@quickchatai/quickreview 1.1.0 → 1.3.1

package/dist/src/githubtoken.js

@@ -0,0 +1,346 @@
+// The host-side GitHub token refresher — `qcr github-token sync`.
+//
+// On the own-account route (`[github] auth = "user"`) the daemon runs on the
+// person's own GitHub credential instead of a GitHub App, and that credential
+// reaches it as ONE FILE: `<secrets dir>/github_token`, mode 0600, the token
+// alone with no newline, rewritten atomically. Never env, never argv: the
+// daemon's UserTokenSource re-reads the file, and nothing here hands it a
+// token any other way.
+//
+// This module is the only writer of that file. It runs on the HOST, as the
+// person, where their GitHub sign-in lives:
+//
+//   1. the token comes from `gh auth token` — the gh binary the wizard
+//      resolved (`--gh <abs path>`, recorded at onboarding because cron's PATH
+//      is not the wizard's: on a Boxes VM the signed-in gh is the broker
+//      wrapper in /usr/local/bin, and a /usr/bin/gh beside it has no login) —
+//      or, when there is no gh at all, from GH_TOKEN / GITHUB_TOKEN;
+//   2. `GET /user` with it proves it works and names the login;
+//   3. only then is the file rewritten (tmp + rename, 0600 under a 0700 dir).
+//
+// It prints the login and the token's KIND (ghu_/gho_/ghp_/github_pat_), and
+// the expiry GitHub states for it, never the token: no line this module
+// produces carries a token value.
+//
+// The wizard installs a user crontab entry that runs this every 20 minutes,
+// marked `# qcr github-token sync` so a re-run replaces it instead of adding a
+// second. Boxes' gh hands out an 8 h `ghu_` token from its broker, so there the
+// refresh is what keeps the reviewer signed in; a `gho_`/`ghp_` token does not
+// expire and the entry is merely harmless.
+//
+// The daemon never imports this module (it reads no personal token itself):
+// the CLI and the onboarding wizard are its only callers.
+import { execFile } from "node:child_process";
+import { chmodSync, mkdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { USER_TOKEN_FILE } from "@quickchatai/pi-quickreview/src/githubAuth.js";
+/** The token file's name in the secrets dir — the one the daemon's UserTokenSource reads. */
+export const GITHUB_TOKEN_FILE = USER_TOKEN_FILE;
+/** The marker that makes the crontab entry idempotent. */
+export const CRON_MARKER = "# qcr github-token sync";
+/** How often the crontab entry refreshes the file. */
+export const CRON_SCHEDULE = "*/20 * * * *";
+export function tokenKind(token) {
+    if (token.startsWith("github_pat_"))
+        return {
+            prefix: "github_pat_",
+            label: "fine-grained personal access token (expires on the date you set)",
+            expires: true,
+        };
+    if (token.startsWith("ghu_"))
+        return {
+            prefix: "ghu_",
+            label: "GitHub App user token (expires after 8 hours — the crontab refresh keeps it current)",
+            expires: true,
+        };
+    if (token.startsWith("gho_"))
+        return { prefix: "gho_", label: "OAuth token from gh (does not expire)", expires: false };
+    if (token.startsWith("ghp_"))
+        return {
+            prefix: "ghp_",
+            label: "classic personal access token (expires only if you set one)",
+            expires: null,
+        };
+    if (token.startsWith("ghs_"))
+        return {
+            prefix: "ghs_",
+            label: "GitHub App installation token (expires within the hour)",
+            expires: true,
+        };
+    return { prefix: "unknown", label: "token of an unrecognised kind", expires: null };
+}
+/** A token is one line of word characters; anything else is not a token. */
+const TOKEN_RE = /^[A-Za-z0-9_]{20,255}$/;
+/** The absolute path of the `gh` the CALLER's environment resolves, or null.
+ * Recorded at onboarding so the crontab entry runs that same binary. */
+export async function resolveGhPath(runner) {
+    const r = await runner.run("sh", ["-c", "command -v gh"]);
+    const path = r.code === 0 ? r.stdout.trim().split("\n")[0].trim() : "";
+    return path.startsWith("/") ? path : null;
+}
+/**
+ * The person's token: `gh auth token` first (the named binary, else `gh` on
+ * PATH), then GH_TOKEN, then GITHUB_TOKEN. Env is read only when gh cannot
+ * answer at all — a gh that exists but is signed out is said as itself.
+ */
+export async function readPersonToken(o) {
+    const gh = o.gh && o.gh.trim() !== "" ? o.gh : "gh";
+    const r = await o.runner.run(gh, ["auth", "token"]);
+    const out = r.code === 0 ? r.stdout.trim() : "";
+    if (out !== "") {
+        if (!TOKEN_RE.test(out))
+            return { ok: false, problem: `\`${gh} auth token\` printed something that is not a token` };
+        return { ok: true, token: out, source: "gh" };
+    }
+    for (const name of ["GH_TOKEN", "GITHUB_TOKEN"]) {
+        const v = (o.env[name] ?? "").trim();
+        if (v === "")
+            continue;
+        if (!TOKEN_RE.test(v))
+            return { ok: false, problem: `${name} is set but is not a token` };
+        return { ok: true, token: v, source: `env:${name}` };
+    }
+    const why = (r.stderr || r.stdout).trim().split("\n")[0]?.slice(0, 160) ?? "";
+    return {
+        ok: false,
+        problem: `no GitHub sign-in found: \`${gh} auth token\` gave no token${why ? ` (${why})` : ""} and neither GH_TOKEN nor ` +
+            "GITHUB_TOKEN is set. Sign in with `gh auth login`, then run this again",
+    };
+}
+/** `GET /user` — which account the token is, and when GitHub says it lapses. */
+export async function githubLogin(fetchFn, token, apiBase = "https://api.github.com") {
+    try {
+        const res = await fetchFn(`${apiBase}/user`, {
+            headers: {
+                authorization: `Bearer ${token}`,
+                accept: "application/vnd.github+json",
+                "user-agent": "quickreview-github-token-sync",
+            },
+            signal: AbortSignal.timeout(10_000),
+        });
+        const text = await res.text();
+        let body = null;
+        try {
+            body = text ? JSON.parse(text) : null;
+        }
+        catch {
+            body = null;
+        }
+        const login = body?.login;
+        if (res.status === 200 && typeof login === "string" && login !== "") {
+            const expiry = res.headers?.get?.("github-authentication-token-expiration") ?? null;
+            return { ok: true, login, expiry: expiry && expiry.trim() !== "" ? expiry.trim() : null };
+        }
+        const message = body?.message;
+        return {
+            ok: false,
+            status: res.status,
+            detail: `GET /user answered HTTP ${res.status}${typeof message === "string" ? `: ${message}` : ""}`,
+        };
+    }
+    catch (err) {
+        return { ok: false, status: 0, detail: `GET /user failed: ${String(err)}` };
+    }
+}
+/** Write the token file: 0600 under a 0700 dir, the token alone, tmp+rename so
+ * a reader never sees half a token. Returns the file's path. */
+export function writeTokenFile(secretsDir, token) {
+    if (!TOKEN_RE.test(token))
+        throw new Error("refusing to write something that is not a token");
+    mkdirSync(secretsDir, { recursive: true, mode: 0o700 });
+    chmodSync(secretsDir, 0o700);
+    const path = join(secretsDir, GITHUB_TOKEN_FILE);
+    const tmp = join(secretsDir, `.${GITHUB_TOKEN_FILE}.${process.pid}.tmp`);
+    try {
+        writeFileSync(tmp, token, { mode: 0o600 });
+        chmodSync(tmp, 0o600);
+        renameSync(tmp, path);
+    }
+    finally {
+        rmSync(tmp, { force: true });
+    }
+    return path;
+}
+/** The whole refresh: read the person's token, prove it with `GET /user`, and
+ * only then rewrite the file. A token GitHub refuses never reaches the file. */
+export async function syncGithubToken(o) {
+    const got = await readPersonToken(o);
+    if (!got.ok)
+        return got;
+    const who = await githubLogin(o.fetch, got.token, o.apiBase);
+    if (!who.ok)
+        return {
+            ok: false,
+            problem: who.status === 401
+                ? `GitHub rejected the token from ${got.source} (${who.detail}) — sign in again (\`gh auth login\`); the token file was left as it was`
+                : `could not check the token from ${got.source} with GitHub (${who.detail}); the token file was left as it was`,
+        };
+    let path;
+    try {
+        path = writeTokenFile(o.secretsDir, got.token);
+    }
+    catch (err) {
+        return {
+            ok: false,
+            problem: `could not write ${join(o.secretsDir, GITHUB_TOKEN_FILE)}: ${String(err)}`,
+        };
+    }
+    return {
+        ok: true,
+        login: who.login,
+        kind: tokenKind(got.token),
+        source: got.source,
+        expiry: who.expiry,
+        path,
+    };
+}
+/** The one line a sync reports. No token value can appear in it. */
+export function renderSync(r) {
+    if (!r.ok)
+        return `✗ github-token sync: ${r.problem}`;
+    return (`✓ github-token sync: signed in as ${r.login} — ${r.kind.prefix} ${r.kind.label}` +
+        `${r.expiry ? `, GitHub says it expires ${r.expiry}` : ""}; from ${r.source}, written to ${r.path} (0600)`);
+}
+// ---- the crontab entry -------------------------------------------------------
+/** POSIX single-quoting for one word of the crontab command. */
+function shq(word) {
+    return /^[A-Za-z0-9_./=:@%+-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/** The app's own cli.js, beside this module in the built tree. */
+export function defaultCliPath() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), "cli.js");
+}
+/** The command a refresh runs: absolute node, absolute cli.js, the gh the
+ * wizard resolved and the secrets dir it wrote to — cron's environment knows
+ * none of them. */
+export function syncCommandWords(o) {
+    return [
+        o.node,
+        o.cli,
+        "github-token",
+        "sync",
+        ...(o.gh ? ["--gh", o.gh] : []),
+        "--secrets-dir",
+        o.secretsDir,
+    ];
+}
+export function syncCommandLine(o) {
+    return syncCommandWords(o).map(shq).join(" ");
+}
+export function cronLine(o) {
+    return `${CRON_SCHEDULE} ${syncCommandLine(o)} >/dev/null 2>&1 ${CRON_MARKER}`;
+}
+/** Replace every marked line with `line` (or add it). Idempotent: a crontab
+ * that already carries exactly this line comes back unchanged. */
+export function mergeCrontab(existing, line) {
+    const lines = existing.split("\n").filter((l, i, all) => !(l === "" && i === all.length - 1));
+    const kept = lines.filter((l) => !l.includes(CRON_MARKER));
+    const text = `${[...kept, line].join("\n")}\n`;
+    const before = lines.length === 0 ? "" : `${lines.join("\n")}\n`;
+    return { text, changed: text !== before };
+}
+/**
+ * Install (or refresh) the marked user crontab entry, through the runner:
+ * `crontab -l`, merge, write the result to a 0600 scratch file, `crontab
+ * <file>`. A machine with no `crontab` is reported as such, never an error.
+ */
+export async function installCronEntry(o) {
+    const which = await o.runner.run("sh", ["-c", "command -v crontab"]);
+    if (which.code !== 0 || which.stdout.trim() === "")
+        return { kind: "no-crontab", line: o.line };
+    const current = await o.runner.run("crontab", ["-l"]);
+    let existing = "";
+    if (current.code === 0)
+        existing = current.stdout;
+    else if (!/no crontab/i.test(current.stderr + current.stdout))
+        return {
+            kind: "failed",
+            line: o.line,
+            detail: `crontab -l exited ${current.code}: ${(current.stderr || current.stdout).trim().slice(0, 200)}`,
+        };
+    const merged = mergeCrontab(existing, o.line);
+    if (!merged.changed)
+        return { kind: "unchanged", line: o.line };
+    mkdirSync(o.scratchDir, { recursive: true });
+    const file = join(o.scratchDir, "crontab.qcr.new");
+    try {
+        writeFileSync(file, merged.text, { mode: 0o600 });
+        const put = await o.runner.run("crontab", [file]);
+        if (put.code !== 0)
+            return {
+                kind: "failed",
+                line: o.line,
+                detail: `crontab ${file} exited ${put.code}: ${(put.stderr || put.stdout).trim().slice(0, 200)}`,
+            };
+    }
+    finally {
+        rmSync(file, { force: true });
+    }
+    return { kind: "installed", line: o.line };
+}
+/** Does the user crontab carry the marked entry, and does it run THIS gh? */
+export async function cronEntryState(runner, gh) {
+    const which = await runner.run("sh", ["-c", "command -v crontab"]);
+    if (which.code !== 0 || which.stdout.trim() === "")
+        return "no-crontab";
+    const current = await runner.run("crontab", ["-l"]);
+    const line = (current.code === 0 ? current.stdout : "")
+        .split("\n")
+        .find((l) => l.includes(CRON_MARKER));
+    if (!line)
+        return "absent";
+    if (gh && !line.includes(` --gh ${shq(gh)} `))
+        return "stale";
+    return "present";
+}
+// ---- the CLI verb ------------------------------------------------------------
+export const GITHUB_TOKEN_USAGE = "usage: qcr github-token sync [--gh <path to gh>] [--secrets-dir <dir>]";
+export function parseGithubTokenArgs(rest) {
+    if (rest[0] !== "sync")
+        throw new Error(GITHUB_TOKEN_USAGE);
+    let gh = null;
+    let secretsDir = null;
+    for (let i = 1; i < rest.length; i++) {
+        const a = rest[i];
+        const v = rest[i + 1];
+        if ((a === "--gh" || a === "--secrets-dir") && v !== undefined && v.trim() !== "") {
+            if (a === "--gh")
+                gh = v;
+            else
+                secretsDir = v;
+            i++;
+        }
+        else
+            throw new Error(GITHUB_TOKEN_USAGE);
+    }
+    return { gh, secretsDir };
+}
+/** A real runner for the CLI: execFile, never a shell, never a throw. */
+export const execRunner = {
+    run: (cmd, args) => new Promise((done) => {
+        execFile(cmd, args, { timeout: 30_000 }, (err, stdout, stderr) => {
+            const code = err === null ? 0 : typeof err.code === "number" ? err.code : 1;
+            done({
+                code,
+                stdout: String(stdout),
+                stderr: err && !stderr ? String(err.message) : String(stderr),
+            });
+        });
+    }),
+};
+/** `qcr github-token sync`. Exit 0 on a written, proven token; 1 otherwise. */
+export async function cmdGithubToken(rest, deps) {
+    const args = parseGithubTokenArgs(rest);
+    const log = deps.log ?? ((l) => console.log(l));
+    const result = await syncGithubToken({
+        runner: deps.runner ?? execRunner,
+        env: deps.env ?? process.env,
+        fetch: deps.fetch ?? fetch,
+        secretsDir: args.secretsDir ?? deps.secretsDir(),
+        gh: args.gh,
+    });
+    log(renderSync(result));
+    return result.ok ? 0 : 1;
+}
+//# sourceMappingURL=githubtoken.js.map

package/dist/src/githubtoken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"githubtoken.js","sourceRoot":"","sources":["../../src/githubtoken.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,0EAA0E;AAC1E,uBAAuB;AACvB,EAAE;AACF,2EAA2E;AAC3E,4CAA4C;AAC5C,EAAE;AACF,uEAAuE;AACvE,+EAA+E;AAC/E,yEAAyE;AACzE,8EAA8E;AAC9E,qEAAqE;AACrE,gEAAgE;AAChE,8EAA8E;AAC9E,EAAE;AACF,6EAA6E;AAC7E,wEAAwE;AACxE,kCAAkC;AAClC,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,2CAA2C;AAC3C,EAAE;AACF,4EAA4E;AAC5E,0DAA0D;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,+CAA+C,CAAC;AAEhF,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAEjD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAErD,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAgB5C,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,aAAa;YACrB,KAAK,EAAE,kEAAkE;YACzE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,sFAAsF;YAC7F,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,uCAAuC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC5F,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,6DAA6D;YACpE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,yDAAyD;YAChE,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtF,CAAC;AAED,4EAA4E;AAC5E,MAAM,QAAQ,GAAG,wBAAwB,CAAC;AAO1C;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAmB;IACrD,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC;IAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAIrC;IACC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qDAAqD,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,EAAE,cAAc,CAAU,EAAE,CAAC;QACzD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE;YAAE,SAAS;QACvB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,IAAI,4BAA4B,EAAE,CAAC;QAC1F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9E,OAAO;QACL,EAAE,EAAE,KAAK;QACT,OAAO,EACL,8BAA8B,EAAE,8BAA8B,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,4BAA4B;YAChH,wEAAwE;KAC3E,CAAC;AACJ,CAAC;AAMD,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAqB,EACrB,KAAa,EACb,OAAO,GAAG,wBAAwB;IAElC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,OAAO,EAAE;YAC3C,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,+BAA+B;aAC9C;YACD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,GAAY,IAAI,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAI,IAAmC,EAAE,KAAK,CAAC;QAC1D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACpE,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,wCAAwC,CAAC,IAAI,IAAI,CAAC;YACpF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAI,IAAqC,EAAE,OAAO,CAAC;QAChE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,MAAM,EAAE,2BAA2B,GAAG,CAAC,MAAM,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;SACpG,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IAC9E,CAAC;AACH,CAAC;AAED;gEACgE;AAChE,MAAM,UAAU,cAAc,CAAC,UAAkB,EAAE,KAAa;IAC9D,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IAC9F,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,iBAAiB,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3C,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtB,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAaD;gFACgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,CAOrC;IACC,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IACxB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,GAAG,CAAC,MAAM,KAAK,GAAG;gBAChB,CAAC,CAAC,kCAAkC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,0EAA0E;gBACvI,CAAC,CAAC,kCAAkC,GAAG,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAM,sCAAsC;SACpH,CAAC;IACJ,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,mBAAmB,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI;KACL,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,UAAU,CAAC,CAAa;IACtC,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,wBAAwB,CAAC,CAAC,OAAO,EAAE,CAAC;IACtD,OAAO,CACL,qCAAqC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE;QACjF,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,gBAAgB,CAAC,CAAC,IAAI,SAAS,CAC3G,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF,gEAAgE;AAChE,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC1F,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,cAAc;IAC5B,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACpE,CAAC;AAED;;mBAEmB;AACnB,MAAM,UAAU,gBAAgB,CAAC,CAKhC;IACC,OAAO;QACL,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,GAAG;QACL,cAAc;QACd,MAAM;QACN,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,eAAe;QACf,CAAC,CAAC,UAAU;KACb,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAyC;IACvE,OAAO,gBAAgB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,CAAyC;IAChE,OAAO,GAAG,aAAa,IAAI,eAAe,CAAC,CAAC,CAAC,oBAAoB,WAAW,EAAE,CAAC;AACjF,CAAC;AAED;kEACkE;AAClE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;AAC5C,CAAC;AAQD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,CAItC;IACC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACrE,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChG,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;QAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;SAC7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC3D,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,qBAAqB,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACxG,CAAC;IACJ,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,WAAW,IAAI,WAAW,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;aACjG,CAAC;IACN,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAmB,EACnB,EAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,YAAY,CAAC;IACxE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;SACpD,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI;QAAE,OAAO,QAAQ,CAAC;IAC3B,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAC7B,wEAAwE,CAAC;AAE3E,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAI1D,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC5D,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,UAAU,GAAkB,IAAI,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,eAAe,CAAC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAClF,IAAI,CAAC,KAAK,MAAM;gBAAE,EAAE,GAAG,CAAC,CAAC;;gBACpB,UAAU,GAAG,CAAC,CAAC;YACpB,CAAC,EAAE,CAAC;QACN,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAgB;IACrC,GAAG,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CACjB,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QACnB,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,CAAC;gBACH,IAAI;gBACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;CACL,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAuB,EACvB,IAOC;IAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;QACnC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,UAAU;QACjC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC5B,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,KAAK;QAC1B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE;QAChD,EAAE,EAAE,IAAI,CAAC,EAAE;KACZ,CAAC,CAAC;IACH,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}