c",
-            "core.hooksPath=/dev/null",
-            ...signingConfig,
-            "commit",
-            "-q",
-            "-m",
-            "chore: init",
-            "--",
-            ".gitkeep",
-        ], cwd);
-    }
-    if (!(await gitSucceeds(["remote", "get-url", "origin"], cwd))) {
-        const repoName = `${basename(cwd)}-${Math.floor(Date.now() / 1000)}`;
-        await run("gh", ["repo", "create", repoName, "--private", "--source=.", "--remote=origin", "--push"], cwd);
-        result.createdRemote = repoName;
-    }
-    return result;
-}
-export async function runDcoDispatch(cwd, description, options = {}) {
-    if (!description || description.trim().length === 0) {
-        return { ok: false, failure: "A PR description is required." };
-    }
-    // Dispatch always appends its own authoritative `Agent DID:` line. A
-    // description that already carries one would put two DIDs in the PR body,
-    // and `extractAgentDid` treats a multi-DID body as unverifiable, so the PR
-    // would be created and then fail its own verification. `hasAgentDidClaim`
-    // uses the exact same line pattern the verifier does, so it catches the
-    // backticked, mid-line form the managed CLAUDE.md block emits, not just a
-    // line-start one. Reject before any side effects.
-    if (hasAgentDidClaim(description)) {
-        return {
-            ok: false,
-            failure: "The description already contains an `Agent DID:` line. Dispatch adds the attribution automatically; pass only your prose so the PR body has exactly one Agent DID line.",
-        };
-    }
-    const title = deriveDispatchTitle(description, options.title);
-    const identityResult = await resolveSigningIdentity(cwd, options.agent);
-    if (!identityResult.ok) {
-        return {
-            ok: false,
-            failure: identityResult.failure,
-            ...(identityResult.agent ? { agent: identityResult.agent } : {}),
-            ...(identityResult.did ? { did: identityResult.did } : {}),
-            title,
-        };
-    }
-    const { agent, did, signingConfig } = identityResult.identity;
-    const result = {
-        ok: false,
-        agent: { name: agent.name, slug: agent.slug },
-        did,
-        title,
-    };
-    try {
-        const coldStart = await ensureColdStartRepo(cwd, signingConfig);
-        result.createdRemote = coldStart.createdRemote;
-        const branch = `dco-demo-${Math.floor(Date.now() / 1000)}`;
-        await run("git", ["checkout", "-b", branch], cwd);
-        result.branch = branch;
-        // Symlink-safe append. Two vectors, both closed here:
-        //  - Read: if a planted DCO-DEMO.md is a symlink, remove it (lstatSync
-        //    does not follow the link) rather than readFileSync through it, so
-        //    another file's contents can never be read into the committed demo
-        //    file. A regular file is read and appended to as normal.
-        //  - Write: writeFileAtomicSafe creates its temp sibling with O_EXCL and
-        //    renameSync-replaces the destination inode without following it, so
-        //    the write never lands outside the working tree.
-        const dcoDemoPath = join(cwd, "DCO-DEMO.md");
-        if (existsSync(dcoDemoPath) && lstatSync(dcoDemoPath).isSymbolicLink()) {
-            rmSync(dcoDemoPath);
-        }
-        const existingDcoDemo = existsSync(dcoDemoPath)
-            ? readFileSync(dcoDemoPath, "utf-8")
-            : "";
-        writeFileAtomicSafe(dcoDemoPath, `${existingDcoDemo}${new Date().toISOString()} - ${title} - signed by ${agent.name} (${did})\n`);
-        await run("git", ["add", "DCO-DEMO.md"], cwd);
-        const commitSubject = buildDispatchCommitSubject(title);
-        // Own the trailers explicitly instead of relying on the setup-installed
-        // prepare-commit-msg hook: that hook is baked to whichever agent ran
-        // `dco setup`, which for a dispatch as a different slug (or in a fresh
-        // directory with no hook at all) would attribute the commit to the wrong
-        // agent, or to no agent. Disabling hooks and adding the sign-off (`-s`,
-        // the human committer) plus a Co-authored-by for THIS dispatch's agent
-        // keeps the commit trailer, the signing key, and the PR `Agent DID:` line
-        // all pointing at the same identity. `-- DCO-DEMO.md` restricts the
-        // commit to the demo file so unrelated staged changes never ride along.
-        const coAuthoredTrailer = `Co-authored-by: ${agent.name} <${agent.slug}@agents.knowthat.ai>`;
-        await run("git", [
-            "-c",
-            "core.hooksPath=/dev/null",
-            ...signingConfig,
-            "commit",
-            "-s",
-            "--trailer",
-            coAuthoredTrailer,
-            "-m",
-            commitSubject,
-            "--",
-            "DCO-DEMO.md",
-        ], cwd);
-        result.commitSha = await run("git", ["rev-parse", "HEAD"], cwd);
-        const rawCommit = await run("git", ["cat-file", "commit", "HEAD"], cwd);
-        result.signed = isCommitSigned(rawCommit);
-        if (!result.signed) {
-            result.failure =
-                "The commit was created but is NOT signed. Run `dco setup` in this repo, then dispatch again.";
-            return result;
-        }
-        await run("git", ["push", "-u", "origin", "HEAD"], cwd);
-        const body = [
-            description,
-            "",
-            `Agent: [${agent.name}](${agent.url})`,
-            `Agent DID: ${did}`,
-        ].join("\n");
-        const prOutput = await run("gh", ["pr", "create", "--title", title, "--body", body], cwd);
-        const urlMatch = prOutput.match(/https:\/\/github\.com\/\S+\/pull\/\d+/);
-        if (!urlMatch) {
-            result.failure = `Could not find a PR URL in \`gh pr create\` output: ${prOutput}`;
-            return result;
-        }
-        result.prUrl = urlMatch[0];
-        const prBody = await getPullRequestBody(result.prUrl);
-        const verification = await verifyPrAttribution(prBody);
-        result.verified = verification.ok;
-        if (!verification.ok) {
-            result.failure = `PR created (${result.prUrl}) but attribution verification failed: ${verification.detail ?? verification.reason ?? "unknown"}`;
-            return result;
-        }
-        result.ok = true;
-        return result;
-    }
-    catch (error) {
-        result.failure = errorMessage(error);
-        return result;
-    }
-}
-//# sourceMappingURL=dispatch.js.map

package/dist/utils/dco/dispatch.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/utils/dco/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AA6B1C,KAAK,UAAU,GAAG,CAAC,GAAW,EAAE,IAAc,EAAE,GAAW;IACzD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE;QAChD,GAAG;QACH,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;KAC5B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC5D,MAAM,MAAM,GAAG,MAAM,CAAE,KAA8B,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAgBD,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,SAAS,QAAQ,CAAC,KAAa,EAAE,SAAiB;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAChF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CACjC,WAAmB,EACnB,aAAsB;IAEtB,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,QAAQ,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,iBAAiB,GAAG,WAAW;SAClC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC,iBAAiB,IAAI,EAAE,EAAE,gBAAgB,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,SAAS,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,yBAAyB,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO;QACL,IAAI;QACJ,gBAAgB;QAChB,IAAI;QACJ,qBAAqB;QACrB,IAAI;QACJ,mBAAmB,OAAO,EAAE;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC;AAED;;8DAE8D;AAC9D,KAAK,UAAU,mBAAmB,CAAC,GAAW;IAC5C,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,wCAAwC,GAAG,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACvE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBAClC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,OAAO,QAAQ,QAAQ,CAAC,MAAM,SAAS,WAAW,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAqB,CAAC;QACxD,IAAI,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,OAAO,GAAG,WAAW,cAAc,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,GAAG,EAAE,CAAC;QACnE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,WAAW,iBAAiB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IAC9D,CAAC;AACH,CAAC;AAqBD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAW,EACX,SAA6B;IAE7B,IAAI,KAAkD,CAAC;IACvD,IAAI,aAAuB,CAAC;IAC5B,IAAI,OAAe,CAAC;IAEpB,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,6BAA6B,SAAS,QAAQ,OAAO,qBAAqB,SAAS,6BAA6B;aAC1H,CAAC;QACJ,CAAC;QACD,KAAK,GAAG;YACN,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,8BAA8B,SAAS,EAAE;SAC/C,CAAC;QACF,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO;gBACL,4DAA4D;gBAC5D,yDAAyD;gBACzD,2DAA2D;gBAC3D,6DAA6D;gBAC7D,kLAAkL;aACrL,CAAC;QACJ,CAAC;QACD,KAAK,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QAExE,yEAAyE;QACzE,wEAAwE;QACxE,qEAAqE;QACrE,oEAAoE;QACpE,wEAAwE;QACxE,YAAY;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,OAAO,EAAE,6BAA6B,QAAQ,CAAC,IAAI,QAAQ,OAAO,uDAAuD;aAC1H,CAAC;QACJ,CAAC;QACD,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,GAAG,GAAG,8BAA8B,KAAK,CAAC,IAAI,EAAE,CAAC;IAEvD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,aAAa,GAAG,sBAAsB,YAAY,KAAK;gBACvD,mEAAmE;gBACnE,2BAA2B;gBAC3B,0KAA0K;YAC5K,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC7C,GAAG;SACJ,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAC;AACxE,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,aAAuB;IAC5E,MAAM,MAAM,GAAoB,EAAE,CAAC;IAEnC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACrD,sEAAsE;QACtE,yDAAyD;QACzD,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,qEAAqE;QACrE,iEAAiE;QACjE,mEAAmE;QACnE,qEAAqE;QACrE,qEAAqE;QACrE,mEAAmE;QACnE,4DAA4D;QAC5D,MAAM,GAAG,CACP,KAAK,EACL;YACE,IAAI;YACJ,0BAA0B;YAC1B,GAAG,aAAa;YAChB,QAAQ;YACR,IAAI;YACJ,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,UAAU;SACX,EACD,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,CACP,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EACpF,GAAG,CACJ,CAAC;QACF,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC;IAClC,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAW,EACX,WAAmB,EACnB,UAA8B,EAAE;IAEhC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC;IACjE,CAAC;IACD,qEAAqE;IACrE,0EAA0E;IAC1E,2EAA2E;IAC3E,0EAA0E;IAC1E,wEAAwE;IACxE,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,yKAAyK;SAC5K,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAE9D,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,cAAc,CAAC,OAAO;YAC/B,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,KAAK;SACN,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC;IAE9D,MAAM,MAAM,GAAsB;QAChC,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC7C,GAAG;QACH,KAAK;KACN,CAAC;IAEF,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAChE,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAC;QAE/C,MAAM,MAAM,GAAG,YAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEvB,sDAAsD;QACtD,uEAAuE;QACvE,uEAAuE;QACvE,uEAAuE;QACvE,6DAA6D;QAC7D,yEAAyE;QACzE,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7C,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;YACvE,MAAM,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,mBAAmB,CACjB,WAAW,EACX,GAAG,eAAe,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,gBAAgB,KAAK,CAAC,IAAI,KAAK,GAAG,KAAK,CAChG,CAAC;QACF,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,aAAa,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;QACxD,wEAAwE;QACxE,qEAAqE;QACrE,uEAAuE;QACvE,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,oEAAoE;QACpE,wEAAwE;QACxE,MAAM,iBAAiB,GAAG,mBAAmB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,sBAAsB,CAAC;QAC7F,MAAM,GAAG,CACP,KAAK,EACL;YACE,IAAI;YACJ,0BAA0B;YAC1B,GAAG,aAAa;YAChB,QAAQ;YACR,IAAI;YACJ,WAAW;YACX,iBAAiB;YACjB,IAAI;YACJ,aAAa;YACb,IAAI;YACJ,aAAa;SACd,EACD,GAAG,CACJ,CAAC;QAEF,MAAM,CAAC,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QACxE,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,MAAM,CAAC,OAAO;gBACZ,8FAA8F,CAAC;YACjG,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;QAExD,MAAM,IAAI,GAAG;YACX,WAAW;YACX,EAAE;YACF,WAAW,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,GAAG;YACtC,cAAc,GAAG,EAAE;SACpB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,QAAQ,GAAG,MAAM,GAAG,CACxB,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,EAClD,GAAG,CACJ,CAAC;QACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,OAAO,GAAG,uDAAuD,QAAQ,EAAE,CAAC;YACnF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE3B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACvD,MAAM,CAAC,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,CAAC,OAAO,GAAG,eAAe,MAAM,CAAC,KAAK,0CAC1C,YAAY,CAAC,MAAM,IAAI,YAAY,CAAC,MAAM,IAAI,SAChD,EAAE,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACrC,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}