@onepointfour-packs/flaredeck-agent 0.1.0

package/dist/flaredeck.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The harness's own line to FlareDeck, over the REST API.
+ *
+ * Deliberately not the MCP server: that is the MODEL's identity, and the harness is a different
+ * actor. An approval must be posted and read by the supervisor even when the model is wedged,
+ * mid-compaction, or refusing to call tools — so it cannot go through the model's tools.
+ */
+export type Approval = {
+    request_id: string;
+    tool_name: string;
+    description: string;
+    input_preview: string;
+    state: 'pending' | 'allow' | 'deny' | 'expired';
+    expires_at: string;
+    decided_by?: string;
+    decided_by_name?: string;
+    decided_at?: string;
+};
+/** One open request, as the inbox lists it: the question plus where it was asked. */
+export type PendingApproval = {
+    comment_id: string;
+    request_id: string;
+    tool_name: string;
+    description: string;
+    input_preview: string;
+    state: 'pending' | 'allow' | 'deny' | 'expired';
+    expires_at: string;
+    created_at: string | null;
+    sender_key: string | null;
+    sender_name: string | null;
+    /** Present when a lead must endorse it before anyone is asked. */
+    review?: {
+        by: string;
+        state: 'pending' | 'endorsed' | 'rejected';
+        note?: string;
+        decided_by_name?: string;
+    };
+    approvers?: string[];
+    ran_at?: string;
+    decided_by_name?: string;
+    card: {
+        key: string;
+        code: string | null;
+        name: string | null;
+        board_key: string;
+        board_name: string | null;
+    };
+};
+export type Comment = {
+    id: string;
+    message: string;
+    sender_key: string | null;
+    sender_name: string | null;
+    created_at: string | null;
+    /** Present when this comment IS a permission request — the widget people tap. */
+    approval?: Approval;
+};
+export declare class Flaredeck {
+    private readonly tenantId;
+    private readonly auth;
+    private readonly baseUrl;
+    /**
+     * `auth` returns the agent's own access token — a function because it is refreshed as it
+     * expires, and this client outlives any one token. No API key: the agent already has an
+     * identity, and a second tenant-wide credential would be both more to look after and less
+     * accurate, posting work as "API (default)" rather than as the agent that did it.
+     */
+    constructor(tenantId: string, auth: () => Promise<string>, baseUrl?: string);
+    private call;
+    /** Returns the stored comment, so the caller knows exactly which one is its own. */
+    comment(card: string, message: string, approval?: {
+        request_id: string;
+        tool_name: string;
+        description: string;
+        input_preview: string;
+        expires_in_seconds: number;
+        review_by?: string;
+        approvers?: string[];
+    }): Promise<Comment>;
+    /** Every request still waiting for an answer in this workspace, newest first. */
+    pendingApprovals(): Promise<PendingApproval[]>;
+    /** This account's approved requests that were never executed — what a restarted harness owes. */
+    approvedUnrun(): Promise<PendingApproval[]>;
+    /** Report an approved request as executed, so no harness runs it again. */
+    markRan(commentId: string, outcome: string): Promise<void>;
+    /** One request by its comment id, in the inbox's shape — or null when it is not pending. */
+    approval(commentId: string): Promise<PendingApproval | null>;
+    /** The named lead's review of a worker's request: endorse it on to the approvers, or refuse it. */
+    review(commentId: string, state: 'endorsed' | 'rejected', note?: string): Promise<void>;
+    /** A person's verdict on a request. Writes the same fields the app's button does. */
+    decide(commentId: string, state: 'allow' | 'deny'): Promise<void>;
+    comments(card: string): Promise<Comment[]>;
+    /** The whole card as the REST API returns it — fields, description as markdown, the thread. */
+    card(idOrCode: string): Promise<any>;
+    /** Every board with its lanes (key, name, type, order), as the REST API lists them. */
+    boards(): Promise<Array<{
+        id: string;
+        name: string;
+        lanes: Array<{
+            key: string;
+            name: string;
+            type: string | null;
+            order: number | null;
+        }>;
+    }>>;
+    /** Move a card to a lane by key. `keepAssignee` stops the lane's assign-to-role rule from taking the card away. */
+    move(card: string, lane: string, keepAssignee?: boolean): Promise<void>;
+    /** Every scheduled agent task in the workspace. */
+    schedules(): Promise<ScheduleRow[]>;
+    /** Register one. From an agent it comes back `pending`, with an approval request on `card`. */
+    createSchedule(body: {
+        name: string;
+        cron: string;
+        timezone: string;
+        prompt: string;
+        card: string;
+        agent?: string;
+        max_late_minutes?: number;
+    }): Promise<ScheduleRow>;
+    deleteSchedule(id: string): Promise<void>;
+}
+export type ScheduleRow = {
+    id: string;
+    name: string;
+    cron: string;
+    timezone: string;
+    state: 'pending' | 'active' | 'denied' | string;
+    agent_uid: string;
+    agent_name: string | null;
+    next_run_at: string | null;
+    last_run_at: string | null;
+};

package/dist/flaredeck.js

@@ -0,0 +1,106 @@
+/**
+ * The harness's own line to FlareDeck, over the REST API.
+ *
+ * Deliberately not the MCP server: that is the MODEL's identity, and the harness is a different
+ * actor. An approval must be posted and read by the supervisor even when the model is wedged,
+ * mid-compaction, or refusing to call tools — so it cannot go through the model's tools.
+ */
+export class Flaredeck {
+    tenantId;
+    auth;
+    baseUrl;
+    /**
+     * `auth` returns the agent's own access token — a function because it is refreshed as it
+     * expires, and this client outlives any one token. No API key: the agent already has an
+     * identity, and a second tenant-wide credential would be both more to look after and less
+     * accurate, posting work as "API (default)" rather than as the agent that did it.
+     */
+    constructor(tenantId, auth, baseUrl = 'https://mcp.flaredeck.app/api') {
+        this.tenantId = tenantId;
+        this.auth = auth;
+        this.baseUrl = baseUrl;
+    }
+    async call(path, init = {}) {
+        const res = await fetch(`${this.baseUrl}/v1/${this.tenantId}${path}`, {
+            ...init,
+            headers: {
+                Authorization: `Bearer ${await this.auth()}`,
+                'Content-Type': 'application/json',
+                ...(init.headers ?? {}),
+            },
+        });
+        const body = await res.json().catch(() => ({}));
+        if (!res.ok) {
+            throw new Error(`FlareDeck ${res.status}: ${body?.message ?? body?.error ?? 'request failed'}`);
+        }
+        return body;
+    }
+    /** Returns the stored comment, so the caller knows exactly which one is its own. */
+    async comment(card, message, approval) {
+        return (await this.call(`/cards/${encodeURIComponent(card)}/comments`, {
+            method: 'POST',
+            body: JSON.stringify({ message, ...(approval ? { approval } : {}) }),
+        }));
+    }
+    /** Every request still waiting for an answer in this workspace, newest first. */
+    async pendingApprovals() {
+        const body = await this.call('/approvals?state=pending');
+        return Array.isArray(body?.approvals) ? body.approvals : [];
+    }
+    /** This account's approved requests that were never executed — what a restarted harness owes. */
+    async approvedUnrun() {
+        const body = await this.call('/approvals?state=allow&mine=1&unrun=1');
+        return Array.isArray(body?.approvals) ? body.approvals : [];
+    }
+    /** Report an approved request as executed, so no harness runs it again. */
+    async markRan(commentId, outcome) {
+        await this.call(`/approvals/${encodeURIComponent(commentId)}/ran`, { method: 'POST', body: JSON.stringify({ outcome }) });
+    }
+    /** One request by its comment id, in the inbox's shape — or null when it is not pending. */
+    async approval(commentId) {
+        const all = await this.pendingApprovals();
+        return all.find((a) => a.comment_id === commentId) ?? null;
+    }
+    /** The named lead's review of a worker's request: endorse it on to the approvers, or refuse it. */
+    async review(commentId, state, note) {
+        await this.call(`/approvals/${encodeURIComponent(commentId)}/review`, {
+            method: 'POST',
+            body: JSON.stringify({ state, ...(note ? { note } : {}) }),
+        });
+    }
+    /** A person's verdict on a request. Writes the same fields the app's button does. */
+    async decide(commentId, state) {
+        await this.call(`/approvals/${encodeURIComponent(commentId)}/decide`, {
+            method: 'POST',
+            body: JSON.stringify({ state }),
+        });
+    }
+    async comments(card) {
+        const card_ = await this.call(`/cards/${encodeURIComponent(card)}`);
+        return (card_.comments ?? []);
+    }
+    /** The whole card as the REST API returns it — fields, description as markdown, the thread. */
+    async card(idOrCode) {
+        return this.call(`/cards/${encodeURIComponent(idOrCode)}`);
+    }
+    /** Every board with its lanes (key, name, type, order), as the REST API lists them. */
+    async boards() {
+        return ((await this.call('/boards')).boards ?? []);
+    }
+    /** Move a card to a lane by key. `keepAssignee` stops the lane's assign-to-role rule from taking the card away. */
+    async move(card, lane, keepAssignee = true) {
+        await this.call(`/cards/${encodeURIComponent(card)}/move`, { method: 'POST', body: JSON.stringify({ lane, keep_assignee: keepAssignee }) });
+    }
+    /** Every scheduled agent task in the workspace. */
+    async schedules() {
+        return ((await this.call('/schedules')).schedules ?? []);
+    }
+    /** Register one. From an agent it comes back `pending`, with an approval request on `card`. */
+    async createSchedule(body) {
+        return (await this.call('/schedules', { method: 'POST', body: JSON.stringify(body) }));
+    }
+    async deleteSchedule(id) {
+        await this.call(`/schedules/${encodeURIComponent(id)}`, { method: 'DELETE' });
+    }
+}
+//# sourceMappingURL=flaredeck.js.map

package/dist/flaredeck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flaredeck.js","sourceRoot":"","sources":["../src/flaredeck.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4CH,MAAM,OAAO,SAAS;IAQD;IACA;IACA;IATnB;;;;;OAKG;IACH,YACmB,QAAgB,EAChB,IAA2B,EAC3B,UAAU,+BAA+B;QAFzC,aAAQ,GAAR,QAAQ,CAAQ;QAChB,SAAI,GAAJ,IAAI,CAAuB;QAC3B,YAAO,GAAP,OAAO,CAAkC;IACzD,CAAC;IAEI,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAoB,EAAE;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,EAAE,EAAE;YACpE,GAAG,IAAI;YACP,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE;gBAC5C,cAAc,EAAE,kBAAkB;gBAClC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;aACxB;SACF,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,aAAa,GAAG,CAAC,MAAM,KAAM,IAAY,EAAE,OAAO,IAAK,IAAY,EAAE,KAAK,IAAI,gBAAgB,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oFAAoF;IACpF,KAAK,CAAC,OAAO,CACX,IAAY,EACZ,OAAe,EACf,QAAsK;QAEtK,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE;YACrE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SACrE,CAAC,CAAY,CAAC;IACjB,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,gBAAgB;QACpB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACtE,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,OAAe;QAC9C,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,4FAA4F;IAC5F,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,IAAI,CAAC;IAC7D,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAA8B,EAAE,IAAa;QAC3E,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAuB;QACrD,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE;YACpE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAc,CAAC;IAC7C,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,IAAI,CAAC,QAAgB;QACzB,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM;QACV,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAU,CAAC;IAC9D,CAAC;IAED,mHAAmH;IACnH,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,YAAY,GAAG,IAAI;QACxD,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;IAC9I,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,SAAS;QACb,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAkB,CAAC;IAC5E,CAAC;IAED,+FAA+F;IAC/F,KAAK,CAAC,cAAc,CAAC,IAA+H;QAClJ,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAgB,CAAC;IACxG,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChF,CAAC;CACF"}

package/dist/gemini.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Gemini, through the Gemini Developer API (the AI Studio key — the one with a free tier).
+ *
+ * The same brief Haiku writes, from a model that costs nothing at this volume. Flash-Lite is
+ * the default: a few thousand tokens of card thread do not need a bigger one, and its free
+ * quota is counted in requests per day, not tokens. The key comes from aistudio.google.com/apikey.
+ *
+ * Not Vertex and not OpenRouter on purpose: Vertex has no free tier and wants a GCP project,
+ * OpenRouter bills Gemini per token and does not expose the free quota.
+ */
+export declare const GEMINI_DEFAULT_MODEL = "gemini-3.5-flash-lite";
+export type GeminiUsage = {
+    input_tokens: number;
+    output_tokens: number;
+};
+/** Returns the raw JSON text of the brief (parsed by the caller, same as Haiku's) and the token usage. */
+export declare function geminiBriefText(prompt: string, apiKey: string, model?: string): Promise<{
+    text: string;
+    usage: GeminiUsage;
+    model: string;
+}>;

package/dist/gemini.js

@@ -0,0 +1,59 @@
+/**
+ * Gemini, through the Gemini Developer API (the AI Studio key — the one with a free tier).
+ *
+ * The same brief Haiku writes, from a model that costs nothing at this volume. Flash-Lite is
+ * the default: a few thousand tokens of card thread do not need a bigger one, and its free
+ * quota is counted in requests per day, not tokens. The key comes from aistudio.google.com/apikey.
+ *
+ * Not Vertex and not OpenRouter on purpose: Vertex has no free tier and wants a GCP project,
+ * OpenRouter bills Gemini per token and does not expose the free quota.
+ */
+export const GEMINI_DEFAULT_MODEL = 'gemini-3.5-flash-lite';
+const BRIEF_SCHEMA = {
+    type: 'OBJECT',
+    properties: {
+        ask: { type: 'STRING' },
+        repro: { type: 'ARRAY', items: { type: 'STRING' } },
+        area: { type: 'STRING' },
+        acceptance: { type: 'ARRAY', items: { type: 'STRING' } },
+        evidence: { type: 'ARRAY', items: { type: 'STRING' } },
+        open_questions: { type: 'ARRAY', items: { type: 'STRING' } },
+        complexity: { type: 'STRING', enum: ['small', 'medium', 'large'] },
+        touches_production_data: { type: 'BOOLEAN' },
+        confidence: { type: 'NUMBER' },
+    },
+    required: ['ask', 'repro', 'area', 'acceptance', 'evidence', 'open_questions', 'complexity', 'touches_production_data', 'confidence'],
+};
+/** Returns the raw JSON text of the brief (parsed by the caller, same as Haiku's) and the token usage. */
+export async function geminiBriefText(prompt, apiKey, model = GEMINI_DEFAULT_MODEL) {
+    const url = `https://generativelanguage.googleapis.com/v1beta/models/${encodeURIComponent(model)}:generateContent`;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json', 'x-goog-api-key': apiKey },
+        body: JSON.stringify({
+            contents: [{ role: 'user', parts: [{ text: prompt }] }],
+            generationConfig: {
+                temperature: 0.2,
+                responseMimeType: 'application/json',
+                responseSchema: BRIEF_SCHEMA,
+            },
+        }),
+        signal: AbortSignal.timeout(60_000),
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        const err = new Error(`Gemini ${res.status}: ${body?.error?.message ?? 'request failed'}`);
+        err.status = res.status;
+        throw err;
+    }
+    const text = (body.candidates?.[0]?.content?.parts ?? []).map((p) => p.text ?? '').join('');
+    return {
+        text,
+        usage: {
+            input_tokens: Number(body.usageMetadata?.promptTokenCount ?? 0),
+            output_tokens: Number(body.usageMetadata?.candidatesTokenCount ?? 0),
+        },
+        model: String(body.modelVersion ?? model),
+    };
+}
+//# sourceMappingURL=gemini.js.map

package/dist/gemini.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gemini.js","sourceRoot":"","sources":["../src/gemini.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AAE5D,MAAM,YAAY,GAAG;IACnB,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACvB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACnD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;QACxB,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QACtD,cAAc,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE;QAC5D,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE;QAClE,uBAAuB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC5C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;KAC/B;IACD,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,yBAAyB,EAAE,YAAY,CAAC;CACtI,CAAC;AAIF,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,MAAc,EACd,KAAK,GAAG,oBAAoB;IAE5B,MAAM,GAAG,GAAG,2DAA2D,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACnH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,EAAE;QACzE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YACvD,gBAAgB,EAAE;gBAChB,WAAW,EAAE,GAAG;gBAChB,gBAAgB,EAAE,kBAAkB;gBACpC,cAAc,EAAE,YAAY;aAC7B;SACF,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAQ,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAC;QAC1F,GAAW,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;QACjC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjG,OAAO;QACL,IAAI;QACJ,KAAK,EAAE;YACL,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,gBAAgB,IAAI,CAAC,CAAC;YAC/D,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,IAAI,CAAC,CAAC;SACrE;QACD,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;KAC1C,CAAC;AACJ,CAAC"}

package/dist/gitguard.d.ts

@@ -0,0 +1,2 @@
+import type { HookCallbackMatcher, HookEvent } from '@anthropic-ai/claude-agent-sdk';
+export declare function gitGuard(onNote: (text: string) => void): Partial<Record<HookEvent, HookCallbackMatcher[]>>;

package/dist/gitguard.js

@@ -0,0 +1,90 @@
+/**
+ * Keep publishing to the tools, and out of the shell.
+ *
+ * Denying `git push` used to be a rule with no alternative, which is what makes a model creative
+ * — it would find `git -C`, or write a script, not out of mischief but because it had a job to
+ * finish and one door was shut. Now there is a door: push_branch and open_pull_request. So this
+ * refuses the shell route and says where to go instead.
+ *
+ * A PreToolUse hook rather than a deny rule because it sees the command TEXT. `Bash(git push *)`
+ * matches `git push origin x` and misses `git -C /tmp/wt push`, `/usr/bin/git push`, and every
+ * push inside a script. This still is not airtight — nothing that reads strings can be — which
+ * is why the boundary that actually holds is branch protection on the remote. This is fast
+ * feedback and a closed front door, not the fence.
+ */
+/** Publishing, merging and anything that rewrites shared history. */
+const BLOCKED = [
+    { re: /(^|[\s;&|(])git\b[^\n;&|]*\bpush\b/, why: 'push_branch publishes your branch — it takes no arguments, so it cannot push the wrong one.' },
+    { re: /(^|[\s;&|(])git\b[^\n;&|]*\bremote\b[^\n;&|]*\b(add|set-url)\b/, why: 'Pointing the repo at another remote is not something a job does.' },
+];
+/**
+ * READING GitHub is not publishing to it.
+ *
+ * This used to block every `gh`, which meant an agent could not see its own pull request's checks
+ * — it had the tools to open a PR and then no way to look at anything the tools do not cover, so
+ * it reported itself blocked and stopped. Nothing here can change anything on GitHub: these are
+ * the read verbs, and the write ones (merge, create, close, edit, review, comment, run, delete,
+ * rerun, set) are not listed, so they still go through the harness's tools.
+ *
+ * An allowlist, not a denylist: an unrecognised `gh` subcommand is refused rather than waved
+ * through, so a verb added to the CLI later cannot arrive pre-approved.
+ */
+const GH_READ_ONLY = [
+    /^gh\s+(?:pr|issue)\s+(?:view|list|diff|checks|status)\b/,
+    /^gh\s+run\s+(?:view|list|watch)\b/,
+    /^gh\s+(?:repo|release|workflow|label|secret|variable|cache|ruleset)\s+(?:view|list)\b/,
+    /^gh\s+auth\s+status\b/,
+    /^gh\s+(?:search|status)\b/,
+    // `gh api` is a GET unless it is told otherwise. Any method flag, any field, any body makes it
+    // a write — including `-f` on graphql, which is how a mutation would be smuggled past this.
+    /^gh\s+api\b(?!.*(?:-X|--method)\b)(?!.*(?:-f|-F|--field|--raw-field|--input)\b)/,
+];
+/**
+ * Every `gh …` invocation in a command line, so a pipeline or a chain is judged on each of its
+ * parts rather than on the first one that matches.
+ */
+function ghInvocations(command) {
+    return command
+        .split(/[\n;|&]+|\$\(|`/)
+        .map((part) => part.trim())
+        .filter((part) => /^gh(\s|$)/.test(part));
+}
+/** True when every `gh` in the line only reads. An empty list means there was no `gh` at all. */
+function ghIsReadOnly(command) {
+    const calls = ghInvocations(command);
+    if (!calls.length)
+        return false;
+    return calls.every((call) => GH_READ_ONLY.some((re) => re.test(call)));
+}
+export function gitGuard(onNote) {
+    return {
+        PreToolUse: [
+            {
+                matcher: 'Bash',
+                hooks: [
+                    async (input) => {
+                        const command = String(input?.tool_input?.command ?? '');
+                        // Reading GitHub is allowed; the write verbs fall through to the refusal below.
+                        if (ghIsReadOnly(command) && !BLOCKED.some((b) => b.re.test(command)))
+                            return { continue: true };
+                        const hit = BLOCKED.find((b) => b.re.test(command))
+                            ?? (/(^|[\s;&|(])gh\b/.test(command)
+                                ? { why: 'open_pull_request, pull_request_status and merge_and_promote do what you need through the harness, which holds the credentials. Reading GitHub with gh (pr view/list/diff/checks, run view/list, api without a method or field) is allowed.' }
+                                : undefined);
+                        if (!hit)
+                            return { continue: true };
+                        onNote(`blocked a shell publish: ${command.slice(0, 80)}`);
+                        return {
+                            decision: 'block',
+                            reason: `Do not publish from the shell. ${hit.why}\n\n` +
+                                `Everything local is yours as normal — commit, branch, diff, merging the base ` +
+                                `branch into yours to stay current. Only reaching GitHub goes through the tools, ` +
+                                `so a job can publish its own work and nothing else.`,
+                        };
+                    },
+                ],
+            },
+        ],
+    };
+}
+//# sourceMappingURL=gitguard.js.map

package/dist/gitguard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitguard.js","sourceRoot":"","sources":["../src/gitguard.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,qEAAqE;AACrE,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,EAAE,oCAAoC,EAAE,GAAG,EAAE,6FAA6F,EAAE;IAChJ,EAAE,EAAE,EAAE,gEAAgE,EAAE,GAAG,EAAE,kEAAkE,EAAE;CAClJ,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAa;IAC7B,yDAAyD;IACzD,mCAAmC;IACnC,uFAAuF;IACvF,uBAAuB;IACvB,2BAA2B;IAC3B,+FAA+F;IAC/F,4FAA4F;IAC5F,iFAAiF;CAClF,CAAC;AAEF;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,OAAO;SACX,KAAK,CAAC,iBAAiB,CAAC;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,iGAAiG;AACjG,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAChC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,MAA8B;IACrD,OAAO;QACL,UAAU,EAAE;YACV;gBACE,OAAO,EAAE,MAAM;gBACf,KAAK,EAAE;oBACL,KAAK,EAAE,KAAU,EAAE,EAAE;wBACnB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;wBACzD,gFAAgF;wBAChF,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;4BAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;wBACjG,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;+BAC9C,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;gCAClC,CAAC,CAAC,EAAE,GAAG,EAAE,6OAA6O,EAAE;gCACxP,CAAC,CAAC,SAAS,CAAC,CAAC;wBACjB,IAAI,CAAC,GAAG;4BAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;wBAEpC,MAAM,CAAC,4BAA4B,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;wBAC3D,OAAO;4BACL,QAAQ,EAAE,OAAO;4BACjB,MAAM,EACJ,kCAAkC,GAAG,CAAC,GAAG,MAAM;gCAC/C,+EAA+E;gCAC/E,kFAAkF;gCAClF,qDAAqD;yBACxD,CAAC;oBACJ,CAAC;iBACF;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/github.d.ts

@@ -0,0 +1,38 @@
+import type { MergeConfig } from './preflight.js';
+import type { Decider } from './permissions.js';
+/**
+ * Publishing to GitHub, as tools the harness runs rather than commands the agent writes.
+ *
+ * A hook that inspects `git push` has to out-guess `git -C dir push`, `/usr/bin/git`, a push
+ * inside a script, an alias. You can get that 95% right and never learn about the rest. A tool
+ * has no string to be clever with: `push_branch` takes NO branch argument, so the branch is the
+ * one the job created and there is no way to name another.
+ *
+ * The same shape gives the boundary the lead needs. A worker publishes its own branch and opens
+ * a pull request; merging is simply not a tool it has, so "don't merge to dev" stops being a rule
+ * it must remember and becomes something it cannot express.
+ */
+export type Job = {
+    /** Supplies a valid GitHub token. A function, because it is refreshed as it expires. */
+    token: () => Promise<string>;
+    /** Where the work is. */
+    cwd: string;
+    /** The branch this job created — the only one it may publish. */
+    branch: string;
+    /** What a pull request targets, from the board's own configuration. */
+    base: string;
+    card: string;
+};
+export declare function githubTools(job: () => Job | null, 
+/**
+ * Present only where a project declares a merge command AND this agent may merge. `config` is
+ * read per call, from the checkout the job is in: an agent working a folder of repos has a
+ * merge script per repo, and one project's promote script must never be handed another
+ * project's branch. Null means this job's repo declares none, so there is nothing to run.
+ */
+merge?: {
+    config: () => MergeConfig | null;
+    decider: Decider;
+}): import("@anthropic-ai/claude-agent-sdk").McpSdkServerConfigWithInstance;
+/** The tool names to pre-approve: publishing your own branch needs no one's permission. */
+export declare const GIT_TOOL_NAMES: string[];

package/dist/github.js

@@ -0,0 +1,153 @@
+import { spawn } from 'node:child_process';
+import { createSdkMcpServer, tool } from '@anthropic-ai/claude-agent-sdk';
+import { z } from 'zod';
+function run(command, args, cwd, token) {
+    return new Promise((resolve) => {
+        const child = spawn(command, args, {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env: {
+                ...process.env,
+                // The harness's own credential, handed to this one command. It is never in the agent's
+                // environment, so a model that wanted the token could not read it even from a shell —
+                // which is the difference between a boundary and a rule.
+                ...(token ? { GH_TOKEN: token, GITHUB_TOKEN: token } : {}),
+                // Never stop for a credential prompt: an unattended push must fail rather than hang.
+                GIT_TERMINAL_PROMPT: '0',
+            },
+        });
+        let out = '';
+        const cap = (d) => { if (out.length < 4000)
+            out += String(d); };
+        child.stdout.on('data', cap);
+        child.stderr.on('data', cap);
+        child.on('close', (c) => resolve({ code: c ?? 1, out: out.trim() }));
+        child.on('error', (e) => resolve({ code: 1, out: String(e) }));
+    });
+}
+/**
+ * The job's branch is the one the harness created, not whatever HEAD happens to be — so an agent
+ * cannot change which branch it may publish by checking out another one.
+ *
+ * But it CAN check out another one and commit there, and then publishing the job's branch would
+ * push something stale while the real work sat unpublished. That is not a refusal to punish; it
+ * is a reading nobody would notice was wrong. So: publishing requires HEAD to be where the job
+ * put it, and says so plainly when it is not.
+ */
+async function onJobBranch(j) {
+    const head = await run('git', ['rev-parse', '--abbrev-ref', 'HEAD'], j.cwd);
+    if (head.code !== 0)
+        return `Could not read the current branch in ${j.cwd}.`;
+    if (head.out !== j.branch) {
+        return (`This job is on ${j.branch}, but the checkout is on ${head.out}. ` +
+            `Only ${j.branch} can be published from here — move your commits onto it ` +
+            `(git checkout ${j.branch} && git merge ${head.out}) and try again.`);
+    }
+    return null;
+}
+const say = (text, isError = false) => ({
+    content: [{ type: 'text', text }],
+    ...(isError ? { isError: true } : {}),
+});
+export function githubTools(job, 
+/**
+ * Present only where a project declares a merge command AND this agent may merge. `config` is
+ * read per call, from the checkout the job is in: an agent working a folder of repos has a
+ * merge script per repo, and one project's promote script must never be handed another
+ * project's branch. Null means this job's repo declares none, so there is nothing to run.
+ */
+merge) {
+    const needJob = () => {
+        const j = job();
+        if (!j)
+            throw new Error('There is no job running, so there is nothing to publish.');
+        return j;
+    };
+    return createSdkMcpServer({
+        name: 'git',
+        version: '1.0.0',
+        tools: [
+            tool('push_branch', 'Publish this job\'s branch to GitHub. Takes no arguments: it pushes the branch this job ' +
+                'created, which is the only branch you may publish.', {}, async () => {
+                const j = needJob();
+                const wrong = await onJobBranch(j);
+                if (wrong)
+                    return say(wrong, true);
+                const token = await j.token();
+                // Push over an authenticated URL for this call only, rather than rewriting the remote:
+                // the checkout keeps its normal origin and no credential is left behind in it.
+                const origin = await run('git', ['remote', 'get-url', 'origin'], j.cwd);
+                const url = origin.out.replace(/^https:\/\//, `https://x-access-token:${token}@`);
+                const { code, out } = await run('git', ['push', '-u', url, `${j.branch}:${j.branch}`], j.cwd, token);
+                // Redact before anything is shown: git echoes the remote URL on failure, and that URL
+                // now carries the token.
+                const safe = out.split(token).join('[REDACTED]');
+                return code === 0
+                    ? say(`Pushed ${j.branch}.\n${safe}`)
+                    : say(`Could not push ${j.branch}:\n${safe}`, true);
+            }),
+            tool('open_pull_request', 'Open a pull request from this job\'s branch. The source and target branches are fixed by ' +
+                'the job and the board, so you choose only the title and the description.', {
+                title: z.string().describe('One line. What the change does, not which card it came from.'),
+                body: z.string().describe('What changed and why, for whoever reviews it.'),
+            }, async ({ title, body }) => {
+                const j = needJob();
+                const { code, out } = await run('gh', ['pr', 'create', '--base', j.base, '--head', j.branch,
+                    '--title', title, '--body', `${body}\n\n---\nFlareDeck card: ${j.card}`], j.cwd, await j.token());
+                return code === 0 ? say(out) : say(`Could not open a pull request:\n${out}`, true);
+            }),
+            ...(merge
+                ? [
+                    tool('merge_and_promote', 'Merge this job\'s branch and promote it, using the project\'s own merge script. ' +
+                        'Takes no arguments: the branch is this job\'s, and a person approves the result ' +
+                        'of a dry run before anything is pushed.', {}, async () => {
+                        const j = needJob();
+                        const wrong = await onJobBranch(j);
+                        if (wrong)
+                            return say(wrong, true);
+                        const cfg = merge.config();
+                        if (!cfg) {
+                            return say(`${j.cwd} declares no merge command, so there is nothing to promote here. ` +
+                                'Open a pull request instead and say on the card that it is ready.', true);
+                        }
+                        const token = await j.token();
+                        const base = cfg.command.split(' ');
+                        // ALWAYS the dry run first. Not "the agent should preview it" — it cannot skip
+                        // this, because it is not composing the command.
+                        const preview = await run(base[0], [...base.slice(1), j.branch, ...(cfg.dryRun ? [cfg.dryRun] : [])], j.cwd, token);
+                        if (preview.code !== 0) {
+                            return say(`The merge script refused before doing anything:\n${preview.out}`, true);
+                        }
+                        // A person sees what the dry run said and decides. The confirmation flag exists
+                        // in these scripts precisely so a human says yes — an agent passing it for
+                        // itself would be answering its own question.
+                        const decision = await merge.decider({ toolName: 'merge_and_promote', input: { branch: j.branch, preview: preview.out } }, { signal: new AbortController().signal });
+                        if (!decision.allow)
+                            return say(`Not merged. ${decision.reason}`, true);
+                        const done = await run(base[0], [...base.slice(1), j.branch, ...(cfg.confirm ? [cfg.confirm] : [])], j.cwd, token);
+                        const safe = done.out.split(token).join('[REDACTED]');
+                        // The script's own "NOT PROVED" lines come back verbatim. A merge that pushed but
+                        // could not prove the deploy is not a success, and rewording it would lose that.
+                        return done.code === 0 ? say(safe) : say(`The merge did not complete:\n${safe}`, true);
+                    }),
+                ]
+                : []),
+            tool('pull_request_status', 'How this job\'s pull request is doing: checks, reviews, whether it can merge.', {}, async () => {
+                const j = needJob();
+                const { code, out } = await run('gh', ['pr', 'view', j.branch, '--json',
+                    'number,title,state,mergeable,reviewDecision,statusCheckRollup,url'], j.cwd, await j.token());
+                return code === 0 ? say(out) : say(`No pull request found for ${j.branch}.`, true);
+            }),
+        ],
+    });
+}
+/** The tool names to pre-approve: publishing your own branch needs no one's permission. */
+export const GIT_TOOL_NAMES = [
+    'mcp__git__push_branch',
+    'mcp__git__open_pull_request',
+    'mcp__git__pull_request_status',
+    // Pre-approved as a TOOL, but it asks a person inside itself before it pushes anything. The
+    // approval is on the merge, not on the agent's right to attempt one.
+    'mcp__git__merge_and_promote',
+];
+//# sourceMappingURL=github.js.map

package/dist/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../src/github.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,IAAI,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AA8BxB,SAAS,GAAG,CACV,OAAe,EACf,IAAc,EACd,GAAW,EACX,KAAc;IAEd,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,GAAG,EAAE;gBACH,GAAG,OAAO,CAAC,GAAG;gBACd,uFAAuF;gBACvF,sFAAsF;gBACtF,yDAAyD;gBACzD,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,qFAAqF;gBACrF,mBAAmB,EAAE,GAAG;aACzB;SACF,CAAC,CAAC;QACH,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,IAAI;YAAE,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;QACrE,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,WAAW,CAAC,CAAM;IAC/B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,wCAAwC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7E,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,CACL,kBAAkB,CAAC,CAAC,MAAM,4BAA4B,IAAI,CAAC,GAAG,IAAI;YAClE,QAAQ,CAAC,CAAC,MAAM,0DAA0D;YAC1E,iBAAiB,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,GAAG,kBAAkB,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAO,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;IAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,CAAC;IAC1C,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CACzB,GAAqB;AACrB;;;;;GAKG;AACH,KAA8D;IAE9D,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;QACpF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,OAAO,kBAAkB,CAAC;QACxB,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE;YACL,IAAI,CACF,aAAa,EACb,0FAA0F;gBACxF,oDAAoD,EACtD,EAAE,EACF,KAAK,IAAI,EAAE;gBACT,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;gBACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,KAAK;oBAAE,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACnC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC9B,uFAAuF;gBACvF,+EAA+E;gBAC/E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;gBACxE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,0BAA0B,KAAK,GAAG,CAAC,CAAC;gBAClF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;gBACrG,sFAAsF;gBACtF,yBAAyB;gBACzB,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACjD,OAAO,IAAI,KAAK,CAAC;oBACf,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC;oBACrC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,MAAM,MAAM,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;YACxD,CAAC,CACF;YAED,IAAI,CACF,mBAAmB,EACnB,2FAA2F;gBACzF,0EAA0E,EAC5E;gBACE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,8DAA8D,CAAC;gBAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,+CAA+C,CAAC;aAC3E,EACD,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;gBACxB,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAC7B,IAAI,EACJ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM;oBACpD,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,IAAI,4BAA4B,CAAC,CAAC,IAAI,EAAE,CAAC,EACzE,CAAC,CAAC,GAAG,EACL,MAAM,CAAC,CAAC,KAAK,EAAE,CAChB,CAAC;gBACF,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;YACrF,CAAC,CACF;YAED,GAAG,CAAC,KAAK;gBACP,CAAC,CAAC;oBACE,IAAI,CACF,mBAAmB,EACnB,kFAAkF;wBAChF,kFAAkF;wBAClF,yCAAyC,EAC3C,EAAE,EACF,KAAK,IAAI,EAAE;wBACT,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;wBACpB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;wBACnC,IAAI,KAAK;4BAAE,OAAO,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;wBACnC,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;wBAC3B,IAAI,CAAC,GAAG,EAAE,CAAC;4BACT,OAAO,GAAG,CACR,GAAG,CAAC,CAAC,GAAG,mEAAmE;gCACzE,mEAAmE,EACrE,IAAI,CACL,CAAC;wBACJ,CAAC;wBACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC;wBAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;wBAEpC,+EAA+E;wBAC/E,iDAAiD;wBACjD,MAAM,OAAO,GAAG,MAAM,GAAG,CACvB,IAAI,CAAC,CAAC,CAAE,EACR,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACjE,CAAC,CAAC,GAAG,EACL,KAAK,CACN,CAAC;wBACF,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;4BACvB,OAAO,GAAG,CAAC,oDAAoD,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;wBACtF,CAAC;wBAED,gFAAgF;wBAChF,2EAA2E;wBAC3E,8CAA8C;wBAC9C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAClC,EAAE,QAAQ,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,EACpF,EAAE,MAAM,EAAE,IAAI,eAAe,EAAE,CAAC,MAAM,EAAE,CACzC,CAAC;wBACF,IAAI,CAAC,QAAQ,CAAC,KAAK;4BAAE,OAAO,GAAG,CAAC,eAAe,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,CAAC;wBAExE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,IAAI,CAAC,CAAC,CAAE,EACR,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACnE,CAAC,CAAC,GAAG,EACL,KAAK,CACN,CAAC;wBACF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;wBACtD,kFAAkF;wBAClF,iFAAiF;wBACjF,OAAO,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gCAAgC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;oBACzF,CAAC,CACF;iBACF;gBACH,CAAC,CAAC,EAAE,CAAC;YAEP,IAAI,CACF,qBAAqB,EACrB,+EAA+E,EAC/E,EAAE,EACF,KAAK,IAAI,EAAE;gBACT,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;gBACpB,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,CAC7B,IAAI,EACJ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ;oBAChC,mEAAmE,CAAC,EACrE,CAAC,CAAC,GAAG,EACL,MAAM,CAAC,CAAC,KAAK,EAAE,CAChB,CAAC;gBACF,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,MAAM,GAAG,EAAE,IAAI,CAAC,CAAC;YACrF,CAAC,CACF;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,uBAAuB;IACvB,6BAA6B;IAC7B,+BAA+B;IAC/B,4FAA4F;IAC5F,qEAAqE;IACrE,6BAA6B;CAC9B,CAAC"}