@nanonets/graft 0.22.0 → 0.23.0

package/dist/app/brain-build-worker.d.ts

@@ -1,35 +0,0 @@
-/**
- * The process one repository read runs in.
- *
- * Forked by brain-build-process.ts, one per read, and it exits when the read
- * does. It receives the credential it needs rather than the App's private key,
- * for the same reason the reviewer's worker does: `ps` and `/proc/<pid>/environ`
- * are readable, and a key that never crosses the boundary cannot leak across it.
- *
- * Everything expensive happens here — the clone, the tree-sitter parse, the
- * pull-request walk — and none of it can reach the server's event loop.
- */
-import { readRepository, type BrainBuildJob, type RepoReadAuth } from "./brain-build.js";
-/** Parent → child, once, immediately after the fork. */
-export interface StartMessage {
-    t: "start";
-    job: BrainBuildJob;
-    auth: RepoReadAuth;
-    api?: string;
-    githubHost?: string;
-}
-/** Child → parent: a line for the App's log, so a read is still traceable. */
-export interface LogMessage {
-    t: "log";
-    msg: string;
-}
-export interface DoneMessage {
-    t: "done";
-    result: Awaited<ReturnType<typeof readRepository>>;
-}
-export interface FailedMessage {
-    t: "failed";
-    message: string;
-}
-export type FromChild = LogMessage | DoneMessage | FailedMessage;
-//# sourceMappingURL=brain-build-worker.d.ts.map

package/dist/app/brain-build-worker.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"brain-build-worker.d.ts","sourceRoot":"","sources":["../../src/app/brain-build-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEzF,wDAAwD;AACxD,MAAM,WAAW,YAAY;IAC3B,CAAC,EAAE,OAAO,CAAC;IACX,GAAG,EAAE,aAAa,CAAC;IACnB,IAAI,EAAE,YAAY,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,CAAC,EAAE,KAAK,CAAC;IACT,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC1B,CAAC,EAAE,MAAM,CAAC;IACV,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,QAAQ,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC"}

package/dist/app/brain-build-worker.js

@@ -1,56 +0,0 @@
-/**
- * The process one repository read runs in.
- *
- * Forked by brain-build-process.ts, one per read, and it exits when the read
- * does. It receives the credential it needs rather than the App's private key,
- * for the same reason the reviewer's worker does: `ps` and `/proc/<pid>/environ`
- * are readable, and a key that never crosses the boundary cannot leak across it.
- *
- * Everything expensive happens here — the clone, the tree-sitter parse, the
- * pull-request walk — and none of it can reach the server's event loop.
- */
-import { readRepository } from "./brain-build.js";
-/**
- * Send, and tell me when it has actually gone.
- *
- * `process.send` is asynchronous, and a digest of a large repository is several
- * megabytes — a thousand commits, four thousand symbols. Disconnecting on the
- * next line tears the channel down mid-write: the child exits 0, having done
- * every bit of the work, and the parent reports "exited before reporting a
- * result". It only shows on big repositories, because a small payload clears
- * the pipe in one write and survives the race.
- */
-function send(msg, done) {
-    if (!process.send) {
-        done?.();
-        return;
-    }
-    try {
-        process.send(msg, undefined, undefined, () => done?.());
-    }
-    catch {
-        /* parent went away; the exit is the report */
-        done?.();
-    }
-}
-process.on("message", (raw) => {
-    const msg = raw;
-    if (msg.t !== "start")
-        return;
-    void readRepository(msg.job, {
-        // No creds: this half needs none. resolveRepoRead already did every call
-        // that requires the App's identity, and its answer is in `auth`.
-        creds: { appId: "", privateKey: "" },
-        fetch: globalThis.fetch,
-        api: msg.api,
-        githubHost: msg.githubHost,
-        log: (line) => send({ t: "log", msg: line }),
-    }, msg.auth)
-        .then((result) => {
-        send({ t: "done", result }, () => process.disconnect?.());
-    })
-        .catch((e) => {
-        send({ t: "failed", message: e instanceof Error ? e.message : String(e) }, () => process.disconnect?.());
-    });
-});
-//# sourceMappingURL=brain-build-worker.js.map

package/dist/app/brain-build-worker.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"brain-build-worker.js","sourceRoot":"","sources":["../../src/app/brain-build-worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,cAAc,EAAyC,MAAM,kBAAkB,CAAC;AA6BzF;;;;;;;;;GASG;AACH,SAAS,IAAI,CAAC,GAAc,EAAE,IAAiB;IAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,IAAI,EAAE,EAAE,CAAC;QACT,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;QAC9C,IAAI,EAAE,EAAE,CAAC;IACX,CAAC;AACH,CAAC;AAED,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;IAC5B,MAAM,GAAG,GAAG,GAAmB,CAAC;IAChC,IAAI,GAAG,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO;IAC9B,KAAK,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE;QAC3B,yEAAyE;QACzE,iEAAiE;QACjE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE;QACpC,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;KACrD,EAAE,GAAG,CAAC,IAAI,CAAC;SACT,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;QACf,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE;QACpB,IAAI,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3G,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/app/brain-build.d.ts

@@ -1,160 +0,0 @@
-import { type AppCredentials, type Fetch, type RepoAccessGap } from "./identity.js";
-import { type RepoDigest } from "./history.js";
-/** One request to build a repository into a brain. */
-export interface BrainBuildJob {
-    owner: string;
-    repo: string;
-    /** Branch to read; empty means the repository's default. */
-    ref?: string;
-    /**
-     * The brain the rules land in, and the workspace key to write it with.
-     *
-     * Both optional, and omitting them changes the mode: with them, the digest is
-     * posted straight to the brain and only a job id comes back; without them the
-     * digest is RETURNED and the caller ingests it itself.
-     *
-     * The second mode is what the platform's own proxy uses. It already holds the
-     * user's session and can write to the brain directly, so handing graft a
-     * workspace key just to have it call back would mean minting a credential per
-     * build for no gain.
-     */
-    brainId?: string;
-    brainToken?: string;
-    /** Platform base URL. Defaults to production. */
-    brainBaseUrl?: string;
-    /** File the rules as approved rather than as drafts. Onboarding sets it:
-     * a brain whose every rule is an invisible draft answers nothing. */
-    autoApprove?: boolean;
-}
-export interface BrainBuildResult {
-    /** Set only when the digest was posted; empty in return-the-digest mode. */
-    jobId: string;
-    headSha: string;
-    commits: number;
-    threads: number;
-    symbols: number;
-    sources: number;
-    /** Set only in return-the-digest mode. */
-    digest?: RepoDigest;
-}
-export interface BrainBuildDeps {
-    creds: AppCredentials;
-    fetch: Fetch;
-    api?: string;
-    githubHost?: string;
-    log?: (msg: string) => void;
-    now?: () => number;
-    /**
-     * Token used for a public repository the App is not installed on.
-     *
-     * Optional. Without it the read borrows one of our own installation's tokens,
-     * which GitHub answers for any public resource, and falls back to anonymous
-     * if the App has no installations at all. Anonymous works but is 60 requests
-     * an hour for the whole box — one pull-request walk — so it is the last
-     * resort, not the plan.
-     */
-    publicToken?: string;
-    /** Whose installation to borrow for those reads. Ours, so a public read
-     * spends our rate limit and not a customer's. */
-    publicOwner?: string;
-}
-/** Raised when the App cannot see the repository. Distinct because the caller
- * turns it into a specific answer — "install the app, or run it locally" — and
- * not into a 500. */
-export declare class RepoNotAccessibleError extends Error {
-    /** Which gap it is, so the caller can send the user to the right place. */
-    readonly gap: RepoAccessGap;
-    constructor(message: string, 
-    /** Which gap it is, so the caller can send the user to the right place. */
-    gap?: RepoAccessGap);
-}
-/** What a repository lets us do, before any of the work is started. */
-export interface RepoAccess {
-    /** True when we can read it: installed on it, or it is public. */
-    accessible: boolean;
-    isPrivate: boolean;
-    /** How we would read it — for the log, and for deciding nothing else. */
-    via: "installation" | "public" | "none";
-    /** Set only when accessible is false: what to tell the user, and where to
-     * send them. Same shape RepoNotAccessibleError carries. */
-    reason?: string;
-    gap?: RepoAccessGap;
-}
-/**
- * Can we read this repository at all?
- *
- * The cheap half of a build, on its own: an installation lookup and at most
- * one repository lookup, about a second in total, with no clone and no graph.
- *
- * It exists as its own call because the answer decides which screen the user
- * sees next, and the rest of the read takes minutes. Waiting for the whole
- * build to find out means either holding the person there or guessing from a
- * timer, and a guess is wrong exactly when the box is busy — which is when
- * two people are onboarding at once.
- */
-export declare function checkRepoAccess(job: {
-    owner: string;
-    repo: string;
-}, deps: BrainBuildDeps): Promise<RepoAccess>;
-/**
- * Read the repository and hand its history to the brain.
- *
- * An installation is the preferred way in: it is the only way into a private
- * repository, and it carries a rate limit worth having. It is not required for
- * a public one, though — those clone anonymously and answer the API
- * anonymously — so a failed installation lookup is a reason to try the open
- * door, not a reason to stop. Only a repository that is private or unreadable
- * both ways is one we genuinely cannot see, and that is the case the UI turns
- * into "read it on your machine".
- */
-/** Everything the heavy half needs, and nothing it could mint for itself. */
-export interface RepoReadAuth {
-    /** Installation or public-read token, for the GitHub API calls. */
-    token: string;
-    /** Credential for the clone. Empty for a public repository we are not
-     * installed on: git serves those to anyone, and a token minted for another
-     * account is not promised to work on this one. */
-    cloneToken: string;
-    meta: RepoMeta;
-}
-/**
- * Decide how this repository gets read, and mint the credential for it.
- *
- * The network half of a build, kept separate from the work: an installation
- * lookup, a token, a repository lookup. About a second, none of it blocking.
- *
- * Throws RepoNotAccessibleError when there is no way in. That is the answer the
- * onboarding UI turns into a choice, which is why it is raised here — before a
- * single byte is cloned — rather than discovered somewhere inside the read.
- */
-export declare function resolveRepoRead(job: BrainBuildJob, deps: BrainBuildDeps): Promise<RepoReadAuth>;
-/**
- * Read the repository and hand its history to the brain.
- *
- * An installation is the preferred way in: it is the only way into a private
- * repository, and it carries a rate limit worth having. It is not required for
- * a public one, though — those clone anonymously and answer the API
- * anonymously — so a failed installation lookup is a reason to try the open
- * door, not a reason to stop. Only a repository that is private or unreadable
- * both ways is one we genuinely cannot see, and that is the case the UI turns
- * into "read it on your machine".
- */
-export declare function buildRepoIntoBrain(job: BrainBuildJob, deps: BrainBuildDeps): Promise<BrainBuildResult>;
-/**
- * The heavy half: clone, graph, history, digest.
- *
- * Takes its credential rather than minting one, because this is the half that
- * runs somewhere else. Every expensive thing in it is synchronous — the git
- * calls are spawnSync, the parse is a loop of native tree-sitter calls, the
- * graph is written with a blocking stringify — so in the server process it
- * holds the event loop for the whole read, and a second person pasting a URL
- * waits behind the first. See brain-build-process.ts.
- */
-export declare function readRepository(job: BrainBuildJob, deps: BrainBuildDeps, auth: RepoReadAuth): Promise<BrainBuildResult>;
-/** What the repository says about itself. */
-interface RepoMeta {
-    isPrivate: boolean;
-    defaultBranch: string;
-}
-export {};
-//# sourceMappingURL=brain-build.d.ts.map

package/dist/app/brain-build.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"brain-build.d.ts","sourceRoot":"","sources":["../../src/app/brain-build.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,cAAc,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAkE,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAc/G,sDAAsD;AACtD,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,4DAA4D;IAC5D,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iDAAiD;IACjD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;yEACqE;IACrE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,cAAc,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;qDACiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;qBAEqB;AACrB,qBAAa,sBAAuB,SAAQ,KAAK;IAG7C,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,EAAE,aAAa;gBAF3B,OAAO,EAAE,MAAM;IACf,2EAA2E;IAClE,GAAG,GAAE,aAAgF;CAIjG;AAED,uEAAuE;AACvE,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,UAAU,EAAE,OAAO,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;IACnB,yEAAyE;IACzE,GAAG,EAAE,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxC;+DAC2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAsBrH;AAED;;;;;;;;;;GAUG;AACH,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC;IACd;;sDAEkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,QAAQ,CAAC;CAChB;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CA2BrG;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAE5G;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA2G5H;AAED,6CAA6C;AAC7C,UAAU,QAAQ;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB"}

package/dist/app/brain-build.js

@@ -1,278 +0,0 @@
-/**
- * Building one repository into a brain, on demand.
- *
- * The whole point of the onboarding flow this serves: someone pastes a
- * repository URL, and a minute later they are looking at rules mined from their
- * own history. Nothing is installed and nobody has signed up yet, so this has to
- * work from the repository name alone.
- *
- * Runs in the app rather than in the platform because only the app has the
- * GitHub App credentials, only it can clone, and only graft can build a symbol
- * graph. What crosses back to the platform is a digest of messages and symbol
- * ids — never source.
- */
-import { buildGraph } from "../graph/build.js";
-import { contextDirFor } from "../context/node-file.js";
-import { loadGraphCached } from "../graph/load.js";
-import { checkoutRepository } from "./checkout.js";
-import { appJwt, ghHeaders, installationFor, publicReadInstallation, repoAccessGap, } from "./identity.js";
-import { buildDigest, postDigest, readCommits, readSymbols, readThreads } from "./history.js";
-import { budgetSources, readAgentInstructions, readBranchProtection, readCodeowners, readCodifiedRules, readDecisionDocs, readDeclinedIssues, readReverts, readTestNames, } from "./sources.js";
-/** Raised when the App cannot see the repository. Distinct because the caller
- * turns it into a specific answer — "install the app, or run it locally" — and
- * not into a 500. */
-export class RepoNotAccessibleError extends Error {
-    gap;
-    constructor(message, 
-    /** Which gap it is, so the caller can send the user to the right place. */
-    gap = { reason: "not_installed", ownerId: null, installationId: null }) {
-        super(message);
-        this.gap = gap;
-    }
-}
-/**
- * Can we read this repository at all?
- *
- * The cheap half of a build, on its own: an installation lookup and at most
- * one repository lookup, about a second in total, with no clone and no graph.
- *
- * It exists as its own call because the answer decides which screen the user
- * sees next, and the rest of the read takes minutes. Waiting for the whole
- * build to find out means either holding the person there or guessing from a
- * timer, and a guess is wrong exactly when the box is busy — which is when
- * two people are onboarding at once.
- */
-export async function checkRepoAccess(job, deps) {
-    const api = deps.api ?? "https://api.github.com";
-    const installationId = await installationFor(deps.creds, job.owner, job.repo, deps.fetch, (deps.now ?? Date.now)(), api);
-    if (installationId !== null) {
-        const token = await installationToken(deps, installationId, `${job.owner}/${job.repo}`, api);
-        const meta = await repoMeta(job.owner, job.repo, token, deps.fetch, api);
-        return { accessible: true, isPrivate: meta?.isPrivate ?? true, via: "installation" };
-    }
-    const meta = await repoMeta(job.owner, job.repo, await publicReadToken(deps, api), deps.fetch, api);
-    if (meta && !meta.isPrivate)
-        return { accessible: true, isPrivate: false, via: "public" };
-    const gap = await repoAccessGap(deps.creds, job.owner, deps.fetch, (deps.now ?? Date.now)(), api);
-    return {
-        accessible: false,
-        isPrivate: true,
-        via: "none",
-        reason: gap.reason === "repo_not_selected"
-            ? `graft is installed on ${job.owner} but ${job.owner}/${job.repo} is not in the list of repositories it can see`
-            : `graft is not installed on ${job.owner}`,
-        gap,
-    };
-}
-/**
- * Decide how this repository gets read, and mint the credential for it.
- *
- * The network half of a build, kept separate from the work: an installation
- * lookup, a token, a repository lookup. About a second, none of it blocking.
- *
- * Throws RepoNotAccessibleError when there is no way in. That is the answer the
- * onboarding UI turns into a choice, which is why it is raised here — before a
- * single byte is cloned — rather than discovered somewhere inside the read.
- */
-export async function resolveRepoRead(job, deps) {
-    const api = deps.api ?? "https://api.github.com";
-    const tag = `${job.owner}/${job.repo}`;
-    const installationId = await installationFor(deps.creds, job.owner, job.repo, deps.fetch, (deps.now ?? Date.now)(), api);
-    if (installationId !== null) {
-        const token = await installationToken(deps, installationId, tag, api);
-        const meta = await repoMeta(job.owner, job.repo, token, deps.fetch, api);
-        return { token, cloneToken: token, meta: meta ?? { isPrivate: true, defaultBranch: "" } };
-    }
-    // No installation on this repository. That rules out nothing yet: a public
-    // repo clones with no credential at all, and its API answers to any token we
-    // hold. So find a credential for the reading, then ask whether it is public.
-    const token = await publicReadToken(deps, api);
-    const meta = await repoMeta(job.owner, job.repo, token, deps.fetch, api);
-    if (!meta || meta.isPrivate) {
-        // Which of the two gaps it is decides what the UI can offer, so it is
-        // resolved here rather than guessed there.
-        const gap = await repoAccessGap(deps.creds, job.owner, deps.fetch, (deps.now ?? Date.now)(), api);
-        throw new RepoNotAccessibleError(gap.reason === "repo_not_selected"
-            ? `graft is installed on ${job.owner} but ${tag} is not in the list of repositories it can see`
-            : `graft is not installed on ${job.owner}`, gap);
-    }
-    return { token, cloneToken: "", meta };
-}
-/**
- * Read the repository and hand its history to the brain.
- *
- * An installation is the preferred way in: it is the only way into a private
- * repository, and it carries a rate limit worth having. It is not required for
- * a public one, though — those clone anonymously and answer the API
- * anonymously — so a failed installation lookup is a reason to try the open
- * door, not a reason to stop. Only a repository that is private or unreadable
- * both ways is one we genuinely cannot see, and that is the case the UI turns
- * into "read it on your machine".
- */
-export async function buildRepoIntoBrain(job, deps) {
-    return readRepository(job, deps, await resolveRepoRead(job, deps));
-}
-/**
- * The heavy half: clone, graph, history, digest.
- *
- * Takes its credential rather than minting one, because this is the half that
- * runs somewhere else. Every expensive thing in it is synchronous — the git
- * calls are spawnSync, the parse is a loop of native tree-sitter calls, the
- * graph is written with a blocking stringify — so in the server process it
- * holds the event loop for the whole read, and a second person pasting a URL
- * waits behind the first. See brain-build-process.ts.
- */
-export async function readRepository(job, deps, auth) {
-    const rawLog = deps.log ?? (() => { });
-    const api = deps.api ?? "https://api.github.com";
-    const tag = `${job.owner}/${job.repo}`;
-    const { token, cloneToken, meta } = auth;
-    // Every line carries how long we have been at it. A read that feels slow is
-    // four things in a trench coat — the clone, the graph build, the
-    // pull-request walk, the digest — and without the elapsed time on each, the
-    // only observation anyone can make is "it took two minutes".
-    const startedAt = (deps.now ?? Date.now)();
-    const log = (msg) => rawLog(`[+${(((deps.now ?? Date.now)() - startedAt) / 1000).toFixed(1)}s] ${msg}`);
-    const phase = (name) => {
-        const at = (deps.now ?? Date.now)();
-        return () => log(`${tag}: ${name} took ${(((deps.now ?? Date.now)() - at) / 1000).toFixed(1)}s`);
-    };
-    const doneClone = phase("clone");
-    const checkout = checkoutRepository({
-        owner: job.owner,
-        repo: job.repo,
-        ref: job.ref || meta.defaultBranch,
-        token: cloneToken,
-        api: deps.githubHost,
-        log,
-    });
-    doneClone();
-    try {
-        // `graphOnly`: the symbol ids and their hashes are all the digest needs, and
-        // the markdown projections cost real time on a large repo.
-        const doneGraph = phase("symbol graph");
-        await buildGraph(checkout.dir, { graphOnly: true });
-        const graph = loadGraphCached(contextDirFor(checkout.dir));
-        doneGraph();
-        const commits = readCommits(checkout.dir);
-        const symbols = readSymbols(graph);
-        // The threads are the slow part (two API calls per pull request), and the
-        // one most likely to fail on a rate limit. A failure here degrades to a
-        // commits-only ingest rather than losing the whole build.
-        let threads = [];
-        const doneThreads = phase("pull-request discussion");
-        try {
-            threads = await readThreads(job.owner, job.repo, token, deps.fetch, api);
-        }
-        catch (e) {
-            log(`${tag}: pull-request discussion unavailable (${e instanceof Error ? e.message : e}); mining commits only`);
-        }
-        doneThreads();
-        // Everything the repo already states as a rule. All best-effort: the file
-        // readers cannot fail the build, and the two API readers swallow their own
-        // errors, so a repo with none of this still gets a brain from its history.
-        const doneSources = phase("stated sources");
-        const sources = budgetSources([
-            ...readAgentInstructions(checkout.dir),
-            ...readDecisionDocs(checkout.dir),
-            ...readCodeowners(checkout.dir),
-            ...readCodifiedRules(checkout.dir),
-            ...readReverts(checkout.dir),
-            ...readTestNames(symbols.map((s) => ({ name: s.name, path: s.path }))),
-            ...(await readBranchProtection(job.owner, job.repo, meta.defaultBranch, token, deps.fetch, api)),
-            ...(await readDeclinedIssues(job.owner, job.repo, token, deps.fetch, api)),
-        ]);
-        doneSources();
-        log(`${tag}: read ${commits.length} commits, ${threads.length} threads, ${symbols.length} symbols, ${sources.length} stated sources`);
-        const digest = buildDigest({
-            owner: job.owner,
-            name: job.repo,
-            headSha: checkout.headSha,
-            defaultBranch: job.ref || meta.defaultBranch,
-            isPrivate: meta.isPrivate,
-            commits,
-            threads,
-            symbols,
-            sources,
-            autoApprove: job.autoApprove ?? false,
-        });
-        const counts = {
-            headSha: checkout.headSha,
-            commits: commits.length,
-            threads: threads.length,
-            symbols: symbols.length,
-            sources: sources.length,
-        };
-        if (!job.brainId || !job.brainToken) {
-            return { jobId: "", ...counts, digest };
-        }
-        const { jobId } = await postDigest(job.brainBaseUrl ?? "https://agents.nanonets.com", job.brainId, job.brainToken, digest, deps.fetch);
-        return { jobId, ...counts };
-    }
-    finally {
-        // Always: the clone was made with an installation token and is not something
-        // to leave in /tmp.
-        checkout.cleanup();
-    }
-}
-/**
- * The repository's visibility and default branch, in one call.
- *
- * Null when the call did not answer, which is not the same as private and is
- * why this does not fold the two together: with an installation, an unanswered
- * call is a hiccup the read can carry on past; without one, it is the whole
- * decision about whether we can see this repository at all. Callers that only
- * need the fields treat null as private, because saying a repo is public when
- * it is not would leak its name onto a pre-signup screen.
- */
-async function repoMeta(owner, repo, token, fetchImpl, api) {
-    try {
-        const res = await fetchImpl(`${api}/repos/${owner}/${repo}`, { headers: ghHeaders(token) });
-        if (!res.ok)
-            return null;
-        const parsed = JSON.parse(await res.text());
-        return {
-            isPrivate: parsed.private !== false,
-            defaultBranch: (parsed.default_branch ?? "").trim(),
-        };
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * A credential for reading a public repository we are not installed on.
- *
- * Order: a token configured for exactly this, then one of our own
- * installation's, then nothing. Every step of that ladder works — the
- * difference is only the rate limit, and the drop to anonymous is a factor of
- * eighty, so it is worth two extra calls to avoid.
- */
-async function publicReadToken(deps, api) {
-    if (deps.publicToken)
-        return deps.publicToken;
-    try {
-        const id = await publicReadInstallation(deps.creds, deps.publicOwner ?? "trailhq", deps.fetch, (deps.now ?? Date.now)(), api);
-        if (id === null)
-            return "";
-        return await installationToken(deps, id, "public read", api);
-    }
-    catch {
-        return "";
-    }
-}
-/** Mint an installation token, the credential every authenticated read uses. */
-async function installationToken(deps, installationId, tag, api) {
-    const res = await deps.fetch(`${api}/app/installations/${installationId}/access_tokens`, {
-        method: "POST",
-        headers: {
-            authorization: `Bearer ${appJwt(deps.creds, (deps.now ?? Date.now)())}`,
-            accept: "application/vnd.github+json",
-            "user-agent": "graft-app",
-        },
-    });
-    if (!res.ok)
-        throw new Error(`installation token for ${tag} failed: ${res.status}`);
-    return JSON.parse(await res.text()).token;
-}
-//# sourceMappingURL=brain-build.js.map

package/dist/app/brain-build.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"brain-build.js","sourceRoot":"","sources":["../../src/app/brain-build.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EACL,MAAM,EACN,SAAS,EACT,eAAe,EACf,sBAAsB,EACtB,aAAa,GAId,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAmB,MAAM,cAAc,CAAC;AAC/G,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,aAAa,GAEd,MAAM,cAAc,CAAC;AA+DtB;;qBAEqB;AACrB,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAIpC;IAHX,YACE,OAAe;IACf,2EAA2E;IAClE,MAAqB,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE;QAE9F,KAAK,CAAC,OAAO,CAAC,CAAC;QAFN,QAAG,GAAH,GAAG,CAAkF;IAGhG,CAAC;CACF;AAeD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAoC,EAAE,IAAoB;IAC9F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC;IACjD,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzH,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpG,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;IAE1F,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAClG,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,SAAS,EAAE,IAAI;QACf,GAAG,EAAE,MAAM;QACX,MAAM,EACJ,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAChC,CAAC,CAAC,yBAAyB,GAAG,CAAC,KAAK,QAAQ,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,gDAAgD;YACjH,CAAC,CAAC,6BAA6B,GAAG,CAAC,KAAK,EAAE;QAC9C,GAAG;KACJ,CAAC;AACJ,CAAC;AAwBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAkB,EAAE,IAAoB;IAC5E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,cAAc,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzH,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC5B,sEAAsE;QACtE,2CAA2C;QAC3C,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QAClG,MAAM,IAAI,sBAAsB,CAC9B,GAAG,CAAC,MAAM,KAAK,mBAAmB;YAChC,CAAC,CAAC,yBAAyB,GAAG,CAAC,KAAK,QAAQ,GAAG,gDAAgD;YAC/F,CAAC,CAAC,6BAA6B,GAAG,CAAC,KAAK,EAAE,EAC5C,GAAG,CACJ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAkB,EAAE,IAAoB;IAC/E,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAkB,EAAE,IAAoB,EAAE,IAAkB;IAC/F,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,wBAAwB,CAAC;IACjD,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;IACvC,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAEzC,4EAA4E;IAC5E,iEAAiE;IACjE,4EAA4E;IAC5E,6DAA6D;IAC7D,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,GAAW,EAAQ,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACtH,MAAM,KAAK,GAAG,CAAC,IAAY,EAAgB,EAAE;QAC3C,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,KAAK,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnG,CAAC,CAAC;IAEF,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,kBAAkB,CAAC;QAClC,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa;QAClC,KAAK,EAAE,UAAU;QACjB,GAAG,EAAE,IAAI,CAAC,UAAU;QACpB,GAAG;KACJ,CAAC,CAAC;IACH,SAAS,EAAE,CAAC;IACZ,IAAI,CAAC;QACH,6EAA6E;QAC7E,2DAA2D;QAC3D,MAAM,SAAS,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;QACxC,MAAM,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,eAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,SAAS,EAAE,CAAC;QAEZ,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QACnC,0EAA0E;QAC1E,wEAAwE;QACxE,0DAA0D;QAC1D,IAAI,OAAO,GAA4C,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,GAAG,0CAA0C,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAClH,CAAC;QAED,WAAW,EAAE,CAAC;QAEd,0EAA0E;QAC1E,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,aAAa,CAAC;YAC5B,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC;YACtC,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC;YACjC,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/B,GAAG,iBAAiB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAClC,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC5B,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACtE,GAAG,CAAC,MAAM,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAChG,GAAG,CAAC,MAAM,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;SAC3E,CAAC,CAAC;QAEH,WAAW,EAAE,CAAC;QAEd,GAAG,CACD,GAAG,GAAG,UAAU,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,iBAAiB,CACjI,CAAC;QAEF,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,aAAa,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa;YAC5C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO;YACP,OAAO;YACP,OAAO;YACP,OAAO;YACP,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;SACtC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG;YACb,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,OAAO,EAAE,OAAO,CAAC,MAAM;YACvB,OAAO,EAAE,OAAO,CAAC,MAAM;SACxB,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YACpC,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC;QAC1C,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAChC,GAAG,CAAC,YAAY,IAAI,6BAA6B,EACjD,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,UAAU,EACd,MAAM,EACN,IAAI,CAAC,KAAK,CACX,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,6EAA6E;QAC7E,oBAAoB;QACpB,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAQD;;;;;;;;;GASG;AACH,KAAK,UAAU,QAAQ,CAAC,KAAa,EAAE,IAAY,EAAE,KAAa,EAAE,SAAgB,EAAE,GAAW;IAC/F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,GAAG,UAAU,KAAK,IAAI,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;QAC9F,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,OAAO,KAAK,KAAK;YACnC,aAAa,EAAE,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,eAAe,CAAC,IAAoB,EAAE,GAAW;IAC9D,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,sBAAsB,CACrC,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,WAAW,IAAI,SAAS,EAC7B,IAAI,CAAC,KAAK,EACV,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,EACxB,GAAG,CACJ,CAAC;QACF,IAAI,EAAE,KAAK,IAAI;YAAE,OAAO,EAAE,CAAC;QAC3B,OAAO,MAAM,iBAAiB,CAAC,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,iBAAiB,CAAC,IAAoB,EAAE,cAAsB,EAAE,GAAW,EAAE,GAAW;IACrG,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,sBAAsB,cAAc,gBAAgB,EAAE;QACvF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACvE,MAAM,EAAE,6BAA6B;YACrC,YAAY,EAAE,WAAW;SAC1B;KACF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,OAAQ,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC,KAAK,CAAC;AACnE,CAAC"}